One of my sites was hacked the day after I got the notice that there was a vulnerability with 3.4.6. Sitelock cleaned it (this particular site is on Bluehost). They told me I was good to go.
Since then I have been unable to log out properly. When I click logout I am returned to the control panel; click logout again get invalid security token error; try to access another function, it returns to the login screen. If I try to log in again, I can't. Nothing happens. I need to wait about 15 minutes before I can log in again and the same thing happens when I try to logout.
I'm worried that if I'm not fully logged out, the site is left open to another attack.
I was wondering if maybe more than the malicious code was removed when the site was cleaned. Maybe there are some core Joomla files related to logging out that need to be reinstalled -- but I have no clue which they might be, where to look, or how to reinstall them. Not sure what else it could be.