[Forum] Urgent problem: Blank pages except for modcp and admincp login pages

[eam]

Some time last night my site started producing blank or empty pages. I was notified of the problem today by a moderator. He said that the iOS app (Forum Runner) is working fine but the pages aren't displaying. I looked it over and found that the admincp and modcp login pages are loading just fine, but nothing else is. It doesn't appear to be timing out; the page loads blank immediately. After logging in to the admincp or modcp a blank page is produced. The URL is http://www.thecomicboard.com

I have not made any changes whatsoever to the site in the time before this started happening (no one else has either). In fact, I didn't even log in to the site yesterday.

I have a number of variations of this in the server error log:

[26-Dec-2013 02:39:32 America/New_York] PHP Fatal error: Cannot redeclare ty() (previously declared in /home/smackbom/public_html/thecomicboard/index.php(1) : eval()'d code(2) : eval()'d code(1) : eval()'d code:1) in /home/smackbom/public_html/thecomicboard/forum/global.php(1) : eval()'d code(2) : eval()'d code(1) : eval()'d code on line 1
[26-Dec-2013 02:39:54 America/New_York] PHP Fatal error: Cannot redeclare ty() (previously declared in /home/smackbom/public_html/thecomicboard/forum/showthread.php(1) : eval()'d code(2) : eval()'d code(1) : eval()'d code:1) in /home/smackbom/public_html/thecomicboard/forum/global.php(1) : eval()'d code(2) : eval()'d code(1) : eval()'d code on line 1
[26-Dec-2013 02:40:34 America/New_York] PHP Fatal error: Cannot redeclare ty() (previously declared in /home/smackbom/public_html/thecomicboard/forum/external.php(1) : eval()'d code(2) : eval()'d code(1) : eval()'d code:1) in /home/smackbom/public_html/thecomicboard/forum/global.php(1) : eval()'d code(2) : eval()'d code(1) : eval()'d code on line 1
[26-Dec-2013 02:41:50 America/New_York] PHP Fatal error: Cannot redeclare ty() (previously declared in /home/smackbom/public_html/thecomicboard/index.php(1) : eval()'d code(2) : eval()'d code(1) : eval()'d code:1) in /home/smackbom/public_html/thecomicboard/forum/global.php(1) : eval()'d code(2) : eval()'d code(1) : eval()'d code on line 1
[26-Dec-2013 02:41:55 America/New_York] PHP Fatal error: Cannot redeclare ty() (previously declared in /home/smackbom/public_html/thecomicboard/index.php(1) : eval()'d code(2) : eval()'d code(1) : eval()'d code:1) in /home/smackbom/public_html/thecomicboard/forum/global.php(1) : eval()'d code(2) : eval()'d code(1) : eval()'d code on line 1
[26-Dec-2013 02:42:03 America/New_York] PHP Fatal error: Cannot redeclare ty() (previously declared in /home/smackbom/public_html/thecomicboard/forum/external.php(1) : eval()'d code(2) : eval()'d code(1) : eval()'d code:1) in /home/smackbom/public_html/thecomicboard/forum/global.php(1) : eval()'d code(2) : eval()'d code(1) : eval()'d code on line 1
[26-Dec-2013 02:43:00 America/New_York] PHP Fatal error: Cannot redeclare ty() (previously declared in /home/smackbom/public_html/thecomicboard/forum/showthread.php(1) : eval()'d code(2) : eval()'d code(1) : eval()'d code:1) in /home/smackbom/public_html/thecomicboard/forum/global.php(1) : eval()'d code(2) : eval()'d code(1) : eval()'d code on line 1
[26-Dec-2013 02:43:46 America/New_York] PHP Fatal error: Cannot redeclare ty() (previously declared in /home/smackbom/public_html/thecomicboard/forum/external.php(1) : eval()'d code(2) : eval()'d code(1) : eval()'d code:1) in /home/smackbom/public_html/thecomicboard/forum/global.php(1) : eval()'d code(2) : eval()'d code(1) : eval()'d code on line 1
[26-Dec-2013 02:45:04 America/New_York] PHP Fatal error: Cannot redeclare ty() (previously declared in /home/smackbom/public_html/thecomicboard/forum/external.php(1) : eval()'d code(2) : eval()'d code(1) : eval()'d code:1) in /home/smackbom/public_html/thecomicboard/forum/global.php(1) : eval()'d code(2) : eval()'d code(1) : eval()'d code on line 1
[26-Dec-2013 02:45:29 America/New_York] PHP Fatal error: Cannot redeclare ty() (previously declared in /home/smackbom/public_html/thecomicboard/forum/external.php(1) : eval()'d code(2) : eval()'d code(1) : eval()'d code:1) in /home/smackbom/public_html/thecomicboard/forum/global.php(1) : eval()'d code(2) : eval()'d code(1) : eval()'d code on line 1
[26-Dec-2013 02:45:29 America/New_York] PHP Fatal error: Cannot redeclare ty() (previously declared in /home/smackbom/public_html/thecomicboard/forum/external.php(1) : eval()'d code(2) : eval()'d code(1) : eval()'d code:1) in /home/smackbom/public_html/thecomicboard/forum/global.php(1) : eval()'d code(2) : eval()'d code(1) : eval()'d code on line 1
[26-Dec-2013 02:47:23 America/New_York] PHP Fatal error: Cannot redeclare ty() (previously declared in /home/smackbom/public_html/thecomicboard/forum/showthread.php(1) : eval()'d code(2) : eval()'d code(1) : eval()'d code:1) in /home/smackbom/public_html/thecomicboard/forum/global.php(1) : eval()'d code(2) : eval()'d code(1) : eval()'d code on line 1
[26-Dec-2013 02:47:31 America/New_York] PHP Fatal error: Cannot redeclare ty() (previously declared in /home/smackbom/public_html/thecomicboard/index.php(1) : eval()'d code(2) : eval()'d code(1) : eval()'d code:1) in /home/smackbom/public_html/thecomicboard/forum/global.php(1) : eval()'d code(2) : eval()'d code(1) : eval()'d code on line 1
[26-Dec-2013 02:49:36 America/New_York] PHP Fatal error: Cannot redeclare ty() (previously declared in /home/smackbom/public_html/thecomicboard/index.php(1) : eval()'d code(2) : eval()'d code(1) : eval()'d code:1) in /home/smackbom/public_html/thecomicboard/forum/global.php(1) : eval()'d code(2) : eval()'d code(1) : eval()'d code on line 1
[26-Dec-2013 02:49:39 America/New_York] PHP Fatal error: Cannot redeclare ty() (previously declared in /home/smackbom/public_html/thecomicboard/forum/external.php(1) : eval()'d code(2) : eval()'d code(1) : eval()'d code:1) in /home/smackbom/public_html/thecomicboard/forum/global.php(1) : eval()'d code(2) : eval()'d code(1) : eval()'d code on line 1
[26-Dec-2013 02:49:46 America/New_York] PHP Fatal error: Cannot redeclare ty() (previously declared in /home/smackbom/public_html/thecomicboard/index.php(1) : eval()'d code(2) : eval()'d code(1) : eval()'d code:1) in /home/smackbom/public_html/thecomicboard/forum/global.php(1) : eval()'d code(2) : eval()'d code(1) : eval()'d code on line 1

A Google search for "Cannot redeclare ty()" didn't appear to turn up anything. I have checked and do not see any obvious signs of being hacked, and modification date of the files and folders of my site are not recent.

I am in a shared hosting environment so access to many server settings are limited or restricted. But again the site has been working fine for months now.

Some info:

1. vBulletin Version - 4.2.2 (I believe; I can't log in to double check)
2. PHP Version - 5.4.21
3. MySQL Version - 5.5.34cll
4. Any Addons installed - Forum Runner & Tapatalk, but no changes have been made or new add ons installed prior to error
5. Does the issue occur in a default style? - Yes
6. Error message on the screen' - None; pages are blank
7. Browser and Browser version used. - Tested in Safari 7 and various versions of Firefox and Chrome
8. A list of steps that can be used to recreate the issue. - Visit any page of the site except admincp or modcp

[donald1234]

Can you post the first few lines of your forum.php file?

Looks similar to this.

http://www.vbulletin.com/forum/forum/vbulletin-4/vbulletin-4-questions-problems-and-troubleshooting/4012392-help-both-forum-and-admin-panel-just-show-white-page

[Mark.B]

Have a read through THIS post in the first instance.

[eam]

Thanks for the responses.

Yes - I am compromised. Both forum.php and index.php begin with <?php eval(base64_decode(" etc.

What are the steps to fix this? Obviously I will upload fresh vB files but that won't take care of the new files such as image.php (which I do have) will it? How do I find all of those? Are there other steps that must be taken?

Also is there a way to tell if a plugin is compromised? I have a couple others besides the ones I listed but since I cannot log in I can't see a complete list.

[Mark.B]

All he steps are in the post I linked to, follow each and every one and this will secure your site.
It's important not to miss any out.

Information on how to check for compromised plugins is HERE.

[eam]

I understand, but I'm not sure how to look for/discover new files. If I'm just re-uploading the site files it's not going to eliminate new files...?

[Mark.B]

You're confusing plugins with files.

You can check for both rogue plugins and new files AFTER you have regained access to the AdminCP by following the first set of instructions.
AdminCP > Diagnostics > Suspect File Versions

[eam]

You're confusing plugins with files.

You can check for both rogue plugins and new files AFTER you have regained access to the AdminCP by following the first set of instructions.
AdminCP > Diagnostics > Suspect File Versions

Got it - thanks.

[eam]

Alright, I think I got everything. Thanks again for the reply.

Is there a reason Suspect File Versions would say that forum.php isn't recognized as part of vBulletin?

[BirdOPrey5]

Is forum.php in your root folder? If it was moved/accidentally copied to a different folder it wouldn't be recognized.

Please also be sure you checked your customavatar and olther folders that save uplaoded files, make sure there are no .php files in them, if there are they are likely backdoors. Check out this link for a good way to secure these folders- http://vbtechsupport.com/2355/10/

[eam]

Is forum.php in your root folder? If it was moved/accidentally copied to a different folder it wouldn't be recognized.

Please also be sure you checked your customavatar and olther folders that save uplaoded files, make sure there are no .php files in them, if there are they are likely backdoors. Check out this link for a good way to secure these folders- http://vbtechsupport.com/2355/10/

forum.php is in the root of my forum, which is not in the root of my site. It is forum/forum.php

[BirdOPrey5]

Then I really don't know- On occasion I have seen it say file doesn't contain expected contents even when it does. I would give the files a quick glance, as long as it looks OK I wouldn't concern yourself too much about it. Look at the file from the original download package on your computer so you know what it should look like on your server.