Joomla site hacked. Some visitors see spam content, while others see normally my site's real content

Question

My website address is http://bethelrc.org

Google is reporting it may be hacked, when I look at the file system, there are many unauthorized folders and files recently created. I deleted all these malicious files that I was able to find and submit my website to google for review. Also there are many unauthorized users and articles on Joomla backend, I deleted all of them.

However, today one of my users report that when he opens the home page he sees a totally different article, screenshot is as follows:

Looks like the hacker not only injected files but also hijacked Joomla system. Because when I open the website I see our own homepage. So my question is, technically and joomla-wise, how is this possible that when different users open homepage they see different things? Or, do they manipulate the database so that at some certain time homepage is pointing to this article? I look at my backend but I couldn't find this injected article, where could it be stored?

Answer 1

Check your .htaccess file, many users are used to search domains in google search box, I have been hacked this way.

Open your .htaccess, activate line wrap and check file.

In the other hand, it's a good idea change your ftp password and then reinstall your joomla from scratch.

Answer 2

As others have pointed, this may be an .htaccess hack. However, we are noticing a trend in the hacked Joomla websites, where such hacks are actually in the core. Try overwriting your core files from a fresh Joomla install (as described here) and see if that fixes the problem.

If you are still seeing the problem, check your non-core extensions (modules, components, plugins, and templates) - the problem might be there.

One last thing, check to see if there is an .htaccess file in a higher directory (we had a few cases where that was the problem). For example, if your website is under /home/your-user/public_html then check to see if there is an .htaccess file under /home/your-user/

Answer 3

Compromised .htaccess

As per https://blog.sucuri.net/2011/05/understanding-htaccess-attacks-part-1.html it may be that the .htaccess file has been compromised and is redirecting certain visitors to a hacked page based on the referrer or similar.

For example, visitors arriving at the website via a Google search may be redirected to the hacked page but visitors arriving at the site directly (e.g. the site owner) are not affected.

Hackers do this so as not to alert the website owner of the infection.

Cleaning Up a Hacked Website

Basically, it comes down to 3 choices: restore, rebuild or clean.

Cleaning using https://mysites.guru (formerly myjoomla.com) or http://sucuri.net or similar is usually the most cost effective solution. For more details see:

https://joomla.stackexchange.com/a/2339/120