Hi Paul

There have been reports of a large number of hacks on Joomla 3.4.6 sites. If your site remained on this version for any length of time you would have been under serious risk of been attacked. It is very difficult to fix as any number of backdoors could have been added to your site allowing attackers continued access to your site. Unfortunately the only real way of resolving this issue is to revert your site to a previous backup and then updating Joomla immediately.

Ciarán

Hi Ciaran,
Unfortunately, I do not have a backup. I always though the hosting service backed it up, but they only take screen shots every few days and only keep it for 30 days. The women who owns the site did not notice it going down and the hosting service no longer has any backup or way to restore it. Can a programmer fix the site by locating all the hackers code and removing it?

Also what is the best way of backing up a joomla site? The hosting service wants $29 a year to back it up on the cloud. Would you suggest that or another method?

Also is there a way to temporarily restore the site so I could get the text and rebuild the site? We do not even has copies of the site or any printed pages. Everything was lost.

Assuming the database is intact, If I reloaded the demo installer would the demo erase or overwrite my text and other material? Or should I just install the Renovate theme without the demo, because the site was already created? If the database is intact, I could then at least have a temporary site until I totally rebuilt it. What would be best, to install the demo or just the theme? Or is is hopeless?
Thanks Paul

Hi Paul

Firstly, to backup your site you can use a Joomla extension. The most common option is Akeeba backup (http://extensions.joomla.org/extension/akeeba-backup). Alternatively you should have an option with your site cPanel to create a backup however this can vary from host to host.

How your site was effected can vary greatly depending on the attackers intentions so it is difficult to say for sure. Usually it is not in the attackers best intentions to take the site down, usually opting to leave the site up to make you think there is nothing wrong while setting up something like a phishing site on a sub folder or a mail server to send out mass spam. Your case seems to be a bit more malicious considering the site is down

If you wish you can send us temporary FTP access to your server and we will take a look and see if there is any chance of getting the site back up temporarily. Details can be sent to info@joomla51.com. For our reference please paste a link to this post in your email.

Ciarán

Hi Ciaran,
I created the temporary FTP last week and emailed it to you. I hope you are able to fix the site. If you need more info let me know.
Thank You,
Paul Barrett

Hi Paul

I replied to your email stating that we were unable to connect to your FTP with the details provided. Following is a copy of our reply...

Hi Paul



Sorry to say we are unable to connect to your FTP with the following error...



Status:    Connecting to ftp.awarehtaf.org:21...

Status:    Resolving address of ftp.awarehtaf.org

Status:    Connecting to 192.186.216.70:21...

Status:    Connection established, waiting for welcome message...

Status:    Initializing TLS...

Status:    Verifying certificate...

Status:    TLS connection established.

Command:    USER HIDDEN

Response:    331 User HIDDEN OK. Password required

Command:    PASS **********

Response:    530 Login authentication failed

Error:    Critical error: Could not connect to server



Regards

Ciarán

Ciarán

Hi Ciaran,
I messed up the temporary FTP account, it led to an empty file. Sorry I did not get back to you sooner. Very busy.
I will email you the IP address and password, so you can enter and have full access to the cpanel. Thanks for your help and I hope you are able to save this site. The email will be sent shortly. Thank you once again!
Paul