-1

This question already has an answer here:

My website has been blocked by google because it thinks it's been affected by malware. When I run scans they don't show anything. How can I detect what's wrong?

My sites always get affected with malware and the site is then blocked by google. I cannot figure out what causes it . is it the hosting or Joomla itself or incorrect security settings. can someone please help how to protect from these javascript and PHP code injections?

marked as duplicate by FFrewin, Neil Robertson, TryHarder, Terry Carter, Farahmand Aug 7 '17 at 20:31

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • there are many similar questions in this site that would be helpful - have you searched? – FFrewin Aug 2 '17 at 5:14
  • What version of Joomla is your site running on? – BodgeIT Aug 4 '17 at 12:44
  • @FFrewin yes , didnt help me. – Faheem Rasheed Aug 7 '17 at 4:33
  • @BodgeIT joomla 3.4.5 – Faheem Rasheed Aug 7 '17 at 4:34
  • 1
    Joomla Security and overall security is a very broad topic. Your question is also the same. So any answers will turn around the essentials of a Secure Joomla website and what to do if it's hacked/affected with malware, which is widely covered on Q/A on JSE and in many other locations on the web. so the level of help you are seeking here it's certainly covered somewhere. I doubt there can be any more insightful answer here that's not referred elsewhere. If you are unable to resolve it, then I recommend to hire an expert to work on your security issues, clean up your site and secure it. – FFrewin Aug 7 '17 at 8:17
3

DON'T TRUST SITE OR MALWARE SCANNERS!

You should use a firewall extension like Admin Tools to secure your cms. Unfortunately it's a bad practice to try to get your infected site back online, yeah because it's compromised and could have some backdoors now.

The best and secure way would be setting up a new Joomla site and transferring your content by hand from your old site.

But, what I do in such situations:

  1. Make a list of installed third-party extensions (plugins, modules, components). Deactivate ALL OF THEM.

  2. Duplicate the current database to a new one. (Databases should always have limited local access, no remote access! Don't use the old database password!)

  3. Setup a new Joomla installation, after the installation change the database to the duplicated one. This can lead to some errors if your database is from a different Joomla version. Reinstall the last Joomla update via com_joomlaupdate (?option=com_joomlaupdate), if necessary do a database repair run through the com_installer (?option=com_installer&view=database) .

  4. Reinstall your third-party extensions (latest version) and activate them one by one.

  5. If possible, install a fresh and updated version of your frontend template. If it's custom or modified and you are familiar with PHP / JS and malware code, you can download your old template via FTP and check every file (php,js,css etc.) for malware code, remove it. Zip your template and install your template to the new site.

  6. Install and setup Admin Tools firewall.

  7. Check every third-party extension if they are really needed, if not, uninstall them. Mostly your form extensions or extensions with ajax calls are the weak point.

  8. If possible, get a SSL-certificate (Let's Encrypt e.g.) and force SSL (Joomla config, htaccess) on your whole site.

  9. Don't forget to change all user account passwords, your ftp passwords and email passwords.

  10. Delete all the data (ftp + database) from the old site and check if there are more folders and files in the webspace root, those could be also compromised and should be deleted or at least set chmod to 000 to lock access to those files and folders. (not your new installation of course)

Now you can start to unlist your domain from blacklists. Btw., always keep an eye on the folder and file permissions, NEVER use chmod 777!! (Admin Tools will handle this for you.)

Folders: 755 or "lower" Files: 644 or "lower"

Do backups every week or month. (Akeeba Backup is good for me.)

https://docs.joomla.org/Security

https://geekflare.com/joomla-security/

  • 1
    Note: Core version of Admin Tools does not include firewall. Only Pro version does. – BodgeIT Aug 4 '17 at 12:43
  • Thank you, dennis for your answer. I have admin tools installed and usually follow many of the points you have mentioned. My question though is, what causes the code injection? weak security of hosting or Joomla itself is weak to defend against attackers? – Faheem Rasheed Aug 7 '17 at 4:37
  • 1
    That doesn't matter, every PHP script which allows user input is vulnerable if not secured. I would bet that some form was the entry point. – Dennis Heiden Aug 7 '17 at 8:54
  • 1
    He is on Joomla 3.4.5, so don't bother with the trying to help to figure out what could be the problem... – FFrewin Aug 7 '17 at 9:06
1

Joomla Security and overall security is a very broad topic. Your question is also the same. So any answers will turn around the essentials of a Secure Joomla website and what to do if it's hacked/affected with malware, which is widely covered on Q/A on JSE and in many other locations on the web, plus you already have a good answer by Dennis Heiden here with some additional links to Joomla security resources.

So the level of help you are seeking here it's certainly covered somewhere and I doubt there can be any more insightful answer here that's not referred elsewhere.

Q/A in JSE:


I also started considering that lack of information in your question and thought that you never mentioned your Joomla version. Then I saw your comment that your have J 3.4.5. That explains why your site is getting hacked, but also denotes that you haven't study/research enough as you claimed you have done in your comments.

Keeping a Joomla Installation up-to-date is the #1 security rule. We can't expand on anything else of the causes and whys for a Joomla site being hacked, if the site itself is not up to date and uses a vulnerable and insecure version of Joomla!.

UPDATE TO THE LATEST JOOMLA ASAP!!!

Same time, I still recommend to hire an expert anyways.

Not the answer you're looking for? Browse other questions tagged or ask your own question.