Joomla! Discussion Forums

Suddenly my disk space started to grow.

After contacting my host it appears that somebody maked hidden folders "...." in the /includes/js/dtree/ folder and started an ftp server from that place.

Database Version: 5.0.45-community
PHP Version: 5.2.5
Web Server: Apache/2
WebServer to PHP interface: apache2handler
Joomla! Version: Joomla! 1.0.15 Stable [ Daytime ] 22 February 2008 23:00 UTC

After downloading the includes directory to my computer my virus scanner found:
trjohan horse PHP/Backdoor.r57Shell
In the file:
includes\domit\xml_domit_con.php

I would recommend using Joomla! Tools Suite (JTS-sa) & HISA (HISA-sa) to analyze your site:
http://extensions.joomla.org/component/ ... Itemid,35/