Bluehost How-To : Viruses and malware scripts in Joomla install

Bluehost is among our best web hosts. Sign up with bluehost here

This is a bluehost question posted by hanke on 02 August 2008

I’ve found viruses and malware scripts in my joomla/virtuemart install. I’ll post filenames here maybe this will be helpfull for someone.

There was a mail.php script in main Joomla directory which was K. Script v0.3 Beta, from http://kenshin-lt.net/

There was also a directory under joomla_dir/components/com_virtuemart/sistem / (with space), which contained files:
.serial
errors.php
httpd.so
httpd.so~
m4

There was a file 402.php in main joomla dir with

and there were multiple files (mainly errors.php) which contained the same include..

You can also look for user-agents like: libwww-perl/5.79 , libwww-perl/5.803 etc. and files: id.txt?, spread.txt?, blank??, rox.txt??, echo.txt?, sistem.txt?
in your system logs.

We used to have an old joomls install and that was probably the source of problems..

You can read more about bluehost in detail or sign up now with bluehost web hosting