Someone hacked into our servers. Not sure when. They have created this folder
/public_html/modules/com_gcalendar and some files in it.
Any one of you had the same attack? Any findings?
Webmasters Stack Exchange is a question and answer site for pro webmasters. It only takes a minute to sign up.Sign up to join this community
Google has: http://malwareview.com/index.php?topic=347.0
Joomla Google Calendar com_gcalendar 1.1.2 SQL Injection PoC
So now your site is open to SQL injection
That Joomla module has a vulnerability, but it may or may not be a hack. Has anything happened?
Are you on a shared hosting account? If so you should call your ISP to see if they have a exploit on their servers, hackers get in by a shared account and get into all the home directories and place nasty spam scripts.
If you have a dedicated server I would check how your permissions for the www user are set or if they have been changed. Review your permission and chmod anything that isn't suppose to be accessed.
If you use dreamweaver, setup a new site and download all your joomla files as well as your SQL database to your local computer and update locally and then sync your files to update/upload to your server this way no matter what you do, it's going to overwrite any hackers code.
The more details we have the better I think we can see whats going on here.