how to get rid of these files !

Discussion regarding Joomla! 3.x security issues.
Post Reply
zoohayr
Joomla! Apprentice
Joomla! Apprentice
Posts: 32
Joined: Tue Jun 28, 2016 1:44 am

how to get rid of these files !

Post by zoohayr » Wed Dec 30, 2020 10:13 am

Hello,

I know I was hacked, but I don't know how to get rid of it! I noticed that my results from my website in google redirects to links from advertising pages. I scanned the site with malware built into the host's cpanel. this software has to detect files like ".6fjklecce.ico". when i delete these files but when i scan the next day i find they are returned !
Last edited by toivo on Wed Dec 30, 2020 10:29 am, edited 1 time in total.
Reason: mod note: moved from 3.x General Questions

gws
Joomla! Virtuoso
Joomla! Virtuoso
Posts: 4188
Joined: Tue Aug 23, 2005 1:56 pm
Location: South coast, UK
Contact:

Re: how to get rid of these files !

Post by gws » Wed Dec 30, 2020 11:24 am

I would have my site audited by https://mysites.guru/ the first audit is free. Phil is a true joomla expert. I have no affiliation with the site.

User avatar
abernyte
Joomla! Virtuoso
Joomla! Virtuoso
Posts: 3926
Joined: Fri May 15, 2009 2:01 pm
Location: Écosse - Scozia - Escocia - Škotija -स्कॉटलैंड

Re: how to get rid of these files !

Post by abernyte » Wed Dec 30, 2020 11:27 am

Or follow viewtopic.php?f=714&t=946026 to the letter.
What we obtain too cheap, we esteem too lightly…Thomas Paine

zoohayr
Joomla! Apprentice
Joomla! Apprentice
Posts: 32
Joined: Tue Jun 28, 2016 1:44 am

Re: how to get rid of these files !

Post by zoohayr » Wed Dec 30, 2020 10:36 pm

Hello and thank you friends for your help. I prefer to go for the mysites.guru platform! because I have modifications in the joomla template and in the source files too. in the meantime I would like to know if the code in the attached file is far from being hackers' code? this is a file that I found in a plugin offered for free by its author.
You do not have the required permissions to view the files attached to this post.

User avatar
toivo
Joomla! Master
Joomla! Master
Posts: 13137
Joined: Thu Feb 15, 2007 5:48 am
Location: Zagreb, Croatia

Re: how to get rid of these files !

Post by toivo » Wed Jan 13, 2021 3:30 pm

Where did you download the plugin from? What is the plugin supposed to do? Does it provide some sort of a scroll effect?

The code itself, when put through a beautifier, looks obscure but possibly harmless.
Toivo Talikka, Global Moderator

User avatar
PhilTaylor-Prazgod
Joomla! Ace
Joomla! Ace
Posts: 1228
Joined: Sat Aug 20, 2005 12:32 pm
Location: Jersey, Channel Islands
Contact:

Re: how to get rid of these files !

Post by PhilTaylor-Prazgod » Wed Jan 13, 2021 5:30 pm

files named ".6fjklecce.ico" are hackers files. Your site is hacked.
Phil Taylor
Founder, Lead Developer
- https://mySites.guru - Manage Multiple Joomla/WordPress Sites In One Dashboard for Security, Audits, Backups and more....
- https://www.phil-taylor.com/ - My Twitter Streams

User avatar
JAVesey
Joomla! Hero
Joomla! Hero
Posts: 2289
Joined: Tue May 14, 2013 1:21 pm
Location: Cardiff, Wales, UK
Contact:

Re: how to get rid of these files !

Post by JAVesey » Sun Jan 17, 2021 10:45 am

zoohayr wrote:
Wed Dec 30, 2020 10:36 pm
...I have modifications in the joomla template and in the source files too...
Have modified Joomla core files? :eek:

Modified core files may well get overwritten during an update. I note that you haven’t said which Joomla version you’re running; have you been keeping your installation up to date?
John V
Cardiff, Wales, UK
Uses Joomla 3.9.24 and PHP7.4.11


Post Reply

Return to “Security in Joomla! 3.x”