deltuna

when i try and access yahoo mail from my laptop this is what comes up. i'm really worried..please help




<?PHP
ini_set('display_errors', 0);
$data = yahoo_reg_login_setup();

if ( $data === FALSE )
{
exit();
}
else if ( ! isset( $data['DISPLAY_FORM'] ) )
{
error_log( "yahoo_reg_login_setup didn't set the DISPLAY_FORM field" );
header( "Location: http://login.yahoo.com/");
exit();
}

$tstname = @$data['.testname'];
$src = @$data['.src'];
$partner = @$data['.partner'];
$intl = @$data['.intl'];

// This is a hack put in place so that persistancy files are
// picked from the regular html directory.
// yinst packaging didn't allow for the multiple links to be created
// with one single command.
if($tstname == "tst_pst") {
$tstname = "";
}

// Adding support for pkg using PHP
if((@$data['pkg'] != null) && (@$data['pkg'] != "" ))
{
$data['.abs_path'] = "/home/y/share/htdocs/idaho/php/${intl}_shrkwp";
$res=include("/home/y/share/pear/Yahoo/reg/logic/shrkwp.inc");
}

// Adding support for .partner via PHP
// If both .src and .partner are present, and .src=ym, then .src takes
// precedence, else .partner takes precedence. - Aanchal, Bug #368481
// Please note that if in future, a more complicated pprecednce has to
// be added, the priorityMap array from propTemplate.inc.ros and
// header.inc.ros should be used.
// Disabling the src=ym precedence over the partner user as ym is not
// converted in intls like ca and cf and users end up seeing the older
// login_verify page for ym. It is better if we show them the partner
// branding. - bug # 652617
//else if(($src != null) && ($src != "") && ($src == "ym"))
//{
//$data['.abs_path'] = "/home/y/share/htdocs/idaho/php/${tstname}/${intl}_${src}";
//$res=include("/home/y/share/htdocs/idaho/php/${tstname}/${intl}_${src}/login/${data['DISPLAY_FORM']}");
//}
else if(($partner != null) && ($partner != ""))
{
$data['.abs_path'] = "/home/y/share/htdocs/idaho/php/${tstname}/${intl}_${partner}";
$res=include("/home/y/share/htdocs/idaho/php/${tstname}/${intl}_${partner}/login/${data['DISPLAY_FORM']}");
}
else if(($src != null) && ($src != ""))
{
$data['.abs_path'] = "/home/y/share/htdocs/idaho/php/${tstname}/${intl}_${src}";
$res=include("/home/y/share/htdocs/idaho/php/${tstname}/${intl}_${src}/login/${data['DISPLAY_FORM']}");
}
else
{
$data['.abs_path'] = "/home/y/share/htdocs/idaho/php/${tstname}/${intl}";
$res=include("/home/y/share/htdocs/idaho/php/${tstname}/${intl}/login/${data['DISPLAY_FORM']}");
}

// This check is put in place to avoid showing a blank login page
// when some test is set in common_login.conf and that test package is not
// installed on the machine.
// Ideally this should not happen. - Aanchal, Feb 3, 2005
// Bug # 305858
if($res != '1')
{
if(!is_dir($data['.abs_path'])){
// reset abs_path only if it didn't exist before
// a temp fix for ym logout issue
// Bug 1146959
$data['.abs_path'] = "/home/y/share/htdocs/idaho/php/${intl}";
}
include("/home/y/share/htdocs/idaho/php/${intl}/login/${data['DISPLAY_FORM']}");
}
?>

Go The Power

Hello and welcome to TSF.

Are you on a network and what web browser are you using?

chauffeur2

Hello Deltuna,

Going by the look of your post, you have been infected with something rather sinister.

Please go here; read the instructions carefully and follow each step; then, post your Logs in our HJT Support Forum here.
(Please click on the coloured links)

The analysts are usually very busy in the Security Team, so please be patient, and one of them will be along as soon as they can to assist you.

Good Luck with it!

Kind Regards,

deltuna

hi there, i have posted my log in hjt section.


go to the power -- i am on laptop at home network and this is the only pc. i am on a wireless connection using windows vista.

Go The Power

Hello
My advice would be to wait for an expert Analyst to check your logs for infections.

Good luck.

Ben

This doesn't look like an infection to me, Its just where the browser isn't rendering the php code properly

What browser are you using?

Ben

Also, should this thread be in Computer Security News?

deltuna

hi i'm using AOL browser

Ben

Try using Interent Explorer and see if you still have the same problem