Hi,
I am managing a new Joomla website for our local junior footy club. We had the site designed for us and I took over the construction as I was a programmer in a former life. The site has been going along fine for the last month or so, we have our coaches uploading match reports and I have been working on the back end setting up the site so it looks great.
Then all of a sudden nobody can log in. Front end and back end.
Any suggestions? As I said, it came from nowhere, one minute we were ok, the next we were locked out. All we get when we try to login is a refreshed page. I have looked at the joomla.org forums and am overwhelmed by the amount of information there.

This could be due to a plugin or module you have installed recently. I'd open up the database using phpMyAdmin and go through jos_plugins and jos_modules, and change published to 0 for anything you've added recently. By process of elimination you should be able to find the cause.

regards

Tim

Hey there - where are you up to here - well I'm hopign no-one has deleted or tinkered with eth user table...... - a hacker or developer or administrator.

Do you have ftp access and access to the database (phpmyadmin etc) - I can have a peek if you are around now? skype me j-training

Thanks JustloveJoomla, I see that you are in Sydney, I'm not going to skype now, it's a bit late.
As for the website, I've been looking around at the plugins and modules as suggested, but still no luck. We are now talking about re-installing. If you like you can skype me tomorrow morning or tonight if you are still around. (jabbewright). I'm in Perth.
I do have FTP and phpmyadmin access.
Thanks again.

What the????????
This is an email received this morning. I don't know anything about it, now what do I do?
Please, anyone?

Greetings,

AusCERT has received advice from a source which suggests that an account
within your organisation may be compromised resulting in a web-site being
defaced. We have no further details other than the following:

> Defaced URL: hxxp: //jetsjfc.com.au //templates /ste_underground /id1.txt

AusCERT cannot verify the veracity of this information, but deemed it
necessary to pass on the information for your own investigation.

It might also be worthwhile checking your systems for signs of compromise.
There are several documents available from:

www.auscert.org.au/1938

eg. Windows NT Intruder Detection Checklist
Steps for Recovering from a UNIX or NT System Compromise

which can provide some assistance.

Best regards,

The AusCERT Team

Australian Computer Emergency Response Team | Hotline: +61 7 3365 4417
(AusCERT) | Fax: +61 7 3365 7031
The University of Queensland | WWW: www.auscert.org.au
Qld 4072 Australia | Email: This e-mail address is being protected from spambots. You need JavaScript enabled to view it
-----BEGIN PGP SIGNATURE-----
Comment: www.auscert.org.au/render.html?it=1967

Sounds like a hack to me - but helpfully they have given you the filename to look at.
Hoping you've got good backups and can restore, if so?
Dex

if you contact your host - you may find that they have a backup .. you may also want to investigate their security etc / it's worth trying to figure out how you got into trouble etc

Thanks folks to all who replied, particularly JustLoveJoomla for the advice. I have reinstalled and we are back up and running. We are having issues with emails from our webserver which tells me that there's something not quite right going on with that end.
But thanks again, now I know you are here, I will be visiting often!www.joomladay.org.au/components/com_kune...oticons/cheerful.png