Trying to recover From Hack..

Discussion regarding Joomla! 2.5 security issues.

Moderators: Bernard T, mandville, fcoulter, PhilD, General Support Moderators

Forum rules
Forum Rules
Absolute Beginner's Guide to Joomla! <-- please read before posting, this means YOU.
Forum Post Assistant / FPA - If you are serious about wanting help, you will use this tool to help you post.
Locked
hotrod007
Joomla! Intern
Joomla! Intern
Posts: 71
Joined: Tue Jan 09, 2007 5:15 pm
Contact:

Trying to recover From Hack..

Post by hotrod007 » Sat Jan 17, 2015 4:17 pm

Site was recently Hacked with a Pharmaceutical Links showing in Google.. Of course this was brought to my attention when my client got an email saying it was.. and they could fix it..

I updated to latest version.. (which I missed when I should have).. And My host helped direct me to multiple malicious files and folders that I removed.

Over Wrote all core Joomla files..

Site and all Are up to latest 2.5 version. But..

In the Admin side, Configuration Page It come up with no formatting and has this error.
Fatal error: Cannot redeclare get_request_info() (previously declared in /home/laceycha/public_html/libraries/joomla/session/storage/index.php:31) in /home/laceycha/public_html/libraries/joomla/session/storage/index.php on line 39

That was one of the Injected files it seems that from somewhere is trying to be called.

See screen shot
You do not have the required permissions to view the files attached to this post.

User avatar
toivo
Joomla! Master
Joomla! Master
Posts: 11161
Joined: Thu Feb 15, 2007 5:48 am
Location: Oxford, UK

Re: Trying to recover From Hack..

Post by toivo » Sat Jan 17, 2015 5:00 pm

That was one of the Injected files it seems that from somewhere is trying to be called.
If you removed this file before, some other infected or injected file adds it back and tries to run it.

You need to follow the instructions in the sticky notes at the top of this Security forum, remove all files and rebuild the site. Otherwise there is no guarantee that the malicious files are gone.
Toivo Talikka, Global Moderator

hotrod007
Joomla! Intern
Joomla! Intern
Posts: 71
Joined: Tue Jan 09, 2007 5:15 pm
Contact:

Re: Trying to recover From Hack..

Post by hotrod007 » Sat Jan 17, 2015 5:31 pm

Your Right.. I was back in there.. I deleted it and the admin section loads fine now..
I'll have to see if it comes back and start checking as you said..

Looks like it got back in there 2 hours before I over wrote all the core files..

Thank You


Locked

Return to “Security in Joomla! 2.5”