site hack with geopic.php

[jennied53]

Hi
I've just downloaded a backup of a 1.5 site with a view to migrating it to a new Joomla version, but appears we left it too long!
My virus scanner picked up on a trojan file geopic.php. I've now deleted this from the server but I've discovered a lot of rogue files in the root folder, containing this code with various URLs:

Code: Select all

<?php
$urls = array (
            'http://realworkathomegooglejobs.com/indexer.php?a=269321&c=job&s=4j27z',
            );
          
          
$n = mt_rand(0,count($urls) - 1);
$rand_url = $urls[$n];
?>
<meta http-equiv="refresh" content="1; url=<?php echo  $rand_url;?> ">

I'm following the docs and looking at cleaning up the site, but I was hoping for some advice in view of the fact that we are about to migrate the site, hopefully to Joomla 3. Is there a way to establish if the database has been tampered with or is this type of hack likely to be confined to PHP files on the server? Will upgrading the site eliminate some of the problems automatically?

This is a large site, otherwise I'd probably play safe and start with a fresh installation and copy data across manually, but it would really help if I could use the database. Having said that, I know the database structure is completely different after 1.5 so I don't know if I'll be able to do that anyway.

Any advice would be really helpful from someone who has more experience with these kind of problems. This is only the second time I've had to deal with a hacked site.

Thanks in advance
Jennie

[mandville]

personally i would go with these two options
* scrub the site and build afresh with j3
* get the site hack free then go to the migration forums for help on 1.5 - 3

run the fpa so we can see if there is any hint to how you got the hack

[jennied53]

Hi thanks for your reply Mandville.

The hosting company disabled the site so I've had to try and get the site back into working order as a priority. I've used an old backup from last August for the site files and added the new database. The hosting company thought it would be OK to use the same database. Mostly I was left with missing images, so I've picked them up manually from the latest contaminated backup. It's looking OK so far.

Definitely will be looking to migrate to 3.0 as speedily as possible. I did run FPA before the site was disabled and I've attached the results.

Thanks again
Jennie

[mandville]

please follow the instructions listed in the fpa topic on how to generate a fpa report.
in the meantime i see the following major issues
Hotspots
2.0.5

RD_Sitemap
2.0.J-rc1

Admintools
2.1.1

JCE

Akeeba

Custom Properties
1.98.3.3

aiContactSafe - Form
1.0.13.stable

old, exploitable, hackable

i have removed your fpa as it includes your url which can cause even more hacking to occour