Hi there

One of my joomla sites has been recently hacked. I fixed it originally but now it has been hacked again by a different hacker. I have logged in to phpmyadmin and all the database is still there. It appears they have changed the main template as well as the admin template but am wondering if someone can give some ideas of where to look to begin troubleshooting. The site itself is www.rle.org.au

Thanks in advance.

Reditech,

Hackers normally take out several key files in order to disrupt the site, and in my experience, usually don't get into the database (unless particularly determined - touch wood, I've not had that happen yet.).

The main exploited hole they find is when your file permissions are set to 777 - which gives public write access.

Easiest way to fix it is to reupload any files you know have been changed - usually the fastest way a Joomla site comes down is if they change the root index.php file, rather than other files in the site - so it might not be the template that's been modified, just the index.php page. Trying www.rle.org.au/index.php showed that page was missing, so that's a starting point.

Essential reading on Security: forum.joomla.org/viewtopic.php?t=102558

Patrick

Hi there

I have just had a site brought down recently for the second time...

The steps I have taken were...
- firstly replace the index file... and check the "config" file also

then... and I do suggest you do this... go to your hosts CPanel and look closely at the "Server log" This can tell you several things that are to your advantage... Usually overtime a hacked will return... and you should be able to detect which files are his entry and exit points... and also those pages he is using. (I found he had hacked the "wrapper" element and was using it as an entry to another site - to cut a long story short)

The server log should also give you hints as to their IP... so ban that IP in CPanel.
Also password protect the Admin folder... unfortunate... though makes a doublly secure entry... your admins will need to log in twice... though is better than allowing access to others

My two bobs worth

Best of luck... Simon