My joomla websites are all down

christer · #1 01-07-2006, 04:58 PM

Hello,
I just saw that someone has the same problem as me. Suddenly all joomla website are not working anymore. Just gets a white page. I can login into my admin but there the same problem. Some funstions are working and most of them not. Can anyone explain what is going on? Just got a review from a pc magazine in Belgium for one of my websites and I have to say that it isn't a nice thing if they look at your website and just see a blank page.
Hope this problem will be fixed soon.

Kostas · #2 01-07-2006, 05:53 PM

Same problem with MAMBO...
I see via FTP that some files have changed... with the today's date

Could you see if you have the same changes?

voodoo · #3 01-07-2006, 06:16 PM

Some of my PHP_Nuke sites are down as well. Some have parse errors, some blank pages

Kostas · #4 01-07-2006, 06:20 PM

The same problem in my hosting account and I have no answer from the support department

I started to upload my backup files... and I hope to stop the problem here...

voodoo · #5 01-07-2006, 06:21 PM

don't bother...I tried it

voodoo · #6 01-07-2006, 06:23 PM

only thing it achieved was to get rid of the parse error & give a white page

Kostas · #7 01-07-2006, 06:29 PM

The problem is only in sites which installed by fantastico...

voodoo · #8 01-07-2006, 06:35 PM

no, I have a few that are not fantastico that are down also

Kostas · #9 01-07-2006, 06:40 PM

where is the problem?

Have you got an answer from the support department?

voodoo · #10 01-07-2006, 06:44 PM

The support hasn't got back yet as to the problem. In fact they said at first there was no problem they knew of with php_nuke sites. I have only 1 php_nuke site still up. All others are down. The html pages I built inside those sites still work though, as do the hosting, and zen-cart in my php_nuke site.

Kostas · #11 01-07-2006, 06:50 PM

I uploaded one back and now work ok...

I'm trying to do the same and in my other sites

christer · #12 01-08-2006, 05:10 AM

Still the same problem with me. Hope It will be fixed soon.

Kostas · #13 01-08-2006, 05:22 AM

The problem has to make with some new files like date.php, contacts.php in your mambo files...
These file are not from the Joomla, Mambo installation.
Delete this files and start to upload your backup files...

If you still have problem pm me...

quietFinn · #14 01-08-2006, 06:38 AM

Quote:

Originally Posted by Kostas

The problem has to make with some new files like date.php, contacts.php in your mambo files...
These file are not from the Joomla, Mambo installation.
Delete this files and start to upload your backup files...

If you still have problem pm me...

If in your site there are files you didn't put there doesn't it mean that your site is hacked?

And if you then delete the files and upload the backup doesn't it mean that your site can get hacked again?

Restore your site and then upgrade it to the latest version of mambo/joomla.

Kostas · #15 01-08-2006, 07:15 AM

I found the reason for the problem...

Hostgator updated the PHP version from 4.3.11 to 4.4.1 and may be this is the reason...

Mr Self Destruct · #16 01-08-2006, 11:38 AM

Are you sure? I'm getting frequent fatal errors on my LDU powered site.

suzigeek · #17 01-08-2006, 02:03 PM

My Joomla and mambo sites are all down also...It looks like all of the files have the last chopped off. This seems more like a server wide hack if anything rather than a security exploit( especially since I have different versions of this software and ALL versions have been hacked!) ...uuggghhh.

I knew I should have moved all of my sites to my new server!!! I think the only way to fix is to upload your backups!!

Good Luck to all!!

P.S. NOT only have files been changed BUT there are new files sitting in my websites. new htaccess and php files. Not only will you have to back up your sites but make sure uploaded files are deleted!!!

I would like a response from hostgator on this issue please??

UPDATE Some of these files will not let me rename - delete - or overwrite. Or change chmod levels...this is not good.

UPDATE: Looks like files that were hacked are files that have 777 permissions on them .

MORE UPDATE: One of my sites redirected to this website:

http: //find.gl /?cT1eXl5zPWVeXl5kPTU=

Seems actually it is redirecting to a new site on every refresh. Here is the whois for one website that showed up.

Silnov Dmitry address: 117292, Russia, Moscow, Kedrova st. 4/2 pom1a. phone: +7 926 5242052 nic-hdl: SD6-UG source: UG

Kostas · #18 01-08-2006, 03:21 PM

Quote:

Originally Posted by suzigeek

I would like a response from hostgator on this issue please??

UPDATE Some of these files will not let me rename - delete - or overwrite. Or change chmod levels...this is not good.

UPDATE: Looks like files that were hacked are files that have 777 permissions on them .

MORE UPDATE: One of my sites redirected to this website:

http: //find.gl /?cT1eXl5zPWVeXl5kPTU=

Seems actually it is redirecting to a new site on every refresh. Here is the whois for one website that showed up.

Silnov Dmitry address: 117292, Russia, Moscow, Kedrova st. 4/2 pom1a. phone: +7 926 5242052 nic-hdl: SD6-UG source: UG

You have right...

suzigeek · #19 01-08-2006, 03:36 PM

I googled the persons name and came across this post:

www.pro-networks.org/forum/about62756.html&sid=2ca71c73ba26a9489532a0313a29de f3

So this guys been at it for awhile. I'm having to delete all the files and then restore becuase there are files hiding...actually some files won't allow me to delete them even from file manager, so I'm probably going to have to delete the whole account and start over.

christer · #20 01-08-2006, 04:10 PM

Is there a possibility that Hostgator can restore my acount by using backups they have made from my account in the past? If that is possible, please do it. This normally should fix the problem and I will loose some pages but I will make them again.

quietFinn · #21 01-08-2006, 04:20 PM

Quote:

Originally Posted by christer

Is there a possibility that Hostgator can restore my acount by using backups they have made from my account in the past? If that is possible, please do it. This normally should fix the problem and I will loose some pages but I will make them again.

http://www.hostgator.com/restore.php

Kostas · #22 01-08-2006, 04:56 PM

Quote:

Originally Posted by suzigeek

I googled the persons name and came across this post:

www.pro-networks.org/forum/about62756.html&sid=2ca71c73ba26a9489532a0313a29de f3

So this guys been at it for awhile. I'm having to delete all the files and then restore becuase there are files hiding...actually some files won't allow me to delete them even from file manager, so I'm probably going to have to delete the whole account and start over.

Which is the safest methot to protect our MAMBO-JOOMLA sites after this attack?

suzigeek · #23 01-08-2006, 05:24 PM

What server is everyone on?

I'm wondering if it is a server wide php attack or specific to Mambo/Joomla. I'm on Infinite I think.
I thought I saw someone post that their Nuke site was Nuked also?

quietFinn · #24 01-08-2006, 05:37 PM

Quote:

Originally Posted by suzigeek

What server is everyone on?

I'm wondering if it is a server wide php attack or specific to Mambo/Joomla. I'm on Infinite I think.
I thought I saw someone post that their Nuke site was Nuked also?

Because that seems to be happening to quite many of us I suggest that everyone having symptoms that their sites are hacked write to support@hostgator.com, explaining what has happened, and refering to this thread.

If you have the latest Mambo (2.5.3) or Joomla (1.0.5) then they itself are safe, but there might be something else in the server(s) that is not safe. Then it's probably something you can't control at all.

d0t · #25 01-08-2006, 10:59 PM

I don't have mambo, joomla or php-nuke installed and I got hacked too, might be a server-wide attack...

Quote:

What server is everyone on?

Galant