Support

Admin Tools

#22673 akgeoip code error

Posted in ‘Admin Tools for Joomla! 4 & 5’
This is a public ticket

Everybody will be able to see its contents. Do not include usernames, passwords or any other sensitive information.

Environment Information

Joomla! version
n/a
PHP version
n/a
Admin Tools version
n/a

Latest post by user87293 on Monday, 25 May 2015 09:37 CDT

user87293
Hi
Siteground's malware scanner detected 'suspicious code' in a GeoIP file composer.phar . They have gone on to say it is BASE64 code (means nothing to me, I think).

The coding contains many characters that are question marks in a black diamond, at the top and at the bottom of the page. Research suggests it is to do with encoding, and if I change from MacOSX 'default" to (forget offhand but think changing the browser setting to Western Mac OS Roman or possibly UTF-8) the question marks contain other 'normal' characters, but still seemingly random.

The file date is the same as the original install.

If this sounds like the incomplete installation situation that is described in Admin Tools documentaion for AKGeoIP, the self-check feature, then I will just re-install on top and see what happens.

If not, then can you please suggest what to do?

The file path is plugins/system/akgeoip/lib/composer.phar

The strange code starts

_ HALT _ COMPILER ( ) ; ?>
?oX
composer . pharsrc / bootstrap . php?K??S???2??src / Composer....... [followed by 30 or so lines of similar]

and ends

d | ??? | ?
??? B ? GBMB

please note that question marks are white in a black diamond and I have added some extra character spaces just in case (just to be safe).

Thanks for any suggestions on what to do.
Robin

nicholas
Akeeba Staff
Manager
This file was added to the download package in error. It is NOT malware, it is the well-known, well-respected and widely used dependency tool Composer. It is used to install PHP libraries by virtually all PHP developers. Do note that even the Joomla! project is using Composer to install several PHP libraries shipped with Joomla! itself.

Nicholas K. Dionysopoulos

Lead Developer and Director

πŸ‡¬πŸ‡·Greek: native πŸ‡¬πŸ‡§English: excellent πŸ‡«πŸ‡·French: basic β€’ πŸ• My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

user87293
Thanks for your fast reply Nicholas. Sorry if I misled, I hadn't thought the composer file itself was malware, or Composer, which I researched first (and got a little understanding of its use/status).

What I was unsure of was if the code including question marks was inserted mal-code - inserted during or since download, or as it should be. Somewhere in your excellent documentation you suggest malware often is inserted at the start and end of (php) files, the pattern I saw here.

I also am a little unsure with your comment that the file was added to the download package in error, in case it was my error. Or if you are saying (which I think most likely), all is fine and nothing to worry about.

As I am familiar with html and css hopefully a time will come that I start to understand other file types and potential good/bad coding. Until then, sorry, I feel it necessary to ask!

Thanks again
Robin

nicholas
Akeeba Staff
Manager
I also am a little unsure with your comment that the file was added to the download package in error, in case it was my error


Not yours. It's my fault. I will fix it in the next release!

Nicholas K. Dionysopoulos

Lead Developer and Director

πŸ‡¬πŸ‡·Greek: native πŸ‡¬πŸ‡§English: excellent πŸ‡«πŸ‡·French: basic β€’ πŸ• My time zone is Europe / Athens
Please keep in mind my timezone and cultural differences when reading my replies. Thank you!

user87293
OK thanks for that reassurance Nicholas!

Support Information

Working hours: We are open Monday to Friday, 9am to 7pm Cyprus timezone (EET / EEST). Support is provided by the same developers writing the software, all of which live in Europe. You can still file tickets outside of our working hours, but we cannot respond to them until we're back at the office.

Support policy: We would like to kindly inform you that when using our support you have already agreed to the Support Policy which is part of our Terms of Service. Thank you for your understanding and for helping us help you!