1

There is a backend process on my hosting that got hacked few days ago.

The process inserts rows in a table. The website is on Joomla. Whenever I move the website from root to another folder, the sites works fine with domain.com/newFolderName but when I bring it back on the root. It keeps inserting the values.

How can I detect what process is doing that? I can't see hidden files on cpanel. I doubt there could be something in the hidden files too.

I checked the triggers at database end as well, there is nothing like that. Something is fishy on the application level.

Improve this question
7
  • I'll bet you any money it has nothing to do with what you are calling 'daemon' process. In my nine years of dealing with Joomla on 15 diferent hosts, I've never seen or heard of such a thing. But what I can tell you, from your previous post and the tag you used, your site is STILL VULNERABLE! You should install clean J! 3.4.8, migrate data, template and settings, and strengthen security by using Admin Tools and RSFirewall. Thats just my two cents, without more information I can't write full answer.
    – Mikan
    Mar 8, 2016 at 14:27
  • It is probably functionality hidden in the Joomla code that is run when the website is accessed. Do like Mirko suggested: replace your codebase with a clean joomla install. Code you have developed or modified yourself you need to review, before you can copy it into the clean installation.
    – jonasfh
    Mar 8, 2016 at 19:13
  • @MirkoMikan agree and understand that..
    – Danyal Sandeelo
    Mar 9, 2016 at 5:48
  • @jonasfh the thing is that, I didn't develop it. It was developed 3 years ago by a developer. It was on 1.5 and I brought it to 2.5. I have the cpanel access only. Can you tell me what tool should I use?
    – Danyal Sandeelo
    Mar 9, 2016 at 5:49
  • @MirkoMikan I will have to redevelop the site. It will take time, when I move the code in subfolder, the daemon doesn't work but when I move it back to root directory, daemon keeps inserting the values..
    – Danyal Sandeelo
    Mar 9, 2016 at 6:22

1 Answer 1

Reset to default
2

As per https://joomla.stackexchange.com/a/2339/120 you have a few choices in your situation such as restoring back to a good version of the website, rebuilding the website or finding and eliminating the malware.

What usually works best for me is updating everything to the latest version and then using a commercial service such as mysites.guru (formerly myjoomla.com) or sucuri.net to scan the web space and find and remove the compromised files.

Joomla 2.5 is no longer officially supported but you should at least update to the latest version in the series, version 2.5.28 (if you haven't already) and apply the Session Hardening update from December 2015 which you can find at: https://docs.joomla.org/Security_hotfixes_for_Joomla_EOL_versions

Update all third party extensions to the latest versions.

Also check that no rogue CRON job has been set up in your hosting control panel.

Once the website is clean again, reset the passwords on Joomla Administrator account(s), the database password and your hosting control panel password.

Also consider updating to Joomla 3.x.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.