[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 578
  • Last Modified:

Joomla site hacked. bad link has been added

Hi
www.planetaid-uk.org
If you sroll all the way to to bottom, 3 bad links to porno sites has been added
I am trying to remove them but cant find any place where they have added it
I have tried the index.php of my template but its not there

Please see attached.
Is there a way to find out where this 3 links has been added so i can remove it?
hacking.jpg
0
morten444
Asked:
morten444
  • 5
  • 2
1 Solution
 
ceo_techCommented:
Restore your backup and you should be back up and running in know time. Also you should get fail2ban install.
0
 
Scott Fell, EE MVEDeveloperCommented:
If you have any plug ins for forms, ads, comments etc.  Turn those off.  Then make sure they are all up to date.
0
 
morten444Author Commented:
Hi
Thanks for advice.
My question was more if there is a way to locate using firebug or any other tool how to find in what PHP file this has been inserted?

we have file2ban installed
Have 15days rolling backup. problem is customer discovered so late that even the first one is infected so restore no option.
I need to find where the text has been inseted

Anyone?
0
What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

 
Scott Fell, EE MVEDeveloperCommented:
I would just query the db and look for <script>something bad... </script> and remove/find and replace.
0
 
morten444Author Commented:
Hi
Thanks for your answer.
I have tried to search how i can search any text from any table in my database

I have a database called planetaiduk
I have about 60 tables (joomla and extentions)
I use PhPmyadmin
There is a search field when my database is highligted but i get no maches when i search for example "r43dsworlduk" (one of the hacked links)

I also do not get any match if i search planetaid so i guess i can not search in that way
Can you tell me how i can search any text containing the word
r43dsworlduk
in any table in my database using phpmyadmin?
0
 
morten444Author Commented:
Hi again
Sorry if i mark all the tables i do get responds but no match on this word
I do get matches on other words i search so i guess the database is not compremised
So it has to be inseted into a php file i guess
any other idears?
0
 
morten444Author Commented:
Issue solved
I downloaded website and did a search on this word without any match
i then updated joomla to latest version and that seem to have removed the script
0
 
morten444Author Commented:
Updating Joomla must have overwritten the file that was infected.
0

Featured Post

Restore individual SQL databases with ease

Veeam Explorer for Microsoft SQL Server delivers an easy-to-use, wizard-driven interface for restoring your databases from a backup. No expert SQL background required. Web interface provides a complete view of all available SQL databases to simplify the recovery of lost database

  • 5
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now