Site went down, is this due to a database error?

[10incher]

My site just went down and displays the following error message when I goto the admin section:

Warning: Unterminated comment starting line 39 in /home1/action/public_html/catalog/admin/includes/configure.php on line 39
Parse error: syntax error, unexpected 'XxxQ13a2s' (T_STRING) in /home1/action/public_html/catalog/admin/includes/configure.php(39) : eval()'d code on line 11
Warning: mysqli_connect(): (HY000/1045): Access denied for user ''@'localhost' (using password: NO) in /home1/action/public_html/catalog/admin/includes/functions/database.php on line 20
Unable to connect to database server!

when I goto the site page www.rewindtoys.ca it takes me to the default install page. My only recent change was to the stylesheet page and maybe an alias domain redirect change. Thinking its a database issue maybe with my webhost. Any idea what may have happened?

[Demitry]

Seems like your admin configuration file got hacked. That file should not have an eval() function and that is a common function that hackers use.

Compare that file to the same of a backup. After you resolve that issue, change your admin folder name and add htaccess password protection to that directory.

 

 

[10incher]

I replaced it with a stock backup file that I know is good, still same errors.

[Demitry]

Those errors are related to database connectivity. So, it is either the database name, username or password. And, from what it looks like, it's the password on line 39. Check to make sure that the username and password are the same in that configuration file as they are on your server.

The T_STRING error is usually a missing single quote, or an extra one. So, check that configuration file for any extra or missing single quotes, and specifically on line 39, which should be your database password.

Do the same in the catalog configuration file.

 

[10incher]

OK uploaded backups on both those files and now both ends are back up and running. Not sure what happened to those 2 files but all good now. Thanks bud!

[Demitry]

One or both likely got hacked. Most hackers are apprentices and hack for the fun and novelty of it. You are not completely out of the woods yet. Chances are that this one will be back to marvel at his/her work. 

That means you need to beef up security to protect those two files and the rest of your site. 

You should also use a comparison tool and compare your site today to a recent backup. There may be other files altered.

And, run an online scan for malware and viruses. Your hosting company will do this for free as well. 

 

 

[Jack_mcs]

@10incherYou may want to install SiteMonitor.  It won't help you in this case but if your site was hacked and you can't find out why, it will help you identify what was changed the next time. That is important because if the hackers added files, you won't know it unless you just happen to identify the name as not being one of the shops.