My website security - it is being hacked

[vbangaru]

[20-Jan-2013 21:23:30 America/Denver] PHP Strict Standards: Only variables should be assigned by reference in /home3/smilesg1/public_html/spaces.ac.in/templates/siteground-j16-9/templates.php on line 1

Joomla! Instance :: Joomla! 1.7.3-Stable (Ember) 14-Nov-2011
Joomla! Platform :: Joomla Platform 11.2.0-Stable+Modified (Omar) 27-Jul-2011
Joomla! Configured :: Yes | Writable (755) | Owner: smilesg1 (uid: 1/gid: 1) | Group: smilesg1 (gid: 1) | Valid For: 1.7
Configuration Options :: Offline: 0 | SEF: 1 | SEF Suffix: 0 | SEF ReWrite: 0 | .htaccess/web.config: Yes | GZip: 0 | Cache: 0 | FTP Layer: 0 | SSL: N/A | Error Reporting: default | Site Debug: 0 | Language Debug: 0 | Default Access: 1 | Unicode Slugs: 0 | Database Credentials Present: Yes

Host Configuration :: OS: Linux | OS Version: 2.6.32-20130101.60.1.bh6.x86_64 | Technology: x86_64 | Web Server: Apache | Encoding: gzip,deflate,sdch | Doc Root: /home3/smilesg1/public_html/spaces.ac.in | System TMP Writable: Yes

PHP Configuration :: Version: 5.4.10 | PHP API: cgi-fcgi | Session Path Writable: Yes | Display Errors: | Error Reporting: 24575 | Log Errors To: error_log | Last Known Error: 20th January 2013 21:23:30. | Register Globals: | Magic Quotes: | Safe Mode: | Open Base: | Uploads: 1 | Max. Upload Size: 10M | Max. POST Size: 10M | Max. Input Time: 60 | Max. Execution Time: 30 | Memory Limit: 128M

MySQL Configuration :: Version: 5.5.29-log (Client:5.5.29) | Host: --protected-- (--protected--) | Collation: latin1_swedish_ci (Character Set: latin1) | Database Size: 641.67 KiB | #of Tables:  34

PHP Extensions :: Core (5.4.10) | date (5.4.10) | ereg () | libxml () | openssl () | pcre () | sqlite3 (0.7) | zlib (2.0) | bcmath () | bz2 () | calendar () | ctype () | curl () | dba () | dom (20031129) | enchant (1.1.0) | hash (1.0) | fileinfo (1.0.5) | filter (0.11.0) | ftp () | gd () | gettext () | gmp () | SPL (0.2) | iconv () | session () | intl (1.1.0) | json (1.2.1) | ldap () | mbstring () | mcrypt () | mysql (1.0) | mysqli (0.1) | odbc (1.0) | pcntl () | standard (5.4.10) | PDO (1.0.4dev) | pdo_dblib (1.0.1) | pdo_mysql (1.0.2) | PDO_ODBC (1.0.1) | pdo_pgsql (1.0.2) | pdo_sqlite (1.0.1) | pgsql () | Phar (2.0.1) | posix () | pspell () | readline (5.4.10) | recode () | Reflection ($Id: 60f1e547a6dd00239162151e701566debdcee660 $) | imap () | shmop () | SimpleXML (0.1) | soap () | sockets () | exif (1.4 $Id$) | sysvmsg () | sysvsem () | sysvshm () | tidy (2.0) | tokenizer (0.1) | wddx () | xml () | xmlreader (0.1) | xmlrpc (0.51) | xmlwriter (0.1) | xsl (0.1) | zip (1.11.0) | cgi-fcgi () | mhash () | Zend Engine (2.4.0) |
Potential Missing Extensions :: suhosin |

Switch User Environment (Experimental) :: PHP CGI: Yes | Server SU: Yes | PHP SU: Yes | Custom SU (LiteSpeed/Cloud/Grid): Yes
Potential Ownership Issues: No

Core Folders :: images/ (755) | components/ (755) | modules/ (755) | plugins/ (755) | language/ (755) | templates/ (755) | cache/ (755) | logs/ (755) | tmp/ (755) | administrator/components/ (755) | administrator/modules/ (755) | administrator/language/ (755) | administrator/templates/ (755) |

Elevated Permissions (First 10) ::

Components :: SITE :: com_wrapper (1.7.0) | com_mailto (1.7.0) |
Components :: ADMIN :: com_search (1.7.0) | com_admin (1.7.0) | com_installer (1.7.0) | com_categories (1.7.0) | com_newsfeeds (1.7.0) | com_config (1.7.0) | com_login (1.7.0) | com_users (1.7.0) | com_menus (1.7.0) | com_checkin (1.7.0) | com_messages (1.7.0) | com_banners (1.7.0) | com_redirect (1.7.0) | com_content (1.7.0) | com_modules (1.7.0) | com_cache (1.7.0) | com_media (1.7.0) | com_plugins (1.7.0) | com_languages (1.7.0) | com_cpanel (1.7.0) | com_templates (1.7.0) | com_weblinks (1.7.0) |

Modules :: SITE :: mod_login (1.7.0) | mod_banners (1.7.0) | mod_languages (1.7.0) | mod_related_items (1.7.0) | mod_menu (1.7.0) | mod_articles_categories (1.7.0) | mod_random_image (1.7.0) | NGMenu Free (1.6.2) | mod_breadcrumbs (1.7.0) | mod_articles_category (1.7.0) | mod_articles_latest (1.7.0) | mod_whosonline (1.7.0) | mod_footer (1.7.0) | mod_wrapper (1.7.0) | mod_feed (1.7.0) | mod_weblinks (1.7.0) | mod_users_latest (1.7.0) | mod_articles_popular (1.7.0) | mod_syndicate (1.7.0) | mod_articles_news (1.7.0) | mod_search (1.7.0) | mod_custom (1.7.0) | mod_articles_archive (1.7.0) | mod_stats (1.7.0) |
Modules :: ADMIN :: mod_login (1.7.0) | mod_toolbar (1.7.0) | mod_menu (1.7.0) | mod_popular (1.7.0) | mod_title (1.7.0) | mod_quickicon (1.7.0) | mod_feed (1.7.0) | mod_logged (1.7.0) | mod_status (1.7.0) | mod_latest (1.7.0) | mod_multilangstatus (1.7.1) | mod_submenu (1.7.0) | mod_custom (1.7.0) |

Plugins :: SITE :: plg_user_profile (1.7.0) | plg_user_joomla (1.7.0) | plg_user_contactcreator (1.7.0) | plg_extension_joomla (1.7.0) | plg_editors-xtd_image (1.7.0) | plg_editors-xtd_readmore (1.7.0) | plg_editors-xtd_pagebreak (1.7.0) | plg_editors-xtd_article (1.7.0) | plg_content_pagenavigation (1.7.0) | plg_content_vote (1.7.0) | plg_content_pagebreak (1.7.0) | plg_content_geshi (1.7.0) | plg_content_emailcloak (1.7.0) | plg_content_joomla (1.7.0) | plg_content_loadmodule (1.7.0) | plg_system_log (1.7.0) | plg_system_p3p (1.7.0) | plg_system_logout (1.7.0) | plg_system_remember (1.7.0) | plg_system_languagefilter (1.7.0) | plg_system_redirect (1.7.0) | plg_system_cache (1.7.0) | plg_system_sef (1.7.0) | plg_system_debug (1.7.0) | plg_editors_codemirror (1.0) | plg_editors_tinymce (3.4.4) | plg_search_content (1.7.0) | plg_search_categories (1.7.0) | plg_search_newsfeeds (1.7.0) | plg_search_weblinks (1.7.0) | plg_search_contacts (1.7.0) | plg_authentication_ldap (1.7.0) | plg_authentication_gmail (1.7.0) | plg_authentication_joomla (1.7.0) |

Templates :: SITE :: beez5 (1.7.0) | atomic (1.7.0) | beez_20 (1.7.0) | siteground-j16-3 (1.0.0) | Siteground-j16-6 (1.0.0) | siteground-j16-9 (1.0.0) |
Templates :: ADMIN :: hathor (1.7.0) | bluestork (1.7.0) |

[ranwilli]

Is your security concern stemming solely from the Strict Standards Notice?

[vbangaru]

I don't know the reason. Suddenly I see that some of my public html folder files being replaced even though I changed my passwords. When I contacted my hosting server they asked me to look for joomla support.

[mandville]

My Initial reaction is that your security issue may be you are running am out of date and exploitable version and should update now. Treat your site as hacked for good measure and follow the stickies.