Tell me more ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.
up vote 0 down vote favorite

someone hacked into our servers. Not sure when. They have created this folder "/public_html/modules/com_gcalendar" and some files in it.

any one of had the same attack? any findings?

share|improve this question
I'm not sure if you have tried this, but you might want to cross post this to the Joomla forums. Sorry to hear you are going through this, mate! – Greg Hluska Oct 29 '10 at 18:46
Sorry about that, but welcome to Joomla! site admin. – John Oct 29 '10 at 18:47

migrated from stackoverflow.com Oct 29 '10 at 18:58

4 Answers

up vote 2 down vote

Google has: http://malwareview.com/index.php?topic=347.0

Joomla Google Calendar com_gcalendar 1.1.2 SQL Injection PoC

So now your site is open to SQL injection

share|improve this answer
the com_gcalendar was present in modules folder where all folders start with the name "mod_" . and this is not present in components folder. which means i have not installed gcalendar. none of the files inside this folder are joomla related. how did they get in? – Vivek Chandraprakash Oct 29 '10 at 18:50
up vote 2 down vote

That Joomla module has a vulnerability, but it may or may not be a hack. Has anything happened?

share|improve this answer
up vote 1 down vote

Check the logs from your server

share|improve this answer
up vote 1 down vote

Are you on a shared hosting account? If so you should call your ISP to see if they have a exploit on their servers, hackers get in by a shared account and get into all the home directories and place nasty spam scripts.

If you have a dedicated server I would check how your permissions for the www user are set or if they have been changed. Review your permission and chmod anything that isn't suppose to be accessed.

If you use dreamweaver, setup a new site and download all your joomla files as well as your SQL database to your local computer and update locally and then sync your files to update/upload to your server this way no matter what you do, it's going to overwrite any hackers code.

The more details we have the better I think we can see whats going on here.

share|improve this answer
Downloading and re-uploading the same files doesn't remove malware or guarantee that your site will be clean. If you want that, then you need to export your database, wipe the site clean and use a fresh install of the latest version of Joomla, then import your data. – Lèse majesté Oct 29 '10 at 19:15

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.