Joomla! Discussion Forums

Hi,
I just found the following version of the base64_decode/gzinflate hack.

They used the form:
"$v1 = strrev("edoced_46esab"); $v2 = strrev("etalfnizg"); eval ...."

So in case you think your site got hacked:
Don't "grep" only for "base64_decode" and/or "gzinflate";
also scan for "edoced_46esab" and "etalfnizg".

Hope this helps.

Yes that is correct and that is not the only version we have!
There some versions thats are complete masked, no "eval", no "base64" at all

old, very OLD..

just check for iframe injections ...

Surely you can see that was likely randomly generated, right?