My Joomla! website is infected by an iframe injected malware, according to Sucuri SiteCheck:

enter image description here

To remove the malware, does it suffice to remove the infected file site/media/system/js/caption.js? Or should I, and how to, further investigate the all the other files?

Thank you in advance for your help.


First of all, many thanks to @begueradj, @Aurora, @André Daniel and @SilverlightFox for their comments and answers. And please forgive me for not replying earlier, I have been involved in another urgent mission and have just finished.

I was so panic that I deleted the infected file, i.e., .../media/system/js/caption.js, and took the site offline. Now what I am planning to do are:

  1. On localhost: upgrade Joomla! as well as all the installed extensions to the latest versions.
  2. Move the website to a new hosting.

Does it suffice? Since I deleted the infected javascript file, I do not know what the injected code look like, thus will not be able to find other infected files.

  • You should first investigate how it got there in the first place. Also I bet that file was originally a legitimate file and the nasty code was just appended to it, so simply deleting the file would also break your site. – user42178 Dec 24 '14 at 16:54
  • You should take the site offline and deploy to a clean server. It is the only way to know for sure that there are no backdoors, users added to various components on your system, etc, etc. – SilverlightFox Dec 29 '14 at 16:52
  • @AndréDaniel: thanks for your comment. But I don't know how to find out how it got there :( – Khue Jan 8 '15 at 15:40
  • @SilverlightFox: thanks. Do you mean that I should rebuild everything from scratch? :\ – Khue Jan 8 '15 at 15:41

It is more likely the attacker has succeeded to install a backdoor. It is by nature hidden, and quite hard to detect and disable.

You need to check some important and classic directories such as the one you use to upload images or other files because you usually trust such directories and never check what is inside them. Also, if your Joomla website has inactivate themes, it is better to delete them because they are targetted by hackers to incubate their backdoors, usually. Also, you will need to check the source code of your most sensible files (such as configuration files). At the end you will need to change your credentials and ask the users of your website to do the same, but also the credentials you are using to access your server.

  • Thanks, @begueradj. Please forgive me for the late reply, and please see the update. A Joomla! website has so many files, I don't know how to check all of them :( – Khue Jan 8 '15 at 15:38

Chances are, if you are having a problem with this, you may have a shell installed on your sever. Shells are php backdoors that are normally installed by an attacker through some sort of remote file inclusion vulnerability.

First thing to do, is to breath and don't panic. Find the snippet of injected code in the js file and remove it. Chances are, it has been injected into many other files. Therefore, you may need to grep around to see if it has been put in anywhere else.

Next thing you need to do is to find the shell, and root it out as quickly as possible. This will involve looking through your folders, and seeing what files are out of place. Many will tell you to look in image folder, and such. Although sometimes they may lie there, chances are the attacker moved the shell upon getting it in. Look through all of the folders. One (unorthodox) method that I have used in the past is to use a different backdoor shell to seek out other shells. This is common practice in the attackers world, and is fun to use in the defenders world. Try placing this php code in a file, and opening it remotely. It has some automated functions to seek out other shells, and could prove to be helpful if you are lazy like me. If you take this option, then remove the shell you placed in as quickly as possible (remember, it is still a backdoor, even if you put it there yourself).

After this, you need to find out how the shell was able to slip in. Look to see if there are updates to any forum/blog software you are using. If there is, then update it promptly. If you are using only your own code, then look for things such as upload scripts.

This is never a fun thing to deal with, but it could be much worse. Do not put off any actions to secure your server.

  • Thanks, @Aurora. Please forgive for the late reply, and please see the update. Could you please be more specific on how to use the shell that you provided? I don't know how to find out how the shell was able to slip in :( I'm new to web security :( – Khue Jan 8 '15 at 15:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.