Is this an exploit?

Create your own CMS. If you do it right, it can be easier to use, more secure, and more customizable in your favor :).

Quote:

---

Originally Posted by s-p-n

Read this as well:

Joomla! • View topic - PHP Sites on Popular Hosting Services Exploited

I consider these Malware infections on your hosting account or server. There are several steps to take in order to prevent these.

They can be caused by: MySQL Injections, Upload Script Vulnerabilities, File Permission vulnerabilities, XSS Injections (For JavaScript redirects/popups from malicious scareware/scam web-site), and possibly various other issues depending on what technologies you're using.

It usually seems to arise from a web developer with a large lack of knowledge in security, whom makes an add-on/extension for a popular CMS. I'm not sure if it has anything to do with the entire host being insecure/infected (probably not), or the CMS' core being insecure (likely not).

There are some tools out there (PHP scripts) that scan all your files and take out the malicious code, but I wouldn't recommend those.

Scan your computer with a trusted antivirus,
create a new FTP account and disable the one that may be infected,
copy all the good content to a text-editor like MS word/some PDF program/open office/whatever- - -NOT HTML,
back up the current site (the PHP/HTML/images- everything) offline,
delete everything off of your host,
download the latest version of a given CMS- pick a theme that suites you, avoid using the same extensions from before (or research to see if they're exploited/insecure before using them) OR get a new secure, up-to-date CMS and (if needed) secure, up-to-date extensions.

Research for exploits before using extensions for any CMS. Stick to the popular ones that have numerous, good reviews. Common sense helps.

---

Thank you, like i said before this was not my work im just fixing it.

I have found all files that were edited and removed the code manually there were a lot. Now like i do not know how was the extension adapted to joomla, its going to be a pain to figure where the hole is.

Unfortunately, these things tend to come back as fast as you attempt get rid of them. Time will only tell if it's really gone. Start throwing the names of the tools you're using on a google search with "exploit", "scam", or "insecure" in the search. Try to find problems similar to what you have, and a solution.

If you missed a piece of malicious code that can (possibly) reproduces all of the insecure code you just removed over, and over again. I'd suggest starting fresh- just using the content from the old site and a brand new CMS+theme install. Otherwise you're playing cat & mouse with malware.