1

Someone hacked into our servers. Not sure when. They have created this folder /public_html/modules/com_gcalendar and some files in it.

Any one of you had the same attack? Any findings?

Improve this question
2
  • I'm not sure if you have tried this, but you might want to cross post this to the Joomla forums. Sorry to hear you are going through this, mate!
    – Greg Hluska
    Oct 29, 2010 at 18:46
  • Sorry about that, but welcome to Joomla! site admin.
    – John
    Oct 29, 2010 at 18:47

3 Answers 3

Reset to default
3

Google has: http://malwareview.com/index.php?topic=347.0

Joomla Google Calendar com_gcalendar 1.1.2 SQL Injection PoC

So now your site is open to SQL injection

Improve this answer
1
  • the com_gcalendar was present in modules folder where all folders start with the name "mod_" . and this is not present in components folder. which means i have not installed gcalendar. none of the files inside this folder are joomla related. how did they get in?
    – Vivek Chandraprakash
    Oct 29, 2010 at 18:50
2

That Joomla module has a vulnerability, but it may or may not be a hack. Has anything happened?

Improve this answer
1

Are you on a shared hosting account? If so you should call your ISP to see if they have a exploit on their servers, hackers get in by a shared account and get into all the home directories and place nasty spam scripts.

If you have a dedicated server I would check how your permissions for the www user are set or if they have been changed. Review your permission and chmod anything that isn't suppose to be accessed.

If you use dreamweaver, setup a new site and download all your joomla files as well as your SQL database to your local computer and update locally and then sync your files to update/upload to your server this way no matter what you do, it's going to overwrite any hackers code.

The more details we have the better I think we can see whats going on here.

Improve this answer
1
  • Downloading and re-uploading the same files doesn't remove malware or guarantee that your site will be clean. If you want that, then you need to export your database, wipe the site clean and use a fresh install of the latest version of Joomla, then import your data.
    – Lèse majesté
    Oct 29, 2010 at 19:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.