Quote:
[ ] Run the
Forum Post Assistant / FPA Instructions
available here and are also included in the download package.
[ ] Ensure you have the
latest version of Joomla.
Delete all files in your Joomla installation. Replace the deleted files with fresh copies of a current full version of Joomla, and fresh copies of extensions and templates used.
Only by replacing all files in the installation (including extensions and templates) can you be sure to remove the backdoors inserted and hidden in files and directoriesI currently do not have any access to the server. Account (FTP/cPanel/etc) disabled by web host until I give them the ok to either wipe the site, or clean it. Due to this I'm unable to do the above.
Quote:
I've looked through the list and don't have any of the extensions installed that are listed under the heading 'January 2012 and onwards Reported Vulnerable Extensions'. As for the other extensions below that, I've listed some possibilities below. As I haven't worked on the sites in a long while, apart from updating them recently, and not currently having access to the sites, it's hard to say for certain.
FCKeditor - This
may be installed. I'm fairly certain it's not, but I have installed a 3rd party editor whose name I can't recall, so I wouldn't want to rule this out as a possibility.
Akeeba - All my sites are running the latest version of Akeeba Backup Free. I've checked the vulnerability, and I believe it's both resolved and not a major threat in itself anyway.
flexicontent - This was installed on one of the sites a while ago. It wasn't used on the live site (I was trying out a few different content creation components) but was left installed from testing phases in error. However, it was uninstalled shortly after the site launched several months ago, so not likely an issue.
xmap 1.2.10 - Both affected sites were running
a version of xmap. It may not have been the latest version, it was several months ago when the extension was installed, however I don't believe I updated the component. Could be a possibility...
They're the only extensions I recognise from that list.
[
Quote:
] Review and action
Security Checklist checklist 7 to make sure you've gone through all of the steps.
As per first point, most of the steps in this check list require access to the account, which I don't have.
Quote:
[ ] Scan all machines with FTP, Joomla super admin, and Joomla admin access for malware, virus, trojans, spyware, etc.
Working on a Mac with anti virus. Not bomb proof by any means but unlikely infected...
Quote:
[ ] Change all passwords and if possible user names for the website host control panel and your Joomla site.
See first point...
Quote:
[ ] Use proper permissions on files and directories. They should never be 777, but ideal is 644 and 755
I'm unable to say for certainty due to lack of access. However, looking at other (un-compromised) Joomla sites I run and were set up the same way, the permissions were set correctly. Files 644 and directories 755.
Quote:
[ ] Check your htaccess for for any odd code (i.e. code which is not in the standard htaccess supplied as part of the Joomla installation).
I can't access the .htaccess of the live sites, due to above reasons. However, my local version adds the following code to redirect all
http://* requests to
http://www.*.
Code:
# Rerdirect http://site to http://www
RewriteCond %{HTTP_HOST} ^domain.net
RewriteRule (.*) http://www.domain.net/$1 [R=301,L]
There's also a section required for components using suhosin, and a further section which I'm not entirely sure of. I'm using custom fonts and this appears to relate to that. I'm not sure exactly what it does, though.
Code:
<IfModule mod_php.c>
php_value suhosin.executor.include.whitelist tmpl://, file://
</IfModule>
<FilesMatch "\.(ttf|otf|woff)$">
<IfModule mod_headers.c>
Header set Access-Control-Allow-Origin "*"
</IfModule>
</FilesMatch>
Quote:
[ ] Check the crontab or Task Scheduler for unexpected jobs/tasks.
Unable to access.
Quote:
[ ] Ensure you do not have anonymous ftp enabled
Although unable to access now to confirm, by default anonymous FTP is disabled by my host. Whilst I think I can enable it, I have never done so and would assume that it is turned off.
