SOmething is inserting unwanted text into pages

Discussion regarding Joomla! 3.x security issues.

Moderators: Bernard T, mandville, fcoulter, PhilD, General Support Moderators

Forum rules
Forum Rules
Absolute Beginner's Guide to Joomla! <-- please read before posting, this means YOU.
Forum Post Assistant / FPA - If you are serious about wanting help, you will use this tool to help you post.
Amongthegums
Joomla! Apprentice
Joomla! Apprentice
Posts: 49
Joined: Wed Mar 04, 2015 6:22 am

SOmething is inserting unwanted text into pages

Postby Amongthegums » Mon Feb 12, 2018 7:47 am

Every article we create is having
Price: $1,405.00
inserted at the top when the page is displayed on the front end.

Also, we can't change the template since this started. Seems we've been subjected to someone with too much time on their hands or who has a limited social life. Or maybe both.

Any tips on what might be causing it and how to remove it before I restore from a backup?

Thanks

phamtungpth
Joomla! Explorer
Joomla! Explorer
Posts: 467
Joined: Mon Aug 26, 2013 2:32 am
Contact:

Re: SOmething is inserting unwanted text into pages

Postby phamtungpth » Mon Feb 12, 2018 10:25 am

Hi,

Did you check the content of your articles in back end if they contain that text or not?

Please try to check if there is strange plugin on your site!

Amongthegums
Joomla! Apprentice
Joomla! Apprentice
Posts: 49
Joined: Wed Mar 04, 2015 6:22 am

Re: SOmething is inserting unwanted text into pages

Postby Amongthegums » Mon Feb 12, 2018 10:48 am

phamtungpth wrote:Hi,
Did you check the content of your articles in back end if they contain that text or not?


No; the data for the article is clean. It is not visible in code on the admin side or in the data records. So it seems it is being added when the pages are generated.

Re "strange" plug in, nothing I've noticed. Admin tools PHP File Change monitoring also reports no changes.

Weird.

I can restore, but it'd be good to know what this is....

Amongthegums
Joomla! Apprentice
Joomla! Apprentice
Posts: 49
Joined: Wed Mar 04, 2015 6:22 am

Re: SOmething is inserting unwanted text into pages

Postby Amongthegums » Mon Feb 12, 2018 10:54 am

/administrator > Extensions > Manage > Manage > Database is showing me


Database schema version (3.8.2-2017-10-14) does not match CMS version (3.8.4-2018-01-16).
Table 'a1e9k_user_keys' should not have index 'series_2'. (From file 3.8.4-2018-01-16.sql.)
Table 'a1e9k_user_keys' should not have index 'series_3'. (From file 3.8.4-2018-01-16.sql.)


Is that significant?

Amongthegums
Joomla! Apprentice
Joomla! Apprentice
Posts: 49
Joined: Wed Mar 04, 2015 6:22 am

Re: SOmething is inserting unwanted text into pages

Postby Amongthegums » Mon Feb 12, 2018 1:52 pm

This is what's being placed into each article:

Code: Select all

<dl class="fields-container">
                           <dd class="field-entry ">
            <span class="field-label">Price: </span>
<span class="field-value">$1,405.00</span>
      </dd>

User avatar
leolam
Joomla! Master
Joomla! Master
Posts: 18714
Joined: Mon Aug 29, 2005 10:17 am
Location: Netherlands/ UK/ S'pore/Jakarta/ North America
Contact:

Re: SOmething is inserting unwanted text into pages

Postby leolam » Mon Feb 12, 2018 5:14 pm

You have been hacked and a script has been placed somewhere in your file structure causing this. You need to clean your site as described here viewtopic.php?f=714&t=946026

Alternatively and much faster and costs little use myjoomla.com. This will discover where the crsp is located and takes care for it. First scan is free

Leo 8)
Celebrating 12-Years of Professional Joomla Support Services
- Joomla Professional Support:https://gws-desk.com -
- Joomla Specialized Hosting Solutions:https://gws-host.com -
- Member Joomla Bug Squad & J-CMS Release Team

Amongthegums
Joomla! Apprentice
Joomla! Apprentice
Posts: 49
Joined: Wed Mar 04, 2015 6:22 am

Re: SOmething is inserting unwanted text into pages

Postby Amongthegums » Mon Feb 12, 2018 10:11 pm

leolam wrote:You have been hacked and a script has been placed somewhere in your file structure causing this. You need to clean your site as described here viewtopic.php?f=714&t=946026

Alternatively and much faster and costs little use myjoomla.com. This will discover where the crsp is located and takes care for it. First scan is free

Leo 8)


Thanks for that. I have dealt with hacked J sites before, and have cleaned house and restored. I was just keen to know where the nuisance code was hiding.

Cheers

User avatar
leolam
Joomla! Master
Joomla! Master
Posts: 18714
Joined: Mon Aug 29, 2005 10:17 am
Location: Netherlands/ UK/ S'pore/Jakarta/ North America
Contact:

Re: SOmething is inserting unwanted text into pages

Postby leolam » Tue Feb 13, 2018 2:10 am

Amongthegums wrote: I was just keen to know where the nuisance code was hiding.
Ypou only can find out with a file integrity check and a run at myjoomla.com will tell you this

Leo 8)
Celebrating 12-Years of Professional Joomla Support Services
- Joomla Professional Support:https://gws-desk.com -
- Joomla Specialized Hosting Solutions:https://gws-host.com -
- Member Joomla Bug Squad & J-CMS Release Team

Amongthegums
Joomla! Apprentice
Joomla! Apprentice
Posts: 49
Joined: Wed Mar 04, 2015 6:22 am

Re: SOmething is inserting unwanted text into pages

Postby Amongthegums » Tue Feb 13, 2018 5:29 am

leolam wrote:
Amongthegums wrote: I was just keen to know where the nuisance code was hiding.
Ypou only can find out with a file integrity check and a run at myjoomla.com will tell you this

Leo 8)


I had initialised Akeeba Admin Tools' PHP FIle CHange Scanner, but it had not reported anything.

Anyway, I have backed up the infected site and in a moment of madness will go through it.

Thanks for the feedback, people.


Return to “Security in Joomla! 3.x”

Who is online

Users browsing this forum: neiljames54 and 5 guests