[SOLVED] Desperately need help :( Cannot redeclare xmail() refers to comprofiler default_language.php

2 days ago I discovered my Joomla 1.5.26 (yes, I know and I will be updating soon) had been hacked. The site loads blank white pages.

I cleaned up the hacked files, paid Sucuri Security to scan and deep clean and they see no errors or 'damaged files' to warrant the problem that continues. My site is loading blank white and not responding on front or back end.

The ONLY error generating (my error_logs come up with nothing at my web hosting provider) is this:

Fatal error: Cannot redeclare xmail() (previously declared in <span>/</span>home<span>/</span>MYSITE/public_html/connect/administrator/components/com_comprofiler/comprofiler.class.php:1) in <span>/</span>home<span>/</span>MYSITE/public_html/connect/components/com_comprofiler/plugin/language/default_language/default_language.php on line 1

I am stuck with a paid membership site that will not load for 48+ hours now and without access to my admin area, I have no idea where to go from here.

Any help with this error message would be very much appreciated.

[MOD EDIT]: Please don't post compromised files here...

I'm getting somewhere!!!
I opened the two files in question (see attachments) and discovered extraneous code way way over to the right on line #1 of both files.

After removing that and re-loading my site, the next error was:


in home/MYSITE/public_html/connect/components/com_uddeim/uddeim.api.php on line 60

line 60 reads:

So I am still stuck now and frantic as the site is down (blank pages, nothing will load at all) for going on day 3. I have members wanting access and management extremely upset.

If your site was hacked you need to find out how is was done and then restore things to how they were before the hack and then close the door (once you figure out how it was hacked).

This involves parsing your access logs to find out how your site was hacked.

Hackers usually leave code here and there so they can visit again your restored site and hack it again.

If you are not able to do all of this you need to find someone that does.

There are many specialists that offer such services over the internet.

fix.myjoomla.com/

is just one recommendation.

Sorry I could not be more helpful here.

Hi Nant, and thanks ... but I paid Sucuri Security to scan and clean and harden the site.
I'm digging in myself with debug mode on and cleaning out a few additional items.

Now the error is:

Fatal error: Call to undefined function uddeIMloadLanguage() in <span>/</span>home<span>/</span>MYSITE/public_html/connect/components/com_uddeim/uddeim.api.php on line 60

And a few other issues regarding loading the language files. I have no access to my admin panel so am trying to find help to do this via ftp and phpmyadmin.

How can I reinstall to overwrite these files please?

Re-install all your Joomla extensions on top of one another then do the same for your CB plugins. Your site was compromised. Scanned doesn't mean fixed as core files were likely modified.

Thanks. Scanned does mean fixed when you pay Sucuri Security to clean it up And they did (though I did find a few additional items which I sent to you here). All is well now, site is back up without reinstalling Joomla or CB -- there was a damaged uddeIM file that I replaced.

I have another issue but will put that in its own thread.

Thanks for the help!