Possible Duplicate:
My Sites Were Hacked. What To Do?

A few of my joomla sites were hacked. After I became aware of this, I did these things:

  1. Changed hosting passwords (mysql, ftp, control panel)
  2. Renamed joomla admin user name to "admin" in users table (Hacker had changed the user name how?)
  3. Upgraded joomla latest Added php.ini root directory of host.
  4. Disabled cgi access

But the site is still hacked. I checked up on the index.php file and owerwrite original index.php but the site is still hacked.

How is this possible?

  • It can comes from many source: from your server breach, maybe it uploads some single file that operate like a ftp and give full access to your server, maybe this is a problem from joomla wich isn't patched, etc ... – j0k Jul 26 '12 at 9:10
  • How can I find new uploaded file from logs or otherwhere? – RedLEON Jul 26 '12 at 9:12
  • Normaly when I navigate index.php, it must be show index.php. But the index.php doesn't run another index file activated. How it be possibbe I wonder? – RedLEON Jul 26 '12 at 9:23
  • I setup clamav and updated virus database. It's scanning now. – RedLEON Jul 26 '12 at 11:58
  • Hackers are damaged joomla templates directory and template files. – RedLEON Jul 26 '12 at 12:06

Start from Scratch

If you have a recent database and files copy nuke all and start all over again. This is truly the best way there is when you have been hacked in a massive way.

No Good Backups

Most of the time there is no good backup in my experience. And I guess you do not either. If you did a scan with ClamAV and or online scans with sites like

and found the contaminated files you could remove and or replace them by clean files. Hopefully all hidden shells will be caught as well as all other possible backdoors. It does seem like the infection is pretty bad though. So hard to say this will be waterproof. It has worked for me before so do try!

Backdoor Shell

In your case it seems there is probably a Shell file on your server you missed with a name the scans do not find easily. Online shells are files that have server rights to change other files on that server on command. Shells can have names like "I love you" or other less taunting names. I have found several in the past and have some on backup to use as intel in case I need to help another client.

Compare clean install to contaminated one

You could also do a comparison using Diff or Meld - GUI version of Diff - and compare a clean installation to the infected one. This will cover all standard files, but not the template nor extension files. These you would have to do separately using the proper packages.

Database Cleanup

This all will not help with the database as much though. If you have a copy of the database that is OK and was from before the hack I would replace the database by that copy. If you have a decent backup of all files and the database a clean start would be the best way anyways. If not, then I would use some of the upcoming command line tools if possible. Remember you can download a database copy and run these commands locally as well!

Command Line Tools

Another option - if you have Shell access - is to do some basic scans for obfuscated code. There are even some PHP scripts I use for that that work as well. Here some useful search and destroy stuff. Most of them help to unhide obfuscated code like:

<?php $_8b7b="\x63\x72\x65\x61\x74\x65\x5f\x66\x75\x6e\x63\x74\x69\x6f\x6e";$_8b7b1f="\x62\x61\x73\x65\x36\x34\x5f\x64\x65\x63\x6

PHP Script(s)


Not the answer you're looking for? Browse other questions tagged or ask your own question.