Note: This post assumes you have cPanel access to your website. The instructions for other hosting interfaces are different and are not covered in this post.
Warning: The method described in this post will wipe out any core modifications that you might have on your Joomla website. You have been warned!
Another warning: As explained in this post, this method may or may not work on your website (depending on the type of hack) – so there are no guarantees whatsoever that your website will be “clean” once you follow the below.
For years now, we’ve been getting so many tasks to unhack Joomla websites every month. What’s interesting is that these tasks never bore us, because quite a few of them are unique, and by unique we mean that the exploited websites suffered from hacking techniques that we have never seen (or fixed before). But about 50% (or maybe even more) of these tasks are standard (a standard Joomla hack, as we see it, is where core, and only core, Joomla files are hacked – anything other than that is a non-standard hack), and this has helped us devise a super fast method to cleanup a standard-hacked Joomla website.
You might be wondering – didn’t we write about this before? Well, not really, because the method described in the previous post is fast, but this method is super fast. On the flip side, the method described in this post is a hit or miss: it might work on your website or it might not work, while the other method is more of a solid process to cleanup Joomla websites.
So, without further delay (we know that you’re probably anxious and don’t have time to read literature), here’s our super fast method that you can use to clean your Joomla website from malware:
- Do not visit your website (backend or frontend).
-
Backup your website. Yes, we know it’s bloated with malware, but you should back it up!
-
Ensure that index.php is the only PHP file that Apache can run as described here.
- Login to the cPanel account hosting your Joomla website.
-
Click on File Manager, and then browse to the libraries/cms/version folder located under your Joomla website.
-
Open the file version.php and take note of these 2 variables: $RELEASE and $DEV_LEVEL. These variables (a variable, in the programming world, is… Well, we don’t know how to explain it in layman terms, but, if you don’t get it, that’s OK…) will tell you the exact version of your Joomla website. For example, if you have something like…
public $RELEASE = '3.4';
public $DEV_LEVEL = '5';…then your Joomla version is 3.4.5.
-
Download the exact version of your Joomla website from Joomla’s official website (you can always google your Joomla version and you will find the download page for your version somewhere in the first 3 links). Note that you should download the full release, and not the update.
-
Upload the file that you have just downloaded (from joomla.org) through cPanel’s File Manager to the main directory of your Joomla website – e.g. the /home/[username]/public_html directory – and extract it there (just right click on the file, and then click Extract).
-
Once the file is extracted (unzipped), then remove the installation folder and the Joomla zipped file that you have just extracted.
-
Check if your website is now clean!
If this method works for you, then congratulations! You’re one of the lucky ones! We do suggest, however, that you investigate how your website got hacked in the first place to prevent the same thing from happening again. If it doesn’t work, then don’t worry, we’re here for you! Just contact us and we’ll clean your website in no time and for a very affordable price!