Reinstall after problems, now blank homepage

Quote from: neilcreek at May 26, 2009, 05:36 PM

Ugh... That’s not what I wanted to hear. I had a look and found the same added code in two of my client’s sites, on different hosts each. How did this happen? Was there a loophope in the host’s security?

I’m not a server owner. All of my sites are hosted on third party hosts as virtual servers, shared with othre customers. What do I do? Should I ask the host to restore the site from an older backup? Do I need to get my host to find out what they did to the server with the exploit? I’m completely lost, and don’t know what to do to fix all this mess. The link you gave is very scary, but doesn’t show how to recover from the exploit.

This news has just made my day...

Before you freak out from the FUD, you need to see what kind of damage they did and figure out how they got the files uploaded. Make sure you have the latest WordPress if that is running on all your hosts, and see if you are missing any other important files (a good way to check is to find the Apache error log and see what requested files are not being found). Any other common factors between your sites?

I use the wordpress auto update feature, so it’s always running the latest version, as are all plugins. I can’t check the server logs unfortunately. I just went into media temple control panel, and server error logging was disabled by default. I enabled it and loaded my site, but the error log is still appearing empty. I’ll have a look again in a while to see if anything new gets added.

I know for certain of two sites affected, and a third I suspect. The only thing in common with them is ModX. However I first noticed odd problems with my site a few month back when errors would appear on my ModX generated pages complaining about a missing file in my wordpress plugin directory. I disabled the offending plugin (wpsupercache) ad the errors went away. This recent trouble brought these errors back, even though the plugin was still deactivated. I don’t know if that’s related at all.

I’m sorry I can’t give you anything more than that. Thanks for your help though, I very much appreciate it!

I have a very knowledgable and skilled friend helping me recover from the hack, and it’s going very well. I’m trying to convince him to write a guide/blog post to explain how he handled it. If I can get any helpful info from him, I’ll be sure to share it here.

My site’s not back up yet, but it’s looking like we’ll be able to!

The good news is, with Leif’s help I’ve been able to get rid of the hack from my site.

The bad news is, my site is still loading a blank page.

I’ve downgraded to the previous version, which was working, but with an error message, but the site is still blank. Leif suggested there might be something wrong the the database. It’s very hard to diagnose as I have nothing to go by, except for an empty page. As before, the manager seems to be working perfectly, and all the pages I checked loaded just fine.

I’m totally stumped again - as is Leif. Does anyone have any suggestions please?

Did you check the Reports --> System Events log for any new entries since the recovery? Or any PHP errors being logged to the error log you turned on?

I find that if the manager works but the site doesn’t it often means that there’s something wrong with either the permissions or the content of index.php and .htaccess in the site root. Compare the permissions on those files (and their folders) between the root and the Manager first.

Thanks for the additional suggestions.

The System events log is empty for the last couple of days. Nothing has been added to it at all since the site went blank. The php error log mostly shows 404 errors for other poarts of my site. There haven’t been any errors logged for neilcreek.com since I activated it two days ago.

The chmod of the .htaccess and the index.php are both 755, which is identical to the same files in the/manager directory, as well as the /manager directory itself. The content of the index.php file is unmodified from the uploaded version.

Sorry I can’t shed any more light on the problem with this post, but it looks like the whole site has become invisible to everything but the manager.

I’m sure it’s some simple, stupid mistake I’ve made somewhere. Any other ideas?

Thanks again!

Try uploading the install/ directory and running an upgrade. Let us know if that does anything or if you have the same result.

As per your suggestion I reuploaded the files, all of them in fact, first for 0.9.6.2 and then 0.9.6.3 and ran the upgrade both times. The result was still the same: blank page in both cases.

This is starting to get frustrating - it’s very confusing to say the least!

Has anyone had any more ideas about this? I care more about getting my site back now, rathre than finding out what went wrong.

Would doing a parallel fresh installation of MODx help? Could I do an export/import of the content into a new install? How about upgrading to the beta of MODx 2? I know there’s risks involved, but right now I have no site at all.

Any suggestions would be very welcome.