1
Xman04
Hacked site or server problem?
  • 2005/11/29 18:00

  • Xman04

  • Not too shy to talk

  • Posts: 180

  • Since: 2004/7/12


Hi,

I've been working on an XOOPS site for quite a while, with no problems. I'm the only one with password access to the site and knowledge of the site, except for my host provider.

The last time I accessed the site was last week, and the site was running fine with no problems. I've not made any changes to the site in quite a while. However, when I signed into my site yesterday, I started receiving error messages and the site would not load properly. In fact, several times my IE browser tried to popup a porn site and triggered an installer program on my personal computer to start running.

One possibility is that the host server is running a bad script or virus. I ran a check on my on computer, and there are no viruses or malware problems. I don't have this problem with any other sites, but only when attempting to open my own site. The popups do not consistently occur, but the errors are always there. Given the fact that I've not changed anything in weeks, something must be happening on the host server, or somehow my files were corrupted or hacked. Also, I tried installing another test copy of XOOPS in another directory, and it seems to be running fine. Thus, whatever is happening seems specific to my original installation of Xoops. **Although, the test copy is not a duplicate of my main installation, since it doesn't have all the modules and upgrades installed (as the main installation does).

Here are the details of what happens:

I have the site turned off, and need to log into the "site down for maintenance page," in order to get to the home page. However, the text label on the user login button is not displaying correctly. Instead of correctly displaying the text "User Login" on the button, it displays the text "User Login", but with the addition of some some html code too (which shouldn't be displayed on the button). This error has been coming and going. It will be there one minute and gone the next.

When I submit my ID and password through the same page, I receive the following error:

Quote:
Parse error: parse error, unexpected $ in /home/MySiteUserName/public_html/templates_c/%%C6^C61^C6174DC0%%db%3Axoopspoll_block_poll.html.php on line 40


After I receive the above error, I attempt to move to the administration panel of my XOOPS program, by typing the URL: Quote:
http://www.mysite.com/admin.php


However, I receive the following error message:

Quote:
Parse error: parse error, unexpected T_STRING in /home/MySiteUserName/public_html/cache/adminmenu.php on line 4


The only way I can somewhat access my XOOPS system is by typing the URL: Quote:
http://www.mysite.com/user.php


However, this only works after I attempt to signon with my password.

The page that appears is extremely jumbled and distorted. If I click on other menu options, much of the formatting that should have been generated is not there, and there are other similar error messages. Some stuff does not come up at all, but just generates similar errors.

Does anyone have any idea what may be going on or what has happened? The only possibilities I can think of are a host server virus, changes made by the host to the server (which is affecting my system), a corruption that occurred to my files somewhere, or something being hacked. I'm not really even sure that the intermittent popups are directly related to the errors (or just a weird chain reaction of events).

I spoke with my host provider, and they are looking into it, but are implying that it is probably something gone bad in my XOOPS system. However, if this is so, I have no idea what could have happened, since it ran fine the last time I checked it (and I made no changes).

Any ideas would be greatly appreciated. Where do I start looking for the source of this problem?

Thanks,
Dave

2
coopersita
Re: Hacked site or server problem?

Seems like your chache went bad. Empty the contents of templates_c folder. See if that helps.

After you delete it should create new cache files.

I don't know if you where hacked, but it could be. Open /cache/adminmenu.php, and if you see extra code at the end, you've been hacked...

You can also delete the contents of /cache (and after login in as admin at least one change permissions to 755)

3
martyboy
Re: Hacked site or server problem?
  • 2005/11/29 18:17

  • martyboy

  • Quite a regular

  • Posts: 256

  • Since: 2004/5/25


coopersita is correct. I had a similar problem where the hackers managed to alter files in cache/templates_c and insert random code, links to porn sites, etc if your on a shared server then they possible gained access through anotehr compromised site or something like that.

As coopersita said empty all the files in cache and templates_c and you should be up and running again also make sure to turn on indexing in cpanel or ensure there is index.html files in the cache and templates_c folders and as always update to the latest XOOPS and you could also install the protector module too.
Michael Jackson = King Of Pop

Xoops = King Of CMS

4
Xman04
Re: Hacked site or server problem?
  • 2005/11/29 22:45

  • Xman04

  • Not too shy to talk

  • Posts: 180

  • Since: 2004/7/12


Thank you martyboy and coopersita. The cache and template_c folders were hacked/infected with bad files. I followed your instructions, and now the site is back up and running normally.

Dave

5
al_in_chicag
Help! I followed this advice and know I can't login back into my site!

I followed the advice on this post because my website was experiencing similar difficulties. My biggest problem know is that I can't login and pretty much nothing works. Homepage is there but nothing works. Links, menu,login, nothing.

I guess I should deal with the biggest problem now. How do I login back into my website and no links work. I have tried to go in through user.php but instead of getting the page to login in, only the homepage appears. Please help!

Thank you in advance.

Alfonso

6
jensclas
Re: Help! I followed this advice and know I can't login back into my site!

Did you try this FAQ?
If not go for a anmin login search and see what else is there...there are a number of things you can do and most manage to find thr right way for them.

7
al_in_chicag
Re: Help! I followed this advice and know I can't login back into my site!

Hello Jen.

I did look extensively through the Q&A and the supports forums and followed the advice which is how I ended up here.

My main issue know is, how do I login to my website when none of the links work. If I try to login, I do get the page saying, "thank you for loggin in, if you do not get redirected, please click here". However it just returns to the homepage, without having logged me in.

also, not one link works on the website. If a link is clicked for the news, gallery, forum, and gallery modules, it always returns to the homepage.

Please help! I have looked through the forums and Q&A pages and I am about to pull my hair out because I can't find anything to address this specific problem.

Alfonso

Login

Who's Online

236 user(s) are online (122 user(s) are browsing Support Forums)


Members: 0


Guests: 236


more...

Donat-O-Meter

Stats
Goal: $100.00
Due Date: May 31
Gross Amount: $0.00
Net Balance: $0.00
Left to go: $100.00
Make donations with PayPal!

Latest GitHub Commits