It does not have to be an htaccess redirect hack or even a server hack.
Though there are other methods that can be employed, the code (as with any other type of malware hack) normally gets onto a site by an insecure extension or by using out of date (and thus insecure) core software.
Because this code can be within almost any file within a site and it is recommended that one follow the points below. Only by doing this can one be assured the code is truly removed form the site.
[ ] Run the Forum Post Assistant / FPA
Instructions available here
and are also included in the download package. Select the checkboxes for Show Components, Show Modules, Show Plugins before generating the forum code.
[ ] Ensure you have the latest version of Joomla
. Delete all files in your Joomla installation, saving a copy of the configuration.php file.
Replace the deleted files with fresh copies of a current full version of Joomla (minus the installation directory), and fresh copies of extensions and templates used. Upload the copy of your configuration file. Only by replacing all files in the installation (including extensions and templates) can you be sure to remove the backdoors inserted and hidden in files and directories
More detail can be found in the security Checklist 7 link below.
[ ] Review Vulnerable Extensions List
[ ] Review and action Security Checklist 7
to make sure you've gone through all of the steps.
[ ] Scan all machines with FTP, Joomla super admin, and Joomla admin access for malware, virus, trojans, spyware, etc.
[ ] Change all passwords and if possible user names for the website host control panel and your Joomla site.
[ ] Use proper permissions on files and directories. They should never be 777
, but ideal is 644 and 755
[ ] Check your htaccess for for any odd code (i.e. code which is not in the standard htaccess supplied as part of the Joomla installation).
[ ] Check the crontab or Task Scheduler for unexpected jobs/tasks.
[ ] Ensure you do not have anonymous ftp enabledNote: The forum post tool will work with 1.0.x, J1.6.x, J1.7.x, 2.5.x versions of Joomla.