Errpr: Use of undefined constant c - assumed 'c'

[Мel]

Hi everybody.
I'm getting lots and lots of errors like this:
"Use of undefined constant c - assumed 'c'
(different lines)
I tried everything I could think of - no result Any ideas? I would appreciate any help with this.

[Arantor]

It would really help to know where the errors are exactly...

[Мel]

It goes like this

http://forum.***/index.php?action=admin;area=logs;sa=errorlog;desc8: Use of undefined constant c - assumed 'c'File: /home/me/forum/Themes/Curve_Multi_Color/index.template.php
Line: 9

[Arantor]

Any chance you can post that file here as an attachment?

[CapadY]

Wild guess:

Somewhere in your code you'll find:

Code Select Expand


C  =>  $something;


This should be:

Code Select Expand


' C'   =>  $something;


[Arantor]

CapadY: probably, but I want to see the file itself just in case it's something else. The error is... unusual.

[MrPhil]

For the core and default themes, line 9 is still way up in the /* prologue comment block */. It's possible that your theme file has been hacked, or it just may be an unusual layout. I would have assumed that the author had tested the theme before releasing it, so I'm leaning towards a hack (or other damage to the file). Anyway, attaching a copy of the file to your next post would settle the issue very quickly.

[Мel]

Yes, there was actually a trojan on my forum, something called Trojan.PHP45 I think.
And here is the file.

[Kindred]

so, have you cleaned all of your files?

[Мel]

Yep, some files seems to be corrupted. I'm replacing them from originals step by step.

[Kindred]

If you were hacked and they altered ANY of your files, it is likely that they dropped  backdoor (or multiple) into some hidden, buried directory.
I would suggest replacing **ALL** forum files in **ALL** directories.
Specifically:
save a copy of your Settings.php, as well as your attachments and avatars directories
delete the entire forum tree.
install a fresh copy of the forum files
restore your saved Settings.php file and directories.

reinstall mods and/or themes.

[MrPhil]

Your index.template.php file looks very suspicious to me. Between the opening <?php and the normal prologue comments are a bunch of obfuscated code lines with eval(base64_decode()) statements. Legitimate code rarely looks like that... I think it's a hack. Try removing those lines 2 through 9 (keep a copy of the file, just in case). Or, compare it to a known clean backup copy.

[Мel]

Kindred
Yes, thank you. But it wasn't a deliberate hack, just an ad trojan on my configuration (it appeared to be flawed, somebody wrote about this kind of problem some time ago). Also, I've made my FTPAccess to recognize only one my IP.

MrPhil
I've replaced it with a new one from that theme.

[Kindred]

note: base64 encoding is not used in **ANY** part of SMF, as distributed.

there are several mods (mostly by ADK) which add their copyrights in base64, but this is **BAD** practice, and IMO, any code with the start base64 should be killed with fire and removed from the code as soon as found.

[Мel]

Thanks.