XF 2.3 Overnight Gremins hit our website

Snoopjiggyjigg · Jan 11, 2025

Yesterday night, Gremlins hit our forum.

the post reply and starting box went missing, images disappeared and all kinds of strange things started happening. We then tried to upgrade to the latest software which looked to have solved some of the stuff - but that doesn't happen.

Sometimes when I go to the site it takes me to this website address https://www.theevertonforum.co.uk/login_up.php

I tried turning off all of the addons and I now can't turn them back on as it's not processing - so we also have template errors.

It's a mess!!!

We tried turning off proxy for cloudflare and restarting server services. We tried rolling back to old backups of the server. Nothing has worked. I am assuming I have some malicious code somewhere.

I'm not the most technical - can anyone advise anything?

Alpha1 · Jan 11, 2025

Snoopjiggyjigg said:
I'm not the most technical - can anyone advise anything?

Get help from someone who has the required skillset. Maybe @MySiteGuy or @MattW can help.

ForumDevs · Jan 11, 2025

Snoopjiggyjigg said:
Yesterday night, Gremlins hit our forum.

the post reply and starting box went missing, images disappeared and all kinds of strange things started happening. We then tried to upgrade to the latest software which looked to have solved some of the stuff - but that doesn't happen.

Sometimes when I go to the site it takes me to this website address https://www.theevertonforum.co.uk/login_up.php

I tried turning off all of the addons and I now can't turn them back on as it's not processing - so we also have template errors.

It's a mess!!!

We tried turning off proxy for cloudflare and restarting server services. We tried rolling back to old backups of the server. Nothing has worked. I am assuming I have some malicious code somewhere.

I'm not the most technical - can anyone advise anything?

I offered my help but the XF staff removed my post, stating “This is the troubleshooting forum, not a paid requests forum,” even though I never mentioned anything about paid services.

It's very difficult to troubleshoot these kinds of issues through posting because it’s usually a back-and-forth process so taking into account the previous post was approved I've sent a private message to this member offering our help.