The Joomla! Forum ™

Hi - I got a site which got Malwared - I followed all the security proceedures I could (shared host, couldn't find mods, plugins, components etc)

Does this look like I got most/all of it?

%%%%%%%%%% was my username

Thanks

Hi - I haven't experienced this before, and I thought I had followed all the steps required, and used Forum Post Assistant... did I post wrong information or follow incorrect forum procedure?

You are the victim of the htaccess hacking making the rounds. There is a thread in both this forum and the 2.5 forum detailing more on it.

You will need to follow the info below. Make sure you follow all of it and make sure there are no insecure or out of date extensions being used.

_________________
PhilD -- Unrequested PM's and/or emails may not get a response.
Security Moderator

Thanks Phil... I just updated the last few extensions and have followed the other points, so fingers crossed.... the only thing I can't do is check other admins machines, but I have emailed them to check.... and password protected administrator area so they have to ask me to for logins... then I can track the person if this is the cause.

I forgot that my htaccess was compromised too - Reading through that thread now

Is it worth removing unused templates?

Probably should have done the htaccess first or in conjunction with the other cleaning. Make sure to delete anything within the Joomla /tmp directory. Make sure to delete any htaccess files found to have the added code. It is hidden to the very far right at both top and bottom. also make sure there is no htaccess file residing outside of your public_html directory. There is generally a hacked one hiding there also. There is no valid reason to have an htaccess file outside of a public_html area so any there are probably hacked ones.

At this point, I would just make sure you find all the htaccess files that are compromised (look in the root of the major directories such as public_html, above the public_html directory, the administrator directory, images directory etc.) and fix or delete them as the case warrants.

I would delete any template you do not use. Especially 3rd party ones. Deleting the default ones is up to you, but I sometimes delete those if I am not using them and I sometimes leave them.

Also uninstall and delete the directories associated with any extension you do not use. May extensions when uninstalled leave a directory in both the front end and in the administrator directory areas with at least some (if not all) files. These can possibly be used later to hack a site.

_________________
PhilD -- Unrequested PM's and/or emails may not get a response.
Security Moderator

Thank you PhilD , my site got Malwared too and i removed some htaccess that was hidden , and uninstalled all templates that i dont use , and now its perfect

_________________
A Joomla games website http://www.jeuxgratuitflash.com
http://www.jeuxgratuitflash.com/les-jeux-en-3d.html

I do not believe it is perfect since you have not followed all steps as outlined to make sure all is clean. You need to follow all steps since you can be assured that you have hidden scripts elsewhere as well

Leo

_________________
--- Joomla Professional Support Services :: http://gws-desk.com ---
--- Joomla Professional and Specialized Hosting :: http://gws-host.com ---
--- Ready to Roll Joomla! Web Sites : 1 - 7 days only! :: @ gws-market.com ---

Hankin - please do not hijack topics. Start your own topic.

topic locked due to no response from original poster -see viewtopic.php?f=432&t=509319

_________________
HU2HY- Poor questions = Poor answer
Un requested Help PM's will be added to the foe list and possibly just deleted
{Community.Connect Administrator }{ Showcase & Security Moderator}