Random article is generating every day Topic is solved

[mvalouch]

Random article is generating every day

I suspect, that some malware is on website. Every day morning si generating some articles (one to five articles). The creatorName is empty. Category is "Joomla" and is inserted into root.
I made some actions:
- up to date joomla version
- uninstal non necesery extensions / modules
- remove all the "suspicious" articles

Thanks for trying help me.
Marek

Joomla! Instance :: Joomla! 3.9.27-Stable (Amani) 25-May-2021
Joomla! Platform :: Joomla Platform 13.1.0-Stable (Curiosity) 24-Apr-2013
Joomla! Configured :: Yes | Read-Only (444) |
Configuration Options :: Offline: false | SEF: true | SEF Suffix: false | SEF ReWrite: true | .htaccess/web.config: Yes | GZip: false | Cache: false | CacheTime: 15 | CacheHandler: file | CachePlatformPrefix: false | FTP Layer: false | Proxy: false | LiveSite: | Session lifetime: 15 | Session handler: database | Shared sessions: false | SSL: 2 | Error Reporting: default | Site Debug: false | Language Debug: false | Default Access: 1 | Unicode Slugs: false | dbConnection Type: mysqli | PHP Supports J! 3.9.27: Yes | Database Supports J! 3.9.27: Yes | Database Credentials Present: Yes |

Host Configuration :: OS: Linux | OS Version: 2.6.32-754.9.1.el6.x86_64 | Technology: x86_64 | Web Server: Apache | Encoding: gzip, deflate, br | System TMP Writable: Yes | Free Disk Space : Unknown |

PHP Configuration :: Version: 7.3.1 | PHP API: fpm-fcgi | Session Path Writable: Yes | Display Errors: 1 | Error Reporting: 24567 | Log Errors To: | Last Known Error: | Register Globals: | Magic Quotes: | Safe Mode: | Allow url fopen: 1 | Open Base: /data/web/virtuals/168741/virtual | Uploads: 1 | Max. Upload Size: 128M | Max. POST Size: 128M | Max. Input Time: 30 | Max. Execution Time: 90 | Memory Limit: 256M

Database Configuration :: Version: 5.5.5-10.1.19-MariaDB (Client:mysqlnd 5.0.12-dev - 20150407 - $Id: 401a40ebd5e281cf22215acdc170723a1519aaa9 $) | Database Size: 116.98 MiB | #of Tables with config prefix: 162 | #of other Tables: 0 | User Privileges : GRANT SELECTUser Privileges : INSERTUser Privileges : UPDATEUser Privileges : DELETEUser Privileges : CREATEUser Privileges : DROPUser Privileges : INDEXUser Privileges : ALTERUser Privileges : CREATE TEMPORARY TABLESUser Privileges : LOCK TABLESUser Privileges : EXECUTEUser Privileges : CREATE VIEWUser Privileges : SHOW VIEWUser Privileges : CREATE ROUTINEUser Privileges : ALTER ROUTINEUser Privileges : TRIGGER

PHP Extensions :: Core (7.3.1) | date (7.3.1) | libxml (7.3.1) | openssl (7.3.1) | pcre (7.3.1) | sqlite3 (7.3.1) | zlib (7.3.1) | bcmath (7.3.1) | bz2 (7.3.1) | calendar (7.3.1) | ctype (7.3.1) | curl (7.3.1) | dom (20031129) | hash (7.3.1) | fileinfo (7.3.1) | filter (7.3.1) | ftp (7.3.1) | gd (7.3.1) | gettext (7.3.1) | gmp (7.3.1) | SPL (7.3.1) | iconv (7.3.1) | session (7.3.1) | intl (7.3.1) | json (1.7.0) | mbstring (7.3.1) | standard (7.3.1) | mysqlnd (mysqlnd 5.0.12-dev - 20150407 - $Id: 401a40ebd5e281cf22215acdc170723a1519aaa9 $) | mysqli (7.3.1) | PDO (7.3.1) | pdo_mysql (7.3.1) | pdo_sqlite (7.3.1) | Phar (7.3.1) | posix (7.3.1) | Reflection (7.3.1) | imap (7.3.1) | SimpleXML (7.3.1) | soap (7.3.1) | sockets (7.3.1) | exif (7.3.1) | sysvmsg (7.3.1) | sysvsem (7.3.1) | sysvshm (7.3.1) | tokenizer (7.3.1) | wddx (7.3.1) | xml (7.3.1) | xmlreader (7.3.1) | xmlrpc (7.3.1) | xmlwriter (7.3.1) | xsl (7.3.1) | zip (1.15.4) | cgi-fcgi () | imagick (3.4.3) | ionCube Loader () | Zend OPcache (7.3.1) | Zend Engine (3.3.1) |
Potential Missing Extensions ::
Disabled Functions :: apache_child_terminate | apache_setenv | define_syslog_variables | diskfreespace | disk_free_space | disk_total_space | dl | exec | leak | link | openlog | passthru | pfsockopen | popen | posix_getgrnam | posix_getpgid | posix_getpwuid | posix_getpwnam | posix_getrlimit | posix_initgroups | posix_kill | posix_mkfifo | posix_mknod | posix_setpgid | posix_setsid | posix_setuid | posix_uname | proc_close | proc_get_status | proc_nice | proc_open | proc_terminate | putenv | readlink | register_tick_function | set_time_limit | shell_exec | show_source | symlink | syslog | system |

Switch User Environment :: PHP CGI: No | Server SU: No | PHP SU: No | Potential Ownership Issues: No

Core Folders :: images/ (755) | components/ (755) | modules/ (755) | plugins/ (755) | language/ (755) | templates/ (755) | cache/ (755) | logs/ (---) | tmp/ (755) | administrator/components/ (755) | administrator/modules/ (755) | administrator/language/ (755) | administrator/templates/ (755) | administrator/logs/ (755) |

Elevated Permissions (First 10) ::

Database statistics :: Uptime: 60964188 | Threads: 9 | Questions: 19273634080 | Slow queries: 0 | Opens: 54349304 | Flush tables: 1 | Open tables: 24991 | Queries per second avg: 316.146 |

Components :: Site ::
Core :: com_wrapper (3.0.0) 1 | com_mailto (3.0.0) 1 |
3rd Party:: WF_AGGREGATOR_DAILYMOTION_TITLE (2.5.12) ? | WF_AGGREGATOR_VIMEO_TITLE (2.5.12) ? | WF_AGGREGATOR_VINE_TITLE (2.5.12) ? | WF_AGGREGATOR_[youtube]_TITLE (2.5.12) ? | WF_FILESYSTEM_JOOMLA_TITLE (2.5.12) ? | WF_LINKS_JOOMLALINKS_TITLE (2.5.12) ? | WF_MEDIAPLAYER_JCEPLAYER_TITLE (2.5.12) ? | WF_POPUPS_JCEMEDIABOX_TITLE (2.5.12) ? | WF_POPUPS_WINDOW_TITLE (2.5.12) ? | WF_LINK_SEARCH_TITLE (2.5.12) ? | WF_ANCHOR_TITLE (2.5.12) ? | WF_ARTICLE_TITLE (2.5.12) ? | WF_AUTOSAVE_TITLE (2.5.12) ? | WF_BROWSER_TITLE (2.5.12) ? | WF_CHARMAP_TITLE (2.5.12) ? | WF_CLEANUP_TITLE (2.5.12) ? | WF_CLIPBOARD_TITLE (2.5.12) ? | WF_CONTEXTMENU_TITLE (2.5.12) ? | WF_DIRECTIONALITY_TITLE (2.5.12) ? | WF_FONTCOLOR_TITLE (2.5.12) ? | WF_FONTSELECT_TITLE (2.5.12) ? | WF_FONTSIZESELECT_TITLE (2.5.12) ? | WF_FORMATSELECT_TITLE (2.5.12) ? | WF_FULLSCREEN_TITLE (2.5.12) ? | WF_HR_TITLE (2.5.12) ? | WF_IMGMANAGER_TITLE (2.5.12) ? | WF_INLINEPOPUPS_TITLE (2.5.12) ? | WF_KITCHENSINK_TITLE (2.5.12) ? | WF_LAYER_TITLE (2.5.12) ? | WF_LINK_TITLE (2.5.12) ? | WF_LISTS_TITLE (2.5.12) ? | WF_MEDIA_TITLE (2.5.12) ? | WF_NONBREAKING_TITLE (2.5.12) ? | WF_PREVIEW_TITLE (2.5.12) ? | WF_PRINT_TITLE (2.5.12) ? | WF_SEARCHREPLACE_TITLE (2.5.12) ? | WF_SOURCE_TITLE (2.5.12) ? | WF_SPELLCHECKER_TITLE (2.5.12) ? | WF_STYLE_TITLE (2.5.12) ? | WF_STYLESELECT_TITLE (2.5.12) ? | WF_TABLE_TITLE (2.5.12) ? | WF_TEXTCASE_TITLE (2.5.12) ? | WF_VISUALBLOCKS_TITLE (2.5.12) ? | WF_VISUALCHARS_TITLE (2.5.12) ? | WF_XHTMLXTRAS_TITLE (2.5.12) ? |

Components :: Admin ::
Core :: com_users (3.0.0) 1 | com_templates (3.0.0) 1 | com_tags (3.1.0) 1 | com_search (3.0.0) 1 | com_redirect (3.0.0) 1 | com_postinstall (3.2.0) 1 | com_plugins (3.0.0) 1 | com_newsfeeds (3.0.0) 1 | com_modules (3.0.0) 1 | com_messages (3.0.0) 1 | com_menus (3.0.0) 1 | com_media (3.0.0) 1 | com_login (3.0.0) 1 | com_languages (3.0.0) 1 | com_joomlaupdate (3.6.2) 1 | com_installer (3.0.0) 1 | com_finder (3.0.0) 1 | com_cpanel (3.0.0) 1 | com_contenthistory (3.2.0) 1 | com_content (3.0.0) 1 | com_config (3.0.0) 1 | com_checkin (3.0.0) 1 | com_categories (3.0.0) 1 | com_cache (3.0.0) 1 | com_banners (3.0.0) 1 | com_ajax (3.2.0) 1 | com_admin (3.0.0) 1 | com_associations (3.7.0) 1 | com_fields (3.7.0) 1 | com_actionlogs (3.9.0) 1 | com_privacy (3.9.0) 1 |
3rd Party:: COM_TIMETABLE (1.6) 1 | UniForm (4.1.29) 1 | COM_SIGPRO (3.0.0) 1 | com_easytimetable (1.8.3) 1 | Akeeba (7.1.4) 1 | BaForms (1.6.3) 0 | com_uniterevolution2 (4.7.3 b1) 0 | SP Page Builder (2.3.5) 1 | RokSprocket (2.1.17) 0 | AcyMailing (5.5.0) 1 | AcyMailing (5.6.1) 1 | AcyMailing : (auto)Subscribe during (5.6.1) ? | AcyMailing Editor (5.6.1) 1 | AcyMailing Template Class Replacer (5.6.1) 1 | AcyMailing Tag : Joomla User Inform (5.6.1) ? | AcyMailing Tag : Date / Time (5.6.1) 1 | AcyMailing Tag : Manage the Subscri (5.6.1) ? | AcyMailing Tag : Subscriber informa (5.6.1) ? | AcyMailing Tag : content insertion (3.7.0) 1 | AcyMailing Tag and filter : Communi (3.7.2) ? | AcyMailing Tag and filter : Communi (3.7.2) ? | AcyMailing table of contents genera (1.0.0) ? | AcyMailing : Statistics Plugin (3.7.0) 1 | AcyMailing : share on social networ (1.0.0) ? | AcyMailing Tag : Website links (3.7.0) 1 | AcyMailing Manage text (1.0.0) 1 | AcyMailing : trigger Joomla Content (3.7.0) ? | AcyMailing Module (3.7.0) 1 | JCE (2.5.12) 1 | GDPR (1.2) 1 | com_profiles (1.5.0) 1 | MapyCZ (1.6) 1 | Smart Slider 3 (3.5.0.5) 1 |

Modules :: Site ::
Core :: mod_login (3.0.0) 1 | mod_languages (3.5.0) 1 | mod_footer (3.0.0) 1 | mod_finder (3.0.0) 1 | mod_feed (3.0.0) 1 | mod_custom (3.0.0) 1 | mod_breadcrumbs (3.0.0) 1 | mod_banners (3.0.0) 1 | mod_menu (3.0.0) 1 | mod_random_image (3.0.0) 1 | mod_related_items (3.0.0) 1 | mod_search (3.0.0) 1 | mod_stats (3.0.0) 1 | mod_syndicate (3.0.0) 1 | mod_tags_popular (3.1.0) 1 | mod_tags_similar (3.1.0) 1 | mod_users_latest (3.0.0) 1 | mod_whosonline (3.0.0) 1 | mod_wrapper (3.0.0) 1 | mod_articles_popular (3.0.0) 0 | mod_articles_news (3.0.0) 1 | mod_articles_latest (3.0.0) 0 | mod_articles_category (3.0.0) 1 | mod_articles_categories (3.0.0) 1 | mod_articles_archive (3.0.0) 1 |
3rd Party:: RokSprocket Module (2.1.17) 0 | SP Social (1.0.2) 1 | SP Page Builder (1.1) 1 | MOD_TIMETABLE_NAME (1.6) 1 | JSN UniForm (4.1.29) 1 | Unite Revolution Slider 2 (4.7) 0 | AcyMailing Module (3.7.0) 1 | Smart Slider 3 Module (3.5.0.5) 1 | image hover effect (1.2) 1 | Counter.GD (2.5.5) 1 |

Modules :: Admin ::
Core :: mod_version (3.0.0) 1 | mod_toolbar (3.0.0) 1 | mod_title (3.0.0) 1 | mod_submenu (3.0.0) 1 | mod_status (3.0.0) 1 | mod_stats_admin (3.0.0) 1 | mod_quickicon (3.0.0) 1 | mod_popular (3.0.0) 1 | mod_multilangstatus (3.0.0) 1 | mod_menu (3.0.0) 1 | mod_login (3.0.0) 1 | mod_logged (3.0.0) 1 | mod_latest (3.0.0) 1 | mod_feed (3.0.0) 1 | mod_custom (3.0.0) 1 | mod_sampledata (3.8.0) 1 | mod_privacy_dashboard (3.9.0) 1 | mod_latestactions (3.9.0) 1 |
3rd Party:: mod_sppagebuilder_icons (1.0.2) 1 | mod_sppagebuilder_admin_menu (1.1) 1 | mod_sppagebuilder_admin_menu (1.3) 1 |

Libraries ::
Core ::
3rd Party:: file_fof30 (3.5.4) ? | Regular Labs Library (20.11.23860) 1 |

Plugins ::
Core :: plg_user_profile (3.0.0) 0 | plg_user_joomla (3.0.0) 1 | plg_user_contactcreator (3.0.0) 0 | plg_user_terms (3.9.0) 0 | plg_twofactorauth_yubikey (3.2.0) 0 | plg_twofactorauth_totp (3.2.0) 0 | plg_system_updatenotification (3.5.0) 1 | plg_system_stats (3.5.0) 1 | plg_system_sef (3.0.0) 1 | plg_system_remember (3.0.0) 1 | plg_system_redirect (3.0.0) 0 | plg_system_p3p (3.0.0) 1 | plg_system_logout (3.0.0) 1 | plg_system_log (3.0.0) 1 | plg_system_languagefilter (3.0.0) 0 | plg_system_languagecode (3.0.0) 0 | plg_system_highlight (3.0.0) 1 | plg_system_debug (3.0.0) 1 | plg_system_cache (3.0.0) 0 | plg_system_fields (3.7.0) 1 | plg_system_sessiongc (3.8.6) 1 | plg_system_sessiongc (3.8.6) 1 | plg_system_privacyconsent (3.9.0) 0 | plg_system_logrotation (3.9.0) 1 | PLG_SYSTEM_ACTIONLOGS (3.9.0) 0 | plg_search_tags (3.0.0) 1 | plg_search_newsfeeds (3.0.0) 1 | plg_search_content (3.0.0) 1 | plg_search_contacts (3.0.0) 1 | plg_search_categories (3.0.0) 1 | plg_quickicon_joomlaupdate (3.0.0) 1 | plg_quickicon_extensionupdate (3.0.0) 1 | plg_quickicon_phpversioncheck (3.7.0) 1 | plg_quickicon_privacycheck (3.9.0) 1 | PLG_INSTALLER_URLINSTALLER (3.6.0) 1 | plg_installer_packageinstaller (3.6.0) 1 | PLG_INSTALLER_FOLDERINSTALLER (3.6.0) 1 | plg_installer_webinstaller (2.1.2) 1 | plg_finder_tags (3.0.0) 1 | plg_finder_newsfeeds (3.0.0) 1 | plg_finder_content (3.0.0) 1 | plg_finder_contacts (3.0.0) 1 | plg_finder_categories (3.0.0) 1 | plg_extension_joomla (3.0.0) 1 | plg_editors-xtd_readmore (3.0.0) 1 | plg_editors-xtd_pagebreak (3.0.0) 1 | plg_editors-xtd_module (3.5.0) 1 | plg_editors-xtd_image (3.0.0) 1 | plg_editors-xtd_article (3.0.0) 1 | plg_editors-xtd_fields (3.7.0) 1 | plg_editors-xtd_menu (3.7.0) 1 | plg_content_vote (3.0.0) 1 | Content - SP Page Builder (1.2) 1 | plg_content_pagenavigation (3.0.0) 1 | plg_content_pagebreak (3.0.0) 1 | plg_content_loadmodule (3.0.0) 1 | plg_content_joomla (3.0.0) 1 | plg_content_finder (3.0.0) 0 | plg_content_emailcloak (3.0.0) 1 | plg_content_fields (3.7.0) 1 | plg_content_confirmconsent (3.9.0) 0 | plg_captcha_recaptcha (3.4.0) 0 | plg_captcha_recaptcha_invisible (3.8) 0 | plg_authentication_ldap (3.0.0) 0 | plg_authentication_joomla (3.0.0) 1 | plg_authentication_gmail (3.0.0) 0 | plg_authentication_cookie (3.0.0) 1 | plg_fields_calendar (3.7.0) 1 | plg_fields_checkboxes (3.7.0) 1 | plg_fields_color (3.7.0) 1 | plg_fields_editor (3.7.0) 1 | plg_fields_imagelist (3.7.0) 1 | plg_fields_integer (3.7.0) 1 | plg_fields_list (3.7.0) 1 | plg_fields_media (3.7.0) 1 | plg_fields_radio (3.7.0) 1 | plg_fields_sql (3.7.0) 1 | plg_fields_text (3.7.0) 1 | plg_fields_textarea (3.7.0) 1 | plg_fields_url (3.7.0) 1 | plg_fields_user (3.7.0) 1 | plg_fields_usergrouplist (3.7.0) 1 | plg_fields_repeatable (3.9.0) 1 | plg_privacy_message (3.9.0) 1 | plg_privacy_user (3.9.0) 1 | plg_privacy_consents (3.9.0) 1 | plg_privacy_actionlogs (3.9.0) 1 | plg_privacy_content (3.9.0) 1 | PLG_ACTIONLOG_JOOMLA (3.9.0) 1 |
3rd Party:: K2 - Simple Image Gallery Pro (3.0.0) 1 | plg_system_jsnframework (2.1.9) 1 | plg_extension_jsnframework (2.1.9) 1 | PLG_SYSTEM_BACKUPONUPDATE (7.1.4) 1 | plg_system_shlib (0.3.1.587) 1 | PLG_SYS_BYEBYEGENERATOR (1.12) 0 | BaForms - System (1.6.3) 0 | System - SP Page Builder Pro Update (1.0) ? | System - SP PageBuilder (1.1) 1 | System - RokSprocket (2.1.17) 0 | System - RokCommon (3.2.5) 1 | AcyMailing : (auto)Subscribe during (5.5.0) ? | System - Helix3 Framework (2.5.8) 1 | plg_system_jce (2.5.12) 1 | PLG_SYSTEM_AKEEBAUPDATECHECK (7.1.4) 0 | System - GDPR (1.2) 1 | System - JSN Uniform (4.1.29) 1 | plg_system_regularlabs (20.11.23860) 1 | plg_system_sourcerer (8.4.3) 1 | plg_system_tjupdates (1.0.3) 1 | Smart Slider 3 System Plugin (3.5.0.5) 1 | System - Add Custom CSS (1.2.1) 1 | PLG_CWGEARS (0.6.4) 1 | plg_system_articlehits (1.0) 1 | plg_search_easytimetable (1.1.0) 1 | plg_search_sppagebuilder (1.2) 1 | plg_quickicon_akeebabackup (7.1.4) 1 | plg_quickicon_jcefilebrowser (2.5.12) 1 | Smart Slider 3 Updater Plugin (3.5.0.5) 1 | plg_extension_jsnframework (2.1.9) 1 | JSN_UNIFORM_PLUGIN_BUTTON_TITLE (4.1.29) 1 | Button - Simple Image Gallery Pro (3.0.0) 1 | PLG_EDITORS_XTD_WBAMP (1.6.0.607) 1 | BaForms - Shortcode (1.4.0) 0 | plg_editors-xtd_sourcerer (8.4.3) 1 | MapyCZ button (1.6) 1 | pdf_btn (2.2.0) 1 | plg_editors_tinymce (4.5.12) 1 | plg_editors_codemirror (5.60.0) 1 | AcyMailing Editor (5.5.0) 1 | plg_editors_jce (2.5.12) 1 | PLG_TIMETABLE_NAME (1.6) 1 | JSN_UNIFORM_PLUGIN_CONTENT_TITLE (4.1.29) 1 | Content - Simple Image Gallery Pro (3.0.0) ? | Content - RokInjectModule (1.7) 1 | MapyCZ (1.8) 1 | pdf_embed (2.2.0) 1 | Helix3 - Ajax (2.5.6) 1 | AcyMailing Template Class Replacer (5.5.0) 1 | AcyMailing Tag : Joomla User Inform (5.5.0) ? | AcyMailing Tag : Date / Time (5.5.0) 1 | AcyMailing Tag : Manage the Subscri (5.5.0) ? | AcyMailing Tag : Subscriber informa (5.5.0) ? | AcyMailing Tag : content insertion (3.7.0) 1 | AcyMailing Tag and filter : Communi (3.7.2) ? | AcyMailing Tag and filter : Communi (3.7.2) ? | AcyMailing table of contents genera (1.0.0) ? | AcyMailing : Statistics Plugin (3.7.0) 1 | AcyMailing : share on social networ (1.0.0) ? | AcyMailing Tag : Website links (3.7.0) 1 | AcyMailing Manage text (1.0.0) 1 | AcyMailing : trigger Joomla Content (3.7.0) ? | PLG_ACTIONLOG_AKEEBABACKUP (7.1.4) 1 |

Templates :: Site :: ts_onebiz (1.2) 1 | protostar (1.0) 1 | beez3 (3.1.0) 1 |
Templates :: Admin :: isis (1.0) 1 | hathor (3.0.0) 1 |

[illovo]

This is just a quick&dirty test: In frontend enter the url
index.php?option=com_content&view=form&layout=edit
when you are NOT logged in. If you see an editor something is wrong. You're lucky if it's just incorrectly set user permissions.

This is only a superficial initial examination: If new articles are created don't delete them all immediately. Ask your host for the access logs of your site. Try to find the URL that was logged at the creation date and time of the articles. Note that there may be a time difference between the creation date displayed in Joomla and the one in the log file. Depending on the set time zone.

You should close your site then with a .htaccess protection to protect your visitors from malware. Nobody knows what else is going on on your website at the moment.

Normally, however, you will need an expert to restore a hacked site for you. Most of the time, it is cheaper to rebuild the website yourself.

Unfortunately, the possibilities are far too extensive for useful and complete tips to be given in a forum.

[leolam]

What is your site's URL pls.

You have been hacked I am pretty sure of what you describe and that is logical since you are using a tremendous amount of outdated extensions

Please post your link and after that go to mysites.guru and subscribe. The first scan is free... Very sophisticated checking and advice by Phil Taylor, a Joomla super Expert

Leo

[illovo]

What is your site's URL pls.

Really? Posting URLs of potentially infected sites in a forum ;-) Normally forums remove them for good reasons.

[mvalouch]

Thank everyone for so much worthly advices. I found the source of problems. The site was really hacked. I removed the backdoor hacked place (thanks to access log) and found some problems via antivirus and scans. It was also a necessity to do some work to boos security.
Now it seems like no more "randomly" added articles and none randomly access with suspicios behaviour.

Thanks again everyone

[pe7er]

Good to see that you've solved it. Thanks for sharing your solution!