• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1128
  • Last Modified:

Joomla hack redirects article saves to malware

I have a 2 y/o Joomla site.  Using Joomla 1.5.2.  Has worked fine until today.  Attempted to edit the article home page.  Made the change and clicked on Save. Was immediately redirected to a site declaring i was infected ...  great fireworks showing phony scans indicating many infections. X'd out of all and end processed the offending tab ..   went to site to see if my change had taken.  It hadn't.  Went back to admin and it appears that once in an article if I attempt to save or close or apply I am immediately redirected to an unbranded Search site with Facebook themed hits.  This happens on any computer.  Verio is my host and it happened to my tech support rep.
There has been no impact on the site itself ...  it's just admin so far that is affected/infected.   THere is only an htaccess.txt file in the site root.  The files licenses.php, license.php, install.php,index.php credits.php, configuration.php and changelog.php all have dates of 2/23/2011 ..  I made no changes on that day.
Welcome suggestions ..
0
bborner
Asked:
bborner
1 Solution
 
thomasd04Commented:
Hi bborner. Are you asking for how this may have happened or how to fix the problem?
Are you using any forms on the website? If so perhaps a possible SQL Injection.
Or do you use unsecured FTP to transfer files or install extensions?

0
 
bbornerAuthor Commented:
attached are the last 200 lines of my logfile ... says morpheus strikes again
 logfiles.txt
0
 
Peter HartCommented:
have you every backed up the system? if I would restore the source files (not the database - leave that)
if no backup then I would back up the site first (use http://www.akeebabackup.com/download.html)
then I would reupload your original Joomla source files (except for the installation directory)
if that doesn't fix it  re-install any extensions you have iinstalled.
0
Worried about phishing attacks?

90% of attacks start with a phish. It’s critical that IT admins and MSSPs have the right security in place to protect their end users from these phishing attacks. Check out our latest feature brief for tips and tricks to keep your employees off a hackers line!

 
austegaCommented:
Mmmm... Take a deep breath and don't rush into anything, in order to avoid making things worse.

Then follow the path that others have found safest and most useful - see the one on the Joomla doc site at http://docs.joomla.org/Security_and_Performance_FAQs#Help.21_My_site.27s_been_compromised._Now_what.3F .

From what you have said I would think that a complete new install - either via Akeeba's Kickstart script if you have an Akeeba backup from before the hack or using a Joomla 1.5.22 install will be required. Probably your database is okay.

Remember to review your backup and security arrangements while you are motivated to put them in place!
0
 
bbornerAuthor Commented:
Thank you all for your comments ...  
I found the obscure code in each of the files; licenses.php, changelog.php, configuration.php, copyright.php, credits.php, index.php immediately after the first <?php...

All is well .. thanks again
0
 
bbornerAuthor Commented:
Found the incriminating code causing the problem
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Cloud Class® Course: Microsoft Office 2010

This course will introduce you to the interfaces and features of Microsoft Office 2010 Word, Excel, PowerPoint, Outlook, and Access. You will learn about the features that are shared between all products in the Office suite, as well as the new features that are product specific.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now