Your blog – report on Gumblar helped me to understand what is going on..

My site with 1000’s of pages was ruined…

I have found that they got the ftp and went through one by one putting code into every joomla site…

Someone calling himself Alex used the contact for of each one sending this message

Very Nice Site ! Is this yours too”

There seems to have been an intrusion in July and it resumed in late December 23 approx

Here is the code that they place on every joomla site…

It shows up in the database in 10 location

user
sessionplugin
modules
acl ora section
acl ora groups
acl ora something else
contact detail
components ( 17 locations )
categories

Here is the code that they use

I have been banned from Google News as a result of this..

I can see no cure as the code is too deep in the database..

CODE FOLLOWS BEWARE

SELECT *
FROM `que0927708391162`.`jos_core_acl_aro_sections`
WHERE (
`id` LIKE ‘%”Female%’
OR `value` LIKE ‘%”Female%’
OR `order_value` LIKE ‘%”Female%’
OR `name` LIKE ‘%”Female%’
OR `hidden` LIKE ‘%”Female%’
)
OR (
`id` LIKE ‘%use%’
OR `value` LIKE ‘%use%’
OR `order_value` LIKE ‘%use%’
OR `name` LIKE ‘%use%’
OR `hidden` LIKE ‘%use%’
)
OR (
`id` LIKE ‘%of%’
OR `value` LIKE ‘%of%’
OR `order_value` LIKE ‘%of%’
OR `name` LIKE ‘%of%’
OR `hidden` LIKE ‘%of%’
)
OR (
`id` LIKE ‘%viagra”%’
OR `value` LIKE ‘%viagra”%’
OR `order_value` LIKE ‘%viagra”%’
OR `name` LIKE ‘%viagra”%’
OR `hidden` LIKE ‘%viagra”%’
)
LIMIT 0 , 30

DELETE FROM `que0927708391162`.`jos_categories` WHERE (`id` LIKE ‘%”Female%’ OR `parent_id` LIKE ‘%”Female%’ OR `title` LIKE ‘%”Female%’ OR `name` LIKE ‘%”Female%’ OR `alias` LIKE ‘%”Female%’ OR `image` LIKE ‘%”Female%’ OR `section` LIKE ‘%”Female%’ OR `image_position` LIKE ‘%”Female%’ OR `description` LIKE ‘%”Female%’ OR `published` LIKE ‘%”Female%’ OR `checked_out` LIKE ‘%”Female%’ OR `checked_out_time` LIKE ‘%”Female%’ OR `editor` LIKE ‘%”Female%’ OR `ordering` LIKE ‘%”Female%’ OR `access` LIKE ‘%”Female%’ OR `count` LIKE ‘%”Female%’ OR `params` LIKE ‘%”Female%’) OR (`id` LIKE ‘%use%’ OR `parent_id` LIKE ‘%use%’ OR `title` LIKE ‘%use%’ OR `name` LIKE ‘%use%’ OR `alias` LIKE ‘%use%’ OR `image` LIKE ‘%use%’ OR `section` LIKE ‘%use%’ OR `image_position` LIKE ‘%use%’ OR `description` LIKE ‘%use%’ OR `published` LIKE ‘%use%’ OR `checked_out` LIKE ‘%use%’ OR `checked_out_time` LIKE ‘%use%’ OR `editor` LIKE ‘%use%’ OR `ordering` LIKE ‘%use%’ OR `access` LIKE ‘%use%’ OR `count` LIKE ‘%use%’ OR `params` LIKE ‘%use%’) OR (`id` LIKE ‘%of%’ OR `parent_id` LIKE ‘%of%’ OR `title` LIKE ‘%of%’ OR `name` LIKE ‘%of%’ OR `alias` LIKE ‘%of%’ OR `image` LIKE ‘%of%’ OR `section` LIKE ‘%of%’ OR `image_position` LIKE ‘%of%’ OR `description` LIKE ‘%of%’ OR `published` LIKE ‘%of%’ OR `checked_out` LIKE ‘%of%’ OR `checked_out_time` LIKE ‘%of%’ OR `editor` LIKE ‘%of%’ OR `ordering` LIKE ‘%of%’ OR `access` LIKE ‘%of%’ OR `count` LIKE ‘%of%’ OR `params` LIKE ‘%of%’) OR (`id` LIKE ‘%viagra”%’ OR `parent_id` LIKE ‘%viagra”%’ OR `title` LIKE ‘%viagra”%’ OR `name` LIKE ‘%viagra”%’ OR `alias` LIKE ‘%viagra”%’ OR `image` LIKE ‘%viagra”%’ OR `section` LIKE ‘%viagra”%’ OR `image_position` LIKE ‘%viagra”%’ OR `description` LIKE ‘%viagra”%’ OR `published` LIKE ‘%viagra”%’ OR `checked_out` LIKE ‘%viagra”%’ OR `checked_out_time` LIKE ‘%viagra”%’ OR `editor` LIKE ‘%viagra”%’ OR `ordering` LIKE ‘%viagra”%’ OR `access` LIKE ‘%viagra”%’ OR `count` LIKE ‘%viagra”%’ OR `params` LIKE ‘%viagra”%’)

Thanks you very much for this valuable article.
Best regards from Italy!!!

Thanks for taking the time to help us with this helpfull guide!

Regards from argentina.

They are using robots.php as well.

I had to remove the link to your site from your signature since your site is still infected.

This time link to “uznai-pravdu-ru.1gb .ru/ includes/style.php”

Make sure you followed my removal instructions

JS:
vgallery.extra .hu/ categories/style.php
case.writeup .co.jp/ images/a5hd/img-osouji.php
koltaiandor.extra .hu/ portre/nyito_right.php

HTML:
koltaiandor.extra .hu/ portre/nyito_right.php

beauty-shop-color.php
VideoPlaylist.php

just contained the eval backdoor… these files were not found on original backups prior to the attack date of Nov 11 2009