JHackGuard Problem - uninstallation of extension (I need delete all of JhackGuard fs)

[xmask]

Hello...
JHackGuard were installed on our website kojetice.cz, but one month ago i have to upload the backup because some virus destroyed our website...now, the Jhack is not installed, but some parts of it are still as a part od our website...what happend after backup upload? in few hours the eval64(aklsjdkasljd.. string is added again into all php files and site is unreachable by visitors... i think that eval64xxx is an encryption string of jhackguard..?
How I can delete all of JHackGuard files from the site... its not anymore in modules/plugins...
what I have to check...

Martin

[Daniel.K]

Hello,

Our JHackGuard plugin does not use eval, gzinflate and base64_decode functions. If the plugins is not present in your Joomla administrative area -> plugins section this means that it has been successfully removed from the CMS. Hackers use base64_decode PHP functions to inject malicious code in Joomla files. I strongly advise you to follow the steps below, so that you can be sure that only you have access to the website:

1. Update your Antivirus software to the latest version. For windows we recommend Norton Internet Security (http://www.dpbolvw.net/click-3048779-10516109).

2. Run a complete antivirus scan on your local computer including all hard drives.

3. Ensure your Operating system (Windows, Linux or MacOS) is up-to-date and all security patches are applied.

4. Ensure your Internet connection is secure. If you are using wireless connection the only secure encryptions is wpa2. For more information contact your router vendor or ISP.

5. Change your control panel password.

6. Change the passwords for your web application backend.

7. Upgrade your Joomla application and all extensions to their latest stable versions.

You can also check this category (http://kb.siteground.com/category/Joomla_Security.html) in our KB for more details how to additionally secure the Joomla CMS.