The Joomla! Forum ™

Hrmm.. no replies at all...

in any case, I am bringing the topic back to life because not a month after cleaning the site completely, the security checks report my site as being infected with trojans again. I have followed the steps to completely clean the site exactly, and here I am again...

Sucura reports:

Description: Web site identified with Blackhat SEO Spam. This often means that it was hacked and the attackers inserted links to their own sites to increase their page rank on search engines.



Any ideas on what to do?
Thank you!

Check if your FTP/SSH credentials are compromised. Ask your webhost to run a file system check. Try to get the actual logged files that are generating the reports.

If the case seemed hopeless, I would pay Sucuri to clean the site from malware for one year. I think it costs 90 USD. Then I would install the security extension eyesite that checks the site for new or changed files. With such a tool Sucuri would not be needed after a year.

http://www.lesarbresdesign.info/extensions/eyesite

@Slackervaara
Are you affiliated with EyeSite? You sure promote the use of it heavily.

@In general
The use of extensions for security will not keep your site safe from hacks, prevent them from occurring, relieve one from taking proper security measures, or applying security updates to keep extensions and Joomla secure. Many illicit ways into a site will never invoke any response from Joomla, any extension, or even be detected as anything other than a legitimate request. Depending upon how the hack is crafted and what weak spot is used for the exploit the hack may even bypass added password (htpasswd) protection on the administration directory.

@NiksaVel
When you cleaned your site did you also look for added subdomains, added cron jobs, anonymous ftp access, added ftp users, and anything such as added files outside of the public_html area that should not be there (a copy of a hacked htaccess file is a common one)?

The way many hacks work and look to an antivirus scan; they will not be picked up by an antivirus scan of a directory so manually looking within the directory is best. Won't take that long unless you have 46,000 files in one directory.

I would make sure your extensions, plugins etc are up to date and you are not using any versions that appear on the VEL http://docs.joomla.org/Vulnerable_Extensions_List

Do not keep any site backups within a public area and remove any extra files you don't need.

You can set up a cron job with results to be emailed to the account owner with the command listed under chmod and cron in the checklist 7
http://docs.joomla.org/Security_Checkli ... d_and_cron
It is the paragraph that begins with "To check for recent file changes within the last day on your system...." It is very effective in detecting changes and added files. The drawback is cache files get included, but you have to scan the cache directory for added files anyway as it is a somewhat common place to put hack files.

_________________
PhilD -- Unrequested PM's and/or emails may not get a response.
Security Moderator