controller.php.suspected

Yes I saw it and not a flexicontent file, so deleted
Release is 3.4.5 for joomla and FC latest build.
I can still access backend / fronted

When hacked again there is a new file.php in Joomla root and controller becomes suspected.

I still have not changed passwords, I will do it while and after.

Thanks

Hello

maybe better is (provide that your server software is good, and no other server issue)
- restore last clean backup to a temp folder (e.g. to your localhost)
- upgrade extensions and change passwords of admins
- then use temp installation as live site

unfortunately it's difficult to know which backup was clean and safe

hackling has begin since weeks though we didn't suspect id.(ie before controller was renamed)


Create a new clean web site/database is a solution.
but it's not possible te create all FC data.
Perhaps just keep FC tables ?

Hello

you can try
- but you will loose ACL permissions
- and component configuration
- other problems ?


better do this
in localhost
- back / download old DB
- keep ALL current database (just double check users table for admin accounts before you make it live again later)
- make a new install and install all extensions you had
- only copy *.png, *.jpeg etc from the old installation folder, any hacks inside such image files, etc should be unusuable if your server software is good
but scan with any tools you have
- then set the new installation to use the old database, and change passwords

Hello

please note that using the OLD db, besides cleaning admin accounts,
may still be (potentially) a security problem

e.g. with malicious JS inside content, that can steal your password during frontend login
...

in FLEXIcontent fields:
- textaread, description, text
there are parameters to strip output or encode it (HTML / JS will be come visible)

I just have in my apache logs
POST /plugins/flexicontent_fields/core/menu64.php

I wonder if I could empty this file change owner and put readonly
even if I have to clean every web site, I cannot let them offline for many days.