Textpattern CMS support forum
You are not logged in. Register | Login | Help
- Topics: Active | Unanswered
[SOLVED] Strange website behavior, possibly malware
I’ve recently had a malware infection on my Dreamhost account. I’m in the process of cleaning everything out and battening down the hatches. My Textpattern install is exhibiting two odd behaviors, even after replacing all the files from a fresh 4.4.1 download:
1. On the front end, the body of comments does not appear: here’s an example … it shows up fine on the backend.
2. On the backend, under forms, the links to expand the forms (article, comment, file, links, misc) don’t work. (The first two are expanded, the rest not, and I can’t seem to do anything to change them).
Any idea what may be going on, or at least where I’d normally look to correct this?
Last edited by alesh (2012-03-24 21:44:17)
Yes, I have tried turning it off and on.
Offline
#2 2012-03-25 00:29:42
- uli
- Moderator
- From: Cologne
- Registered: 2006-08-15
- Posts: 4,306
Re: [SOLVED] Strange website behavior, possibly malware
Is there text in red displayed when you visit Admin > Diagnostics? If so, it will say: “Some Textpattern files have been modified”. (File paths will follow on this message.)
No reason to panic, pretty likely not each of the new files has been copied over to your server. Pick the files Diagnostics mentions from your fresh download and copy them exactly to where it tells you they should be. Are you now still having troubles?
In bad weather I never leave home without wet_plugout, smd_where_used and adi_form_links
Offline
Re: [SOLVED] Strange website behavior, possibly malware
Nope, nothing out of the ordinary on the diagnostic screen. I should also mention that another textpattern site I run, on a different dreamhost account, works just fine on the same computer/browser.
Yes, I have tried turning it off and on.
Offline
Re: [SOLVED] Strange website behavior, possibly malware
can you put your site on debug for us to see the tag trace? It sounds like there might be something wrong with the way you set up your comments_display.
>Edit: If it was malware it would somehow appear in the diagnostics so I’m 99% certain that it is not:)
Last edited by colak (2012-03-26 06:11:17)
Yiannis
——————————
NeMe | hblack.art | EMAP | A Sea change | Toolkit of Care
I do my best editing after I click on the submit button.
Offline
Re: [SOLVED] Strange website behavior, possibly malware
Ok, I’ve turned on debugging. Now I get this … (There are also a bunch of errors on my homepage that I need to clean up, but they don’t seem related ,either).
here’s what’s in my comments form — txp:message is right there!?:
<b><txp:comment_name /></b> <small><txp:comment_time /> <txp:comment_permlink>#</txp:comment_permlink></small> <br/>
<txp:message />
<br /><br />Yes, I have tried turning it off and on.
Offline
Re: [SOLVED] Strange website behavior, possibly malware
somewhere in your code you have txp:message, a tag which does not exist. Maybe you need to change it to <txp:comment_message />. Also don’t worry re the warnings, they’ll go away once you put it back to live mode.
Yiannis
——————————
NeMe | hblack.art | EMAP | A Sea change | Toolkit of Care
I do my best editing after I click on the submit button.
Offline
Re: [SOLVED] Strange website behavior, possibly malware
sure enough—that did it!
I guess this broke when I upgraded to 4.4.1 — the txp:message was supported in an older version of TXP, and I’ve got the original forms. Guess I need to read the release notes more closely.
Thanks!
Yes, I have tried turning it off and on.
Offline