Error on web site "#32f02e# if(empty($hmdx)) {$hmdx = "";ec"

We are running Version 1.4.9.3. If you see http://www.littlegemstoys.com.au/ you will see coding We are unable to login via the Admin page. http://www.littlegemstoys.com.au/admin/ I thought it may have been hacked, but files look okay. The only other thing is maybe the host site has upgraded their server?

Can anyone point me in the write direction to fix this?

Thanks

Andrew

Your code is compromised aka you're hacked.

Check you file permissions and restore your files from a backup.

Back up database first. You cannot merely overwrite everything with a known good backup. For example, anything odd in /download/ will still be there, and any malicious .php or other files having their own names will not be overwritten. Find and delete those, look at timestamps. You can wipe 'er out and replace 'er, or you can overwrite what belongs and destroy what does not belong. For example, this actual bad file with a weird name, executable YbTVjBRr.php, will not be overwritten and must be deleted. If you see a seemingly benign executable default.php among OC files, delete it; not benign, start looking for and deleting other oddments. Lacking a backup but having your database, you still have the option of using a genuine OC .zip for your version. Check your permissions, directories 755, files 644, and ensure that if you correct them such as from 777, they stay corrected. See PM.

Nothing in that is caused by the server. For example, "#32f02e#" stripped of the right-hand # is a color code. It was, as i2Paq immediately and succinctly indicated, hacked.

See also this for some of the extent of hacking: http://forum.opencart.com/viewtopic.php?f=20&t=98644 all the way through to http://forum.opencart.com/viewtopic.php ... 60#p431729