Has my site been hacked?

[ReJigged]

J! 2.5.19

Hi all,

I was performing a backup this morning when my a/v picked up and removed a file. It was in my /components directory. The filename is ssyny9.php and contains a function looking for cookies called '[removed], Jlma2 & Jlma3'.

There was also another file I didn't recognise in there - movie.php. When this is looked at if has a line started "if(@md5($_POST["gif"])....". This file displays '[removed]' if run in a browser.

The site seems to be ok at the moment but I am concerned my anti-virus may have picked up something I need to be aware of. Searches in Google don't seem to turn anything significant up.

Does anyone recognise these files?

Thanks

RJ

edit - I swear I was posting in the security section. Can't see how to move or delete this post.

[pe7er]

mod note: moved to security forum.
Please in the future just report your own post & ask for moving it to the right board. Thanks!

[Bernard T]

You have an old version of Joomla, you should upgrade immediately.

Judging by what you found in your files and your AV reacting on it, I would pretty sure say your website has been compromised with some backdoor/rootkit files.

I'd advise you to follow this instructions closely
http://forum.joomla.org/viewtopic.php?f=621&t=582854