My Joomla website was the victim of a hacker attack recently.
Hackers had access to my server and added some PHP files and mostly modified some
index.php files. THe code is unfortunately ununderstandable to me and obviously too long to show here (if you want some specific file, please ask in comments). All variable and folder names were obfuscated.
Each time they do so, my host (1and1) will switch the chmod to 200 and my website will go offline.
Of course I changed all my passwords but in vain.
From the few things I got from the modified/added files, the hackers seems to be Russian/Ukrainian and they seems to point to games/pornsites, as these links were somewhere in the code (I wont post pornsite links):
One folder was once full of 2 551 files without extensions and containing simple HTML and which names are pinterest posts.
I understand I should get the help of a professionnal but for now I cannot afford it.
What I'd need to know to go on is :
- Could the security hole come from Joomla itself ?
- Else, could it come from my template (Purity III) or module ?
- Else, is there some "easy" way to find it ?
Joomla version: Joomla! 3.8.5 Stable [ Amani ] 6-February-2018 15:00 GMT
PHP version: 5.6.33