URGENT my portal is down and filled with this characters

Discussion regarding Joomla! 2.5 security issues.

Moderators: mandville, General Support Moderators

Forum rules
Forum Rules
Absolute Beginner's Guide to Joomla! <-- please read before posting, this means YOU.
Forum Post Assistant / FPA - If you are serious about wanting help, you will use this tool to help you post.
Locked
drale01
Joomla! Apprentice
Joomla! Apprentice
Posts: 40
Joined: Mon Apr 02, 2012 4:46 pm

URGENT my portal is down and filled with this characters

Post by drale01 » Wed Oct 22, 2014 5:50 am

Check my site http://bih.banke-biznis.com/

I can't reach backend and I don't know what to do.

Please help me
Last edited by imanickam on Thu Oct 23, 2014 7:05 am, edited 1 time in total.
Reason: Moved the topic from the forum General Questions/New to Joomla! 2.5 to the forum Security in Joomla! 2.5

coding1
I've been banned!
Posts: 340
Joined: Mon Oct 20, 2014 10:42 am

Re: URGENT my portal is down and filled with this characters

Post by coding1 » Wed Oct 22, 2014 7:41 am

set error_reporting to maximum in configuration.php file, then see error message.

User avatar
Yiannistaos
Joomla! Enthusiast
Joomla! Enthusiast
Posts: 180
Joined: Sat Aug 08, 2009 11:37 am
Contact:

Re: URGENT my portal is down and filled with this characters

Post by Yiannistaos » Wed Oct 22, 2014 7:48 am

Hello,

Maybe your website is hacked.

1) Edit the file configuration.php through your ftp and set your page offline.
2) Protect your joomla admin folder.
3) Change all passwords (joomla admin, cpanel/plesk, ftp, email etc.).
4) Update your joomla to the latest version.
5) Update all extensions in your latest version.

Try the above 5 steps and let us know about the result, please.

Thank you.
https://www.web357.com/ - Useful Extensions for Joomla!

sander_v_bergen
Joomla! Guru
Joomla! Guru
Posts: 529
Joined: Fri Oct 21, 2011 2:04 pm

Re: URGENT my portal is down and filled with this characters

Post by sander_v_bergen » Wed Oct 22, 2014 8:13 am

Did you change anything to your template code?
Looks like all of the content that should go in your <head> is moved to your <body>

drale01
Joomla! Apprentice
Joomla! Apprentice
Posts: 40
Joined: Mon Apr 02, 2012 4:46 pm

Re: URGENT my portal is down and filled with this characters

Post by drale01 » Wed Oct 22, 2014 8:52 am

coding1 wrote:set error_reporting to maximum in configuration.php file, then see error message.

Done, and only I can see is

Strict Standards: Declaration of JCacheControllerPage::store() should be compatible with JCacheController::store($data, $id, $group = NULL) in /home/bankebiz/public_html/BiH/libraries/joomla/cache/controller/page.php on line 199

drale01
Joomla! Apprentice
Joomla! Apprentice
Posts: 40
Joined: Mon Apr 02, 2012 4:46 pm

Re: URGENT my portal is down and filled with this characters

Post by drale01 » Wed Oct 22, 2014 8:55 am

Yiannistaos wrote:Hello,

Maybe your website is hacked.

1) Edit the file configuration.php through your ftp and set your page offline.
2) Protect your joomla admin folder.
3) Change all passwords (joomla admin, cpanel/plesk, ftp, email etc.).
4) Update your joomla to the latest version.
5) Update all extensions in your latest version.

Try the above 5 steps and let us know about the result, please.

Thank you.

1) I did it
2) how to protect. When I set folder to 444 I can't reach in backend att all
3) done
4) and 5) I can't reach to backand only blank page look: http://www.bih.banke-biznis.com/administrator/

drale01
Joomla! Apprentice
Joomla! Apprentice
Posts: 40
Joined: Mon Apr 02, 2012 4:46 pm

Re: URGENT my portal is down and filled with this characters

Post by drale01 » Wed Oct 22, 2014 8:58 am

sander_v_bergen wrote:Did you change anything to your template code?
Looks like all of the content that should go in your <head> is moved to your <body>
I didn't. I can't reach administratio to see it

User avatar
Webdongle
Joomla! Master
Joomla! Master
Posts: 44088
Joined: Sat Apr 05, 2008 9:58 pm

Re: URGENT my portal is down and filled with this characters

Post by Webdongle » Wed Oct 22, 2014 9:06 am

Have you been copy/pasting from Msword or similar ?
http://www.weblinksonline.co.uk/
https://www.weblinksonline.co.uk/updating-joomla.html
"When I'm right no one remembers but when I'm wrong no one forgets".

sander_v_bergen
Joomla! Guru
Joomla! Guru
Posts: 529
Joined: Fri Oct 21, 2011 2:04 pm

Re: URGENT my portal is down and filled with this characters

Post by sander_v_bergen » Wed Oct 22, 2014 9:09 am

For permissions: http://docs.joomla.org/What_are_the_rec ... issions%3F

After that sort out your <head> and see if this helps. Might have to do with character encoding, see: http://stackoverflow.com/questions/2754 ... stion-mark

User avatar
ionut
Joomla! Ace
Joomla! Ace
Posts: 1264
Joined: Thu May 27, 2010 1:00 pm
Location: EU

Re: URGENT my portal is down and filled with this characters

Post by ionut » Wed Oct 22, 2014 10:38 am

I don't know if you are using a pirated template or you've been hacked but looking at your page source code I can see some unusual links to betting related websites. You might want to investigate this.

User avatar
Webdongle
Joomla! Master
Joomla! Master
Posts: 44088
Joined: Sat Apr 05, 2008 9:58 pm

Re: URGENT my portal is down and filled with this characters

Post by Webdongle » Wed Oct 22, 2014 10:48 am

ionut wrote:... I can see some unusual links to betting related websites. ...
And positioned off screen.

Code: Select all

<div style="position: absolute; top: 0px; left: -8000px;">The best bookmaker 
<a target="_blank" rel="dofollow" href="http://bet365.artbetting.co.uk/">bet365</a>
</div>
http://www.weblinksonline.co.uk/
https://www.weblinksonline.co.uk/updating-joomla.html
"When I'm right no one remembers but when I'm wrong no one forgets".

drale01
Joomla! Apprentice
Joomla! Apprentice
Posts: 40
Joined: Mon Apr 02, 2012 4:46 pm

Re: URGENT my portal is down and filled with this characters

Post by drale01 » Wed Oct 22, 2014 4:26 pm

thank you all. I didn't solve it, my hosting company restore backup

User avatar
Webdongle
Joomla! Master
Joomla! Master
Posts: 44088
Joined: Sat Apr 05, 2008 9:58 pm

Re: URGENT my portal is down and filled with this characters

Post by Webdongle » Wed Oct 22, 2014 4:44 pm

If you've been hacked then the backup could be compromised.
http://www.weblinksonline.co.uk/
https://www.weblinksonline.co.uk/updating-joomla.html
"When I'm right no one remembers but when I'm wrong no one forgets".


Locked

Return to “Security in Joomla! 2.5”