The blank page

[sumpson]

Hello,

After trying days figuring the solution I think it is time to ask for some help here.

the problem is:

index.php or any other page of the website shows blank. admin works, except for content > pages.

What i tried:

searching forum for answers

Restoring a back-up of a working version
website got back, but then atfer a couple of hours the page went blank again

Upgrading to the newest CMSMS version
This seemed to work, but after a week or so the blank page showed up again

The weird thing is to me it has nothing do with the server, I host many CMSMS websites on the server and they all work fine.

I am trying to upgrade.php again and this now says:

Code: Select all

Session not working, you have problem with some modules and functionality! Ask your provider, exiting! 

when entering content > pages it says this:

Code: Select all

Output has already been sent to the browser at /home/toroso/domains/toroso.nl/public_html/config.php:3. Please make sure the command $xajax->processRequest() is placed before this.

I am not sure what to do now and hope anyone of you can point me in the right direction.

[Jeff]

If you can run a unix diff command with your current files(the main ones like index.php, config.php, etc) and a clean download.

If I understood you correctly, you replace the file (via backup or upgrade) and it works for a while and then the problem reappears. I am wondering if someone is accessing(possibly hacking) the files on modifying them in some way.

[sumpson]

Thanks for your respond ajprog,

I am not sure what you mean with "unix diff command" I think this is something for the server owner?

I don't think it has something to do with someone hacking the website, since it just shows a white page consistently, plus its a small website.

[Jeff]

The "diff" command is available if you have shell access to the site. Otherwise open the files side by side in a text editor (like Notepad, or SciTe)

It doesn't matter the size I have dealt with a hacked site before and it was a very small site.

[sumpson]

I don't think I got shell access to the site (dont know what it is, but can't find it in the server admin panel) I could open the main files in a text editor (coda) but am not sure what to do then... compare them with new downloaded files and look for weird things?

[Jeff]

Yep, just compare the same version you have installed. If noone has gotten into them the files should be identical.

[sumpson]

wow,

I see in index.php this:

xxxxxxxxxxxxxxxxxxxxxxxxxxxxx

It seems you are right and the website got hacked, how is this possible?

I guess what I should do now is set up a back-up version and change the ftp login?

[Rolf]

Hi sumpson

Yes, your site was ftp-hacked. Seen this before at also a dutch site. (not mine by the way  ;) )
There are probably many, many corrupted files. Look at the changedates from the files on the server.
Somewhere on your server wil be also a non-cmsms file (or more) which is creating these extra html in your cmsms files.  

Some steps I would take at this moment:
1. change passwords asap: ftp,db,admin just to be shure...
2. Make a backup of the existing hacked website to a computer with a good virusscanner. The virusscanner will detect the non-cmsms, bad files. If so, delete them from your server.
3. You can undo al the changes the hacker made by hand, but that will be a hell of a job. You can try to upgrade (full package) the cmsms software. It overwrites all the (hacked?) files by a clean one, a lot easier.
4. Upgrading overwrites all core files, but the files in the images, uploads, modules and plugin folder you still have to check by hand...
5. ...

I hope this will help you a bit...

Good luck, Rolf  :)

[sumpson]

Thanks,

I'll first try the easy way and see if it comes back.. by restoring a back-up and changing the ftp login, hope this is enough.

[Rolf]

Okay, but be shure there are no bad files on your backup also!
The site I have seen was having trouble for several years.
The two files I found dated 2007 I think.
Dutch forum: http://forum.cmsmadesimple.org/index.ph ... #msg156354

I found the following bad files, you can check this on your site:

/lib/libke.php
/Modules/Filemanager/postlet/dc.txt

But they can be everywhere of course... 

Grtz. Rolf 

[Pierre M.]

Recovering from an exploit