CMS Made Simple Forums

Hello,

After trying days figuring the solution I think it is time to ask for some help here.

the problem is:

index.php or any other page of the website shows blank. admin works, except for content > pages.

What i tried:

searching forum for answers

Restoring a back-up of a working version
website got back, but then atfer a couple of hours the page went blank again

Upgrading to the newest CMSMS version
This seemed to work, but after a week or so the blank page showed up again

The weird thing is to me it has nothing do with the server, I host many CMSMS websites on the server and they all work fine.

I am trying to upgrade.php again and this now says: when entering content > pages it says this:
I am not sure what to do now and hope anyone of you can point me in the right direction.

If you can run a unix diff command with your current files(the main ones like index.php, config.php, etc) and a clean download.

If I understood you correctly, you replace the file (via backup or upgrade) and it works for a while and then the problem reappears. I am wondering if someone is accessing(possibly hacking) the files on modifying them in some way.

Thanks for your respond ajprog,

I am not sure what you mean with "unix diff command" I think this is something for the server owner?

I don't think it has something to do with someone hacking the website, since it just shows a white page consistently, plus its a small website.

The "diff" command is available if you have shell access to the site. Otherwise open the files side by side in a text editor (like Notepad, or SciTe)

It doesn't matter the size I have dealt with a hacked site before and it was a very small site.

I don't think I got shell access to the site (dont know what it is, but can't find it in the server admin panel) I could open the main files in a text editor (coda) but am not sure what to do then... compare them with new downloaded files and look for weird things?

Yep, just compare the same version you have installed. If noone has gotten into them the files should be identical.

wow,

I see in index.php this:

xxxxxxxxxxxxxxxxxxxxxxxxxxxxx

It seems you are right and the website got hacked, how is this possible?

I guess what I should do now is set up a back-up version and change the ftp login?

Hi sumpson

Yes, your site was ftp-hacked. Seen this before at also a dutch site. (not mine by the way  ;) )
There are probably many, many corrupted files. Look at the changedates from the files on the server.
Somewhere on your server wil be also a non-cmsms file (or more) which is creating these extra html in your cmsms files.  

Some steps I would take at this moment:
1. change passwords asap: ftp,db,admin just to be shure...
2. Make a backup of the existing hacked website to a computer with a good virusscanner. The virusscanner will detect the non-cmsms, bad files. If so, delete them from your server.
3. You can undo al the changes the hacker made by hand, but that will be a hell of a job. You can try to upgrade (full package) the cmsms software. It overwrites all the (hacked?) files by a clean one, a lot easier.
4. Upgrading overwrites all core files, but the files in the images, uploads, modules and plugin folder you still have to check by hand...
5. ...

I hope this will help you a bit...

Good luck, Rolf  :)

Thanks,

I'll first try the easy way and see if it comes back.. by restoring a back-up and changing the ftp login, hope this is enough.

Okay, but be shure there are no bad files on your backup also!
The site I have seen was having trouble for several years.
The two files I found dated 2007 I think.
Dutch forum: http://forum.cmsmadesimple.org/index.ph ... #msg156354

I found the following bad files, you can check this on your site:

/lib/libke.php
/Modules/Filemanager/postlet/dc.txt

But they can be everywhere of course... 

Grtz. Rolf