My site was hacked- trying to get it back online

[ItsMeAgain66]

Hi All

My site was setup by an employee of mine back in 2008 with Joomla and it recently got hacked (last Saturday)

My hoster restored my site from a backup and it was all aok in its pre-hacked state. They changed my ftp password which seemed reasonable since we did not know if my pw was compromised.

My first step was to attempt to install a backup tool but when doing so within the admin console of Joomla i got a message saying "JFTP::login: Unable to login JFTP::store: Unable to use passive mode Warning! Failed to move file." I figured OK So i had been able to install the "connector" to do the Joomla audit but that was prior to having my ftp pw changed. I read on here that I was to go to the Joomla admin page and then to Global Configuration then I changed the password to match the new pw. At this point i now have no access to my site and no access to the admin page.

I noted that the file called configuration.php had a file size of ZERO and there was another file called configuration.php-dist and read where the only thing needed to do was rename the configuration.php-dist to configuration.php but guess what no good..

With the Configuration.php (file size sero) originally Configuration.php-dist in place I get "No configuration file found and no installation code available. Exiting..." and with the Configuration.php (file size 3411) I get "Database Error: Unable to connect to the database:Could not connect to MySQL" Further research told me that others were having a similar problem ( here: http://forum.joomla.org/viewtopic.php?t=265091 ) and their fix was to edit the configuration.php with the proper db, user and pw but opening the configuration.php in notepad I have none of those fields available much less so i can't fix them.

Thinking this shouldn't be terribly hard to resolve but i am missing something...

Thank you in advance for any ideas you may have

[ItsMeAgain66]

I was able to get the site restored from a backup again so it is back at 1.5.22

It seems there is no direct patch to go from 1.5.22 to 1.5.26?

Thinking it should be upgraded before the site gets hacked again

[imanickam]

You could use the file Joomla_1.5.0_to_1.5.26-Stable-Patch_Package.zip for this. This file could be downloaded from http://joomlacode.org/gf/project/joomla ... ge_id=6311.

Review of the document http://docs.joomla.org/J1.5:Upgrading_1 ... 5x_version could be of help.

[mandville]

follow the post hack process at http://docs.joomla.org/Security_Checklist_7