Hot answers tagged

14 votes
Accepted

How did hackers manage to create a new user while "allow user registration" is set to "NO"?

The main reason for 3.6.4 update was exactly what happened to you! Security Bulletin [20161001] - Core - Account Creation states "Inadequate checks allows for users to register on a site when ...
  • 3,007
5 votes
Accepted

index.php is sending out a suspicious number of emails

A few steps I take when troubleshooting these types of things for new clients when they’ve been hacked: You can add your first site free to https:://mysites.guru which will then run an audit on your ...
4 votes

How to secure Joomla from Monero Crypto-currency-mining hack

Finding the "backdoor" might be hard. You can check the access logs for strange requests. Maybe your hosting provider offers other logs like (s)FTP connection logs. I recommend installing Akeeba ...
2 votes

How did hackers manage to create a new user while "allow user registration" is set to "NO"?

There are many possible ways that the hacker has broken into your web, I recommend you see these documents: https://docs.joomla.org/Security As to your question I would bet that the hacker could ...
2 votes

How to secure Joomla from Monero Crypto-currency-mining hack

Having done a little research on your malicious code, I came across this article which states what the snippet is and how it will effect you. https://adamfeuer.com/notes/2017/10/16/removing-and-...
  • 26.6k
2 votes

How to secure Joomla from Monero Crypto-currency-mining hack

Finding the backdoor is indeed hard, but it not impossible. You will need to check all your logs, match the dates for each suspicious entry, until you find the root cause of the issue. Having said ...
  • 3,186
1 vote
Accepted

Where does Joomla store user files and folders?

It's not clear to me what you mean by user. Also you do not specify which version or 3rd party extensions you use. The following is true for Joomla 2 and 3: A user registered to your friends website ...
  • 126
1 vote

Fake users created without using site registration form but still using overrides?

Is there a pattern to the emails used? For example, do these emails have a certain tld at the end? If that's the case, you can add a regex to the model blocking those emails. Note: If your website ...
  • 3,186
1 vote

How to secure Joomla from Monero Crypto-currency-mining hack

You can check the VEL to find out if any of your installed extensions have known vulnerabilities. Known vulnerabilities are generally patched as soon as possible. As with any hacked website, you ...
1 vote

Joomla got hacked. Is it safe to replace the entire library directory

Assuming core files have not been modified it should be safe to reinstall the Joomla files. Ideally, run a backup before you start in case anything goes wrong. I highly recommend upgrading to the ...
1 vote

Joomla site hacked. Some visitors see spam content, while others see normally my site's real content

As others have pointed, this may be an .htaccess hack. However, we are noticing a trend in the hacked Joomla websites, where such hacks are actually in the core. Try overwriting your core files from a ...
  • 3,186
1 vote

Joomla site hacked. Some visitors see spam content, while others see normally my site's real content

Compromised .htaccess As per https://blog.sucuri.net/2011/05/understanding-htaccess-attacks-part-1.html it may be that the .htaccess file has been compromised and is redirecting certain visitors to a ...
1 vote

Joomla site hacked. Some visitors see spam content, while others see normally my site's real content

Check your .htaccess file, many users are used to search domains in google search box, I have been hacked this way. Open your .htaccess, activate line wrap and check file. In the other hand, it's a ...
1 vote
Accepted

Joomla Email virus

Your site has been compromised. You need to take immediate actions, to clean it up and secure it. You should hire experts, If you are in doubt or don't know how to proceed. Check these topics for ...
  • 19.6k

Only top scored, non community-wiki answers of a minimum length are eligible