Hacked now can´t login to admin page + header error message.

[tensimismado01]

Hello everyone,
Like to say I´ve been reading posts and googling before posting.
My hosting company e-mailed me to inform me I´d been hacked and that they´d stopped traffic to my site. I paid to have malware removed but now I can´t login to the admin page. Also the site appearance has changed and has a header error;
Warning: session_start() [function.session-start]: Cannot send session cookie - headers already sent by (output started at /nfs/c10/h04/mnt/175462/domains/toucheensimismado.com/html/libraries/joomla/object/object.php:1) in /nfs/c10/h04/mnt/175462/domains/toucheensimismado.com/html/libraries/joomla/session/session.php on line 654
Not sure if the issues are related.
I asked the hosting company if they could reset my password but they said it´s a joomla issue not related to hosting.
I´ve looked through the posts here and created a new super user and followed steps outlined in articles such as;
https://docs.joomla.org/How_do_you_reco ... rator_User
However, I still can´t login.
Any help would be more than appreciated.
Cheers,

[John C]

Your site loads for me apart from the errors you mentioned. When my site got hacked I installed in a new folder a new joomla install. Deleted the installation folder and copied over the configuration.php file and installed the template. You may have to tweak the configuration file but if the site works perfectly it may be then simple to back up the old and copy over the new install in place of the old. Reinstall any exstentions imags etc. Backup at every step just in case.

[Per Yngve Berg]

Mod. Note: Relocated the topic to the Security J3.x forum. Follow the procedure in the stickiers of this forum on how to clean your site.

[Webdongle]

1. Run the fpa and post on here
2. Uninstall any untrusted 3rd party extensions and Templates https://vel.joomla.org/live-vel
3. Delete all the files on the server
4. Scan your computer and all computers that have server or Joomla admin access
5. Change Passwords
6. Install Joomla (of the same version) to a new database. Install up to date 3rd party extensions (that are not on the VEL) then edit the configuration.php to connect to the original database. Update Joomla if you have and old version
7. Change your Joomla SU/Admin Passwords and check the users/groups/access levels are correct and not been tampered with. Update your Joomla And run the fpa again

You could do steps #f and #g on localhost then use Akeeba to transfer the site to your EMPTY server

See http://forum.joomla.org/viewtopic.php?f=714&t=757645 for full details