Given that Avast throws a wobbly on both files... good luck with that. Couldn't pay me to touch either file.
Huh, well, if you're the one that encrypted them surely you should have the original somewhere? Why do I smell a rat...?
Is it paid service or just help? btw decoded 1.txt already and here is the code of first few lines: if(!function_exists('gzuncompress'))die('The PHP zlib module is required to run this script. Please see <A HREF="http://www.php.net/manual/en/ref.zlib.php">http://www.php.net/manual/en/ref.zlib.php</A>');if(((isset($HTTP_SERVER_VARS['SERVER_NAME']))&&(!eregi('((.*\.)?paymentmedium\.com)',$HTTP_SERVER_VARS['SERVER_NAME'])))||((isset($_SERVER['HTTP_HOST']))&&(!eregi('((.*\.)?paymentmedium\.com)',$_SERVER['HTTP_HOST']))))die('This script is locked for paymentmedium.com domain name. Your details submitted to Admin.');$OO00O00O0=ereg_replace('__FILE__',"'".$OOO0O0O00."'",gzuncompress(base64_decode(strtr(fread($O000O0O00,$OO00O0000),'LIsrp/SVDYxKWfltwJ215zu7Ag638q90OkcniF4dRGbUyZeQTmPXa+oCvEHhjMBN=','ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/'))));fclose($O000O0O00);eval($OO00O00O0); ############################################################################### # PROGRAM : PAYMENT PROCESSOR SCRIPT # # COPYRIGHTS : (C)2007 PAYMENTPROCESSORSCRIPT.NET. ALL RIGHTS RESERVED # ############################################################################### # DEVELOPED BY PAYMENTPROCESSORSCRIPT.NET # ############################################################################### # ALL SOURCE CODE, IMAGES, PROGRAMS, FILES INCLUDED IN THIS DISTRIBUTION # # COPYRIGHTS BY (C)2007 PAYMENTPROCESSORSCRIPT.NET. ALL RIGHTS RESERVDED # ############################################################################### # ANY REDISTRIBUTION WITHOUT PERMISSION OF PAYMENTPROCESSORSCRIPT.NET # # AND IS STRICTLY FORBIDDEN # ############################################################################### ############################################################################### error_reporting(E_ERROR | E_WARNING | E_PARSE); if(!ini_get('safe_mode'))set_time_limit(3600); set_magic_quotes_runtime(0); ignore_user_abort(true); Code (markup):