Has my site been hacked?
cosmin 269
From: -
From: -
Notice
This topic is archived. New comments cannot be posted and votes cannot be cast.Responses to this topic
1 Re: Has my site been hacked?
cosmin
OP
269
From: -
From: -
Yes, it's Cpanel. Will talk to them and see what they have to say.
1 Re: Has my site been hacked?
Philipp Esselbach
From: -
Editor
0From: -
Possibly a security problem with the server. I would open a trouble ticket at your webhost.
There are worms that can overwrite files like this even from different accounts on the server. Is this a cPanel server? In this case your webhost should upgrade to PHP 5.2.14 or higher.
There are worms that can overwrite files like this even from different accounts on the server. Is this a cPanel server? In this case your webhost should upgrade to PHP 5.2.14 or higher.
1 Re: Has my site been hacked?
cosmin
OP
269
From: -
From: -
PHP version: 5.2.9
Used API: cgi-fcgi
Integration: Contentteller
Memory Limit: 128M
Upload Limit: 2M / 8M
Suhosin Extension: No
Database Server: MySQL 5.0.91-community
Database Size: 2.4 MB
Server Time/Uptime: 0.65 0.50 0.39 1/180 21169
Next Automated Task: -
Cached Pages (Database): 0
Cached Pages (Filesystem): 21
That's what I have in that module.
Used API: cgi-fcgi
Integration: Contentteller
Memory Limit: 128M
Upload Limit: 2M / 8M
Suhosin Extension: No
Database Server: MySQL 5.0.91-community
Database Size: 2.4 MB
Server Time/Uptime: 0.65 0.50 0.39 1/180 21169
Next Automated Task: -
Cached Pages (Database): 0
Cached Pages (Filesystem): 21
That's what I have in that module.
1 Re: Has my site been hacked?
Philipp Esselbach
From: -
Editor
0From: -
In the System Information block right on the first page: load averages and server time/uptime
1 Re: Has my site been hacked?
cosmin
OP
269
From: -
From: -
Where do I see those?
1 Re: Has my site been hacked?
Philipp Esselbach
From: -
Editor
0From: -
Do you see the server load stats in admin?
1 Re: Has my site been hacked?
cosmin
OP
269
From: -
From: -
When I tried to access cadmin after your question, I got the following error:
Parse error: syntax error, unexpected '?' in /home/********/public_html/cadmin/index.php on line 374. I replaced it with the original though (or at least I think it was the original). I'm gonna compare the local files with the one in the zip file. I'm transferring the files using Adobe Dreamweaver.
class_html.php
class_xml.php
class_wysiwyg.php
twitteroauth.php
Although only cadmin/index.php seemed be modified. The classes and twitteroauth.php seemed to have just a different timestamp between the ones on the server and the local files.
Parse error: syntax error, unexpected '?' in /home/********/public_html/cadmin/index.php on line 374. I replaced it with the original though (or at least I think it was the original). I'm gonna compare the local files with the one in the zip file. I'm transferring the files using Adobe Dreamweaver.
class_html.php
class_xml.php
class_wysiwyg.php
twitteroauth.php
Although only cadmin/index.php seemed be modified. The classes and twitteroauth.php seemed to have just a different timestamp between the ones on the server and the local files.
1 Re: Has my site been hacked?
Philipp Esselbach
From: -
Editor
0From: -
Only the index.php files? Do you have any other scripts installed? Do you get server load stats in the admin section?
1 Re: Has my site been hacked?
cosmin
OP
269
From: -
From: -
Yes, I am.
1 Re: Has my site been hacked?
Philipp Esselbach
From: -
Editor
0From: -
Are you on a shared webhost?
Starting with yesterday I starting getting errors on my website. It seems code is getting appended at the end of my index.php files. Yesterday it was index.php at the root, and now it's cadmin/index.php after the final question mark. This is definitely not of my own doing. Here's what cadmin/index.php had appended: