Re-installing C5 after trojan and code injection attacks

Permalink
Hello,
I was wondering if this is possible. I have a users site that got infected with trojans and some code injection. I wanted to overwrite the C5 files by doing a clean install over itself. What would be the results of doing so? I have done this in wordpress and although there is some site rebuild work it was relatively easy. OR if anyone has any other ideas to fix the site. I cannot even get into the C5 backend.

 
nicolechung replied on at Permalink Reply
Sometimes when a site has gotten "hacked" they've just overrode the index.php (or other files in the site) with something gibberish. If you're lucky - i.e. that's all they've messed around with - if you know PHP and some javascript it's not that hard to fix.

Not being able to get into the admin can be something as simple as a javascript error. If you could post some error messages...for example try to log into the admin and if you are getting an error on the screen, post the error message here.

OR, if you aren't getting any error messages, open up Chrome devtools and see if you are getting some javascript errors.

Also, in the default install of concrete_5, I think the error_log file (no extension) is located in the root folder. If you could download that, that might give you a clue as to the errors since you can't get in the dashboard.
nypcsinc replied on at Permalink Reply
the index.php simply points to a file called dispatcher.php nothing else.
nypcsinc replied on at Permalink Reply
also the site is marked as a malware site by google. Althouth I have put up an index.htm so people would not hit the infected pages. Is there a way to shut down the site from using javascript? I know what the issue is. Some idiot thought it would be a good idea to use a javascript as a photo gallery.. unfortunetly it opened a door and this is the end result.
JohntheFish replied on at Permalink Reply
JohntheFish
A complete unzip of the concrete5 files over the existing concrete5 files could set you back to a fresh site because it would write over config/site.php.

If you made sure to protect config/site.php, then you should be ok to patch over any files with replacements from the same installation zip.

One point of caution. I think there may once have been a separate installer script that was automatically deleted when installation completed. I don't know if it still exists. If it does, accidentally adding it to a site's php files could leave an unfortunate back door.

Maybe someone who knows more about it can clarify that.