[UPSHOT.-- The file relates to a known source; the file may be an executable attack (infected); the file's name may be used for another kind of hacking file entirely. Post 1/3 (present), how it first appeared and may still be problematical; post 2/3 (next) how it appeared when source of file or at least its name was found; post 3/3 (then next) how to get rid of it.]
Version? [You put up 1.5.1.3 meanwhile.] Theme? Extensions? Even bizarre themes and extensions don't show a tree that is outside OC -- /ecc/lib/ itself is not part of OC, let alone D.opencart.php, whose combination indicates likelihood of hacking. Do not try to address or execute D.opencart.php in your browser.
[NOTE that while the file is at least 2,490 lines long the counterpart on github, next post, is only 2,424 lines long including the final ?> line. Code of known executable malicious files whose extensions were nameshifted would readily fit in 66 lines. See
http://forum.opencart.com/viewtopic.php ... +php+shift at
http://forum.opencart.com/viewtopic.php ... 60#p453513. The file might well be infected or its name used for another file entirely, even if the name or file originally came from somewhere known for innocence. DO NOT address and fire the file.]
If you did not put it there, and you seem not to have put it there, then get rid of it. If that tree is 777 on a typical Stateside server whose permissions should be 755/644 and whose ownerships are intended to thwart 777, you may be able to reset and remove it using FileZilla Client or similar, or using putty.exe if you are allowed and know how, but you may need to ask that support have the system administrator get rid of it. Look at your /download/ files for anything that you did not put there -- there should be a zero-byte index.html, hashed names of any files you did upload through admin, and nothing else. If you see any files with route, jpg, or php in their names (often with gibberish which seems hashed properly but is not), then get rid of them. Look through your trees for files you do not recognize, especially oddly named or somehow just too cozy that don't belong, such as grocery.php and default.php (instances of actual hacking consoles more powerful and vicious than phpMyAdmin).
Some of the errors seem to display what may be incompetently attempted invasions, such as "Undefined index: Last4Digits". At least those few do not show 64-bit decryption calls. The file is more than 2,490 lines long (the last would close, as ?>). That puts the file into the size range of some particularly malicious executable files.
[HOWEVER, it is spewing errors because some or most of it is MISSING, see next two posts.]