1

My website address is http://bethelrc.org

Google is reporting it may be hacked, when I look at the file system, there are many unauthorized folders and files recently created. I deleted all these malicious files that I was able to find and submit my website to google for review. Also there are many unauthorized users and articles on Joomla backend, I deleted all of them.

However, today one of my users report that when he opens the home page he sees a totally different article, screenshot is as follows:enter image description here

Looks like the hacker not only injected files but also hijacked Joomla system. Because when I open the website I see our own homepage. So my question is, technically and joomla-wise, how is this possible that when different users open homepage they see different things? Or, do they manipulate the database so that at some certain time homepage is pointing to this article? I look at my backend but I couldn't find this injected article, where could it be stored?

  • It could be possible that the content of the article has been cached. – Lodder Jun 30 '16 at 11:51
  • By cache you mean Joomla's system cache? – shenkwen Jun 30 '16 at 11:53
  • 1
    Yes, Joomla's cache. Your hosting provider may also use a caching mechanism which you can disable on your hosting control panel, but that is a "maybe". Otherwise I'd strongly suggest you change all passwords for your site, update Joomla and all extensions to the latest version, and possibly contact a specialist – Lodder Jun 30 '16 at 12:20
  • This question has been cross posted to: stackoverflow.com/q/38122289/1983389 – Neil Robertson Jul 1 '16 at 2:01
1

Check your .htaccess file, many users are used to search domains in google search box, I have been hacked this way.

Open your .htaccess, activate line wrap and check file.

In the other hand, it's a good idea change your ftp password and then reinstall your joomla from scratch.

  • How can I 'install joomla from scratch" without destroying my current data? – shenkwen Jun 30 '16 at 15:20
  • Te safest way is create a new database, install the joomla, copy your old theme, install all extensions and then copy the content table. Also check your index.php file in theme, for injected lines. Is not a simple task, requires some basic admin skills. – José Sánchez Martín Jun 30 '16 at 15:29
1

As others have pointed, this may be an .htaccess hack. However, we are noticing a trend in the hacked Joomla websites, where such hacks are actually in the core. Try overwriting your core files from a fresh Joomla install (as described here) and see if that fixes the problem.

If you are still seeing the problem, check your non-core extensions (modules, components, plugins, and templates) - the problem might be there.

One last thing, check to see if there is an .htaccess file in a higher directory (we had a few cases where that was the problem). For example, if your website is under /home/your-user/public_html then check to see if there is an .htaccess file under /home/your-user/

1

Compromised .htaccess

As per https://blog.sucuri.net/2011/05/understanding-htaccess-attacks-part-1.html it may be that the .htaccess file has been compromised and is redirecting certain visitors to a hacked page based on the referrer or similar.

For example, visitors arriving at the website via a Google search may be redirected to the hacked page but visitors arriving at the site directly (e.g. the site owner) are not affected.

Hackers do this so as not to alert the website owner of the infection.

Cleaning Up a Hacked Website

Basically, it comes down to 3 choices: restore, rebuild or clean.

Cleaning using https://mysites.guru (formerly myjoomla.com) or http://sucuri.net or similar is usually the most cost effective solution. For more details see:

https://joomla.stackexchange.com/a/2339/120

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.