One of my site was on Joomla 3.4.4. Certainly i can not log into the administrator. Despite using the correct credentials, the page just refreshes and does nothing. I checked my File manager and i discovered lots of unknown html files. Seems like there was a breach and files injected into my site. Is there anything that i can do to log into the backend? Any help would be appreciated
Sorry to be the bearer of bad news, but it might have actually been your fault. Joomla 3.4.x is vulnerable to hackers, therefore Joomla 3.4.5 was released which patched the security issue, which you should have updated to.
Joomla 3.2 to 3.4.4 exploits the content history, which allows people to gain full access to your database.
Here are a list of things you need to do:
- Change your database username
- Change your database password
- Change your database table prefix (e.g
- Create a new Joomla installation on a subdomain or localhost, then copy and paste the password hash for your user from the old database to the new database.
- Download the Joomla 3.4.5 update package and upload the files via your hosting's File Manager.
If all of this is done, your site is now secure, but you still have infected files, which could still pose a security issue. I don't know how harmful these files could be, but I'd suggest taking a backup of your site using Akeeba Backup, putting it on your localhost and completely removing your online site (ALL files).
Once you have your backup running on your localhost, I'd suggest downloading a fresh copy of Joomla 3.4.5 (will come back to this in a bit).
Now, delete the following directories:
Then, delete the files that do not appear to be part of Joomla. You can compare the files in the root of your site to the files in the newly downloaded copy of Joomla.
Now from your downloaded copy of Joomla, replace all the directories and files that your deleted before.
Hopefully, you will be able to login to your site.
Please let me know the results.
Hope this helped.