Joomla site got defaced bt Turkish Hacker

Hi,

My Joomla site got hacked by Turkish Hacker. It was running 1.5.5 version earlier, I had upgrade it to 1.5.7 but I still cant restore the frontpage. Anybody had the same experience on this? I need to restore my frontpage, and also I can't get into the administration panel. I had reset back my admin password at database level (yes, the hacker changed the admin password also) but each time I login, it wont bring me to the administration area. It has been a week of frustration for me to troubleshoot this problem.

The confusing part is, how the hacked frontpage still displaying the hackers message although I had replaced the index.php with a new one (from 1.5.7) and the config file from my backup. Any idea how can I resolve this? Thanks

 

your index file probably got deface. try replace the index file.

btw, check your other plugins. That hacker could have hack your site through one of the outdated plugins..

--
joseph

 

Hi,

I finally found what happened. The hacker had replaced the index file of my template. no wonder how many times i had replaced the main index, the page is still showing the hackers logo. Problem has been rectified now. Thank you for all your help

 

That's nice to know!! can you post the link of your webpage, i just wanna see the joomla based webpage..

Thanks in advance.

Regards
Erhythm

 

How did you rectify the error?

 

Bastards hit me too, I am working on it now..,.

 

replace index file.

 

this due to some week upload script

 

Is this the same person?

http://blogs.zdnet.com/Ou/?p=237

 

Try checking with Joomla! blackbox scanner?

http://yehg.net/lab/pr0js/files.php/joomscan.pl

http://www.securityconfig.com/joomla-security-scanner/

 

http://forums.digitalpoint.com/showthread.php?t=1272518