2

I'm working with a set of Joomla! installations that has been infected by malware and have to clean them up as soon as possible. I'm not used to working with Joomla!. The sites have been badly managed, updates haven't been installed and the original extensions haven't been saved.

My approach to this is as follows

  • Setup a clean installation of Joomla!
  • Export the database and import it to another database with different credentials
  • Copy all images from the previous installation to the clean installation
  • Configure the clean installation to connect to the new database
  • Install a new, clean, version of every extension to the clean Joomla! installation

I'm done with step 1 through 4, but the extensions are proving to be quite a problem. I only want to migrate the extensions that are being used, and I want to ensure that I can get the correct extension, and not just a similar one.

I've managed to extract a list of all extensions using the query SELECT name, type, manifest_cache FROM prefix_extensions WHERE enabled = 1;. I've also filtered this list against a clean database installation of Joomla! to exclude all the default extensions, but I'm still left with a little over 50 extensions.

I don't want to use Google to search for every extension since I would risk getting the wrong extension just with a very similar name. Is there a better way to find out which extensions I actually need to migrate, and a way to find these extensions?

Improve this question

2 Answers 2

Reset to default
2

I think that the sequence that you're using is not what it should be. You should first do the following:

  • Install a fresh install of Joomla (same version that you have)
  • Find all the extensions that are installed on the old website
  • Check each one of these extensions against the VEL
  • Install only the clean (and latest version) of these extensions on the new Joomla website
  • Once you're done, you can point the fresh Joomla install to the old Joomla database and then update the Joomla website to the latest version (if you haven't already)

Now, the above approach, however, has a flaw in it, and it is with the extensions. If an updated extension has a different database structure than the one your old extension, then you will run into serious problems (especially if that extension runs on every page), so it's better to install the same version of the extension first on the fresh Joomla install and then, after pointing the fresh install to the old database, then you can update the extension. And this brings us to another problem, is that it is very hard to find previous versions for many extensions.

We follow the below approach to cleanup Joomla websites:

  • We extract a fresh Joomla (of the same version) instance on top of the old Joomla website.
  • We check for hacked files (mainly as described here) and we delete the hacked files.
  • We update all the extensions to the latest version (with the exception of those listed in the VEL, which we uninstall).
  • We update Joomla to the latest version.
  • We restrict access (through the .htaccess to the index.php file)
  • We install an application firewall
Improve this answer
4
  • 1
    Thanks! How should I go about finding out all the extensions? Is the SQL query I'm using the best way, or could I filter that list further?
    – Thomas Doyle
    Dec 3, 2016 at 17:25
  • 1
    The SQL query is fine, I would add a condition for IDs >= 10000 , as everything in the #__extensions table with an ID >= 10000 is not a core Joomla extension.
    – itoctopus
    Dec 3, 2016 at 17:49
  • 1
    To what extent is it possible to restrict access via .htaccess? As far as I can tell most of the extensions uses the defined JEXEC check which would indicate that I could forbid direct access to other files, but that seems unlikely...?
    – Thomas Doyle
    Dec 4, 2016 at 13:20
  • When you restrict access, this means that if you have some files that were uploaded maliciously in one way or another, then the uploader cannot run them. Blocking access to these backdoor files is an excellent security measure.
    – itoctopus
    Dec 4, 2016 at 15:40
2

Unfortunately, the extension table does not contain installed version or extension author information.

To document this additional third party extension information, I recommend:

  • logging in to the back end and going to Extensions → Manage → Manage
  • sorting by ID by clicking on the "ID" column heading
  • compiling a list of third party extensions by scrolling down to where third party extensions have been added (usually ID = 10,000 or later) and documenting the extension name, currently installed version and hover over the author name to see the author details (see below for an example)

You now have enough information to search the Joomla Extensions Directory and/or the author website for the latest version of the extension and older versions if available.

extension author

Improve this answer
1
  • Thanks! I'm already extracting this from the manifest_cache entry in the database, it's json encoded but contains this information
    – Thomas Doyle
    Dec 4, 2016 at 14:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.