The following comment fragment appears to be popping up at the top of every page of the local government page I'm administrating:

Fragment in action

The site runs of the Joomla! framework, and I've gone through the header sections of each page and found nothing amiss. A quick Google search of

'";} /*B6D1B1EE*/ ?>' 

reveals that I'm not alone in experiencing this problem:

Google Search results, showing several pages that contain this string

I'm surprised that I've never heard of this before. If you have any ideas on what might be causing this and how I might go about fixing it, they would be much appreciated.

  • Just an aside, I have had strings like that show up in php code in Wordpress and is usually something for a cookie to check and evaluate. In my case, it was for malicious coding used for a pharma hack. They embed code deep into your site and you might need to do a deep clean. Might be worth checking. Like I said, just a thought. – semaj0 Dec 2 '16 at 14:46

For some reason PHP code is being sent to the browser. It may be that PHP is not enabled n that server but that page contains some. It could be short tags are used but the server has not enabled it. It could be poorly written code. But you need to get to the source code to find the ultimate root cause.

| improve this answer | |
  • John, he's running joomla so I'm guessing php is enabled. Why do you say that's php code? – Abu Nooh Aug 29 '16 at 15:54
  • Between the comments and closing PHP tag I'd say it's a good match for PHP. – John Conde Aug 29 '16 at 16:43
  • I cannot read the comment you left for me, as the post as been deleted. You can meet me in chat.stackexchange.com/rooms/11540/charcoal-hq to discuss, that would be easier and that is the place from where I review potential spam. – user61554 Sep 2 '16 at 11:49

As a workaround you could delete the ";} /*B6D1B1EE*/ ?> snippet from the index.php file contained in your template folder.

More information could be found for the same issue here:

It could be that sites running a 1.5 version of Joomla were hacked.

| improve this answer | |

It looks like Joomla 1.5 websites without the Session Hardening and File Upload Security patches are being hacked.

These patches can be found at: https://docs.joomla.org/Security_hotfixes_for_Joomla_EOL_versions

According to MiscCoder at http://forum.joomla.org/viewtopic.php?t=933020#p3425599 clean up involves removing the file at /modules/mod_stat/statXXX.php, deleting files in the /tmp folder and cleaning up the files with "B6D1B1EE" in them although I haven't been able to verify this yet.

I'd be inclined to run a security audit using a commercial service such as myjoomla.com or sucuri.net or similar to double check all compromised and modified files have been identified and fixed.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.