Solved

Joomla hack redirects article saves to malware

Posted on 2011-03-01
6
1,117 Views
Last Modified: 2012-05-11
I have a 2 y/o Joomla site.  Using Joomla 1.5.2.  Has worked fine until today.  Attempted to edit the article home page.  Made the change and clicked on Save. Was immediately redirected to a site declaring i was infected ...  great fireworks showing phony scans indicating many infections. X'd out of all and end processed the offending tab ..   went to site to see if my change had taken.  It hadn't.  Went back to admin and it appears that once in an article if I attempt to save or close or apply I am immediately redirected to an unbranded Search site with Facebook themed hits.  This happens on any computer.  Verio is my host and it happened to my tech support rep.
There has been no impact on the site itself ...  it's just admin so far that is affected/infected.   THere is only an htaccess.txt file in the site root.  The files licenses.php, license.php, install.php,index.php credits.php, configuration.php and changelog.php all have dates of 2/23/2011 ..  I made no changes on that day.
Welcome suggestions ..
0
Comment
Question by:bborner
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
6 Comments
 
LVL 3

Expert Comment

by:thomasd04
ID: 35012987
Hi bborner. Are you asking for how this may have happened or how to fix the problem?
Are you using any forms on the website? If so perhaps a possible SQL Injection.
Or do you use unsecured FTP to transfer files or install extensions?

0
 

Author Comment

by:bborner
ID: 35013032
attached are the last 200 lines of my logfile ... says morpheus strikes again
 logfiles.txt
0
 
LVL 29

Expert Comment

by:chilternPC
ID: 35013117
have you every backed up the system? if I would restore the source files (not the database - leave that)
if no backup then I would back up the site first (use http://www.akeebabackup.com/download.html)
then I would reupload your original Joomla source files (except for the installation directory)
if that doesn't fix it  re-install any extensions you have iinstalled.
0
Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
LVL 8

Expert Comment

by:austega
ID: 35014036
Mmmm... Take a deep breath and don't rush into anything, in order to avoid making things worse.

Then follow the path that others have found safest and most useful - see the one on the Joomla doc site at http://docs.joomla.org/Security_and_Performance_FAQs#Help.21_My_site.27s_been_compromised._Now_what.3F .

From what you have said I would think that a complete new install - either via Akeeba's Kickstart script if you have an Akeeba backup from before the hack or using a Joomla 1.5.22 install will be required. Probably your database is okay.

Remember to review your backup and security arrangements while you are motivated to put them in place!
0
 

Accepted Solution

by:
bborner earned 0 total points
ID: 35071708
Thank you all for your comments ...  
I found the obscure code in each of the files; licenses.php, changelog.php, configuration.php, copyright.php, credits.php, index.php immediately after the first <?php...

All is well .. thanks again
0
 

Author Closing Comment

by:bborner
ID: 35120648
Found the incriminating code causing the problem
0

Featured Post

Migrating Your Company's PCs

To keep pace with competitors, businesses must keep employees productive, and that means providing them with the latest technology. This document provides the tips and tricks you need to help you migrate an outdated PC fleet to new desktops, laptops, and tablets.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Getting hacked is no longer a matter or "if you get hacked" — the 2016 cyber threat landscape is now titled "when you get hacked." When it happens — will you be proactive, or reactive?
If you thought ransomware was bad, think again! Doxware has the potential to be even more damaging.
Attackers love to prey on accounts that have privileges. Reducing privileged accounts and protecting privileged accounts therefore is paramount. Users, groups, and service accounts need to be protected to help protect the entire Active Directory …
This video shows how to use Hyena, from SystemTools Software, to update 100 user accounts from an external text file. View in 1080p for best video quality.

732 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question