Administrator logout not logging out

Question

One of my sites was hacked the day after I got the notice that there was a vulnerability with 3.4.6. Sitelock cleaned it (this particular site is on Bluehost). They told me I was good to go.

Since then I have been unable to log out properly. When I click logout I am returned to the control panel; click logout again get invalid security token error; try to access another function, it returns to the login screen. If I try to log in again, I can't. Nothing happens. I need to wait about 15 minutes before I can log in again and the same thing happens when I try to logout.

I'm worried that if I'm not fully logged out, the site is left open to another attack.

I was wondering if maybe more than the malicious code was removed when the site was cleaned. Maybe there are some core Joomla files related to logging out that need to be reinstalled -- but I have no clue which they might be, where to look, or how to reinstall them. Not sure what else it could be.

Answer 1

The invalid token problem generally arises due to session problem. Check the following parameter configuration file: $session_handler

1. This parameter must be set to database. Sometimes it is set to none.
2. Clear #__session table and try logging in again.

And yes, if you suspect any malicious code then use the websites already mentioned.

Answer 2

I recommend the following:

• backup your website using Akeeba Backup or similar (as a precaution)
• install or reinstall the latest stable update package (currently Joomla_3.4.8-Stable-Update_Package.zip) via Extensions -> Manage -> Install -> Upload Package File (this should be safe to do assuming there are no core hacks on your website)
• reinstall the latest versions of all the third party extensions installed on the website (you can reinstall over the top of most extensions without losing settings and this will replace any compromised files with the originals)
• review the contents of your .htaccess file for any malicious code

If the issue is still not resolved, consider switching from Sitelock to Sucuri or mysites.guru (formerly myjoomla.com) which will likely do a better job of detecting and cleaning any malware on a Joomla website.