5

My Joomla 3 site was recently hacked. Browsing to it with a common web browser works fine, but when you switch the user agent to a web crawler, it displays a spam page. How do I track down where the code is that does this?

I replaced index.php in the root with a test page and the test page appears. When I replace index.php in the root of a template, the spam page appears when using a web crawler user agent.

Any help would be greatly appreciated.

Improve this question
2
  • 1
    Thank for all of your replies. I found the hacked page in includes/frameworks.php. The header function was commented out and after it was followed by obfuscated PHP code. When the code is run on its own, it displays the problem page. The code only displays when it detects the following user agents: "Google", "Slurp", "MSNBot", "ia_archiver", "Yandex", "Rambler" I also found administrator/includes/reads.php which was a one line program containing eval($_POST[1]). The database looks ok. I managed to fix the site last night by doing a Joomla update, which overwrote all of the hacked files.
    – UltraJ
    Jan 21, 2016 at 22:33
  • Possible duplicate of joomla.stackexchange.com/q/9643/120
    – Neil Robertson
    Jan 22, 2016 at 8:02

3 Answers 3

Reset to default
3

The best method to check the hacked website is to scan the malware using this link : https://sitecheck.sucuri.net/

Here, all the malware content will be loaded and you can easily back track them.

Enter your website URL in 'Scan your website' textbox and hit the scan button. Check for the results accordingly.

Let me know further if it helps.

Improve this answer
4
  • Thanks for the link! I tried it on my site but it didn't like port 10000. Tomorrow at work I'll put it on a proper domain and test it. Never thought that web sites would need malware scanners. :\
    – UltraJ
    Jan 21, 2016 at 5:31
  • I am glad my answer was useful to you. And hacked website needs malware scanner.This tool is great . You can also upvote the answer to show other users that this answer was helpful :)
    – Liz.
    Jan 21, 2016 at 5:48
  • 2
    @UltraJ: Also make sure you will update your Joomla to the latest releases.
    – FFrewin
    Jan 21, 2016 at 7:41
  • 2
    The free SiteCheck service only does a brief scan of the publicly visible files which may or may not discover malware. You'll need a paid subscription to perform a full scan before you can determine the extent of the infection with any certainty.
    – Neil Robertson
    Jan 22, 2016 at 12:16
4

I had to face this problem recently. In most cases I saw the libraries folder hacked and I had to replace it with a clean one to see my website correctly.

Here is what you can do:

  1. put on the root this https://github.com/mikestowe/Malicious-Code-Scanner/blob/master/phpMalCodeScanner.php , don't forget to put your email address. Then wait for the email listing all malicious files (be carefull deleting them, create a backup)
  2. Secure some folder through your htaccess file preventing the execution of php scripts (or shell), more info here: https://www.gavick.com/documentation/joomla/how-to-secure-your-joomla-3-1-site-against-hacker-attacks
  3. Install Marco's SQL injection plugin, it works great!
  4. sure, update your joomla to latest version, same for extensions. Don't forget to backup all
  5. Check directory and file permissions

Hope it helps, Marco

EDIT: I wrote an article here for more details http://goo.gl/47VTwn

Improve this answer
3
  • Thanks Marco. This info goes into my arsenal of fighting web site malware. :)
    – UltraJ
    Jan 21, 2016 at 22:36
  • The Malicious Code Scanner looks like it was last updated over a year ago so it may not be able to detect the latest Joomla exploits.
    – Neil Robertson
    Jan 22, 2016 at 12:18
  • 2
    Yes its correct, Neil. This code scanner detect known PHP functions like base64_decode or shell (so it doesn't matter when it was updated last time, it works). Latest Joomla exploits are caused by a bug on session handler so the scanner will not help in this situation.
    – Marco
    Jan 22, 2016 at 16:53
0

There are obvious places to look such as the template index.php file but a Joomla install has thousands of files and the only way to be confident that you have identified all the compromised files is scan the whole file structure in your web hosting account with a reliable and recently updated scanning tool.

The most useful tool for this on a Joomla website is the mysites.guru (formerly myjoomla.com) security tool from Phil Taylor. It's not free but very affordable. mysites.guru quickly identifies compromised files and can restore any changed core Joomla files to the original versions.

There are other paid services that can help with scanning such as sucuri.net.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.