Site hacked, I dont know how to remove hacker's content - Joomla! Forum - community, help and support

hello,

my joomla site hacked. suppose stole admin passwords, because of 3 admin accounts in user manager section has been changed.

however, have repaired admin accounts directly through database access.

but now, still have problem content. articles fine, index.php looks fine, .htaccess looks fine, site doesn't fine

i have installed forum post assistant: <removed link>
i have downloaded whole site content , checked through antivirus program.

any suggestion?

tnx in advance!

forum post assistant (v1.2.3) : 10th november 2012 wrote:

basic environment :: wrote:joomla! instance :: joomla! 1.5.20-stable (senu takaa) 18-july-2010
joomla! configured :: yes | read-only (444) | owner: logikars (uid: 1/gid: 1) | group: logikars (gid: 1) | valid for: 1.5
configuration options :: offline: 0 | sef: 0 | sef suffix: 0 | sef rewrite: 0 | .htaccess/web.config: yes | gzip: 0 | cache: 0 | ftp layer: 0 | ssl: 0 | error reporting: -1 | site debug: 0 | language debug: 0 | database credentials present: yes

host configuration :: os: linux | os version: 2.6.18-308.13.1.el5 | technology: i686 | web server: apache | encoding: gzip, deflate | doc root: /home/logikars/public_html | system tmp writable: yes

php configuration :: version: 5.2.17 | php api: cgi-fcgi | session path writable: unknown | display errors: | error reporting: 6135 | log errors to: error_log | last known error: | register globals: | magic quotes: 1 | safe mode: | open base: | uploads: 1 | max. upload size: 64m | max. post size: 64m | max. input time: 60 | max. execution time: 60 | memory limit: 96m

mysql configuration :: version: 5.0.77 (client:5.0.92) | host: --protected-- (--protected--) | collation: utf8_general_ci (character set: utf8) | database size: 537.14 kib | #of tables: 46

detailed environment :: wrote:php extensions :: date (5.2.17) | libxml () | openssl () | pcre () | zlib (1.1) | bcmath () | bz2 () | calendar () | ctype () | curl () | dom (20031129) | hash (1.0) | filter (0.11.0) | ftp () | gd () | gettext () | session () | iconv () | standard (5.2.17) | json (1.2.1) | mbstring () | mcrypt () | mhash () | mime_magic (0.1) | mysql (1.0) | simplexml (0.1) | posix () | reflection (0.1) | imap () | spl (0.2) | mysqli (0.1) | soap () | sockets () | exif (1.4 $id: exif.c 293036 2010-01-03 09:23:27z sebastian $) | tidy (2.0) | tokenizer (0.1) | wddx () | xml () | xmlreader (0.1) | xmlrpc (0.51) | xmlwriter (0.1) | xsl (0.1) | zip (1.8.11) | cgi-fcgi () | suhosin (0.9.33) | pdo (1.0.4dev) | pdo_sqlite (1.0.1) | sqlite (2.0-dev) | apc (3.0.19) | imagick (3.0.0) | pdo_mysql (1.0.2) | zend engine (2.2.0) |
potential missing extensions ::

switch user environment (experimental) :: php cgi: yes | server su: no | php su: yes | custom su (litespeed/cloud/grid): yes
potential ownership issues: no

folder permissions :: wrote:core folders :: images/ (755) | components/ (755) | modules/ (755) | plugins/ (755) | language/ (755) | templates/ (755) | cache/ (755) | logs/ (755) | tmp/ (755) | administrator/components/ (755) | administrator/modules/ (755) | administrator/language/ (755) | administrator/templates/ (755) |

elevated permissions (first 10) ::

database information :: wrote:database _fpa_stats :: uptime: 4973429 | threads: 2 | questions: 578391334 | slow queries: 2763 | opens: 15620689 | flush tables: 1 | open tables: 256 | queries per second avg: 116.296 |

extensions discovered :: wrote:components :: site :: wrapper (1.5.0) | mailto (1.5.0) | user (1.5.0) |
components :: admin :: trash (1.0.0) | user profiles (1.5.0) | template manager (1.5.0) | contact items (1.0.0) | installation manager (1.5.0) | mad4joomla (1.2) | menus manager (1.5.0) | banners (1.5.0) | search (1.5.0) | frontpage (1.5.0) | configuration manager (1.5.0) | content page (1.5.0) | polls (1.5.0) | mass mail (1.5.0) | language manager (1.5.0) | jce (1.5.7.6) | media manager (1.5.0) | new_gallery (v1.0) | newsfeeds (1.5.0) | cache manager (1.5.0) | plugin manager (1.5.0) | control panel (1.5.0) | module manager (1.5.0) | weblinks (1.5.0) | messaging (1.5.0) | user manager (1.5.0) |

modules :: site :: sections (1.5.0) | newsflash (1.5.0) | s5 accordion menu (1.5.0) | login (1.5.0) | mad4joomla mailforms listing (1.0) | footer (1.5.0) | custom html (1.5.0) | wrapper (1.0.0) | syndicate (1.5.0) | simple image holder (1.5.12) | social widgets ultimate editio (1.0.3) | accordion menu apple style (1.53) | related items (1.0.0) | banner (1.5.0) | read content (1.5.0) | feed display (1.5.0) | flash module (3.0.2) | statistics (1.5.0) | vinaora cu3er 3d slideshow (1.2.1) | search (1.0.0) | who\'s online (1.0.0) | menu (1.5.0) | face fanbox or likebox (1.1.0.0) | poll (1.5.0) | breadcrumbs (1.5.0) | archived content (1.5.0) | random image (1.5.0) | pausing up-down scroller (1.51) | lof articlessroller module (1.1) | latest news (1.5.0) | mod_moomenu_ck (1.1.0) |
modules :: admin :: login form (1.0.0) | footer (1.0.0) | custom html (1.5.0) | online users (1.0.0) | admin menu (1.0.0) | toolbar (1.0.0) | popular items (1.0.0) | unread items (1.0.0) | quick icons (1.0.0) | admin submenu (1.0.0) | title (1.0.0) | feed display (1.5.0) | user status (1.5.0) | items stats (1.0.0) | logged in users (1.0.0) | latest news (1.0.0) |

plugins :: site :: system - mootools upgrade (1.5) | system - backlinks (1.5) | system - legacy (1.5) | system - debug (1.5) | system - log (1.5) | system - remember me (1.5) | system - bigshot google analyt (1.5.3) | system - sef (1.5) | system - cache (1.5) | xml-rpc - blogger api (1.0) | xml-rpc - joomla api (1.0) | content - email cloaking (1.5) | content - example (1.0) | content - pagebreak (1.5) | sige (1.5-14) | content - load modules (1.5) | content - page navigation (1.5) | content - vote (1.5) | content - code highlighter (ge (1.5) | simple image gallery plugin (1.2.1) | search - sections (1.5) | search - content (1.5) | search - contacts (1.5) | search - newsfeeds (1.5) | search - categories (1.5) | search - weblinks (1.5) | authentication - ldap (1.5) | authentication - example (1.5) | authentication - openid (1.5) | authentication - gmail (1.5) | authentication - joomla (1.5) | advanced code editor (1.5.7.6) | file browser (1.5.7.6) | paste (1.5.7.6) | image manager (1.5.7.6) | paste (1.5.7.6) | joomla! links advanced lin (1.2.1) | advanced link (1.5.7.6) | media object support (1.5.7.6) | jce spellchecker title (1.5.7.6) | editor - xstandard lite jo (1.0) | editor - jce (1.5.7.6) | editor - tinymce 3 (3.2.6) | button - readmore (1.5) | button - image (1.0.0) | button - pagebreak (1.5) | user - example (1.0) | user - joomla! (1.5) |

templates discovered :: wrote:templates :: site :: siteground-j15-169 (1.0.0) | beez (1.0.0) | zetes (1.0) | ja_purity (1.2.0) | siteground-j15-163 (1.0.0) | jp_bloq_j1.5 (1.6) | rhuk_milkyway (1.0.2) | dynamisch_whiteheadphones_by_j (v1.1) | tj_happiness (1.0.0) | stheno (1.1) | bizco (1.0) |
templates :: admin :: khepri (1.0) |