The Joomla! Forum ™

Hi guys!

I recently noticed that Avira gave me a warning on my site in IE. I went around and searched for sucpisious code.

When I'm indexing my frontpage I found this in the very top of the page:

It's a javascript and my firend helped me decode it. The it turned out like this:



How the H*** did I first think. Where can that file be that adds this code to my index? and all pages for that matter? Where do i start to search? I guess its one file pretending to be a "plugin" that adds the code on all the pages when run?

Please help=)

My site is: http://www.tuaagder. no

[ ] Download and RUN the Forum Post Assistant / FPA Instructions available here and are also included in the download package. Post the generated results in your security/been hacked topic.

[ ] Ensure you have the latest version of Joomla for your 1.5 or 2.5 version of Joomla. Delete all files in your Joomla installation, saving a copy of the configuration.php file.

[ ] Review Vulnerable Extensions List to make sure any 3rd party extensions versions used appear on the vulnerable list.

[ ] Review and action Security Checklist 7 Make sure you've gone through all of the steps.

[ ] Scan all machines with FTP, Joomla super admin, and Joomla admin access for malware, virus, trojans, spyware, etc. Checklist 7 contains a list or recommended scanners.

[ ] Change all passwords and if possible user names for the website host control panel. Change the Joomla database user name and password.

[ ] Use proper permissions on files and directories. They should never be 777, ideal is 644 for files and 755 for directories. The configuration file can be set to 444 which is read only.

[ ] Check your htaccess for for any odd code (i.e. code which is not in the standard htaccess supplied as part of the Joomla installation).

[ ] Check the crontab or Task Scheduler for unexpected jobs/tasks.

[ ] Ensure you do not have anonymous ftp enabled.

[ ] Verify individually that any non-Joomla file such as but not limited to that will be placed back on the website such as images, pdf files, files for download, and other documents and files are valid and are supposed to be part of your website.

[ ] Replace the deleted files with fresh copies of a current full version of Joomla (minus the installation directory) you downloaded earlier. Install freshly downloaded copies of any extensions and templates used on the site. If the Joomla database user name and password were changed earlier, then make the necessary changes to the configuration.php file and upload a copy to the website. Upload any non-Joomla files that are necessary for your website. Only by replacing all files in the installation (including extensions and templates) can you be sure to remove the backdoors inserted and hidden in various files and directories More detailed information can be found in the Security Checklist 7

_________________
HU2HY- Poor questions = Poor answer
Un requested Help PM's will be added to the foe list and possibly just deleted
{Community.Connect Administrator }{ Showcase & Security Moderator}

I checked your site here and it reported malware, which you already know. This reported sucuri for your site:

malware-entry-mwexploitkitblackhole1

http://sitecheck.sucuri.net/scanner/

Yeah I know=) Found that code:D But that was a good scanner BTW!

BUT! My question is. How do I remove this code w.out reinstalling everything. Were looking at MANY hours of work for that to happend=) And, How the H*** did he get in in the first time?=)

Thanks!

Do you have a backup of your files? It could be used unless it is also infected. But here you will get the advice to download fresh unifected Joomla files and use them instead.

Sucuri has a cleaning service for malware, but it costs 90 USD, but lasts for a year. I guess your site gets fixed then directly after a couple of hours.

To avoid situations like yours I use the security extension Eyesite, that detects changed or new files on the site.
http://www.lesarbresdesign.info/extensions/eyesite

follow the first line of the checklist and it may help us judge

_________________
HU2HY- Poor questions = Poor answer
Un requested Help PM's will be added to the foe list and possibly just deleted
{Community.Connect Administrator }{ Showcase & Security Moderator}

FPA report:

Your Joomla is out of date, how many of the extensions are out of date ?

You now need to delete all folders and files. Then do everything else in the list mandville posted.

_________________
http://weblinksonline.co.uk/joomla-faq.html