I have found on my web server the file wp-conf.php which when you call it from the browser with a url parameter like wp-conf.php?t7831n=any value shows an interface where you can control the entire server. I am using Joomla 1.5 on the server which has a lot of vulnerabilities.
The code for this WSO thing that I decoded can be seen here
Besides migrating to a newer version of Joomla, I would like to make sure that all directories are clean of any malicious files. I run chkrootkit and it says that everything is fine. Also, what would the correct permissions need to be on the /var/www directory. After reading quite a few posts, I have them now as 755 (except a temp that needed 777) and the owner is the main user with group owner www-data that the main user is a part of.
Any help/insight is much appreciated. The server is running ubuntu 10.04 and is completely patched. Thanks