Databases
StackOverflow2013
Postsdbo
POWhere to look in my Joomla installation for the pharmacy hack?
 

Note that there are some explanatory texts on larger screens.

plurals
  1. POWhere to look in my Joomla installation for the pharmacy hack?
    primarykey
    data
    text
    <p>We've discovered today that our Joomla website has been hacked by a pharmacy trojan.</p> <p>It was difficult to discover because most users don't see it when visiting our website.</p> <p>One user reported about 2 weeks ago that our site contains viagra/pharmacy spam. We've looked into it, but found nothing. The conclusion was that the users computer was infected.</p> <p>Yesterday another user reported this problem, so I've started to investigate again.</p> <p>One hour later I've discovered that the site is indeed infected.</p> <p>When I visit this webpage with my web browser all if fine:</p> <p><a href="http://www.outertech.com/en/bookmark-manager" rel="nofollow">http://www.outertech.com/en/bookmark-manager</a></p> <p>But, if I do a google translate of this webpage I see the infection (viagra and cialis links):</p> <p><a href="http://translate.google.com/translate?sl=en&amp;tl=de&amp;js=n&amp;prev=_t&amp;hl=de&amp;ie=UTF-8&amp;u=http%3A%2F%2Fwww.outertech.com%2Fen%2Fbookmark-manager" rel="nofollow">http://translate.google.com/translate?sl=en&amp;tl=de&amp;js=n&amp;prev=_t&amp;hl=de&amp;ie=UTF-8&amp;u=http%3A%2F%2Fwww.outertech.com%2Fen%2Fbookmark-manager</a></p> <p>The same happens if I use curl:</p> <pre><code>curl -L -A "Googlebot/2.1 (+http://www.google.com/bot.html)" http://www.outertech.com/en/bookmark-manager </code></pre> <p>As a next step I made a backup (Akeeba) of the website and transferred it to a local xampp installation for further investigation.</p> <p>The local xampp installation with the website has also the same problem, so indeed the Joomla installation is infected.</p> <p>a visit of</p> <pre><code>http://localhost/en/bookmark-manager </code></pre> <p>shows no problems, but a</p> <pre><code>curl -L -A "Googlebot/2.1 (+http://www.google.com/bot.html)" http://localhost/en/bookmark-manager </code></pre> <p>contains the viagra links.</p> <p>I've looked for hours at the (mostly php) files, did a lot of greps etc, but I cannot find anything suspicious.</p> <p>Virus Total and Google Webmaster report the site as clean.</p> <p>I did an audit on myjoomla.com, but no malware was found.</p> <p>I would be really grateful if someone could point me in the right direction.</p> <p>Where to look inside my Joomla installation for this hack?</p>
    singulars
    1. PO
      singulars
      1. PTAnswer
    1. This table or related slice is empty.
    1. PTQuestion
    1. USRobert Harvey
    1. USCasady
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. PO
      singulars
      1. PTAnswer
    2. PO
      singulars
      1. PTAnswer
    3. PO
      singulars
      1. PTAnswer
    1. This table or related slice is empty.
    1. COKind of a longshot, but are you using a cache extension such as JotCache? Some keep user-agent specific data, so you could try and empty the googlebot-specific cache, if any. As to the reason it got poisoned in the first place, that is an interesting thing to investigate, although it appears that you are using Joomla! 1.5, which is no longer supported and does no longer gets security fixes.
      singulars
      1. POWhere to look in my Joomla installation for the pharmacy hack?
      1. USMasterAM
    2. COare you using any extensions for the frontend of the site that allow users to upload files such as a Gallery? It is possible that a 3rd party extensio has exploited your site
      singulars
      1. POWhere to look in my Joomla installation for the pharmacy hack?
      1. USLodder
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload