From last 2 weeks a hacker / brute forces are attacking on our Magento website. First they have changed our emails, password may be for any kind of information because every time when we change passwords of server or admin panel we receive an email. Then they have changed the email (PayPal) for payments. I have searched for that on internet and i have deleted the extension (mag pleasure) because i haven't installed that extension then deleted also some strange folders. Now they unable to change the email but i think they are trying because every morning i see that somebody changes the permissions of these folders /media/css and csssecure and js. And in the history of customers i see these strange urls. www.domainname.org/enable-cookies and www.domainname.org/robots.txt - Anybody can give me suggestions?
You should also contact your hosting provider for help, especially if/how those file permissions can still change.
Given that you're talking about updated e-mail addresses for the server, admin panel and also PayPal, it seems they already found several ways to compromise your setup.
It sounds like your shop is still compromised so you need to bring it back to a secure state.
First steps to take may include:
- Contact your hosting provider
- Set up a firewall/web application firewall (together with the hosting provider)
- Get a new (virtual) server, the old one might have some backdoors open
- Always use SFTP and no plain FTP
- Recover your new setup from a secure state from your version control for development (i hope you have that available)
- Update to the lastest version (currently Magento CE 184.108.40.206) or apply all secrity patches (on the new and clean version!)
- Install a 2-Factor Authentication (as also suggested in the comment)
- Hire a Magento/Security specialist to help you.