Strange one...just checked my site and all the articles have only the text of "undefined". Link is www.evolvewebservices.com.au

It does not look like it has been hacked as the main page which is module based is OK. All of the articles though (except ecommerce) has the problem. I attempted to change the text to something else but it did not save the changes. I then noticed that the editor was not on so I turned on the tinyMCE one and I was able to change the text. I do not recall turning the editor off and when I went into the global config the Xstandard Lite1.7 was highlighted - prior to switching the tinyMCE on of course .

Has anyone ever seen this before? Looks like I will have redo all the pages again...bummer...

Cheers,

John

not sure what that was....

you don't have a backup?

Check your Jos_content database table to see if the content is there or not as well before doing thigns all over again.

I have a full account back up but am unsure about the reinstall and don't want to stuff it up completely but I will have a look in the Jos_content database and see what I can find.

From what I can recall, my provider has to reinstall the full backup. I will have to check with them.

Is it Joomlapak that does the back just for the joomla portion of an account?

Cheers,

John

thats right John - Joomlapack - now known as AkeebaBackup (what a name!) - does that kind of job nicely.

Check your Jos_content database table first though just to make sure that the text actually has been erased.

If I have done the right thing, it looks like that the text is not there. I go to phpMyadmin and then go to jos_content. In the introtext field, it says "undefined" just as the site says. In the default Joomla stuff though, like newsflash, those have the default text like: Yesterday all servers in the U.S. went out on strike....

Looks like I have a bit of work ahead of me.

Like I said, I made a complete backup so I am getting my provider to look into it...

Cheers,

John

I now have the site fully down. Looks like it was hacked via the cpanel. Can a hacker get to the cpanel from the joomla backend? I would love to meet the a-hole that bothers to do this sort of thing......

Looks like I have more work ahead of me than I thought....

Cheers,

John

HI John I have seen several hacked sites and I think on all ocassions but one the hacking was related to the hosting environment not JOomla! - the one that was hacked through Joomla! itself was doen so through a known vulnerability at teh time etc.

Why do you think access was gained through cpanel?
Hmm I don't see how your joomla install would affect cpanel access?

JLJ, the reason I ask is because first of all some of the article contents just had "undefined" in them. Then it was found that the files in the cpanel had their permissions changed. With the 2 being affected at pretty much the same time, that is what made me suspicious.

Bloody hackers, what kicks they get out of inconveniencing people is beyond me.

Here is a question that you might be able to answer...in my case with the permissions, is it likely that someone hacks into a site and physically changes the permissions and anything else or would it all be done automatically once access is achieved?

I have the site up and going again after my host restored a good backup. I still need to fix all the content though.

That should be fun...

Thanks,

John

Hmm - cpanel is a tool to access the server adn as such - I guess can be hacked but if you are viewing changes in permissions - this means someon got to the server somehow - not necessarily through cpanel - article contents is teh database - so it may have been amysl injection - but this isn't really my area - but if your site was reasonably secure from an administrator point of view - docs.joomla.org/Category:Security_Checklist - I would certainly google & whirlpool to check out your host - whirlpool.net.au/