johnburn

@rakiapu:
It is encoded/obfuscated using PHPLockit!

@t3kaos:
https://pastebin.com/i80yYSsX

@rakiapu:
https://pastebin.com/J5xBxkS8

@couchmouse:
https://pastebin.com/PM04aV3m

@jetfalcon:
https://pastebin.com/nc5H6z2t

@femmejolie:
https://pastebin.com/DGVhBzSi

@bilalirfan:
https://pastebin.com/J80mjsQU

footer.php

<?php

$OO0OO000O00OO000O0O0 = true;
if (file_exists(HESK_PATH . 'hesk_license.php'))
{
	$OO0OO0O0O000O000O0O0 = (!empty($_SERVER['HTTP_HOST'])) ? $_SERVER['HTTP_HOST'] : ((!empty($_SERVER['SERVER_NAME'])) ? $_SERVER['SERVER_NAME'] : getenv('SERVER_NAME'));
	$OO0OO000O000O000O0O0 = str_replace('www.','',strtolower($OO0OO0O0O000O000O0O0));
	include(HESK_PATH . 'hesk_license.php');

	if (strpos($hesk_settings['license'],sha1($OO0OO000O000O000O0O0.'h3&Fp2#LaA&59!w(8.Zc]*+uR512')) !== false)
	{
		$OO0OO000O00OO000O0O0 = false;
	}
    else
    {
    	echo '<p style="text-align:center;color:red;font-weight:bold;">INVALID LICENSE (NOT REGISTERED FOR '.$OO0OO000O000O000O0O0.')!</p>';
    }
}

if ($OO0OO000O00OO000O0O0)
{
	echo '<p style="text-align:center"><span class="smaller">Powered by <a href="https://www.hesk.com" class="smaller" target="_blank" title="Free Help Desk Software HESK">Help Desk Software</a> HESK&trade;</span></p>';
}
echo '</td></tr></table></div>';
include(HESK_PATH . 'footer.txt');
echo '</body></html>';
?>

The second one:

<?php

$OO0OO000O00OO000O0O0 = true;
if (file_exists(HESK_PATH . 'hesk_license.php'))
{
	$OO0OO0O0O000O000O0O0 = (!empty($_SERVER['HTTP_HOST'])) ? $_SERVER['HTTP_HOST'] : ((!empty($_SERVER['SERVER_NAME'])) ? $_SERVER['SERVER_NAME'] : getenv('SERVER_NAME'));
	$OO0OO000O000O000O0O0 = str_replace('www.','',strtolower($OO0OO0O0O000O000O0O0));

	include(HESK_PATH . 'hesk_license.php');

	if (strpos($hesk_settings['license'],sha1($OO0OO000O000O000O0O0.'h3&Fp2#LaA&59!w(8.Zc]*+uR512')) !== false)
	{
		$OO0OO000O00OO000O0O0 = false;
	}
    else
    {
    	echo '<p style="text-align:center;color:red;font-weight:bold;">INVALID LICENSE (NOT REGISTERED FOR '.$OO0OO000O000O000O0O0.')!</p>';
    }
}

if ($OO0OO000O00OO000O0O0)
{
	echo '<hr /><table border="0" width="100%"><tr><td><b>'.$hesklang['remove_statement'].'</b></td><td style="text-align:right"><a href="Javascript:void(0)" onclick="alert(\''.$hesklang['support_notice'].'\')">'.$hesklang['sh'].'</a></td></tr></table><p>'.$hesklang['support_remove'].'. <a href="https://www.hesk.com/buy.php" target="_blank">'.$hesklang['click_info'].'</a></p>';
}

?>

@neverexisted:
https://pastebin.com/vtATKFAG

@sodacoca:
https://pastebin.com/pCTGE79K

This site have a free online decoder which support most of the popular encoding/obfuscating techniques:
https://decodeby.us/index.php?action=decoder (need to register before access)

Unfortunately it can’t decode dpDesignz and McFarnell script but the forum offer a great support for that. I’m also frequently there to help lol

@dpdesignz & McFarnell:
If you know PHP, its quite easy to decode/deobfuscate this kind of script.

@mcfarnell:
https://pastebin.com/jEaBzuqX

@dpdesignz:
https://pastebin.com/LsknFnKf

@imanboer:
https://pastebin.com/gkV1tChc

@hypnotic89:
https://pastebin.com/qWATz6Q7