Extension/Module installed Date & Time Joomla 2.5

Question

Recently my joomla website is hacked. After that I tried to find out the Root Cause for the Hack , found a Module installed in my hacked joomla website whih is not installed by me. My website have few Users with Administrator UAC.

I want to find out who (which Joomla User) installed the module and Date & Time of the installed Module.

I have Deleted the all files while restoring the website. So i can't find out the time installed Infected module.

I tried to find out in the Administrator (Admin Panel) & Database regarding this but i can't find any. Is there any other way to find the Date/Time & User of the installed module.

I'm Using Joomla 2.5

Answer 1

If you have access to the Apache logs, then you can do that by just checking the logs. Just do a grep on com_install and see which IP performed the install, and then do a grep on the IP to know which user logged in as that IP.

Hope that helps!