Joomla! Discussion Forums

Hi, my website was hacked today, wasnt a big deal, I just asked the host to restore the lastest backup... Im writing this post because I dont want it to happen again. I have done several joomla wesbites and this is the first time this happens.

The curious fact is that I have other 3 websites hosted on the same account but the one affected was only one.

My theory is the following, Im using Image Vue Image Gallery as a standalone gallery for this website in a separate folder called "gallery", there was the malicious php file called "a.php", and as I also read in this forum one vulnerability on the expose gallery was related to the upload.php file on the admin part of the component, my theory also point to that fact, as Image Vue also has an upload.php file and a upload.js script.

The actions I took:
deleted a.php
stablished 744 access rigth to the folder gallery
stablished 000 access rigth to upload.php and upload.js as I dont use them to update the gallery

Is my theory rigth? did I took good actions? could this happen again despite of the actions I took? any suggestions?

Thank you in advance.

look for readme.php in the images/themes dir.

Unless you know when it happened you may be restoring the attack.

mladost13 -

There are a number of "stickies" in the security forum that you will want to review. The one to spend some time with is entitled You think You're site got hacked?  Read this first, please!!!. Hackwar, one of our Joomla! developers, has done a thorough job of outlining the steps and precautions you should take to protect yourself. It is well worth your time to explore.

I am sorry for your troubles. It is always disappointing to see that happen.

Kind regards,
Amy

The problem is resolved, my website is up again.

I dont use expose, I use Image Vue,  theres no images/themes directory.

I just wanted to know if my theory was correct, if the actions I took are ok and if those actions will prevent a future attack.

Thank you

c99madshell is a viable threat.

You are wise to report it.