@gcasanova I recently experienced something like this with a site I manage (another CMS), it had been hacked.

Please, check the file plugins/socialbuttons_plugin/_socialbuttons.plugin.php. Line 1 is not supposed to contain any code different than the PHP open tag (<?php).

Thanks for your reply @mgsolipa
I'm attaching the plugins code, it doesn't seem altered (at the beginning) to me...

Attachement...

• social.txt (28 KB)

@gcasanova yes, it is altered. Look that right before the <?php tag, are a couple of weird characters ?. Get rid of them and the problem will be solved.

Now, this gives us more questions, how did those characters came to that place? And maybe more important, are there more altered files in your site, with malicious code instead of just garbage like this one?

Maybe you should tell this to your hosting provider to get some hints. Also, downloading the entire site and scanning it with an anti-virus should be useful to make sure (at least in a basic level) that everything is ok.

@mgsolipa I don't see those characters on my side... Could it be that they were added to the text I attached by my notepad software?

But I will download the entire site and check it with an antivirus, I will also alert the hosting provider.

All right, now I get it. That charcaters are known as BOM (http://www.w3.org/International/questions/qa-byte-order-mark.en.php), so it's an encoding thing. Actually, that's why it is in the txt file but not in your online text editor.

If you have not made any change (download, upload, etc) in your site, and this just appeared suddenly, then it's a better idea to talk with the hosting provider, maybe they applied a change in the server that is now revealing an issue that wasn't there before.

My hosting provider informed me of possible hacked files but the one causing problems isn't listed by them.
They also told me that the only changes they've made are PHP updates... they have version: 5.4.30
I checked the possible hacked files and they're fine; not altered at all.
So, what could be the problem?

All right, lets try to solve the BOM issue. To make you a little context, please read the main answer given in this page: http://stackoverflow.com/questions/8028957/how-to-fix-headers-already-sent-error-in-php, specifically the section UTF-8 BOM.

Can you download the file plugins/socialbuttons_plugin/_socialbuttons.plugin.php and open it with Notepad++, or such an editor that lets you actually see the weird characters at the begining of the file? The idea is to delete them and reupload the file.

@mgsolipa I opened the file in Notepad++ but there are no strange characters before the opening tab.
I disbled the socialbuttons plugin meanwhile.
I also replaced the following files that were, as per the hosting provider, possibly hacked:

./....net/inc/tools/model/_system.funcs.php
./....net/inc/_ext/_zip_archives.php
./....net/inc/files/model/_file.class.php

I fixed the problem deleting the plugin and reinstalling it following instructions given in prior topics at this forum and the plugins section:

http://forums.b2evolution.net/topic-22512

and here

http://forums.b2evolution.net/social-buttons-please#c99766

I have no idea how the plugin got corrupted, might have been hacked or the upgrading of PHP version at my host provider did the damage... I guess I will never know.