Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

We've discovered today that our Joomla website has been hacked by a pharmacy trojan.

It was difficult to discover because most users don't see it when visiting our website.

One user reported about 2 weeks ago that our site contains viagra/pharmacy spam. We've looked into it, but found nothing. The conclusion was that the users computer was infected.

Yesterday another user reported this problem, so I've started to investigate again.

One hour later I've discovered that the site is indeed infected.

When I visit this webpage with my web browser all if fine:

http://www.outertech.com/en/bookmark-manager

But, if I do a google translate of this webpage I see the infection (viagra and cialis links):

http://translate.google.com/translate?sl=en&tl=de&js=n&prev=_t&hl=de&ie=UTF-8&u=http%3A%2F%2Fwww.outertech.com%2Fen%2Fbookmark-manager

The same happens if I use curl:

curl -L -A "Googlebot/2.1 (+http://www.google.com/bot.html)" http://www.outertech.com/en/bookmark-manager

As a next step I made a backup (Akeeba) of the website and transferred it to a local xampp installation for further investigation.

The local xampp installation with the website has also the same problem, so indeed the Joomla installation is infected.

a visit of

http://localhost/en/bookmark-manager

shows no problems, but a

curl -L -A "Googlebot/2.1 (+http://www.google.com/bot.html)" http://localhost/en/bookmark-manager

contains the viagra links.

I've looked for hours at the (mostly php) files, did a lot of greps etc, but I cannot find anything suspicious.

Virus Total and Google Webmaster report the site as clean.

I did an audit on myjoomla.com, but no malware was found.

I would be really grateful if someone could point me in the right direction.

Where to look inside my Joomla installation for this hack?

share|improve this question

1 Answer 1

We've discovered today that our Joomla website has been hacked by a pharmacy trojan.

nope; your page delivers that trojan, but how your site has been hacked ... well ...

Where to look inside my Joomla installation for this hack?

did you checked your page with sucuri? when you see the malicious/infected stuff do you find this at the top/bottom or, lets say, within every link? please make a pastebin of your infected html-code

it could be .htaccess, or an require() ontop / end of your index.html or sql-injection or ...

please see this answer (first two links) for the most recent joomla-security-f*ck*p

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.