After Being Hacked
NH
Niels Hvid
Hi, I am using Wondergo with SP Page builder and was hacked across many sites. I am almost done. How do I stop it loading all the shit they inserted
<meta name="viewport" content="width=device-width, initial-scale=1, shrink-to-fit=no">
<meta charset="utf-8">
<meta name="robots" content="index, follow">
<meta name="description" content="Kom ombord i en 2 eller 6 personers ballon med Danmarks mest rutinerede ballonpilot. Flere gange Danmarksmestre og flere danske rekorder under bæltet. Vi garant">
<meta name="generator" content="Helix Ultimate - The Most Popular Joomla! Template Framework.">
<title>Hjem</title>
<link href="/images/favicon-16x16.png" rel="icon" type="image/png">
<link href="/media/vendor/joomla-custom-elements/css/joomla-alert.min.css?0.4.1" rel="stylesheet">
<link href="/components/com_sppagebuilder/assets/css/animate.min.css?fba6c85d81d0c68346fb69189fc1e35e" rel="stylesheet">
<link href="/components/com_sppagebuilder/assets/css/sppagebuilder.css?fba6c85d81d0c68346fb69189fc1e35e" rel="stylesheet">
<link href="/components/com_sppagebuilder/assets/css/dynamic-content.css?fba6c85d81d0c68346fb69189fc1e35e" rel="stylesheet">
<link href="/media/com_sppagebuilder/assets/iconfont/icofont/icofont.min.css?fba6c85d81d0c68346fb69189fc1e35e" rel="stylesheet">
<link href="/media/com_sppagebuilder/assets/iconfont/cox/style.css?fba6c85d81d0c68346fb69189fc1e35e" rel="stylesheet">
<link href="/media/com_sppagebuilder/assets/iconfont/iconfont/style.css?fba6c85d81d0c68346fb69189fc1e35e" rel="stylesheet">
<link href="/media/com_sppagebuilder/assets/iconfont/icodrbqha/style.css?fba6c85d81d0c68346fb69189fc1e35e" rel="stylesheet">
<link href="/media/com_sppagebuilder/assets/iconfont/icoqupptn/style.css?fba6c85d81d0c68346fb69189fc1e35e" rel="stylesheet">
<link href="/media/com_sppagebuilder/assets/iconfont/icoxnlzxt/style.css?fba6c85d81d0c68346fb69189fc1e35e" rel="stylesheet">
<link href="/media/com_sppagebuilder/assets/iconfont/icoghphmv/style.css?fba6c85d81d0c68346fb69189fc1e35e" rel="stylesheet">
<link href="/media/com_sppagebuilder/assets/iconfont/jgmbztrd/style.css?fba6c85d81d0c68346fb69189fc1e35e" rel="stylesheet">
<link href="/media/com_sppagebuilder/assets/iconfont/icotpygjz/style.css?fba6c85d81d0c68346fb69189fc1e35e" rel="stylesheet">
<link href="/media/com_sppagebuilder/assets/iconfont/lnyfxxll/style.css?fba6c85d81d0c68346fb69189fc1e35e" rel="stylesheet">
<link href="/media/com_sppagebuilder/assets/iconfont/ico7fe201/style.css?fba6c85d81d0c68346fb69189fc1e35e" rel="stylesheet">
<link href="/media/com_sppagebuilder/assets/iconfont/ico489f8d/style.css?fba6c85d81d0c68346fb69189fc1e35e" rel="stylesheet">
<link href="/media/com_sppagebuilder/assets/iconfont/icof2e5d9/style.css?fba6c85d81d0c68346fb69189fc1e35e" rel="stylesheet">
<link href="/media/com_sppagebuilder/assets/iconfont/icoa58257/style.css?fba6c85d81d0c68346fb69189fc1e35e" rel="stylesheet">
<link href="/media/com_sppagebuilder/assets/iconfont/icoy3patj/style.css?fba6c85d81d0c68346fb69189fc1e35e" rel="stylesheet">
<link href="/media/com_sppagebuilder/assets/iconfont/icozhyybp/style.css?fba6c85d81d0c68346fb69189fc1e35e" rel="stylesheet">
<link href="/media/com_sppagebuilder/assets/iconfont/icohylqxf/style.css?fba6c85d81d0c68346fb69189fc1e35e" rel="stylesheet">
<link href="/media/com_sppagebuilder/assets/iconfont/icogvdxmx/style.css?fba6c85d81d0c68346fb69189fc1e35e" rel="stylesheet">
<link href="/media/com_sppagebuilder/assets/iconfont/iconhtsmb/style.css?fba6c85d81d0c68346fb69189fc1e35e" rel="stylesheet">
<link href="/media/com_sppagebuilder/assets/iconfont/shxt_lstamb/style.css?fba6c85d81d0c68346fb69189fc1e35e" rel="stylesheet">
<link href="/media/com_sppagebuilder/assets/iconfont/rowvepnu/style.css?fba6c85d81d0c68346fb69189fc1e35e" rel="stylesheet">
<link href="/media/com_sppagebuilder/assets/iconfont/xtbbztup/style.css?fba6c85d81d0c68346fb69189fc1e35e" rel="stylesheet">
<link href="/media/com_sppagebuilder/assets/iconfont/sbvyymul/style.css?fba6c85d81d0c68346fb69189fc1e35e" rel="stylesheet">
<link href="/media/com_sppagebuilder/assets/iconfont/xvprhkns/style.css?fba6c85d81d0c68346fb69189fc1e35e" rel="stylesheet">
<link href="/media/com_sppagebuilder/assets/iconfont/iudhvcbd/style.css?fba6c85d81d0c68346fb69189fc1e35e" rel="stylesheet">
<link href="/media/com_sppagebuilder/assets/iconfont/dmkuieke/style.css?fba6c85d81d0c68346fb69189fc1e35e" rel="stylesheet">
<link href="/media/com_sppagebuilder/assets/iconfont/hirbcpxj/style.css?fba6c85d81d0c68346fb69189fc1e35e" rel="stylesheet">
<link href="/media/com_sppagebuilder/assets/iconfont/cflmwmbl/style.css?fba6c85d81d0c68346fb69189fc1e35e" rel="stylesheet">
<link href="/media/com_sppagebuilder/assets/iconfont/rjuzpwsk/style.css?fba6c85d81d0c68346fb69189fc1e35e" rel="stylesheet">
<link href="/media/com_sppagebuilder/assets/iconfont/kdhxxlbw/style.css?fba6c85d81d0c68346fb69189fc1e35e" rel="stylesheet">
<link href="/media/com_sppagebuilder/assets/iconfont/tpbnfvpx/style.css?fba6c85d81d0c68346fb69189fc1e35e" rel="stylesheet">
<link href="/media/com_sppagebuilder/assets/iconfont/uygllxyn/style.css?fba6c85d81d0c68346fb69189fc1e35e" rel="stylesheet">
<link href="/media/com_sppagebuilder/assets/iconfont/pxbywcqf/style.css?fba6c85d81d0c68346fb69189fc1e35e" rel="stylesheet">
<link href="/media/com_sppagebuilder/assets/iconfont/lwswdanq/style.css?fba6c85d81d0c68346fb69189fc1e35e" rel="stylesheet">
<link href="/media/com_sppagebuilder/assets/iconfont/icocnnkyy/style.css?fba6c85d81d0c68346fb69189fc1e35e" rel="stylesheet">
<link href="/media/com_sppagebuilder/assets/iconfont/dovwpoak/style.css?fba6c85d81d0c68346fb69189fc1e35e" rel="stylesheet">
<link href="/media/com_sppagebuilder/assets/iconfont/icozgggzq/style.css?fba6c85d81d0c68346fb69189fc1e35e" rel="stylesheet">
<link href="/media/com_sppagebuilder/assets/iconfont/icocejpys/style.css?fba6c85d81d0c68346fb69189fc1e35e" rel="stylesheet">
<link href="/media/com_sppagebuilder/assets/iconfont/icofdnjoc/style.css?fba6c85d81d0c68346fb69189fc1e35e" rel="stylesheet">
<link href="/media/com_sppagebuilder/assets/iconfont/icosxugwh/style.css?fba6c85d81d0c68346fb69189fc1e35e" rel="stylesheet">
<link href="/media/com_sppagebuilder/assets/iconfont/icofzkzif/style.css?fba6c85d81d0c68346fb69189fc1e35e" rel="stylesheet">.......
<link href="/media/com_sppagebuilder/assets/iconfont/icotd7132/style.css?fba6c85d81d0c68346fb69189fc1e35e" rel="stylesheet">
<link href="/media/com_sppagebuilder/assets/iconfont/eanaelxg/style.css?fba6c85d81d0c68346fb69189fc1e35e" rel="stylesheet">
<link href="/media/com_sppagebuilder/assets/iconfont/ico25iep8/style.css?fba6c85d81d0c68346fb69189fc1e35e" rel="stylesheet">
<link href="/media/com_sppagebuilder/assets/iconfont/icoc7h50o/style.css?fba6c85d81d0c68346fb69189fc1e35e" rel="stylesheet">
<link href="/components/com_sppagebuilder/assets/css/magnific-popup.css" rel="stylesheet">
<link href="/templates/wondergo/css/bootstrap.min.css" rel="stylesheet">
<link href="/plugins/system/helixultimate/assets/css/system-j4.min.css" rel="stylesheet">
<link href="/templates/wondergo/css/template.css" rel="stylesheet">
<link href="/templates/wondergo/css/presets/preset5.css" rel="stylesheet">
<link href="/templates/wondergo/css/custom.css" rel="stylesheet">3 Answers
Order by
Oldest
PH
Pascal - HTProtect.org
Accepted AnswerDid you already delete those linked files?
The <link> insertions are loaded from the database - SP Page Builder renders those <head> links from the #__sppagebuilder_assets table. Back up the database first, then delete the rogue rows there: type = 'iconfont' with a name you don't recognise and created_by = 0 (your own icons should have created_by > 0), as well as any row whose asset_value isn't plain CSS. Clear all caches and reload the site while logged out - the injected links should then be gone.
To speed things up (detection and removal on click), you could use tools like:
- https://mysites.guru
- https://github.com/zkrana/joomla-security-scanner
- https://htprotect.org/en/#htprotect (my own project, with a malware scanner and cleaning tools, free of charge)
Toufiq
Accepted AnswerHi there,
Thank you for reaching out, and I apologize for any inconvenience caused by this oversight. To better address the issue, could you kindly provide Joomla administrator access? This will enable me to thoroughly investigate the matter and provide you with a prompt resolution.
I appreciate your cooperation and will ensure to get back to you as soon as possible.
Best regards,
Toufiqur Rahman (Team Lead, Support)
Paul Frankowski
Accepted AnswerFollow the cleaning guide: https://www.joomshaper.com/documentation/sp-page-builder/troubleshooting#how-to-clean-an-infected-joomla-4x-6x-site
I wonder why you waited so long with SPPB update, security update (for that issue) was serveral weeks ago.
About Your template from Windstripe Themes. I can only suggest to update Helix Ultimate plugin to last version (2.2.10).