Site Hacked: Code injected in Factory.php

[sebnunes]

Hi all,

We recently've been hacked. We're running 1.5.25, we were about to update to 1.5.26.


There was a
- malicious phpinfo.php file at root level (above the joomla installation)
- unwanted .htaccess at server root level and joomla root level
- injected code in /libraries/joomla/factory.php

Code was like this:

//bldQNTCWORb695RmAGhsPX

$GLOBALS['_1659886199_']=Array(base64_decode('ZGVmaW5l'),...}

I removed the .htaccess & removed the injected code from the factory.php but now I cannot connect to the SQL db. I have an error message saygin:

Database Error: Unable to connect to the database:The MySQL adapter "mysqli" is not available.

I guess there is other malicious code in other files. Any idea how to fix this?

Here is the FPA:

Site Hacked malicious code added in factory.php

Database Error: Unable to connect to the database:The MySQL adapter \"mysqli\" is not available.

I removed the malicious .htaccess file and the code added in the /libraries/joomla/factory.php file but since then the joomla can\'t connect to my database anymore.

Joomla! Instance :: Joomla! 1.5.25-Stable (senu takaa ama mamni) 14-November-2011
Joomla! Configured :: Yes | Read-Only (444) | Owner: ducatisu (uid: 1/gid: 1) | Group: users (gid: 1) | Valid For: 1.5
Configuration Options :: Offline: 1 | SEF: 0 | SEF Suffix: 0 | SEF ReWrite: 0 | .htaccess/web.config: No | GZip: 0 | Cache: 0 | FTP Layer: 0 | SSL: 0 | Error Reporting: -1 | Site Debug: 0 | Language Debug: 0 | Database Credentials Present: Yes

Host Configuration :: OS: Linux | OS Version: 3.10.11-mutu-grs-ipv6-64 | Technology: x86_64 | Web Server: Apache | Encoding: gzip,deflate,sdch | Doc Root: /homez.707/ducatisu/www | System TMP Writable: Unknown

PHP Configuration :: Version: 4.4.9 | PHP API: cgi | Session Path Writable: Yes | Display Errors: 1 | Error Reporting: 2039 | Log Errors To: | Last Known Error: | Register Globals: 1 | Magic Quotes: 1 | Safe Mode: | Open Base: | Uploads: 1 | Max. Upload Size: 64M | Max. POST Size: 64M | Max. Input Time: -1 | Max. Execution Time: 120 | Memory Limit:

MySQL Configuration :: Connection Error: : Database Credentials Present? in Configuration...

PHP Extensions :: zip () | xslt () | xml () | wddx () | tokenizer (0.1) | sysvshm () | sysvsem () | sysvmsg () | standard (4.4.9) | session () | pspell () | posix () | pgsql () | pdf () | overload () | mysql () | ming () | mhash () | mcrypt () | mbstring () | imap () | gmp () | gettext () | gd () | ftp () | filepro () | exif (1.4 $Id: exif.c,v 1.118.2.37.2.8 2007/12/31 07:22:46 sebastian Exp $) | domxml (20020815) | dbase () | dba () | db () | curl () | ctype () | calendar () | bcmath () | zlib (1.1) | pcre () | openssl () | Zend Engine (1.3.0) |
Potential Missing Extensions :: libxml | iconv | mysqli | suhosin |

Switch User Environment (Experimental) :: PHP CGI: Yes | Server SU: Yes | PHP SU: Yes | Custom SU (LiteSpeed/Cloud/Grid): Yes
Potential Ownership Issues: No

Core Folders :: images/ (705) | components/ (705) | modules/ (705) | plugins/ (705) | language/ (705) | templates/ (705) | cache/ (705) | logs/ (705) | tmp/ (705) | administrator/components/ (705) | administrator/modules/ (705) | administrator/language/ (705) | administrator/templates/ (705) |

Elevated Permissions (First 10) ::

Components :: SITE :: Wrapper (1.5.0) | Default (1.5.7) | Unknown (-) | Unknown (-) | Unknown (-) | Unknown (-) | Unknown (-) | Unknown (-) | Unknown (-) | Unknown (-) | Unknown (-) | Unknown (-) | Kunena Forum - English (1.7.2) | Kunena Forum - French (1.7.2) | User (1.5.0) | MailTo (1.5.0) |
Components :: ADMIN :: Messaging (1.5.0) | Module Manager (1.5.0) | uddeim (2.1) | Weblinks (1.5.0) | MorfeoShow (1.2.0) | GCalendar (2.2.0) | Menus Manager (1.5.0) | com_kunena (1.7.2) | Kunena Forum - English (1.7.2) | Kunena Forum - French (1.7.2) | Kunena (1.7.2) | plg_system_kunena (-) | plg_system_kunena (-) | plg_system_kunena (1.7.2) | System - Kunena (1.7.2) | Kunena language pack (@kunenaversio) | Content Page (1.5.0) | Installation Manager (1.5.0) | Frontpage (1.5.0) | Contact Items (1.0.0) | Media Manager (1.5.0) | Language Manager (1.5.0) | JCalPro (1.6.0 Beta.17) | Trombinoscope (1.0.0) | Desmodrome (0.3.0) | Newsfeeds (1.5.0) | sql2excel (2.1.2) | Template Manager (1.5.0) | Dsb Gallery (1.0.0) | Dsb Gallery (1.0.0) | Configuration Manager (1.5.0) | System - Smartsef (1.5) | smartsef (1.5.0) | Smartsef plugin - search (1.0) | Smartsef plugin - weblinks (1.0) | Smartsef plugin - user (1.0) | Smartsef plugin - Contact (1.0) | Smartsef plugin - Newsfeeds (1.0) | Smartsef plugin - mailto (1.0) | Smartsef plugin - virtuemart (1.0) | Plugin Manager (1.5.0) | Cache Manager (1.5.0) | Banners (1.5.0) | wgPicasa (1.1.4) | JCE (1.5.7.6) | User Manager (1.5.0) | DOCman (1.5.7) | DOCman Most Downloaded (1.5) | Unapproved Documents - admin m (1.5) | Latest news from http://www.joomlatoo (1.5) | Latest logged downlods - admin (1.5) | DOCman Lister (1.5) | DOCman Category (1.5) | Latest added documents - admin (1.5) | dmtestplugin (1.5) | DOCman Standard Buttons (1.5.7) | Search - DOCman (1.5.7) | DOCLink (1.5.7) | Most downloaded documents - ad (1.5) | DOCman Latest Downloads (1.5) | Control Panel (1.5.0) | Mass Mail (1.5.0) | Dsb Stats (1.0.0) | Search (1.5.0) | Trash (1.0.0) |

Modules :: SITE :: Banner (1.5.0) | Syndicate (1.5.0) | JCal Client Mini-calendar (1.6.179 Beta) | DOCman Category (1.5) | uddeIM Notifier (2.0) | uddeIM Notifier (2.0) | Nurte Facebook Like Box Module (1.0.0.0) | Who\'s Online (1.0.0) | Newsflash (1.5.0) | VirtueMart Module (1.1.4) | VirtueMart Manufacturers (1.1.0) | VirtueMart Featured Products (1.1.0) | Most Read Content (1.5.0) | GCalendar Overview (2.2.0) | Sections (1.5.0) | VirtueMart Latest Products (1.1.0) | VirtueMart Login (1.1.4) | VirtueMart Product Categories (1.1.0) | Jshopping cart (2.5.0) | DOCman Latest Downloads (1.5) | VirtueMart Search (1.1.0) | Login (1.5.0) | Related Items (1.0.0) | Statistics (1.5.0) | GCalendar Upcoming Events (2.2.0) | Archived Content (1.5.0) | VirtueMart Random Products (1.1.0) | Apoll (2.1.005) | Poll (1.5.0) | DOCman Lister (1.5) | Wrapper (1.0.0) | Module DsbGallery (0.5) | DOCman Most Downloaded (1.5) | VirtueMart Currency Selector (1.1.0) | Module DOC (0.5) | Random Image (1.5.0) | VirtueMart Top Ten Products (1.1.0) | Module Statistiques du Dsb (0.5) | Search (1.0.0) | Menu (1.5.0) | SQL 2 Excel Module (1.1.4) |
Modules :: ADMIN :: Toolbar (1.0.0) | Admin Submenu (1.0.0) | Popular Items (1.0.0) | Custom HTML (1.5.0) | Items Stats (1.0.0) | Online Users (1.0.0) | Login Form (1.0.0) | Title (1.0.0) | Admin Menu (1.0.0) | Most downloaded documents - ad (1.5) | Unread Items (1.0.0) | Quick Icons (1.0.0) | Latest News (1.0.0) | Unapproved Documents - admin m (1.5) | Feed Display (1.5.0) | Logged in Users (1.0.0) | User Status (1.5.0) | Latest added documents - admin (1.5) | Footer (1.0.0) | Latest logged downlods - admin (1.5) | Latest news from http://www.joomlatoo (1.5) |

Plugins :: SITE :: Button - Readmore (1.5) | Button - Pagebreak (1.5) | Button - Image (1.0.0) | DOCLink (1.5.7) | User - Example (1.0) | User - Joomla! (1.5) | Content - Pagebreak (1.5) | Content - Example (1.0) | Content - Vote (1.5) | Content - Page Navigation (1.5) | Nurte Facebook Like Button (2.0.0.0) | Content - Email Cloaking (1.5) | Content - [issuu] (2.10) | Content - Code Highlighter (Ge (1.5) | Content - Load Modules (1.5) | DOCman Standard Buttons (1.5.7) | Search - Contacts (1.5) | Search - DOCman (1.5.7) | Search - Sections (1.5) | Search - Content (1.5) | Search - Newsfeeds (1.5) | Search - Weblinks (1.5) | Search - Categories (1.5) | XML-RPC - Joomla API (1.0) | XML-RPC - Blogger API (1.0) | Authentication - LDAP (1.5) | Authentication - GMail (1.5) | Authentication - OpenID (1.5) | Authentication - Example (1.5) | Authentication - Joomla (1.5) | Editor - XStandard Lite for Jo (1.0) | Editor - TinyMCE 3 (3.2.4.1) | Editor - JCE (1.5.7.6) | File Browser (1.5.7.6) | Paste (1.5.7.6) | Media Object support (1.5.7.6) | Advanced Code Editor (1.5.7.6) | Advanced Link (1.5.7.6) | Joomla! Links for Advanced Lin (1.2.1) | Image Manager (1.5.7.6) | JCE SPELLCHECKER TITLE (1.5.7.6) | Paste (1.5.7.6) | System - Log (1.5) | System - Backlinks (1.5) | System - Legacy (1.5) | System - SEF (1.5) | System - Mootools Upgrade (1.5) | System - Kunena (1.7.2) | System - jQuery (1.2) | System - Remember Me (1.5) | System - Smartsef (1.5) | System - Debug (1.5) | System - EasyCalcCheck PLUS (1.5-14-1) | System - DsbStats (1.5) | System - Cache (1.5) |

Templates :: SITE :: DSB 2011 (1.0.0) | rhuk_milkyway (1.0.2) | beez (1.0.0) | Ducati Sud Belgio Template (1.0.0) | JA_Purity (1.2.0) |
Templates :: ADMIN :: Khepri (1.0) |

[numinousmedia]

If you are getting a database error, I'd check your website's configuration.php file and make sure it still contains all of the correct information about your database, including the correct DB username, DB password, DB location and DB prefix.

I'd also strongly recommend following the instructions on this page: http://docs.joomla.org/Security_Checkli ... or_defaced I know there are a lot of steps there, and there is a lot of information to review, but it really does work.