Suspect compromised - reinstall help
Moderators: mandville, General Support Moderators
Forum rules
Forum Rules
Absolute Beginner's Guide to Joomla! <-- please read before posting, this means YOU.
Forum Post Assistant / FPA - If you are serious about wanting help, you will use this tool to help you post.
Forum Rules
Absolute Beginner's Guide to Joomla! <-- please read before posting, this means YOU.
Forum Post Assistant / FPA - If you are serious about wanting help, you will use this tool to help you post.
-
- Joomla! Enthusiast
- Posts: 103
- Joined: Wed Jan 16, 2013 9:02 pm
Suspect compromised - reinstall help
Hello,
I suspect a site of being compromised and want to delete all files and upload the latest joomla (then replace config and upload images).
I have a few extensions installed, do I uninstall them first? Or how do you go about the extenstions I've installed, I guess the database will look for them?
Thank you
I suspect a site of being compromised and want to delete all files and upload the latest joomla (then replace config and upload images).
I have a few extensions installed, do I uninstall them first? Or how do you go about the extenstions I've installed, I guess the database will look for them?
Thank you
- bewebdev
- Joomla! Ace
- Posts: 1017
- Joined: Tue Apr 17, 2012 11:28 am
- Location: Lincolnshire, UK
Re: Suspect compromised - reinstall help
see PhilD's response in this thread
http://forum.joomla.org/viewtopic.php?f=621&t=785533
regards
@bewebdev ^AW
http://forum.joomla.org/viewtopic.php?f=621&t=785533
regards
@bewebdev ^AW
-
- Joomla! Enthusiast
- Posts: 103
- Joined: Wed Jan 16, 2013 9:02 pm
Re: Suspect compromised - reinstall help
Thanks,
I am getting closer - deleted all and uploaded a new joomla. Now I want to get back a few plugins. Is there any easy way to find out exactely where to put the plugin-files?
I am getting closer - deleted all and uploaded a new joomla. Now I want to get back a few plugins. Is there any easy way to find out exactely where to put the plugin-files?
- bewebdev
- Joomla! Ace
- Posts: 1017
- Joined: Tue Apr 17, 2012 11:28 am
- Location: Lincolnshire, UK
Re: Suspect compromised - reinstall help
random12
Plugins are usually installed using the Joomla extension manager, unless the developer of the particular plugin advises otherwise e.g. some JCE editor plugins are installed within the jce editor. However most common plugins, modules, and components are installed via the extension manager.
regards
@bewebdev ^AW
Plugins are usually installed using the Joomla extension manager, unless the developer of the particular plugin advises otherwise e.g. some JCE editor plugins are installed within the jce editor. However most common plugins, modules, and components are installed via the extension manager.
regards
@bewebdev ^AW
-
- Joomla! Enthusiast
- Posts: 103
- Joined: Wed Jan 16, 2013 9:02 pm
Re: Suspect compromised - reinstall help
Thank you, I know that. What I meant was, since they already are installed I just need to upload the files again. So I need to know where to put them.
More info: From what I gather the database is still intact. So I deleted all files and uploaded a new Joomla. Now updated the configuration file and images and everything seems to be working. If I try to install a plugin the normal way I get an error message that the plugin is already installed. So I should just have to put the fresh files in the correct location, right?
More info: From what I gather the database is still intact. So I deleted all files and uploaded a new Joomla. Now updated the configuration file and images and everything seems to be working. If I try to install a plugin the normal way I get an error message that the plugin is already installed. So I should just have to put the fresh files in the correct location, right?
- bewebdev
- Joomla! Ace
- Posts: 1017
- Joined: Tue Apr 17, 2012 11:28 am
- Location: Lincolnshire, UK
Re: Suspect compromised - reinstall help
random12
when you say plugins do you mean 'plugins' or 'module, components and plugins' as a generic meaning?
the reason why i ask is that depending on what you are trying to install, installing manually will be placed in a different directory?
regards
@bewebdev ^AW
when you say plugins do you mean 'plugins' or 'module, components and plugins' as a generic meaning?
the reason why i ask is that depending on what you are trying to install, installing manually will be placed in a different directory?
regards
@bewebdev ^AW
-
- Joomla! Enthusiast
- Posts: 103
- Joined: Wed Jan 16, 2013 9:02 pm
Re: Suspect compromised - reinstall help
Actually I think this applies to all non core extensions that I had installed. What I need to do is download fresh copies of the extensions unzip them and upload them to the right place. With one plugin it was very easy, all files in one folder (plugins/content/plugin-name). But does that apply to all extensions?
Missing files from extensions leads to this issue of not being able to edit articles. Maybe the extension-part could be a bit more informative in the pinned security post (simply reinstalling the normal way throws an error).
Missing files from extensions leads to this issue of not being able to edit articles. Maybe the extension-part could be a bit more informative in the pinned security post (simply reinstalling the normal way throws an error).
- bewebdev
- Joomla! Ace
- Posts: 1017
- Joined: Tue Apr 17, 2012 11:28 am
- Location: Lincolnshire, UK
Re: Suspect compromised - reinstall help
random12
looking at the instructions provided, i would have differed my approach to unistalling components using the extension manager first, by doing this you wouldn't be deleting your data, however when it came round to where you are now it would mean you could reinstall the components etc using the built in installation tool.
You will now need to as you say download fresh copies of all the components etc you had on the site, manually extract them onto your desktop and in theory uploading them via ftp they should install correctly, you may need to agree to overwrite specific files etc. I would do this in a step by step process, so upload, login, check, if successful backup move on, This way you can be sure that if something breaks your own only have to backup by one step rather than the lot.
regards
@bewebdev ^AW
looking at the instructions provided, i would have differed my approach to unistalling components using the extension manager first, by doing this you wouldn't be deleting your data, however when it came round to where you are now it would mean you could reinstall the components etc using the built in installation tool.
You will now need to as you say download fresh copies of all the components etc you had on the site, manually extract them onto your desktop and in theory uploading them via ftp they should install correctly, you may need to agree to overwrite specific files etc. I would do this in a step by step process, so upload, login, check, if successful backup move on, This way you can be sure that if something breaks your own only have to backup by one step rather than the lot.
regards
@bewebdev ^AW
-
- Joomla! Enthusiast
- Posts: 103
- Joined: Wed Jan 16, 2013 9:02 pm
Re: Suspect compromised - reinstall help
Yep, that sounds like a good approach. I suggest to update this post, and include the uninstall of 3rd party extensions.
I gather there is an installscript in each extension describing where to put the file. Any tips on where to find that? I mean it shold be easy to read the destination-folders and upload the files there.
Thanks
I gather there is an installscript in each extension describing where to put the file. Any tips on where to find that? I mean it shold be easy to read the destination-folders and upload the files there.
Thanks
- mandville
- Joomla! Master
- Posts: 15152
- Joined: Mon Mar 20, 2006 1:56 am
- Location: The Girly Side of Joomla in Sussex
Re: Suspect compromised - reinstall help
that process is mentioned several times. and would be a matter of course if you follow the instructionsrandom12 wrote:Yep, that sounds like a good approach. I suggest to update this post, and include the uninstall of 3rd party extensions.
HU2HY- Poor questions = Poor answer
Un requested Help PM's will be reported, added to the foe list and possibly just deleted
{VEL Team Leader}{TM Auditor }{ Showcase & Security forums Moderator}
Un requested Help PM's will be reported, added to the foe list and possibly just deleted
{VEL Team Leader}{TM Auditor }{ Showcase & Security forums Moderator}
-
- Joomla! Enthusiast
- Posts: 103
- Joined: Wed Jan 16, 2013 9:02 pm
Re: Suspect compromised - reinstall help
It's a great guide. For the not so gifted like myself, I think it would be improved by clearly writing: "if possible, uninstall all 3-rd party extensions" as one of the steps.