link-opmls.php

Discussion regarding Joomla! 3.x security issues.

Moderators: mandville, General Support Moderators

Forum rules
Forum Rules
Absolute Beginner's Guide to Joomla! <-- please read before posting, this means YOU.
Forum Post Assistant / FPA - If you are serious about wanting help, you will use this tool to help you post.
Windows Defender SmartScreen Issues <-- please read this if using Windows 10.
Locked
jgold723
Joomla! Enthusiast
Joomla! Enthusiast
Posts: 226
Joined: Mon Mar 26, 2007 3:13 pm

link-opmls.php

Post by jgold723 » Tue Nov 24, 2015 8:49 pm

I've been dealing with a hack and odd activity on my installation. Today I found a new file placed in the root of the installation titled link-opmls.php. I can't tell what it does and I'm wondering if it's malicious or part of an install. Is anyone familiar with this file? I can post it's contents, if there's a safe way to do that.

John
Top
User avatar
pe7er
Joomla! Master
Joomla! Master
Posts: 24974
Joined: Thu Aug 18, 2005 8:55 pm
Location: Nijmegen, Netherlands
Contact:
Contact pe7er

Re: link-opmls.php

Post by pe7er » Wed Nov 25, 2015 8:08 am

Have you opened the file with a text editor?

From a Google search on the file name, my guess is that your website has been hacked:
https://www.google.com/search?q=link-opmls.php

Information about how to clean your system:
Security Checklist/You have been hacked or defaced https://docs.joomla.org/Security_Checkl ... or_defaced
Kind Regards,
Peter Martin, Global Moderator
Company website: https://db8.nl/en/ - Joomla specialist, Nijmegen, Netherlands
The best website: https://the-best-website.com
Top
jgold723
Joomla! Enthusiast
Joomla! Enthusiast
Posts: 226
Joined: Mon Mar 26, 2007 3:13 pm

Re: link-opmls.php

Post by jgold723 » Wed Nov 25, 2015 11:05 am

Thanks Peter. I did open it. The PHP wasn't obviously malicious to me, but then I don't know enough PHP to truly determine that. It does appear to be doing something with the database, so that makes me suspicious.
Top
User avatar
mandville
Joomla! Master
Joomla! Master
Posts: 15152
Joined: Mon Mar 20, 2006 1:56 am
Location: The Girly Side of Joomla in Sussex

Re: link-opmls.php

Post by mandville » Wed Nov 25, 2015 2:10 pm

You can send it to me by a g d r I v e link so I can check Jr out for you
HU2HY- Poor questions = Poor answer
Un requested Help PM's will be reported, added to the foe list and possibly just deleted
{VEL Team Leader}{TM Auditor }{ Showcase & Security forums Moderator}
Top
jgold723
Joomla! Enthusiast
Joomla! Enthusiast
Posts: 226
Joined: Mon Mar 26, 2007 3:13 pm

Re: link-opmls.php

Post by jgold723 » Wed Nov 25, 2015 2:24 pm

Thank you:

[removed]
Top
User avatar
mandville
Joomla! Master
Joomla! Master
Posts: 15152
Joined: Mon Mar 20, 2006 1:56 am
Location: The Girly Side of Joomla in Sussex

Re: link-opmls.php

Post by mandville » Wed Nov 25, 2015 5:02 pm

file is checked an found to be a content inserter hackers file
HU2HY- Poor questions = Poor answer
Un requested Help PM's will be reported, added to the foe list and possibly just deleted
{VEL Team Leader}{TM Auditor }{ Showcase & Security forums Moderator}
Top
jgold723
Joomla! Enthusiast
Joomla! Enthusiast
Posts: 226
Joined: Mon Mar 26, 2007 3:13 pm

Re: link-opmls.php

Post by jgold723 » Wed Nov 25, 2015 5:23 pm

Thank you very much! I appreciate it.
Top
Locked

Return to “Security in Joomla! 3.x”