There are additional pages created which aren't in my backend Topic is solved

[erwin_m]

Hi,

On my website, which is up-to-date and rs-firewall is installed, there are several pages created. On my site I'm using the dutch and english language, the added pages are in /de/. I can't reach this pages in the backend, The real question is of course, how did they get there, I've bin reading a couple of hours about cleaning the site, but I still don't know where to start.

For a couple of months ago I had the same problem. At that point I hired someone to fix this for me. At that point the site looked clear of vulnerability's. That was under an older version of Joomla. After cleaning, everything is updated to the most recent version and still is. Also moved the site to another host. So I had a really fresh start, at least I think so.

Now the problems turn up again. My last Akeeba-backup is from 22 may, would restoring this solve my unwanted pages? Or do they exist outside my joomla-installation? I realize that there is some weak spot and that it will be found again.

Hope someone can tell me how to work on this problem.

Regards,

Erwin

[toivo]

I can't reach this pages in the backend

How do you then see those pages? What is the URL?

My last Akeeba-backup is from 22 may, would restoring this solve my unwanted pages?

That depends.

Please post the results of the Forum Post Assistant (FPA) by following the instructions from viewtopic.php?f=806&t=969442.

[erwin_m]

I've got a warning from Google search console wherein they mention 3 url's.

Links are like http://www.mydomain.nl/de/ist-[* spam *]-fr ... 3%A4uflich

Those url's aren't all reachable. Some of them results in a 404.

[Webdongle]

What have you been deleting and please run the fpa https://forumpostassistant.github.io/docs/

[erwin_m]

I haven't deleted anything. I've executed FPA, results are below. Hope that someone can tell m something from there.

Joomla! Instance :: Joomla! 3.9.6-Stable (Amani) 7-May-2019
Joomla! Platform :: Joomla Platform 13.1.0-Stable (Curiosity) 24-Apr-2013
Joomla! Configured :: Yes | Read-Only (444) | Owner: --protected-- . (uid: 1/gid: 1) | Group: --protected-- (gid: 1) | Valid For: 3.9
Configuration Options :: Offline: false | SEF: true | SEF Suffix: false | SEF ReWrite: true | .htaccess/web.config: Yes | GZip: true | Cache: false | CacheTime: 15 | CacheHandler: file | CachePlatformPrefix: false | FTP Layer: false | Proxy: false | LiveSite: | Session lifetime: 15 | Session handler: database | Shared sessions: false | SSL: 2 | Error Reporting: none | Site Debug: false | Language Debug: false | Default Access: 1 | Unicode Slugs: false | dbConnection Type: mysqli | PHP Supports J! 3.9.6: Yes | Database Supports J! 3.9.6: Yes | Database Credentials Present: Yes |

Host Configuration :: OS: Linux | OS Version: 2.6.32-954.3.5.lve1.4.64.el6.x86_64 | Technology: x86_64 | Web Server: Apache/2 | Encoding: gzip, deflate | Doc Root: --protected-- | System TMP Writable: Yes | Free Disk Space : 283.73 GiB |

PHP Configuration :: Version: 7.1.29 | PHP API: litespeed | Session Path Writable: Yes | Display Errors: | Error Reporting: 32767 | Log Errors To: | Last Known Error: | Register Globals: | Magic Quotes: | Safe Mode: | Open Base: | Uploads: 1 | Max. Upload Size: 2048M | Max. POST Size: 2048M | Max. Input Time: -1 | Max. Execution Time: 120 | Memory Limit: 2048M

Database Configuration :: Version: 10.2.23-MariaDB-cll-lve (Client:10.2.23) | Host: --protected-- (--protected--) | default Collation: latin1_swedish_ci (default Character Set: latin1) | Database Size: 14.12 MiB | #of Tables:  302

PHP Extensions :: Core (7.1.29) | date (7.1.29) | libxml (7.1.29) | openssl (7.1.29) | pcre (7.1.29) | sqlite3 (7.1.29) | zlib (7.1.29) | bz2 (7.1.29) | calendar (7.1.29) | ctype (7.1.29) | curl (7.1.29) | hash (1.0) | filter (7.1.29) | ftp (7.1.29) | gettext (7.1.29) | gmp (7.1.29) | SPL (7.1.29) | iconv (7.1.29) | pcntl (7.1.29) | readline (7.1.29) | Reflection (7.1.29) | session (7.1.29) | standard (7.1.29) | shmop (7.1.29) | SimpleXML (7.1.29) | mbstring (7.1.29) | tokenizer (7.1.29) | xml (7.1.29) | litespeed () | bcmath (7.1.29) | dom (20031129) | fileinfo (1.0.5) | gd (7.1.29) | intl (1.1.0) | json (1.5.0) | exif (7.1.29) | mcrypt (7.1.29) | mysqli (7.1.29) | mysqlnd (mysqlnd 5.0.12-dev - 20150407 - $Id: 38fea24f2847fa7519001be390c98ae0acafe387 $) | PDO (7.1.29) | pdo_mysql (7.1.29) | pdo_sqlite (7.1.29) | Phar (2.0.2) | posix (7.1.29) | soap (7.1.29) | sockets (7.1.29) | xmlreader (7.1.29) | xmlwriter (7.1.29) | xsl (7.1.29) | zip (1.13.5) | Zend Engine (3.1.0) |
Potential Missing Extensions ::

Switch User Environment (Experimental) :: PHP CGI: No | Server SU: No | PHP SU: No | Custom SU (LiteSpeed/Cloud/Grid): Yes
Potential Ownership Issues: No

Core Folders :: images/ (755) | components/ (755) | modules/ (755) | plugins/ (755) | language/ (755) | templates/ (755) | cache/ (755) | logs/ (755) | tmp/ (755) | administrator/components/ (755) | administrator/modules/ (755) | administrator/language/ (755) | administrator/templates/ (755) | administrator/logs/ (755) |

Elevated Permissions (First 10) ::

Database statistics :: Uptime: 643280 | Threads: 102 | Questions: 2029161319 | Slow queries: 16499 | Opens: 28278623 | Flush tables: 1 | Open tables: 2048 | Queries per second avg: 3154.398 |

Components :: SITE ::
Core :: com_mailto (3.0.0) 1 | com_wrapper (3.0.0) 1 |
3rd Party:: WF_LISTS_TITLE (2.7.13) ? | WF_INLINEPOPUPS_TITLE (2.7.13) ? | WF_EMOTIONS_TITLE (2.7.13) ? | WF_AUTOSAVE_TITLE (2.7.13) ? | WF_XHTMLXTRAS_TITLE (2.7.13) ? | WF_DIRECTIONALITY_TITLE (2.7.13) ? | WF_CLEANUP_TITLE (2.7.13) ? | WF_FONTSIZESELECT_TITLE (2.7.13) ? | WF_STYLESELECT_TITLE (2.7.13) ? | WF_CHARMAP_TITLE (2.7.13) ? | WF_MEDIA_TITLE (2.7.13) ? | WF_TEXTCASE_TITLE (2.7.13) ? | WF_VISUALCHARS_TITLE (2.7.13) ? | WF_FONTSELECT_TITLE (2.7.13) ? | WF_TABLE_TITLE (2.7.13) ? | WF_BROWSER_TITLE (2.7.13) ? | WF_SEARCHREPLACE_TITLE (2.7.13) ? | WF_LINK_TITLE (2.7.13) ? | WF_IMGMANAGER_TITLE (2.7.13) ? | WF_ANCHOR_TITLE (2.7.13) ? | WF_CONTEXTMENU_TITLE (2.7.13) ? | WF_WORDCOUNT_TITLE (2.7.13) ? | WF_ARTICLE_TITLE (2.7.13) ? | WF_FONTCOLOR_TITLE (2.7.13) ? | WF_SOURCE_TITLE (2.7.13) ? | WF_KITCHENSINK_TITLE (2.7.13) ? | WF_HR_TITLE (2.7.13) ? | WF_FULLSCREEN_TITLE (2.7.13) ? | WF_PRINT_TITLE (2.7.13) ? | WF_VISUALBLOCKS_TITLE (2.7.13) ? | WF_LAYER_TITLE (2.7.13) ? | WF_CLIPBOARD_TITLE (2.7.13) ? | WF_PREVIEW_TITLE (2.7.13) ? | WF_FORMATSELECT_TITLE (2.7.13) ? | WF_SPELLCHECKER_TITLE (2.7.13) ? | WF_NONBREAKING_TITLE (2.7.13) ? | WF_STYLE_TITLE (2.7.13) ? | WF_POPUPS_WINDOW_TITLE (2.6.33) ? | WF_POPUPS_JCEMEDIABOX_TITLE (2.7.13) ? | WF_LINK_SEARCH_TITLE (2.7.13) ? | WF_AGGREGATOR_[youtube]_TITLE (2.7.13) ? | WF_AGGREGATOR_DAILYMOTION_TITLE (2.7.13) ? | WF_AGGREGATOR_GOOGLEMAPS_TITLE (2.3.4.4) ? | WF_AGGREGATOR_VINE_TITLE (2.6.33) ? | WF_AGGREGATOR_VIMEO_TITLE (2.7.13) ? | WF_LINKS_JOOMLALINKS_TITLE (2.7.13) ? | WF_FILESYSTEM_JOOMLA_TITLE (2.7.13) ? |

Components :: ADMIN ::
Core :: com_installer (3.0.0) 1 | com_associations (3.7.0) 1 | com_postinstall (3.2.0) 1 | com_weblinks (2.5.0) 1 | com_cpanel (3.0.0) 1 | com_templates (3.0.0) 1 | com_checkin (3.0.0) 1 | com_privacy (3.9.0) 1 | com_config (3.0.0) 1 | com_search (3.0.0) 1 | com_modules (3.0.0) 1 | com_languages (3.0.0) 1 | com_categories (3.0.0) 1 | com_actionlogs (3.9.0) 1 | com_redirect (3.0.0) 1 | com_ajax (3.2.0) 1 | com_menus (3.0.0) 1 | com_contenthistory (3.2.0) 1 | com_joomlaupdate (3.6.2) 1 | com_fields (3.7.0) 1 | com_login (3.0.0) 1 | com_admin (3.0.0) 1 | com_cache (3.0.0) 1 | com_banners (3.0.0) 1 | com_users (3.0.0) 1 | com_content (3.0.0) 1 | com_tags (3.1.0) 1 | com_media (3.0.0) 1 | com_finder (3.0.0) 1 | com_plugins (3.0.0) 1 | com_messages (3.0.0) 1 | com_newsfeeds (3.0.0) 1 |
3rd Party:: PLG_SYSTEM_NONUMBERELEMENTS (14.9.6) ? | PLG_SYSTEM_NNFRAMEWORK (14.9.6) ? | PLG_SYSTEM_NNFRAMEWORK (14.9.6) ? | NoNumber Installer (14.9.6) ? | PLG_EDITORS-XTD_SOURCERER (4.4.4FREE) ? | PLG_SYSTEM_SOURCERER (4.4.4FREE) ? | PLG_EDITORS-XTD_SOURCERER (4.4.4FREE) ? | PLG_SYSTEM_SOURCERER (4.4.4FREE) ? | NoNumber Installer (14.9.6) ? | COM_J2XML (3.1.103) ? | AceSEF (4.2) ? | Content (1.5.12) ? | Mail To (1.5.1) ? | Banners (1.5.2) ? | Web Links (1.5.1) ? | Search (1.5.1) ? | Users (1.5.0) ? | AceSEF (1.5.1) ? | Contact (1.5.3) ? | Wrapper (1.5.0) ? | News Feeds (1.5.1) ? | COM_JCE (2.7.13) 0 | RSFirewall! (2.11.27) 1 | VM Bulk Update (1.5) ? | J2XML Importer (1.6.0.72) ? | VM Invoice 3 (3.1.11) ? | tcpdf (1.0.5) 1 | COM_SITEMAP (1.0) ? | VirtueMart_allinone (-) 1 | VirtueMart_allinone (2.6.22) 1 | ECB Currency Converter (1.0) ? | VIRTUEMART (-) 1 | Akeeba (6.5.1) 1 | CSVI (5.11) ? | com_rsform (2.2.2) 1 | Admintools (3.4.3) ? |

Modules :: SITE ::
Core :: mod_footer (3.0.0) 1 | mod_tags_popular (3.1.0) 1 | mod_search (3.0.0) 1 | mod_articles_categories (3.0.0) 1 | mod_syndicate (3.0.0) 1 | mod_menu (3.0.0) 1 | mod_articles_news (3.0.0) 1 | mod_breadcrumbs (3.0.0) 1 | mod_wrapper (3.0.0) 1 | mod_feed (3.0.0) 1 | mod_articles_category (3.0.0) 1 | mod_finder (3.0.0) 1 | mod_articles_latest (3.0.0) 1 | mod_custom (3.0.0) 1 | mod_weblinks (2.5.0) 1 | mod_tags_similar (3.1.0) 1 | mod_whosonline (3.0.0) 1 | mod_users_latest (3.0.0) 1 | mod_related_items (3.0.0) 1 | mod_articles_archive (3.0.0) 1 | mod_random_image (3.0.0) 1 | mod_banners (3.0.0) 1 | mod_articles_popular (3.0.0) 1 | mod_languages (3.5.0) 1 | mod_stats (3.0.0) 1 | mod_login (3.0.0) 1 |
3rd Party:: JoomlArtWork Menu (1.0) 1 | Image Slider (4.0) 1 | mod_virtuemart_category (3.4.2) 1 | mod_virtuemart_search (3.4.2) 1 | mod_virtuemart_manufacturer (3.4.2) 1 | mod_virtuemart_currencies (3.4.2) 1 | Unite Language Switcher (1.0.3) 1 | mod_virtuemart_product (3.4.2) 1 | mod_virtuemart_cart (3.4.2) 1 |

Modules :: ADMIN ::
Core :: mod_submenu (3.0.0) 1 | mod_menu (3.0.0) 1 | mod_stats_admin (3.0.0) 1 | mod_multilangstatus (3.0.0) 1 | mod_feed (3.0.0) 1 | mod_popular (3.0.0) 1 | mod_custom (3.0.0) 1 | mod_latestactions (3.9.0) ? | mod_title (3.0.0) 1 | mod_logged (3.0.0) 1 | mod_toolbar (3.0.0) 1 | mod_version (3.0.0) 1 | mod_privacy_dashboard (3.9.0) ? | mod_latest (3.0.0) 1 | mod_status (3.0.0) 1 | mod_quickicon (3.0.0) 1 | mod_login (3.0.0) 1 | mod_sampledata (3.8.0) 1 |
3rd Party:: VirtueMart Administrator Menu (3.4.2) ? | AceSEF - Quick Icons (1.7.0) 1 | RSFirewall! Control Panel Module (1.4.0) 1 |

Libraries :: SITE ::
Core ::
3rd Party:: Helvetica (-) ? | Free Mono (-) ? | Regular Labs Library (19.4.11218) 1 | file_fof30 (3.4.4) ? |

Plugins :: SITE ::
Core :: plg_content_vote (3.0.0) 1 | plg_content_finder (3.0.0) 1 | plg_content_pagebreak (3.0.0) 1 | plg_content_pagenavigation (3.0.0) 1 | plg_content_emailcloak (3.0.0) 1 | plg_content_confirmconsent (3.9.0) 0 | plg_content_fields (3.7.0) 1 | plg_content_loadmodule (3.0.0) 1 | plg_content_geshi (2.5.0) 0 | plg_content_joomla (3.0.0) 1 | plg_quickicon_phpversioncheck (3.7.0) 1 | plg_quickicon_privacycheck (3.9.0) ? | plg_quickicon_joomlaupdate (3.0.0) 1 | plg_quickicon_extensionupdate (3.0.0) 1 | plg_editors-xtd_image (3.0.0) 1 | plg_editors-xtd_readmore (3.0.0) 1 | plg_editors-xtd_pagebreak (3.0.0) 1 | plg_editors-xtd_menu (3.7.0) 1 | plg_editors-xtd_article (3.0.0) 1 | plg_editors-xtd_fields (3.7.0) 1 | plg_editors-xtd_module (3.5.0) 0 | PLG_ACTIONLOG_JOOMLA (3.9.0) 1 | plg_search_content (3.0.0) 1 | plg_search_weblinks (2.5.0) 1 | plg_search_categories (3.0.0) 1 | plg_search_contacts (3.0.0) 1 | plg_search_newsfeeds (3.0.0) 1 | plg_search_tags (3.0.0) 0 | plg_finder_content (3.0.0) 1 | plg_finder_weblinks (2.5.0) 1 | plg_finder_categories (3.0.0) 1 | plg_finder_contacts (3.0.0) 1 | plg_finder_newsfeeds (3.0.0) 1 | plg_finder_tags (3.0.0) 0 | PLG_INSTALLER_FOLDERINSTALLER (3.6.0) 1 | plg_installer_webinstaller (2.0.1) 1 | PLG_INSTALLER_URLINSTALLER (3.6.0) 1 | plg_installer_packageinstaller (3.6.0) 1 | plg_system_privacyconsent (3.9.0) ? | plg_system_debug (3.0.0) 1 | plg_system_remember (3.0.0) 0 | plg_system_p3p (3.0.0) 1 | PLG_SYSTEM_ACTIONLOGS (3.9.0) 0 | plg_system_highlight (3.0.0) 1 | plg_system_logout (3.0.0) 1 | plg_system_fields (3.7.0) 1 | plg_system_languagefilter (3.0.0) 1 | plg_system_log (3.0.0) 1 | plg_system_languagecode (3.0.0) 1 | plg_system_logrotation (3.9.0) ? | plg_system_updatenotification (3.5.0) 1 | plg_system_stats (3.5.0) 0 | plg_system_sessiongc (3.8.6) 1 | plg_system_sef (3.0.0) 1 | plg_system_cache (3.0.0) 0 | plg_system_redirect (3.0.0) 1 | plg_twofactorauth_totp (3.2.0) 0 | plg_twofactorauth_yubikey (3.2.0) 0 | plg_fields_imagelist (3.7.0) 1 | plg_fields_sql (3.7.0) 1 | plg_fields_list (3.7.0) 1 | plg_fields_integer (3.7.0) 1 | plg_fields_media (3.7.0) 1 | plg_fields_radio (3.7.0) 1 | plg_fields_textarea (3.7.0) 1 | plg_fields_usergrouplist (3.7.0) 1 | plg_fields_color (3.7.0) 1 | plg_fields_calendar (3.7.0) 1 | plg_fields_editor (3.7.0) 1 | plg_fields_checkboxes (3.7.0) 1 | plg_fields_text (3.7.0) 1 | plg_fields_repeatable (3.9.0) ? | plg_fields_user (3.7.0) 1 | plg_fields_url (3.7.0) 1 | plg_privacy_content (3.9.0) ? | plg_privacy_message (3.9.0) ? | plg_privacy_actionlogs (3.9.0) ? | plg_privacy_consents (3.9.0) ? | plg_privacy_user (3.9.0) ? | plg_authentication_gmail (3.0.0) 0 | plg_authentication_ldap (3.0.0) 0 | plg_authentication_ldap (2.5.0) 0 | plg_authentication_joomla (3.0.0) 1 | plg_authentication_cookie (3.0.0) 0 | plg_user_profile (3.0.0) 0 | plg_user_terms (3.9.0) ? | plg_user_contactcreator (3.0.0) 0 | plg_user_joomla (3.0.0) 1 | plg_extension_joomla (3.0.0) 1 | plg_captcha_recaptcha_invisible (3.8) ? | plg_captcha_recaptcha (3.4.0) 1 |
3rd Party:: PLG_CONTENT_ADMIRORCOLUMNIZER (3.5) 1 | plg_content_jce (2.7.13) 1 | PLG_CONTENT_[youtube] (2.2.2) 1 | plg_quickicon_akeebabackup (6.5.1) 1 | plg_quickicon_jce (2.7.13) 1 | plg_editors-xtd_sourcerer (7.5.0) 1 | PLG_ACTIONLOG_AKEEBABACKUP (6.5.1) 0 | Search - VirtueMart (3.4.2) ? | Realex_hpp_api (3.4.2) ? | plg_installer_rsform (1.0.0) 1 | plg_installer_rsfirewall (1.0.0) 1 | plg_installer_jce (2.7.13) 1 | realex_hpp_api (3.4.2) ? | Klarna (3.4.2) 1 | VM Payment - klikandpay (3.4.2) ? | Sofort Ideal (3.4.2) ? | Heidelpay (16.11.07) 1 | VM Payment - Paybox (3.4.2) 1 | AMAZON (3.4.2) ? | VM - Payment, Systempay (2.0.8c) ? | Klarna Checkout (3.4.2) ? | Standard (3.4.2) 1 | VM - Payment, PayZen (2.0.8c) ? | Skrill (3.4.2) ? | PayPal (3.4.2) 1 | 2Checkout (3.4.2) ? | Authorize.net AIM (3.4.2) ? | Sofort (3.4.2) ? | System - BIT Virtuemart Product Bad (3.1.4) ? | System - RSForm! Pro (1.52.1) 1 | System - RSFirewall! Active Scanner (1.4.0) 1 | manage.myJoomla.com Secure Plugin (n/a) 1 | AMAZON (3.4.2) ? | (3.1.11) ? | plg_system_sourcerer (7.5.0) 1 | plg_system_regularlabs (19.4.11218) 1 | System - AceSEF Meta Manager (Conte (4.1.0) ? | System - Admin Tools (3.4.3) 1 | PLG_SYSTEM_J2XML (3.1.26) 0 | plg_system_jce (2.7.13) 1 | PLG_SYSTEM_JQUERYEASY (2.2.1) 1 | PLG_SYSTEM_FANCYBOX (1.3.8) 1 | System - RSForm! Pro Delete Submiss (1.0.0) ? | PLG_SYSTEM_AKEEBAUPDATECHECK (6.5.1) 1 | System - AceSEF (4.1.0) 1 | VM Framework Loader during Plugin U (1.0) ? | PLG_SYSTEM_BACKUPONUPDATE (6.5.1) 1 | QMap - Content (1.0) 0 | QMap - Menu (1.0) 0 | QMap - Categories (1.0) 0 | plg_fields_mediajce (2.7.13) 1 | Stockable (2.6.22) ? | plgvm_specification (3.4.2) ? | VMCustom - textinput (3.4.2) ? | By weight, ZIP and countries (3.4.2) 1 | VM - Calculation Avalara Tax (3.4.2) ? | plg_extension_jce (2.7.13) 1 | plg_editors_codemirror (5.40.0) 1 | plg_editors_jce (2.7.13) 1 | plg_editors_tinymce (4.5.9) 1 |

Templates :: SITE :: beez_20 (2.5.0) 1 | horme_3 (1.9.0) 1 | beez5 (2.5.0) 1 | beez3 (3.1.0) 1 | Horme 2 (2.1.0) 1 | protostar (1.0) 1 | atomic (2.5.0) 1 |
Templates :: ADMIN :: bluestork (2.5.0) 1 | hathor (3.0.0) 1 | isis (1.0) 1 |

[PhilTaylor-Prazgod]

You cant "find" these "additional pages" because they dont exist. Your site is hacked. The hack responds to the urls, not Joomla. Fix the hack, and then these urls will no longer show "pages"

[erwin_m]

Okay, thank you for making that celar to me. So I don't have to look into joomla it self. Where could I find such a hack? I've looked into my htaccess-file, but don't see anything special.

[toivo]

You can follow the first link in Phil's signature and get your site audited free of charge.

[Webdongle]

Ace sef has a vulnerability https://vel.joomla.org/vel-blog/1492-ac ... -and-below

Please see viewtopic.php?f=714&t=946026 or https://myjoomla.com/

[erwin_m]

I have deactivated Ace sef. In the performed audit at the recommended site there are lots of problems. I don't know what is normal and what is critical. Also I don't know how to fix the files that are infected. Some of them are probably not belonging to joomla files and could be deleted, but I don't know which files to delete. Can anyone tell me what to do?

[Webdongle]

... but I don't know which files to delete. Can anyone tell me what to do?

All of them viewtopic.php?f=714&t=946026 or pay a professional to clean your site.

[leolam]

You can follow the first link in Phil's signature and get your site audited free of charge.

Myjoomla.com is the best way to resolve your hack and Phil is a pro and can get your site back in notime

Leo

[erwin_m]

Today Phil has cleaned up my site. He's indeed very fast and as far as I can see, right now, really a pro.

[PhilTaylor-Prazgod]

Today Phil has cleaned up my site. He's indeed very fast and as far as I can see, right now, really a pro.

Its what I do. Daily. :-)