Topic on Project:Support desk

I need help with my mediawiki.

6 comments • 10:42, 8 August 2020 3 years ago

6

70.95.232.66 (talkcontribs)

I have a site called bookofrealms.com

I keep getting a slew of header errors and my hosting provider keeps telling me I was attacked by malware bots. They want to charge me $300 to fix it. I don't want to pay that so I'm trying to fix this myself.

These are the errors:

Warning: Cannot modify header information - headers already sent by (output started at /home3/sully/public_html/bookofrealms.com/index.php:4) in /home3/sully/public_html/bookofrealms.com/includes/WebStart.php on line 35

Warning: Cannot modify header information - headers already sent by (output started at /home3/sully/public_html/bookofrealms.com/index.php:4) in /home3/sully/public_html/bookofrealms.com/includes/libs/HttpStatus.php on line 112

Warning: Cannot modify header information - headers already sent by (output started at /home3/sully/public_html/bookofrealms.com/index.php:4) in /home3/sully/public_html/bookofrealms.com/includes/WebResponse.php on line 46

I cannot figure out for the life of me what is going on wrong here. I made sure the <?> was correct on the local settings file and I just can't figure out what else to do here. Please help me as this private wiki is very important to me. thanks.

23:19, 5 August 2020 3 years ago

Bawolff (talkcontribs)

the error probably means that index.php was modified. If your server was compromised, index.php was possibly modified to serve malware.

If you were attacked by malware, generally you should do the following:

Take a backup of everything for reference. include both db and filesystem

Try and figure out how it happened (apache access logs can be helpful). Otherwise you will just get compromised again.

Delete the server. This is to get rid of any backdoors the attacker may have installed.

Make a new server. Reinstall mediawiki and extensions (from official sources not from your backup. Use your backup only for the database, uploaded images and LocslSettings.php. verify that LocalSettings.php hss nothing suspicious in it)

Check that it all works.

00:11, 6 August 2020 3 years ago

70.95.232.66 (talkcontribs)

Thank you!

03:44, 6 August 2020 3 years ago

70.95.232.66 (talkcontribs)

Im on a shared hosting account though. I cant delete the server.

03:45, 6 August 2020 3 years ago

Bawolff (talkcontribs)

in that case i would consider terminating your account and starting a new one (that way you know for sure any backdoors are gone. Be sure to backup all data including dbs before doing this).

Failing that, deleting all files is probably good enough. Or at least all files (including dotfiles) in your public_html directory (if your host allows crontabs, ensure nothing evil in there)

07:24, 6 August 2020 3 years ago

70.95.232.66 (talkcontribs)

thank you. You've been extraordinarily helpful.

09:18, 7 August 2020 3 years ago