Malware warning and site down

Discussion regarding Joomla! 1.5 security issues.
Joomla! Vulnerable Extensions: http://feeds.joomla.org/JoomlaSecurityV ... Extensions

Moderator: General Support Moderators

Forum rules
Forum Rules
Absolute Beginner's Guide to Joomla! <-- please read before posting, this means YOU.
Security Checklist
Forum Post Assistant - If you are serious about wanting help, you will use this tool to help you post.
Locked
Tom1884
Joomla! Fledgling
Joomla! Fledgling
Posts: 2
Joined: Tue Sep 16, 2014 2:01 pm

Malware warning and site down

Post by Tom1884 » Tue Sep 16, 2014 2:07 pm

My site here: [url]http://www.calciofiesso.%201957.it[/url] is down (home not uploading) and Google (and other browser) has a malware warning for it. What's the problem?

Here pics of the root directory that seems strange to me...
Image
Image
Image
Last edited by mandville on Tue Sep 16, 2014 6:48 pm, edited 1 time in total.
Reason: broke link

Surroundx
Joomla! Intern
Joomla! Intern
Posts: 60
Joined: Tue Sep 17, 2013 11:20 am
Location: Western Australia
Contact:

Re: Malware warning and site down

Post by Surroundx » Tue Sep 16, 2014 2:26 pm

Google says that your site has been hacked. Unless you know exactly what to do, you should seek professional advice/help.

Tom1884
Joomla! Fledgling
Joomla! Fledgling
Posts: 2
Joined: Tue Sep 16, 2014 2:01 pm

Re: Malware warning and site down

Post by Tom1884 » Tue Sep 16, 2014 2:34 pm

I'm a professional, but without experience for Joomla. May you have any idea of what to do? An hint?
The site is recoverable?

Surroundx
Joomla! Intern
Joomla! Intern
Posts: 60
Joined: Tue Sep 17, 2013 11:20 am
Location: Western Australia
Contact:

Re: Malware warning and site down

Post by Surroundx » Tue Sep 16, 2014 2:56 pm

Tom1884 wrote:I'm a professional, but without experience for Joomla. May you have any idea of what to do? An hint?
The site is recoverable?
Unfortunately I'm not that experienced with Joomla myself. I would suggest waiting for a Joomla professional to come online. However, these links may also be of interest to you:

http://docs.joomla.org/Security_Checkli ... or_defaced
http://docs.joomla.org/Security_Checklist/Site_Recovery
http://www.inmotionhosting.com/support/ ... r-security

User avatar
Per Yngve Berg
Joomla! Master
Joomla! Master
Posts: 30814
Joined: Mon Oct 27, 2008 9:27 pm
Location: Romerike, Norway

Re: Malware warning and site down

Post by Per Yngve Berg » Tue Sep 16, 2014 5:46 pm

Mod. Note: Relocated the topic to the Security Forum.

crusonweb
Joomla! Apprentice
Joomla! Apprentice
Posts: 8
Joined: Sun Sep 07, 2014 10:47 pm
Location: Albany, NY
Contact:

Re: Malware warning and site down

Post by crusonweb » Tue Sep 16, 2014 9:03 pm

There are several files in that image that I am sure are part of the problem. However, the bigger issue is there may be root scripts that are likely creating those. You need to hunt those down and the only sure fire way I have found to do that is run a search through the command line for some value. Usually it is either a value in one of the created files or something that you can see through the source code on the front end.

User avatar
dpacadmin
Joomla! Champion
Joomla! Champion
Posts: 6029
Joined: Sat Aug 16, 2008 1:46 pm
Location: the Bat Cave
Contact:

Re: Malware warning and site down

Post by dpacadmin » Wed Sep 17, 2014 12:20 am

I see many 0kb files in your list, those are hack files or site files that have been emptied.
Read through the sticky posts at the top of this Security forum for more info on cleaning your site.
Do you have a backup know to be safe, if so empty your site and then upload the backup, do the same with your database. Check for any cron jobs added to the site in the cPanel, change all your passwords.


Locked

Return to “Security in Joomla! 1.5”