<?php
#######################
#     PHPWIND.NET     #
#######################

$pernum=200; #ÿٸļתһ

#######################
#     PHPWIND.NET     #
#######################
error_reporting(0);
?>
<html>
<head>
<meta http-equiv='Content-Type' content="text/html; charset=gb2312">
<title>վľɾ
</title>
<style type="text/css">
    BODY { COLOR: #3F3849; FONT-FAMILY: Verdana,Arial; FONT-SIZE: 9pt;
	SCROLLBAR-HIGHLIGHT-COLOR: buttonface;
SCROLLBAR-SHADOW-COLOR: buttonface;
SCROLLBAR-3DLIGHT-COLOR: buttonhighlight;
SCROLLBAR-TRACK-COLOR: #eeeeee;
SCROLLBAR-DARKSHADOW-COLOR: buttonshadow
}
A:LINK		{COLOR: #3F3849; TEXT-DECORATION: none}
A:VISITED	{COLOR: #3F3849; TEXT-DECORATION: none}
A:HOVER		{COLOR: #F5D300; BACKGROUND-COLOR: #40364d}
A:ACTIVE	{COLOR: #F5D300; BACKGROUND-COLOR: #40364d}
		
		.t     {	LINE-HEIGHT: 1.4}
		TD,SELECT,TEXTAREA,DIV,FORM,OPTION,P{COLOR:333333; FONT-FAMILY: ; FONT-SIZE: 9pt}
		INPUT  {	FONT-FAMILY: ; FONT-SIZE: 9pt; height:22px;	}
    </style>
</head>
<body vlink=333333 link=333333 alink=333333 topmargin=0 leftmargin="0" background=#000000>
<center>
<?php
@set_time_limit(0);
$magic_quotes_gpc = get_magic_quotes_gpc();
$register_globals = ini_get('register_globals');
if(!$register_globals || !$magic_quotes_gpc)
{
	extract($_FILES, EXTR_SKIP);
	extract($_POST, EXTR_SKIP);
	extract($_GET, EXTR_SKIP);
}
!$num && $num=0;
function safefile($filename)
{
	global $safe_name,$directfile;
	$db=opendir("$filename/");
	while ($getfile=readdir($db))
	{
		if ($getfile!="." && $getfile!="..") 
		{
			if(@is_dir("$filename/$getfile") && (!$directfile || ereg("^$filename/$getfile",$directfile)!==false)){
				safefile($filename."/".$getfile);
			}elseif((!$directfile || $directfile=="$filename/$getfile") && (ereg("\.php$",$getfile)!==false || ereg("\.php3$",$getfile)!==false || ereg("\.htm$",$getfile)!==false) && "$filename/$getfile"!='./safe.php'){
				$directfile='';
				$GLOBALS[num]++;
				if($GLOBALS[num]==$GLOBALS[pernum]){
					closedir($db);
					redirect("$_SERVER[PHP_SELF]?step=1&directfile=$filename/$getfile&safe_name=$safe_name");
				}
				if(filesize("$filename/$getfile")<1048576){
					$a=readover("$filename/$getfile");
					if(strpos($a,'shell_exec')!==false || strpos($a,'gzencode')!==false){
						if(@rename("$filename/$getfile","$filename/$getfile.txt")){
							writeover('safedata/tmp.txt',"<b>Ѿ $filename/$getfile ļ ȫΪ: $filename/$getfile.txt</b><br>",'ab');
						}else{
							writeover('safedata/tmp.txt',"<b>м $filename/$getfile ļľ</b><br>",'ab');
						}
					}elseif(strpos($a,'eval($_')!==false || strpos($a,'move_uploaded_file($_FILES')!==false || strpos($a,'copy($_FILES')!==false){
						writeover('safedata/tmp.txt',"<b>м $filename/$getfile ļе <font color=blue>eval(\$_</font>  <font color=blue>copy(\$_FILES</font>  <font color=blue>move_uploaded_file(\$_FILES</font> ЩǷϷ</b><br>",'ab');
					}
				}
				
			}
		}
	}
	closedir($db);
}
function writeover($filename,$data,$method="rb+",$iflock=1){
	touch($filename);
	$handle=fopen($filename,$method);
	if($iflock){
		flock($handle,LOCK_EX);
	}
	fputs($handle,$data);
	if($method=="rb+") ftruncate($handle,strlen($data));
	fclose($handle);
}
function redirect($url) {
	echo"<script>";
	echo"function redirect() {window.location.replace('$url');}\n";
	echo"setTimeout('redirect();', 2000);\n";
	echo"</script>";
	echo"<br><br><a href=\"$url\">ûԶת</a><br><br><a href=$_SERVER[PHP_SELF]>ֹͣ</a>";
	exit;
}
function readover($filename,$method="rb"){
	if($handle=@fopen($filename,$method)){
		flock($handle,LOCK_SH);
		$filedata=@fread($handle,filesize($filename));
		fclose($handle);
	}
	return $filedata;
}
$bacename=$_SERVER['PHP_SELF'];
	if($step==1) 
	{
		safefile($safe_name);
		$safedata=readover("safedata/tmp.txt");
		unlink("safedata/tmp.txt");
		echo "$safedata<br><br>ȫȫ<br><br> <a href=$bacename>ؼ</a><br>";
	}
	else
	{
?>
<form name="FORM" method=POST action=<?=$bacename?>  enctype="multipart/form-data">
<tr>
	<td valign=top><font size="3" color="red">˳ĹЧ:Լǿվİȫԡ</font><br><font face="verdana, arial">ǿȫĿ¼:</font><br>
	</td>
	<td colspan=2>
	ҪаȫĿ¼(. ʾĿ¼µļ):&nbsp;&nbsp;<input maxlength=30 size=20 name=safe_name value='.'style="background-color:#FEFEFF; border: 1 double #B4B4B4" onMouseOver="this.style.backgroundColor = '#E5F0FF'" onMouseOut="this.style.backgroundColor = ''">
	</font></td>
</tr>
<tr><td><input type=hidden value=1 name=step>
<input type=submit value="ȷϼǿȫ" style="height:20px;background-color:#f3f3f3;border:1 solid black" onMouseOver ="this.style.backgroundColor='#FFC864'" onMouseOut ="this.style.backgroundColor='#f3f3f3'" onFocus=this.blur()>
</td>
</tr><br><br></form>
<?
	}?>
<br><tr>
	<td>Writen by <a href="http://www.phpwind.net">PHPWIND.NET</a> 
</tr>
	</center>