Google search of my website show Japanese

[asaniom]

hi
yesterday when i search my website name on google i saw some weird Japanese characters

what should i do?

[pe7er]

It also states that "This site may be hacked".
See Security Checklist/You have been hacked or defaced: https://docs.joomla.org/Security_Checkl ... or_defaced

If you do not see any Japanese or Chinese characters on your website itself,
then the hackers probably modified the .htaccess in the root of your website,
so that it only feeds Japanese or Chinese spam to some specified search engines.

[asaniom]

It also states that "This site may be hacked".
See Security Checklist/You have been hacked or defaced: https://docs.joomla.org/Security_Checkl ... or_defaced

If you do not see any Japanese or Chinese characters on your website itself,
then the hackers probably modified the .htaccess in the root of your website,
so that it only feeds Japanese or Chinese spam to some specified search engines.

no i dont see any japanese character on my website .
i open htaccess. :
RewriteEngine On RewriteRule ^([0-9]+)\/([^\d\/]+)([0-9]+)&I.*=[0-9]+&.*=%([0-9]+)[0-9]+%([^\d\/]+)[0-9]+%([0-9]+)[0-9]+%(.*)[0-9]+%([0-9]+)[0-9]+%[0-9]+%([0-9]+)[0-9]+%(.*)F%([0-9]+)[0-9]+%[0-9]+%([0-9]+)([^\d\/]+)%[0-9]+([0-9]+)%([0-9]+)(.*)%[0-9]+&.*=&.*=[0-9]+&.*=.*..*&.*=.*&.*=[0-9]+$ ?$15$16=$17&%{QUERY_STRING}[L] RewriteRule ^([0-9]+)\/([^\d\/]+)([0-9]+)&I.*=[0-9]+&.*=%([0-9]+)(.*)%(.*)[0-9]+%([0-9]+)[0-9]+%[0-9]+%([0-9]+)[0-9]+%[0-9]+%([0-9]+)[0-9]+%([^\d\/]+)[0-9]+&.*=&.*=[0-9]+&.*=.*..*&.*=.*&.*=[0-9]+$ ?$11$1=$10&%{QUERY_STRING}[L] RewriteRule ^([0-9]+)\/([^\d\/]+)([0-9]+)&I.*=[0-9]+&.*=&.*=&.*=[0-9]+&.*=.*..*&.*=.*&.*=[0-9]+$ ?$2$1=$3&%{QUERY_STRING}[L] RewriteRule ^([0-9]+)\/([^\d\/]+)([0-9]+)&I.*=[0-9]+&.*=%([0-9]+)[0-9]+%([^\d\/]+)[0-9]+%([0-9]+)[0-9]+%([^\d\/]+)[0-9]+%([0-9]+)[0-9]+%(.*)E+%([0-9]+)(.*)%(.*)[0-9]+%([0-9]+)[0-9]+%[0-9]+&.*=&.*=[0-9]+&.*=.*..*&.*=.*&.*=[0-9]+$ ?$8$1=$15&%{QUERY_STRING}[L] RewriteRule ^([0-9]+)\/([^\d\/]+)([0-9]+)&I.*=[0-9]+&.*=%([0-9]+)[0-9]+%(.*)[0-9]+%([0-9]+)[0-9]+%([^\d\/]+)[0-9]+%([0-9]+)[0-9]+%([^\d\/]+)E%([0-9]+)[0-9]+%([^\d\/]+)[0-9]+%([0-9]+)[0-9]+%([^\d\/]+)[0-9]+%([0-9]+)[0-9]+%[0-9]+&.*=&.*=[0-9]+&.*=.*..*&.*=.*&.*=[0-9]+$ ?$15$1=$16&%{QUERY_STRING}[L] RewriteRule ^([0-9]+)\/([^\d\/]+)([0-9]+)%[0-9]+([0-9]+).*[0-9]+_.*%[0-9]+%[0-9]+P([0-9]+)[0-9]+.*H(.*).*ZXZ.*([0-9]+).*X[0-9]+([^\d\/]+)PU[0-9]+R.*MV[0-9]+.*O.*[0-9]+%[0-9]+([^\d\/]+)%[0-9]+%[0-9]+%[0-9]+%[0-9]+([^\d\/]+).*%[0-9]+%[0-9]+%[0-9]+([0-9]+)%[0-9]+([0-9]+)-%[0-9]+%[0-9]+([^\d\/]+)$ ?$25$24=$6&%{QUERY_STRING}[L] RewriteRule ^.*..*\/([0-9]+)\/([0-9]+)([^\d\/]+)\/.*\/([0-9]+)-.*-.*-.*-.*-\/.*$ ?$3$4=$2&%{QUERY_STRING}[L]

[asaniom]

fpa :

Joomla! Instance :: Joomla! 3.6.0-Stable (Noether) 12-July-2016
Joomla! Platform :: Joomla Platform 13.1.0-Stable (Curiosity) 24-Apr-2013
Joomla! Configured :: Yes | Writable (777) | Owner: cservcom (uid: 1/gid: 1) | Group: (gid: ) | Valid For: 3.6
Configuration Options :: Offline: 0 | SEF: 1 | SEF Suffix: 0 | SEF ReWrite: 0 | .htaccess/web.config: Yes | GZip: 0 | Cache: 0 | FTP Layer: 0 | SSL: 0 | Error Reporting: default | Site Debug: 0 | Language Debug: 0 | Default Access: 1 | Unicode Slugs: 0 | Database Credentials Present: Yes

Host Configuration :: OS: | OS Version: | Technology: | Web Server: Apache/2 | Encoding: gzip, deflate | Doc Root: /home/cservcom/domains/coursservice.ir/public_html | System TMP Writable: Yes

PHP Configuration :: Version: 5.4.35 | PHP API: fpm-fcgi | Session Path Writable: No | Display Errors: | Error Reporting: 22527 | Log Errors To: | Last Known Error: | Register Globals: | Magic Quotes: | Safe Mode: | Open Base: /home/cservcom/:/tmp/:/var/tmp/:/usr/local/php54/lib/:/usr/local/php54/lib/:/usr/local/php55/lib/:/usr/local/lib/php/ | Uploads: 1 | Max. Upload Size: 64M | Max. POST Size: 64M | Max. Input Time: 60 | Max. Execution Time: 30 | Memory Limit: 128M

MySQL Configuration :: Version: 5.5.31 (Client:mysqlnd 5.0.10 - 20111026 - $Id: c85105d7c6f7d70d609bb4c000257868a40840ab $) | Host: --protected-- (--protected--) | Collation: latin1_swedish_ci (Character Set: latin1) | Database Size: 8.10 MiB | #of Tables: 119

PHP Extensions :: Core (5.4.35) | date (5.4.35) | ereg () | libxml () | openssl () | pcre () | sqlite3 (0.7) | zlib (2.0) | bcmath () | calendar () | ctype () | curl () | dom (20031129) | fileinfo (1.0.5) | filter (0.11.0) | ftp () | gd () | gettext () | hash (1.0) | iconv () | intl (1.1.0) | json (1.2.1) | mbstring () | mcrypt () | SPL (0.2) | session () | standard (5.4.35) | mysqlnd (mysqlnd 5.0.10 - 20111026 - $Id: c85105d7c6f7d70d609bb4c000257868a40840ab $) | PDO (1.0.4dev) | pdo_mysql (1.0.2) | pdo_sqlite (1.0.1) | Phar (2.0.1) | posix () | Reflection ($Id: f6367cdb4e3f392af4a6d441a6641de87c2e50c4 $) | mysqli (0.1) | SimpleXML (0.1) | soap () | sockets () | mysql (1.0) | tokenizer (0.1) | xml () | xmlreader (0.1) | xmlwriter (0.1) | xsl (0.1) | zip (1.11.0) | cgi-fcgi () | mhash () | ionCube Loader () | Zend OPcache (7.0.3FE) | Zend Guard Loader () | Zend Engine (2.4.0) |
Potential Missing Extensions :: suhosin |

Switch User Environment (Experimental) :: PHP CGI: No | Server SU: No | PHP SU: No | Custom SU (LiteSpeed/Cloud/Grid): No
Potential Ownership Issues: Maybe

Core Folders :: images/ (755) | components/ (755) | modules/ (755) | plugins/ (755) | language/ (755) | templates/ (755) | cache/ (755) | logs/ (755) | tmp/ (755) | administrator/components/ (755) | administrator/modules/ (755) | administrator/language/ (755) | administrator/templates/ (755) |

Elevated Permissions (First 10) :: images/djmediatools/ (777) | modules/mod_djtabs/language/ (777) | plugins/djcatalog2/ (777) | plugins/djclassifieds/ (777) | plugins/djmediatools/ (777) | plugins/editors-xtd/djtabs/language/ (777) | plugins/jmonitoring/ (777) | plugins/system/ef4_jmframework/includes/assets/template/ (777) | plugins/system/ef4_jmframework/includes/assets/template/bootstrap/ (777) | plugins/xmap/ (777) |

Components :: SITE :: com_wrapper (3.0.0) | com_mailto (3.0.0) |
Components :: ADMIN :: com_content (3.0.0) | com_cpanel (3.0.0) | RSForm! (1.49.4) | com_admin (3.0.0) | Akeeba (4.2.0) | com_joomlaupdate (3.6.0) | com_search (3.0.0) | com_menus (3.0.0) | com_config (3.0.0) | com_tags (3.1.0) | com_djcatalog2 (3.2.4) | com_modules (3.0.0) | com_postinstall (3.2.0) | com_ajax (3.2.0) | com_contenthistory (3.2.0) | com_finder (3.0.0) | com_djmediatools (2.4.0) | com_media (3.0.0) | com_users (3.0.0) | com_banners (3.0.0) | com_cache (3.0.0) | com_messages (3.0.0) | com_dima_poll (3.2.0) | com_installer (3.0.0) | com_plugins (3.0.0) | com_weblinks (3.0.0) | com_categories (3.0.0) | com_login (3.0.0) | com_templates (3.0.0) | com_cool_map (1.0.0) | com_djtabs (1.2.3) | com_redirect (3.0.0) | com_newsfeeds (3.0.0) | com_checkin (3.0.0) | com_languages (3.0.0) |

Modules :: SITE :: mod_syndicate (3.0.0) | mod_footer (3.0.0) | mod_articles_archive (3.0.0) | mod_djc2search (1.3) | mod_users_latest (3.0.0) | JPro Hotspot Map (1.0) | mod_feed (3.0.0) | mod_custom (3.0.0) | mod_tags_similar (3.1.0) | mod_tags_popular (3.1.0) | mod_whosonline (3.0.0) | mod_stats (3.0.0) | DJ-MediaTools Album (2.1.1) | DJ-Tabs (1.2.3) | DJ-MegaMenu (2.1.0) | JA Image Hotspot (1.0.6) | mod_search (3.0.0) | mod_articles_categories (3.0.0) | mod_login (3.0.0) | mod_djc2filters (3.0) | mod_wrapper (3.0.0) | mod_breadcrumbs (3.0.0) | mod_djc2producers (2.4) | mod_djc2relateditems (3.2) | JMS Support Online (2.0) | mod_banners (3.0.0) | mod_languages (3.5.0) | mod_djc2items (3.1) | Cool Map (1.0.0) | mod_dima_poll (1.0.0) | mod_related_items (3.0.0) | mod_articles_popular (3.0.0) | FrescoChat (1.0) | mod_random_image (3.0.0) | mod_finder (3.0.0) | mod_weblinks (3.0.0) | mod_articles_category (3.0.0) | mod_djc2frontpage (3.0) | mod_articles_news (3.0.0) | mod_menu (3.0.0) | mod_articles_latest (3.0.0) | mod_djc2categories (3.0) |
Modules :: ADMIN :: mod_status (3.0.0) | mod_toolbar (3.0.0) | mod_feed (3.0.0) | mod_custom (3.0.0) | mod_latest (3.0.0) | mod_multilangstatus (3.0.0) | mod_title (3.0.0) | mod_quickicon (3.0.0) | mod_popular (3.0.0) | mod_version (3.0.0) | mod_login (3.0.0) | mod_stats_admin (3.0.0) | mod_logged (3.0.0) | mod_submenu (3.0.0) | mod_menu (3.0.0) |

Plugins :: SITE :: plg_captcha_recaptcha (3.4.0) | plg_xmap_com_djcatalog2 (1.3) | plg_editors_tinymce (4.3.12) | plg_editors_codemirror (5.15.2) | plg_quickicon_extensionupdate (3.0.0) | plg_quickicon_joomlaupdate (3.0.0) | plg_quickicon_djcatalog (1.0) | plg_editors-xtd_pagebreak (3.0.0) | plg_editors-xtd_djtabs (1.0.0) | plg_editors-xtd_image (3.0.0) | plg_editors-xtd_module (3.5.0) | plg_editors-xtd_djmediatools (2.0.0) | plg_editors-xtd_article (3.0.0) | plg_editors-xtd_readmore (3.0.0) | plg_djcatalog2_pagebreak (2.3) | plg_user_profile (3.0.0) | plg_user_joomla (3.0.0) | plg_user_contactcreator (3.0.0) | plg_system_djmegamenu (1.3.0) | plg_system_highlight (3.0.0) | Free Live Support Chat (1.0.0) | plg_system_remember (3.0.0) | plg_system_languagefilter (3.0.0) | plg_system_stats (3.5.0) | plg_system_debug (3.0.0) | plg_system_cache (3.0.0) | plg_system_updatenotification (3.5.0) | plg_system_languagecode (3.0.0) | plg_system_sef (3.0.0) | plg_system_ef4_jmframework (4.4) | plg_system_log (3.0.0) | plg_system_logout (3.0.0) | plg_system_redirect (3.0.0) | plg_system_p3p (3.0.0) | plg_twofactorauth_totp (3.2.0) | plg_twofactorauth_yubikey (3.2.0) | plg_authentication_gmail (3.0.0) | plg_authentication_ldap (3.0.0) | plg_authentication_joomla (3.0.0) | plg_authentication_cookie (3.0.0) | plg_djmediatools_djclassifieds (2.1.2) | plg_djmediatools_djcatalog2 (1.3.2) | plg_djmediatools_folder (1.3.0) | plg_djmediatools_hikashop (1.1.0) | plg_djmediatools_k2 (1.1.1) | plg_djmediatools_virtuemart (1.1.0) | plg_djmediatools_sobipro (1.0.0) | plg_djmediatools_content (1.4.1) | plg_djmediatools_easyblog (1.1.0) | plg_extension_joomla (3.0.0) | plg_finder_contacts (3.0.0) | plg_finder_categories (3.0.0) | plg_finder_tags (3.0.0) | plg_finder_weblinks (3.0.0) | plg_finder_newsfeeds (3.0.0) | plg_finder_content (3.0.0) | plg_content_emailcloak (3.0.0) | plg_content_geshi (3.0.0) | plg_content_pagebreak (3.0.0) | plg_content_djtabs (1.2.1) | Cool Map (1.0.0) | plg_content_pagenavigation (3.0.0) | plg_content_vote (3.0.0) | plg_content_djmediatools (2.1.2) | plg_content_joomla (3.0.0) | plg_content_loadmodule (3.0.0) | plg_content_finder (3.0.0) | plg_search_contacts (3.0.0) | plg_search_djcatalog2 (2.4) | plg_search_categories (3.0.0) | plg_search_tags (3.0.0) | plg_search_weblinks (3.0.0) | plg_search_newsfeeds (3.0.0) | plg_search_content (3.0.0) | PLG_INSTALLER_FOLDERINSTALLER (3.6.0) | PLG_INSTALLER_URLINSTALLER (3.6.0) | plg_installer_packageinstaller (3.6.0) |

Templates :: SITE :: beez3 (3.1.0) | protostar (1.0) | jm-cleaning-company (1.00) |
Templates :: ADMIN :: hathor (3.0.0) | isis (1.0) |

[ribo]

1. Use a htaccess.txt of a joomla package and rename it to .htaccess and delete your .htaccess
2. Fix your permissions. Folders must have 755 files , 644 for files and 444 for configuration.php
3. You also have Session Path Writable: No . this must be yes, tell to your host to fix it.
4. Gennerally follow the instructions of this post http://forum.joomla.org/viewtopic.php?t=582854 how you must clean it and at the end you must have your joomla , your template and your third party extensions up to date.
Also it s good to have the latest php version of 5.6 version as your php version is E.O.L.

[asaniom]

1. Use a htaccess.txt of a joomla package and rename it to .htaccess and delete your .htaccess
2. Fix your permissions. Folders must have 755 files , 644 for files and 444 for configuration.php
3. You also have Session Path Writable: No . this must be yes, tell to your host to fix it.
4. Gennerally follow the instructions of this post http://forum.joomla.org/viewtopic.php?t=582854 how you must clean it and at the end you must have your joomla , your template and your third party extensions up to date.
Also it s good to have the latest php version of 5.6 version as your php version is E.O.L.

tnx
i do following steps and still have the issue
i checked webmaster and i see this

today when i checked google again i notice that my .com domain is ok (i use domain pointer )

[asaniom]

hi
result of file that webmaster found
Crawl - Fetch as google - Downloaded HTTP response:

there is way to find this file and delet or edit this file?

[asaniom]

any idea?
today when i search it again it was ok but after 30 minutes then japanese characters came back

[ribo]

Did you fixed for example the issue of your server. Please post again the fpa results to check it if it is fixed. Sorry to tell it this but i saw before people that they said they fixed their server issue but they did not.

[ribo]

today when i search it again it was ok but after 30 minutes then japanese characters came back

That means that, or you did nt clear full your joomla site and there are still infected files, or again there is issue in your server, or there is still infected extension.

[asaniom]

Joomla! Instance :: Joomla! 3.6.2-Stable (Noether) 4-August-2016
Joomla! Platform :: Joomla Platform 13.1.0-Stable (Curiosity) 24-Apr-2013
Joomla! Configured :: Yes | Read-Only (444) | Owner: cservcom (uid: 1/gid: 1) | Group: (gid: ) | Valid For: 3.6
Configuration Options :: Offline: 0 | SEF: 1 | SEF Suffix: 0 | SEF ReWrite: 0 | .htaccess/web.config: Yes | GZip: 0 | Cache: 0 | FTP Layer: 0 | SSL: 0 | Error Reporting: default | Site Debug: 0 | Language Debug: 0 | Default Access: 1 | Unicode Slugs: 0 | Database Credentials Present: Yes

Host Configuration :: OS: | OS Version: | Technology: | Web Server: Apache/2 | Encoding: gzip, deflate | Doc Root: /home/cservcom/domains/coursservice.ir/public_html | System TMP Writable: Yes

PHP Configuration :: Version: 5.4.35 | PHP API: fpm-fcgi | Session Path Writable: No | Display Errors: | Error Reporting: 22527 | Log Errors To: | Last Known Error: | Register Globals: | Magic Quotes: | Safe Mode: | Open Base: /home/cservcom/:/tmp/:/var/tmp/:/usr/local/php54/lib/:/usr/local/php54/lib/:/usr/local/php55/lib/:/usr/local/lib/php/ | Uploads: 1 | Max. Upload Size: 64M | Max. POST Size: 64M | Max. Input Time: 60 | Max. Execution Time: 30 | Memory Limit: 128M

MySQL Configuration :: Version: 5.5.31 (Client:mysqlnd 5.0.10 - 20111026 - $Id: c85105d7c6f7d70d609bb4c000257868a40840ab $) | Host: --protected-- (--protected--) | Collation: latin1_swedish_ci (Character Set: latin1) | Database Size: 8.04 MiB | #of Tables:  119

PHP Extensions :: Core (5.4.35) | date (5.4.35) | ereg () | libxml () | openssl () | pcre () | sqlite3 (0.7) | zlib (2.0) | bcmath () | calendar () | ctype () | curl () | dom (20031129) | fileinfo (1.0.5) | filter (0.11.0) | ftp () | gd () | gettext () | hash (1.0) | iconv () | intl (1.1.0) | json (1.2.1) | mbstring () | mcrypt () | SPL (0.2) | session () | standard (5.4.35) | mysqlnd (mysqlnd 5.0.10 - 20111026 - $Id: c85105d7c6f7d70d609bb4c000257868a40840ab $) | PDO (1.0.4dev) | pdo_mysql (1.0.2) | pdo_sqlite (1.0.1) | Phar (2.0.1) | posix () | Reflection ($Id: f6367cdb4e3f392af4a6d441a6641de87c2e50c4 $) | mysqli (0.1) | SimpleXML (0.1) | soap () | sockets () | mysql (1.0) | tokenizer (0.1) | xml () | xmlreader (0.1) | xmlwriter (0.1) | xsl (0.1) | zip (1.11.0) | cgi-fcgi () | mhash () | ionCube Loader () | Zend OPcache (7.0.3FE) | Zend Guard Loader () | Zend Engine (2.4.0) |
Potential Missing Extensions :: suhosin |

Switch User Environment (Experimental) :: PHP CGI: No | Server SU: No | PHP SU: No | Custom SU (LiteSpeed/Cloud/Grid): No
Potential Ownership Issues: Maybe

Core Folders :: images/ (755) | components/ (755) | modules/ (755) | plugins/ (755) | language/ (755) | templates/ (755) | cache/ (755) | logs/ (755) | tmp/ (755) | administrator/components/ (755) | administrator/modules/ (755) | administrator/language/ (755) | administrator/templates/ (755) |

Elevated Permissions (First 10) :: images/djmediatools/ (777) | modules/mod_djtabs/language/ (777) | plugins/djcatalog2/ (777) | plugins/djclassifieds/ (777) | plugins/djmediatools/ (777) | plugins/editors-xtd/djtabs/language/ (777) | plugins/jmonitoring/ (777) | plugins/system/ef4_jmframework/includes/assets/template/ (777) | plugins/system/ef4_jmframework/includes/assets/template/bootstrap/ (777) | plugins/xmap/ (777) |

Components :: SITE :: com_wrapper (3.0.0) | com_mailto (3.0.0) |
Components :: ADMIN :: com_content (3.0.0) | com_cpanel (3.0.0) | RSForm! (1.49.4) | com_admin (3.0.0) | Akeeba (4.2.0) | com_joomlaupdate (3.6.2) | com_search (3.0.0) | com_menus (3.0.0) | com_config (3.0.0) | com_tags (3.1.0) | com_djcatalog2 (3.2.4) | com_modules (3.0.0) | com_postinstall (3.2.0) | com_ajax (3.2.0) | com_contenthistory (3.2.0) | com_finder (3.0.0) | com_djmediatools (2.4.0) | com_media (3.0.0) | com_users (3.0.0) | com_banners (3.0.0) | com_cache (3.0.0) | com_messages (3.0.0) | com_dima_poll (3.2.0) | com_installer (3.0.0) | com_plugins (3.0.0) | com_weblinks (3.0.0) | com_categories (3.0.0) | com_login (3.0.0) | com_templates (3.0.0) | com_cool_map (1.0.0) | com_djtabs (1.2.3) | com_redirect (3.0.0) | com_newsfeeds (3.0.0) | com_checkin (3.0.0) | com_languages (3.0.0) |

Modules :: SITE :: mod_syndicate (3.0.0) | mod_footer (3.0.0) | mod_articles_archive (3.0.0) | mod_djc2search (1.3) | mod_users_latest (3.0.0) | JPro Hotspot Map (1.0) | mod_feed (3.0.0) | mod_custom (3.0.0) | mod_tags_similar (3.1.0) | mod_tags_popular (3.1.0) | mod_whosonline (3.0.0) | mod_stats (3.0.0) | DJ-MediaTools Album (2.1.1) | DJ-Tabs (1.2.3) | DJ-MegaMenu (2.1.0) | JA Image Hotspot (1.0.6) | mod_search (3.0.0) | mod_articles_categories (3.0.0) | mod_login (3.0.0) | mod_djc2filters (3.0) | mod_wrapper (3.0.0) | mod_breadcrumbs (3.0.0) | mod_djc2producers (2.4) | mod_djc2relateditems (3.2) | JMS Support Online (2.0) | mod_banners (3.0.0) | mod_languages (3.5.0) | mod_djc2items (3.1) | Cool Map (1.0.0) | mod_dima_poll (1.0.0) | mod_related_items (3.0.0) | mod_articles_popular (3.0.0) | FrescoChat (1.0) | mod_random_image (3.0.0) | mod_finder (3.0.0) | mod_weblinks (3.0.0) | mod_articles_category (3.0.0) | mod_djc2frontpage (3.0) | mod_articles_news (3.0.0) | mod_menu (3.0.0) | mod_articles_latest (3.0.0) | mod_djc2categories (3.0) |
Modules :: ADMIN :: mod_status (3.0.0) | mod_toolbar (3.0.0) | mod_feed (3.0.0) | mod_custom (3.0.0) | mod_latest (3.0.0) | mod_multilangstatus (3.0.0) | mod_title (3.0.0) | mod_quickicon (3.0.0) | mod_popular (3.0.0) | mod_version (3.0.0) | mod_login (3.0.0) | mod_stats_admin (3.0.0) | mod_logged (3.0.0) | mod_submenu (3.0.0) | mod_menu (3.0.0) |

Plugins :: SITE :: plg_captcha_recaptcha (3.4.0) | plg_xmap_com_djcatalog2 (1.3) | plg_editors_tinymce (4.4.0) | plg_editors_codemirror (5.17.0) | plg_quickicon_extensionupdate (3.0.0) | plg_quickicon_joomlaupdate (3.0.0) | plg_quickicon_djcatalog (1.0) | plg_editors-xtd_pagebreak (3.0.0) | plg_editors-xtd_djtabs (1.0.0) | plg_editors-xtd_image (3.0.0) | plg_editors-xtd_module (3.5.0) | plg_editors-xtd_djmediatools (2.0.0) | plg_editors-xtd_article (3.0.0) | plg_editors-xtd_readmore (3.0.0) | plg_djcatalog2_pagebreak (2.3) | plg_user_profile (3.0.0) | plg_user_joomla (3.0.0) | plg_user_contactcreator (3.0.0) | plg_system_djmegamenu (1.3.0) | plg_system_highlight (3.0.0) | Free Live Support Chat (1.0.0) | plg_system_remember (3.0.0) | plg_system_languagefilter (3.0.0) | plg_system_stats (3.5.0) | plg_system_debug (3.0.0) | plg_system_cache (3.0.0) | plg_system_updatenotification (3.5.0) | plg_system_languagecode (3.0.0) | plg_system_sef (3.0.0) | plg_system_ef4_jmframework (4.4) | plg_system_log (3.0.0) | plg_system_logout (3.0.0) | plg_system_redirect (3.0.0) | plg_system_p3p (3.0.0) | plg_twofactorauth_totp (3.2.0) | plg_twofactorauth_yubikey (3.2.0) | plg_authentication_gmail (3.0.0) | plg_authentication_ldap (3.0.0) | plg_authentication_joomla (3.0.0) | plg_authentication_cookie (3.0.0) | plg_djmediatools_djclassifieds (2.1.2) | plg_djmediatools_djcatalog2 (1.3.2) | plg_djmediatools_folder (1.3.0) | plg_djmediatools_hikashop (1.1.0) | plg_djmediatools_k2 (1.1.1) | plg_djmediatools_virtuemart (1.1.0) | plg_djmediatools_sobipro (1.0.0) | plg_djmediatools_content (1.4.1) | plg_djmediatools_easyblog (1.1.0) | plg_extension_joomla (3.0.0) | plg_finder_contacts (3.0.0) | plg_finder_categories (3.0.0) | plg_finder_tags (3.0.0) | plg_finder_weblinks (3.0.0) | plg_finder_newsfeeds (3.0.0) | plg_finder_content (3.0.0) | plg_content_emailcloak (3.0.0) | plg_content_geshi (3.0.0) | plg_content_pagebreak (3.0.0) | plg_content_djtabs (1.2.1) | Cool Map (1.0.0) | plg_content_pagenavigation (3.0.0) | plg_content_vote (3.0.0) | plg_content_djmediatools (2.1.2) | plg_content_joomla (3.0.0) | plg_content_loadmodule (3.0.0) | plg_content_finder (3.0.0) | plg_search_contacts (3.0.0) | plg_search_djcatalog2 (2.4) | plg_search_categories (3.0.0) | plg_search_tags (3.0.0) | plg_search_weblinks (3.0.0) | plg_search_newsfeeds (3.0.0) | plg_search_content (3.0.0) | PLG_INSTALLER_FOLDERINSTALLER (3.6.0) | PLG_INSTALLER_URLINSTALLER (3.6.0) | plg_installer_packageinstaller (3.6.0) |

Templates :: SITE :: beez3 (3.1.0) | protostar (1.0) | jm-cleaning-company (1.00) |
Templates :: ADMIN :: hathor (3.0.0) | isis (1.0) |

[leolam]

Following observations:

• You were told that all folders should have permissions '755' and files '644'. The frontdoor is wide open with your permissions set to '777' Logical you get whacked.
• Session save path not writable. Contact you host. this must be set to (in general) /tmp on server and should be writable
• Outdated extensions which are vulnerable. Keep your extensions up-to-date at all times!
• If you have been hacked the ONLY (!) way of cleansing your site is to follow each and every step of http://forum.joomla.org/viewtopic.php?t=582854

Leo

[asaniom]

Joomla! Instance :: Joomla! 3.6.2-Stable (Noether) 4-August-2016
Joomla! Platform :: Joomla Platform 13.1.0-Stable (Curiosity) 24-Apr-2013
Joomla! Configured :: Yes | Read-Only (444) | Owner: cservcom (uid: 1/gid: 1) | Group: (gid: ) | Valid For: 3.6
Configuration Options :: Offline: 1 | SEF: 1 | SEF Suffix: 0 | SEF ReWrite: 0 | .htaccess/web.config: Yes | GZip: 0 | Cache: 0 | FTP Layer: 0 | SSL: 0 | Error Reporting: default | Site Debug: 0 | Language Debug: 0 | Default Access: 1 | Unicode Slugs: 0 | Database Credentials Present: Yes

Host Configuration :: OS: | OS Version: | Technology: | Web Server: Apache/2 | Encoding: gzip, deflate | Doc Root: /home/cservcom/domains/coursservice.ir/public_html | System TMP Writable: Yes

PHP Configuration :: Version: 5.4.35 | PHP API: fpm-fcgi | Session Path Writable: Yes | Display Errors: | Error Reporting: 22527 | Log Errors To: | Last Known Error: | Register Globals: | Magic Quotes: | Safe Mode: | Open Base: /home/cservcom/:/tmp/:/var/tmp/:/usr/local/php54/lib/:/usr/local/php54/lib/:/usr/local/php55/lib/:/usr/local/lib/php/ | Uploads: 1 | Max. Upload Size: 64M | Max. POST Size: 64M | Max. Input Time: 60 | Max. Execution Time: 30 | Memory Limit: 128M

MySQL Configuration :: Version: 5.5.31 (Client:mysqlnd 5.0.10 - 20111026 - $Id: c85105d7c6f7d70d609bb4c000257868a40840ab $) | Host: --protected-- (--protected--) | Collation: latin1_swedish_ci (Character Set: latin1) | Database Size: 8.32 MiB | #of Tables:  119

PHP Extensions :: Core (5.4.35) | date (5.4.35) | ereg () | libxml () | openssl () | pcre () | sqlite3 (0.7) | zlib (2.0) | bcmath () | calendar () | ctype () | curl () | dom (20031129) | fileinfo (1.0.5) | filter (0.11.0) | ftp () | gd () | gettext () | hash (1.0) | iconv () | intl (1.1.0) | json (1.2.1) | mbstring () | mcrypt () | SPL (0.2) | session () | standard (5.4.35) | mysqlnd (mysqlnd 5.0.10 - 20111026 - $Id: c85105d7c6f7d70d609bb4c000257868a40840ab $) | PDO (1.0.4dev) | pdo_mysql (1.0.2) | pdo_sqlite (1.0.1) | Phar (2.0.1) | posix () | Reflection ($Id: f6367cdb4e3f392af4a6d441a6641de87c2e50c4 $) | mysqli (0.1) | SimpleXML (0.1) | soap () | sockets () | mysql (1.0) | tokenizer (0.1) | xml () | xmlreader (0.1) | xmlwriter (0.1) | xsl (0.1) | zip (1.11.0) | cgi-fcgi () | mhash () | ionCube Loader () | Zend OPcache (7.0.3FE) | Zend Guard Loader () | Zend Engine (2.4.0) |
Potential Missing Extensions :: suhosin |

Switch User Environment (Experimental) :: PHP CGI: No | Server SU: No | PHP SU: No | Custom SU (LiteSpeed/Cloud/Grid): No
Potential Ownership Issues: Maybe

Core Folders :: images/ (755) | components/ (755) | modules/ (755) | plugins/ (755) | language/ (755) | templates/ (755) | cache/ (755) | logs/ (755) | tmp/ (755) | administrator/components/ (755) | administrator/modules/ (755) | administrator/language/ (755) | administrator/templates/ (755) |

Elevated Permissions (First 10) :: administrator/components/com_akeeba/akeeba/ (777) | administrator/components/com_akeeba/akeeba/plugins/ (777) | administrator/components/com_akeeba/assets/ (777) | administrator/components/com_akeeba/engine/Psr/ (777) | administrator/components/com_akeeba/platform/ (777) | administrator/components/com_akeeba/plugins/ (777) | administrator/components/com_templates/views/source/ (777) | administrator/components/com_templates/views/source/tmpl/ (777) | plugins/content/djtabs/language/ (777) | plugins/editors-xtd/djtabs/language/ (777) |

Components :: SITE :: com_wrapper (3.0.0) | com_mailto (3.0.0) |
Components :: ADMIN :: com_content (3.0.0) | com_cpanel (3.0.0) | RSForm! (1.49.4) | com_admin (3.0.0) | Akeeba (4.2.0) | com_joomlaupdate (3.6.2) | com_search (3.0.0) | com_menus (3.0.0) | com_config (3.0.0) | com_tags (3.1.0) | com_djcatalog2 (3.2.4) | com_modules (3.0.0) | com_postinstall (3.2.0) | com_ajax (3.2.0) | com_contenthistory (3.2.0) | com_finder (3.0.0) | com_djmediatools (2.4.0) | com_media (3.0.0) | com_users (3.0.0) | com_banners (3.0.0) | com_cache (3.0.0) | com_messages (3.0.0) | com_dima_poll (3.2.0) | com_installer (3.0.0) | com_plugins (3.0.0) | com_weblinks (3.0.0) | com_categories (3.0.0) | com_login (3.0.0) | com_templates (3.0.0) | com_cool_map (1.0.0) | com_djtabs (1.2.3) | com_redirect (3.0.0) | com_newsfeeds (3.0.0) | com_checkin (3.0.0) | com_languages (3.0.0) |

Modules :: SITE :: mod_syndicate (3.0.0) | mod_footer (3.0.0) | mod_articles_archive (3.0.0) | mod_djc2search (1.3) | mod_users_latest (3.0.0) | JPro Hotspot Map (1.0) | mod_feed (3.0.0) | mod_custom (3.0.0) | mod_tags_similar (3.1.0) | mod_tags_popular (3.1.0) | mod_whosonline (3.0.0) | mod_stats (3.0.0) | DJ-MediaTools Album (2.1.1) | DJ-Tabs (1.2.3) | DJ-MegaMenu (2.1.0) | JA Image Hotspot (1.0.6) | mod_search (3.0.0) | mod_articles_categories (3.0.0) | mod_login (3.0.0) | mod_djc2filters (3.0) | mod_wrapper (3.0.0) | mod_breadcrumbs (3.0.0) | mod_djc2producers (2.4) | mod_djc2relateditems (3.2) | JMS Support Online (2.0) | mod_banners (3.0.0) | mod_languages (3.5.0) | mod_djc2items (3.1) | Cool Map (1.0.0) | mod_dima_poll (1.0.0) | mod_related_items (3.0.0) | mod_articles_popular (3.0.0) | FrescoChat (1.0) | mod_random_image (3.0.0) | mod_finder (3.0.0) | mod_weblinks (3.0.0) | mod_articles_category (3.0.0) | mod_djc2frontpage (3.0) | mod_articles_news (3.0.0) | mod_menu (3.0.0) | mod_articles_latest (3.0.0) | mod_djc2categories (3.0) |
Modules :: ADMIN :: mod_status (3.0.0) | mod_toolbar (3.0.0) | mod_feed (3.0.0) | mod_custom (3.0.0) | mod_latest (3.0.0) | mod_multilangstatus (3.0.0) | mod_title (3.0.0) | mod_quickicon (3.0.0) | mod_popular (3.0.0) | mod_version (3.0.0) | mod_login (3.0.0) | mod_stats_admin (3.0.0) | mod_logged (3.0.0) | mod_submenu (3.0.0) | mod_menu (3.0.0) |

Plugins :: SITE :: plg_captcha_recaptcha (3.4.0) | plg_xmap_com_djcatalog2 (1.3) | plg_editors_tinymce (4.4.0) | plg_editors_codemirror (5.17.0) | plg_quickicon_extensionupdate (3.0.0) | plg_quickicon_joomlaupdate (3.0.0) | plg_quickicon_djcatalog (1.0) | plg_editors-xtd_pagebreak (3.0.0) | plg_editors-xtd_djtabs (1.0.0) | plg_editors-xtd_image (3.0.0) | plg_editors-xtd_module (3.5.0) | plg_editors-xtd_djmediatools (2.0.0) | plg_editors-xtd_article (3.0.0) | plg_editors-xtd_readmore (3.0.0) | plg_djcatalog2_pagebreak (2.3) | plg_user_profile (3.0.0) | plg_user_joomla (3.0.0) | plg_user_contactcreator (3.0.0) | plg_system_djmegamenu (1.3.0) | plg_system_highlight (3.0.0) | Free Live Support Chat (1.0.0) | plg_system_remember (3.0.0) | plg_system_languagefilter (3.0.0) | plg_system_stats (3.5.0) | plg_system_debug (3.0.0) | plg_system_cache (3.0.0) | plg_system_updatenotification (3.5.0) | plg_system_languagecode (3.0.0) | plg_system_sef (3.0.0) | plg_system_ef4_jmframework (4.7.0) | plg_system_log (3.0.0) | plg_system_logout (3.0.0) | plg_system_redirect (3.0.0) | plg_system_p3p (3.0.0) | plg_twofactorauth_totp (3.2.0) | plg_twofactorauth_yubikey (3.2.0) | plg_authentication_gmail (3.0.0) | plg_authentication_ldap (3.0.0) | plg_authentication_joomla (3.0.0) | plg_authentication_cookie (3.0.0) | plg_djmediatools_djclassifieds (2.1.2) | plg_djmediatools_djcatalog2 (1.3.2) | plg_djmediatools_folder (1.3.0) | plg_djmediatools_hikashop (1.1.0) | plg_djmediatools_k2 (1.1.1) | plg_djmediatools_virtuemart (1.1.0) | plg_djmediatools_sobipro (1.0.0) | plg_djmediatools_content (1.4.1) | plg_djmediatools_easyblog (1.1.0) | plg_extension_joomla (3.0.0) | plg_finder_contacts (3.0.0) | plg_finder_categories (3.0.0) | plg_finder_tags (3.0.0) | plg_finder_weblinks (3.0.0) | plg_finder_newsfeeds (3.0.0) | plg_finder_content (3.0.0) | plg_content_emailcloak (3.0.0) | plg_content_geshi (3.0.0) | plg_content_pagebreak (3.0.0) | plg_content_djtabs (1.2.1) | Cool Map (1.0.0) | plg_content_pagenavigation (3.0.0) | plg_content_vote (3.0.0) | plg_content_djmediatools (2.1.2) | plg_content_joomla (3.0.0) | plg_content_loadmodule (3.0.0) | plg_content_finder (3.0.0) | plg_search_contacts (3.0.0) | plg_search_djcatalog2 (2.4) | plg_search_categories (3.0.0) | plg_search_tags (3.0.0) | plg_search_weblinks (3.0.0) | plg_search_newsfeeds (3.0.0) | plg_search_content (3.0.0) | PLG_INSTALLER_FOLDERINSTALLER (3.6.0) | PLG_INSTALLER_URLINSTALLER (3.6.0) | plg_installer_packageinstaller (3.6.0) |

Templates :: SITE :: beez3 (3.1.0) | protostar (1.0) | jm-cleaning-company (1.00) |
Templates :: ADMIN :: hathor (3.0.0) | isis (1.0) |

[leolam]

Elevated Permissions (First 10) :: administrator/components/com_akeeba/akeeba/ (777) | administrator/components/com_akeeba/akeeba/plugins/ (777) | administrator/components/com_akeeba/assets/ (777) | administrator/components/com_akeeba/engine/Psr/ (777) | administrator/components/com_akeeba/platform/ (777) | administrator/components/com_akeeba/plugins/ (777) | administrator/components/com_templates/views/source/ (777) | administrator/components/com_templates/views/source/tmpl/ (777) | plugins/content/djtabs/language/ (777) | plugins/editors-xtd/djtabs/language/ (777) |

Can't you read what I wrote?

You were told that all folders should have permissions '755' and files '644'. The frontdoor is wide open with your permissions set to '777' Logical you get whacked.

So these permissions should all be '755'

Leo

[ribo]

You still have folders with 777 and all folders must have 755 and files 644. Please follow exactly the steps of this post http://forum.joomla.org/viewtopic.php?t=582854 if you want to clean your joomla site for sure

[asaniom]

Elevated Permissions (First 10) :: administrator/components/com_akeeba/akeeba/ (777) | administrator/components/com_akeeba/akeeba/plugins/ (777) | administrator/components/com_akeeba/assets/ (777) | administrator/components/com_akeeba/engine/Psr/ (777) | administrator/components/com_akeeba/platform/ (777) | administrator/components/com_akeeba/plugins/ (777) | administrator/components/com_templates/views/source/ (777) | administrator/components/com_templates/views/source/tmpl/ (777) | plugins/content/djtabs/language/ (777) | plugins/editors-xtd/djtabs/language/ (777) |

Can't you read what I wrote?

You were told that all folders should have permissions '755' and files '644'. The frontdoor is wide open with your permissions set to '777' Logical you get whacked.

So these permissions should all be '755'

Leo

i edit all 777 and i change them to 755 but they getting back to 777 i dont know why

[leolam]

Somebody with knowledge has to go in and see why that is happening. I have replied already to your email so respond

Leo

[asaniom]

i talk to host and they fix save session path and is writable now
and this it new fpa

Joomla! Instance :: Joomla! 3.6.2-Stable (Noether) 4-August-2016
Joomla! Platform :: Joomla Platform 13.1.0-Stable (Curiosity) 24-Apr-2013
Joomla! Configured :: Yes | Read-Only (444) | Owner: cservcom (uid: 1/gid: 1) | Group: (gid: ) | Valid For: 3.6
Configuration Options :: Offline: 1 | SEF: 1 | SEF Suffix: 0 | SEF ReWrite: 0 | .htaccess/web.config: Yes | GZip: 0 | Cache: 0 | FTP Layer: 0 | SSL: 0 | Error Reporting: default | Site Debug: 0 | Language Debug: 0 | Default Access: 1 | Unicode Slugs: 0 | Database Credentials Present: Yes

Host Configuration :: OS: | OS Version: | Technology: | Web Server: Apache/2 | Encoding: gzip, deflate | Doc Root: /home/cservcom/domains/coursservice.ir/public_html | System TMP Writable: Yes

PHP Configuration :: Version: 5.4.35 | PHP API: fpm-fcgi | Session Path Writable: Yes | Display Errors: | Error Reporting: 22527 | Log Errors To: | Last Known Error: | Register Globals: | Magic Quotes: | Safe Mode: | Open Base: /home/cservcom/:/tmp/:/var/tmp/:/usr/local/php54/lib/:/usr/local/php54/lib/:/usr/local/php55/lib/:/usr/local/lib/php/ | Uploads: 1 | Max. Upload Size: 64M | Max. POST Size: 64M | Max. Input Time: 60 | Max. Execution Time: 30 | Memory Limit: 128M

MySQL Configuration :: Version: 5.5.31 (Client:mysqlnd 5.0.10 - 20111026 - $Id: c85105d7c6f7d70d609bb4c000257868a40840ab $) | Host: --protected-- (--protected--) | Collation: latin1_swedish_ci (Character Set: latin1) | Database Size: 8.32 MiB | #of Tables:  119

PHP Extensions :: Core (5.4.35) | date (5.4.35) | ereg () | libxml () | openssl () | pcre () | sqlite3 (0.7) | zlib (2.0) | bcmath () | calendar () | ctype () | curl () | dom (20031129) | fileinfo (1.0.5) | filter (0.11.0) | ftp () | gd () | gettext () | hash (1.0) | iconv () | intl (1.1.0) | json (1.2.1) | mbstring () | mcrypt () | SPL (0.2) | session () | standard (5.4.35) | mysqlnd (mysqlnd 5.0.10 - 20111026 - $Id: c85105d7c6f7d70d609bb4c000257868a40840ab $) | PDO (1.0.4dev) | pdo_mysql (1.0.2) | pdo_sqlite (1.0.1) | Phar (2.0.1) | posix () | Reflection ($Id: f6367cdb4e3f392af4a6d441a6641de87c2e50c4 $) | mysqli (0.1) | SimpleXML (0.1) | soap () | sockets () | mysql (1.0) | tokenizer (0.1) | xml () | xmlreader (0.1) | xmlwriter (0.1) | xsl (0.1) | zip (1.11.0) | cgi-fcgi () | mhash () | ionCube Loader () | Zend OPcache (7.0.3FE) | Zend Guard Loader () | Zend Engine (2.4.0) |
Potential Missing Extensions :: suhosin |

Switch User Environment (Experimental) :: PHP CGI: No | Server SU: No | PHP SU: No | Custom SU (LiteSpeed/Cloud/Grid): No
Potential Ownership Issues: Maybe

Core Folders :: images/ (755) | components/ (755) | modules/ (755) | plugins/ (755) | language/ (755) | templates/ (755) | cache/ (755) | logs/ (755) | tmp/ (755) | administrator/components/ (755) | administrator/modules/ (755) | administrator/language/ (755) | administrator/templates/ (755) |

Elevated Permissions (First 10) ::

Components :: SITE :: com_wrapper (3.0.0) | com_mailto (3.0.0) |
Components :: ADMIN :: com_content (3.0.0) | com_cpanel (3.0.0) | RSForm! (1.49.4) | com_admin (3.0.0) | Akeeba (4.2.0) | com_joomlaupdate (3.6.2) | com_search (3.0.0) | com_menus (3.0.0) | com_config (3.0.0) | com_tags (3.1.0) | com_djcatalog2 (3.2.4) | com_modules (3.0.0) | com_postinstall (3.2.0) | com_ajax (3.2.0) | com_contenthistory (3.2.0) | com_finder (3.0.0) | com_djmediatools (2.4.0) | com_media (3.0.0) | com_users (3.0.0) | com_banners (3.0.0) | com_cache (3.0.0) | com_messages (3.0.0) | com_dima_poll (3.2.0) | com_installer (3.0.0) | com_plugins (3.0.0) | com_weblinks (3.0.0) | com_categories (3.0.0) | com_login (3.0.0) | com_templates (3.0.0) | com_cool_map (1.0.0) | com_djtabs (1.2.3) | com_redirect (3.0.0) | com_newsfeeds (3.0.0) | com_checkin (3.0.0) | com_languages (3.0.0) |

Modules :: SITE :: mod_syndicate (3.0.0) | mod_footer (3.0.0) | mod_articles_archive (3.0.0) | mod_djc2search (1.3) | mod_users_latest (3.0.0) | JPro Hotspot Map (1.0) | mod_feed (3.0.0) | mod_custom (3.0.0) | mod_tags_similar (3.1.0) | mod_tags_popular (3.1.0) | mod_whosonline (3.0.0) | mod_stats (3.0.0) | DJ-MediaTools Album (2.1.1) | DJ-Tabs (1.2.3) | DJ-MegaMenu (2.1.0) | JA Image Hotspot (1.0.6) | mod_search (3.0.0) | mod_articles_categories (3.0.0) | mod_login (3.0.0) | mod_djc2filters (3.0) | mod_wrapper (3.0.0) | mod_breadcrumbs (3.0.0) | mod_djc2producers (2.4) | mod_djc2relateditems (3.2) | JMS Support Online (2.0) | mod_banners (3.0.0) | mod_languages (3.5.0) | mod_djc2items (3.1) | Cool Map (1.0.0) | mod_dima_poll (1.0.0) | mod_related_items (3.0.0) | mod_articles_popular (3.0.0) | FrescoChat (1.0) | mod_random_image (3.0.0) | mod_finder (3.0.0) | mod_weblinks (3.0.0) | mod_articles_category (3.0.0) | mod_djc2frontpage (3.0) | mod_articles_news (3.0.0) | mod_menu (3.0.0) | mod_articles_latest (3.0.0) | mod_djc2categories (3.0) |
Modules :: ADMIN :: mod_status (3.0.0) | mod_toolbar (3.0.0) | mod_feed (3.0.0) | mod_custom (3.0.0) | mod_latest (3.0.0) | mod_multilangstatus (3.0.0) | mod_title (3.0.0) | mod_quickicon (3.0.0) | mod_popular (3.0.0) | mod_version (3.0.0) | mod_login (3.0.0) | mod_stats_admin (3.0.0) | mod_logged (3.0.0) | mod_submenu (3.0.0) | mod_menu (3.0.0) |

Plugins :: SITE :: plg_captcha_recaptcha (3.4.0) | plg_xmap_com_djcatalog2 (1.3) | plg_editors_tinymce (4.4.0) | plg_editors_codemirror (5.17.0) | plg_quickicon_extensionupdate (3.0.0) | plg_quickicon_joomlaupdate (3.0.0) | plg_quickicon_djcatalog (1.0) | plg_editors-xtd_pagebreak (3.0.0) | plg_editors-xtd_djtabs (1.0.0) | plg_editors-xtd_image (3.0.0) | plg_editors-xtd_module (3.5.0) | plg_editors-xtd_djmediatools (2.0.0) | plg_editors-xtd_article (3.0.0) | plg_editors-xtd_readmore (3.0.0) | plg_djcatalog2_pagebreak (2.3) | plg_user_profile (3.0.0) | plg_user_joomla (3.0.0) | plg_user_contactcreator (3.0.0) | plg_system_djmegamenu (1.3.0) | plg_system_highlight (3.0.0) | Free Live Support Chat (1.0.0) | plg_system_remember (3.0.0) | plg_system_languagefilter (3.0.0) | plg_system_stats (3.5.0) | plg_system_debug (3.0.0) | plg_system_cache (3.0.0) | plg_system_updatenotification (3.5.0) | plg_system_languagecode (3.0.0) | plg_system_sef (3.0.0) | plg_system_ef4_jmframework (4.7.0) | plg_system_log (3.0.0) | plg_system_logout (3.0.0) | plg_system_redirect (3.0.0) | plg_system_p3p (3.0.0) | plg_twofactorauth_totp (3.2.0) | plg_twofactorauth_yubikey (3.2.0) | plg_authentication_gmail (3.0.0) | plg_authentication_ldap (3.0.0) | plg_authentication_joomla (3.0.0) | plg_authentication_cookie (3.0.0) | plg_djmediatools_djclassifieds (2.1.2) | plg_djmediatools_djcatalog2 (1.3.2) | plg_djmediatools_folder (1.3.0) | plg_djmediatools_hikashop (1.1.0) | plg_djmediatools_k2 (1.1.1) | plg_djmediatools_virtuemart (1.1.0) | plg_djmediatools_sobipro (1.0.0) | plg_djmediatools_content (1.4.1) | plg_djmediatools_easyblog (1.1.0) | plg_extension_joomla (3.0.0) | plg_finder_contacts (3.0.0) | plg_finder_categories (3.0.0) | plg_finder_tags (3.0.0) | plg_finder_weblinks (3.0.0) | plg_finder_newsfeeds (3.0.0) | plg_finder_content (3.0.0) | plg_content_emailcloak (3.0.0) | plg_content_geshi (3.0.0) | plg_content_pagebreak (3.0.0) | plg_content_djtabs (1.2.1) | Cool Map (1.0.0) | plg_content_pagenavigation (3.0.0) | plg_content_vote (3.0.0) | plg_content_djmediatools (2.1.2) | plg_content_joomla (3.0.0) | plg_content_loadmodule (3.0.0) | plg_content_finder (3.0.0) | plg_search_contacts (3.0.0) | plg_search_djcatalog2 (2.4) | plg_search_categories (3.0.0) | plg_search_tags (3.0.0) | plg_search_weblinks (3.0.0) | plg_search_newsfeeds (3.0.0) | plg_search_content (3.0.0) | PLG_INSTALLER_FOLDERINSTALLER (3.6.0) | PLG_INSTALLER_URLINSTALLER (3.6.0) | plg_installer_packageinstaller (3.6.0) |

Templates :: SITE :: beez3 (3.1.0) | protostar (1.0) | jm-cleaning-company (1.00) |
Templates :: ADMIN :: hathor (3.0.0) | isis (1.0) |

[asaniom]

Somebody with knowledge has to go in and see why that is happening. I have replied already to your email so respond

Leo

i figured it out and i fix it

[leolam]

Good for you and saves you money.... Thanks for the non-communication after your approach

Cheers

Leo

[mandville]

Now.
Beyond not saying how you resolved the 777 issue. You still havent followed many suggestions. If you had followes the cheklist that includes updating your numerous out of date extensions you could be enjoying a hack less site and a decent cup of tea.

[eng_sadat]

I have the same problem and my fpa is:

my site seems to works done but in my [google search console tools ] Search Analytics form show me that there is a kind of infection: my clicks is fixed at 24 clicks and all pages appear (in search analytics) I don't know like:1- (mydomain)/zanrco/htejqdhtej.php2-(mydomain)/zahtyp/qdqdejcoej.php 3-(mydomain)/zanrqd/zazaconrnr.php etc..

no msg

[01-Sep-2016 07:00:32 America/Denver] PHP Warning: ...

scan with antivirus com and remove some undesirable files

Joomla! Instance :: Joomla! 3.6.0-Stable (Noether) 12-July-2016
Joomla! Platform :: Joomla Platform 13.1.0-Stable (Curiosity) 24-Apr-2013
Joomla! Configured :: Yes | Read-Only (444) | Owner: itfivsta (uid: 1/gid: 1) | Group: itfivsta (gid: 1) | Valid For: 3.6
Configuration Options :: Offline: 0 | SEF: 1 | SEF Suffix: 1 | SEF ReWrite: 1 | .htaccess/web.config: Yes | GZip: 0 | Cache: 0 | FTP Layer: 0 | SSL: 0 | Error Reporting: default | Site Debug: 0 | Language Debug: 0 | Default Access: 1 | Unicode Slugs: 1 | Database Credentials Present: Yes

Host Configuration :: OS: Linux | OS Version: 3.12.50-39.ELK6.x86_64 | Technology: x86_64 | Web Server: Apache | Encoding: gzip, deflate | Doc Root: /home1/itfivsta/public_html/drmokhtar.com | System TMP Writable: Yes

PHP Configuration :: Version: 5.6.24 | PHP API: cgi-fcgi | Session Path Writable: Yes | Display Errors: | Error Reporting: 22527 | Log Errors To: error_log | Last Known Error: 01st September 2016 07:00:32. | Register Globals: | Magic Quotes: | Safe Mode: | Open Base: | Uploads: 1 | Max. Upload Size: 64M | Max. POST Size: 64M | Max. Input Time: 60 | Max. Execution Time: 30 | Memory Limit: 256M

MySQL Configuration :: Version: 5.5.42-37.1-log (Client:5.5.42-37.1) | Host: --protected-- (--protected--) | Collation: latin1_swedish_ci (Character Set: latin1) | Database Size: 162.66 MiB | #of Tables:  148

PHP Extensions :: Core (5.6.24) | date (5.6.24) | ereg () | libxml () | openssl () | pcre () | sqlite3 (0.7-dev) | zlib (2.0) | bcmath () | bz2 () | calendar () | ctype () | curl () | dba () | dom (20031129) | enchant (1.1.0) | hash (1.0) | fileinfo (1.0.5) | filter (0.11.0) | ftp () | gd () | gettext () | SPL (0.2) | iconv () | session () | intl (1.1.0) | json (1.2.1) | mbstring () | mcrypt () | standard (5.6.24) | mysql (1.0) | mysqli (0.1) | odbc (1.0) | mysqlnd (mysqlnd 5.0.11-dev - 20120503 - $Id: 76b08b24596e12d4553bd41fc93cccd5bac2fe7a $) | PDO (1.0.4dev) | pdo_dblib (1.0.1) | PDO_ODBC (1.0.1) | Phar (2.0.2) | posix () | pspell () | Reflection ($Id: fbcf7a77ca8e3d4cd7501de8025235b947b8240f $) | imap () | SimpleXML (0.1) | snmp (0.1) | soap () | sockets () | exif (1.4 $Id: 5564de4b4a8fd6b32ae8bd44debf9f13b18c7768 $) | tidy (2.0) | tokenizer (0.1) | wddx () | xml () | xmlreader (0.1) | xmlrpc (0.51) | xmlwriter (0.1) | xsl (0.1) | zip (1.12.5) | cgi-fcgi () | imagick (3.4.1) | pdo_mysql (1.0.2) | pdo_sqlite (1.0.1) | pdo_pgsql (1.0.2) | magickwand (1.0. | mailparse (2.1.6) | OAuth (1.2.3) | oci8 (2.0. | uploadprogress (1.0.3.1) | mhash () | ionCube Loader () | SourceGuardian (11.0.2) | Zend Guard Loader () | Zend OPcache (7.0.4-devFE) | Zend Engine (2.6.0) |
Potential Missing Extensions :: suhosin |

Switch User Environment (Experimental) :: PHP CGI: Yes | Server SU: Yes | PHP SU: Yes | Custom SU (LiteSpeed/Cloud/Grid): Yes
Potential Ownership Issues: No

Core Folders :: images/ (755) | components/ (755) | modules/ (755) | plugins/ (755) | language/ (755) | templates/ (755) | cache/ (755) | logs/ (755) | tmp/ (755) | administrator/components/ (755) | administrator/modules/ (755) | administrator/language/ (755) | administrator/templates/ (755) |

Elevated Permissions (First 10) ::

Components :: SITE :: com_mailto (3.0.0) | com_wrapper (3.0.0) |
Components :: ADMIN :: com_newsfeeds (3.0.0) | com_joomlaupdate (3.6.1) | com_tags (3.1.0) | com_ajax (3.2.0) | com_checkin (3.0.0) | Akeeba (5.1.4) | com_config (3.0.0) | com_menus (3.0.0) | com_templates (3.0.0) | com_users (3.0.0) | com_login (3.0.0) | com_attachments (3.1.3) | com_modules (3.0.0) | com_plugins (3.0.0) | com_content (3.0.0) | com_redirect (3.0.0) | com_weblinks (3.0.0) | com_admin (3.0.0) | com_contenthistory (3.2.0) | com_banners (3.0.0) | com_search (3.0.0) | com_messages (3.0.0) | com_languages (3.0.0) | FW Gallery (3.3) | com_finder (3.0.0) | COM_JANTIVIRUS (5.0) | com_installer (3.0.0) | com_cache (3.0.0) | com_cpanel (3.0.0) | com_postinstall (3.2.0) | com_media (3.0.0) | com_categories (3.0.0) |

Modules :: SITE :: mod_banners (3.0.0) | mod_search (3.0.0) | Sj Mega News (2.5) | Sj Slideshow (2.5) | mod_breadcrumbs (3.0.0) | mod_footer (3.0.0) | mod_articles_archive (3.0.0) | mod_tags_popular (3.1.0) | mod_weblinks (3.0.0) | mod_related_items (3.0.0) | mod_stats (3.0.0) | mod_articles_news (3.0.0) | mod_articles_category (3.0.0) | Sj Slider (2.5) | SJ CAROUSEL (2.5.0) | Sj Basic News (3.0) | mod_menu (3.0.0) | mod_whosonline (3.0.0) | mod_users_latest (3.0.0) | mod_articles_categories (3.0.0) | mod_languages (3.5.0) | mod_articles_popular (3.0.0) | mod_login (3.0.0) | mod_custom (3.0.0) | mod_wrapper (3.0.0) | mod_random_image (3.0.0) | mod_tags_similar (3.1.0) | Sj News Splash (2.5) | mod_articles_latest (3.0.0) | mod_syndicate (3.0.0) | mod_feed (3.0.0) | mod_finder (3.0.0) |
Modules :: ADMIN :: mod_jantivirus (2.5.0) | mod_toolbar (3.0.0) | mod_multilangstatus (3.0.0) | mod_title (3.0.0) | mod_stats_admin (3.0.0) | mod_submenu (3.0.0) | mod_menu (3.0.0) | mod_latest (3.0.0) | mod_login (3.0.0) | mod_quickicon (3.0.0) | mod_custom (3.0.0) | mod_version (3.0.0) | mod_logged (3.0.0) | mod_status (3.0.0) | mod_popular (3.0.0) | mod_feed (3.0.0) |

Plugins :: SITE :: plg_attachments_for_content (3.1.3) | plg_attachments_plugin_framewo (3.1.3) | plg_finder_tags (3.0.0) | plg_finder_contacts (3.0.0) | plg_finder_newsfeeds (3.0.0) | plg_finder_weblinks (3.0.0) | plg_finder_content (3.0.0) | plg_finder_categories (3.0.0) | plg_extension_joomla (3.0.0) | plg_twofactorauth_totp (3.2.0) | plg_twofactorauth_yubikey (3.2.0) | PLG_INSTALLER_FOLDERINSTALLER (3.6.0) | PLG_INSTALLER_URLINSTALLER (3.6.0) | plg_installer_packageinstaller (3.6.0) | plg_user_joomla (3.0.0) | plg_user_contactcreator (3.0.0) | plg_user_profile (3.0.0) | plg_authentication_cookie (3.0.0) | plg_authentication_gmail (3.0.0) | plg_authentication_joomla (3.0.0) | plg_authentication_ldap (3.0.0) | plg_quickicon_attachments (3.1.3) | plg_quickicon_extensionupdate (3.0.0) | plg_quickicon_joomlaupdate (3.0.0) | plg_quickicon_akeebabackup (1.0) | plg_captcha_recaptcha (3.4.0) | plg_search_attachments (3.1.3) | plg_search_tags (3.0.0) | plg_search_contacts (3.0.0) | plg_search_newsfeeds (3.0.0) | plg_search_weblinks (3.0.0) | plg_search_content (3.0.0) | plg_search_categories (3.0.0) | plg_system_languagecode (3.0.0) | plg_system_logout (3.0.0) | plg_system_languagefilter (3.0.0) | plg_system_sef (3.0.0) | PLG_SYSTEM_AKEEBAUPDATECHECK_T (1.1) | plg_system_stats (3.5.0) | plg_system_p3p (3.0.0) | plg_system_log (3.0.0) | plg_system_updatenotification (3.5.0) | plg_system_highlight (3.0.0) | plg_system_debug (3.0.0) | plg_system_redirect (3.0.0) | plg_system_remember (3.0.0) | plg_system_show_attachments_in (3.1.3) | plg_system_cache (3.0.0) | PLG_SYSTEM_BACKUPONUPDATE_TITL (3.7) | YT Framework (2.2.3) | plg_content_attachments (3.1.3) | plg_content_finder (3.0.0) | plg_content_geshi (3.0.0) | plg_content_joomla (3.0.0) | Sj Related News (1.0) | plg_content_vote (3.0.0) | plg_content_loadmodule (3.0.0) | plg_content_pagenavigation (3.0.0) | plg_content_pagebreak (3.0.0) | plg_content_emailcloak (3.0.0) | plg_editors-xtd_module (3.5.0) | plg_editors-xtd_insert_attachm (3.1.3) | plg_editors-xtd_readmore (3.0.0) | plg_editors-xtd_pagebreak (3.0.0) | plg_editors-xtd_article (3.0.0) | plg_editors-xtd_add_attachment (3.1.3) | plg_editors-xtd_image (3.0.0) | plg_editors_tinymce (4.3.12) | plg_editors_codemirror (5.15.2) |

Templates :: SITE :: protostar (1.0) | sj_health (1.2.1) | beez3 (3.1.0) |
Templates :: ADMIN :: isis (1.0) | hathor (3.0.0) |

[leolam]

Open your own issue. Your issue can be totally different from anybody else' issue Therefore .....

posting in a solved issue on the forums won't give you any assistance

Leo

[eng_sadat]

thanks master:
done..
new topic has created :
"search console get Japanese links"