Webmasters Stack Exchange is a question and answer site for pro webmasters. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a website based on Joomla 2.5. Recently people with AVG anti-virus started to complain that some strange windows appear when they open the site. An unknown line of code with comments "Google search bot" appears in index.php files and the permissions set changes.

AVG detected Blackhole and Sweet orange exploit kits. I removed manually all the code but a day later it appeared again. I installed OSE anti-virus plugin and RS Firewall plugin for Joomla and scanned and it said it was OK.Is it necessary to reinstall Joomla? Please, help me. Thank you in advance. Oh, I forgot to say that I can not change the FTP password.

share|improve this question

closed as off topic by Simon Hayter, John Conde Mar 28 '13 at 22:44

Questions on Webmasters Stack Exchange are expected to relate to webmastering within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

Not changing the FTP password is a bummer. It should be the first thing to do (together with all other passwords), then investigate. – Marcel Apr 24 '13 at 7:58

Your problem is that you have not identified how the hackers got in, simply removing the malware/virus doesn't address the actual issue of how they planted the code, therefore simply removing will resolve the problem temporary but at some point the hackers will use the same exploit and replant.

There could be could be 101 reasons why and no one here will be able to help without additional information and then it brings in another question/problem is it suitable for Pro Webmasters? Since its very localized and not very constructive therefor its likely to be closed.

Anyhow! You should follow these steps and hopefully you can get site back on track:

  • Identify how the hackers got in (Check your Access Logs, Error Logs, SQL logs)
  • Fix identified vulnerable code
  • Review all your security measures such as chmod, plugins, etc etc.

Alternatively the guys at Joomla actually have a forum that actively help people with such problems you can find this post directly here.

Also it's worth mentioning that many people within the Stack community are committing to getting a Joomla Stack Exchange into beta phrase at Area 51, it may be in your interest that you commit like so many of us have already have here at Pro Webmasters.

share|improve this answer
Bybe is right. Apache logs are your friend. – Steve Mar 28 '13 at 21:03

Not the answer you're looking for? Browse other questions tagged or ask your own question.