URGENT! My ACYmailing site has been hacked

KevinAdam

I've ran the script by Dax provided on the thread https://forum.acymailing.com/d/5720-script-to-find-files-following-acymailing-vulnerability
@Dax - thank you for the script to find these files

The output points to the following files being (potentially?) infected:
array(40) { [0]=> string(144) "/homepages/38/d466970042/htdocs/clickandbuilds/Joomla/AAFBGC_Joomla/components/com_kunena/template/aurelia/layouts/attachment/item/thumbnail.php" [1]=> string(143) "/homepages/38/d466970042/htdocs/clickandbuilds/Joomla/AAFBGC_Joomla/components/com_kunena/template/system/layouts/attachment/item/thumbnail.php" [2]=> string(120) "/homepages/38/d466970042/htdocs/clickandbuilds/Joomla/AAFBGC_Joomla/media/com_acym/images/thumbnails/thumbnail_0.php.png" [3]=> string(184) "/homepages/38/d466970042/htdocs/clickandbuilds/Joomla/AAFBGC_Joomla/tmp/install_6047852a42ba2/packages/install_6047852fd52a7/site/template/crypsis/layouts/attachment/item/thumbnail.php" [4]=> string(186) "/homepages/38/d466970042/htdocs/clickandbuilds/Joomla/AAFBGC_Joomla/tmp/install_6047852a42ba2/packages/install_6047852fd52a7/site/template/crypsisb3/layouts/attachment/item/thumbnail.php" [5]=> string(186) "/homepages/38/d466970042/htdocs/clickandbuilds/Joomla/AAFBGC_Joomla/tmp/install_6047852a42ba2/packages/install_6047852fd52a7/site/template/crypsisb4/layouts/attachment/item/thumbnail.php" [6]=> string(183) "/homepages/38/d466970042/htdocs/clickandbuilds/Joomla/AAFBGC_Joomla/tmp/install_6047852a42ba2/packages/install_6047852fd52a7/site/template/system/layouts/attachment/item/thumbnail.php" [7]=> string(184) "/homepages/38/d466970042/htdocs/clickandbuilds/Joomla/AAFBGC_Joomla/tmp/install_60756cfab2058/packages/install_60756cfd60696/site/template/crypsis/layouts/attachment/item/thumbnail.php" [8]=> string(186) "/homepages/38/d466970042/htdocs/clickandbuilds/Joomla/AAFBGC_Joomla/tmp/install_60756cfab2058/packages/install_60756cfd60696/site/template/crypsisb3/layouts/attachment/item/thumbnail.php" [9]=> string(186) "/homepages/38/d466970042/htdocs/clickandbuilds/Joomla/AAFBGC_Joomla/tmp/install_60756cfab2058/packages/install_60756cfd60696/site/template/crypsisb4/layouts/attachment/item/thumbnail.php" [10]=> string(183) "/homepages/38/d466970042/htdocs/clickandbuilds/Joomla/AAFBGC_Joomla/tmp/install_60756cfab2058/packages/install_60756cfd60696/site/template/system/layouts/attachment/item/thumbnail.php" [11]=> string(184) "/homepages/38/d466970042/htdocs/clickandbuilds/Joomla/AAFBGC_Joomla/tmp/install_60e896676420b/packages/install_60e8966a3a977/site/template/crypsis/layouts/attachment/item/thumbnail.php" [12]=> string(186) "/homepages/38/d466970042/htdocs/clickandbuilds/Joomla/AAFBGC_Joomla/tmp/install_60e896676420b/packages/install_60e8966a3a977/site/template/crypsisb3/layouts/attachment/item/thumbnail.php" [13]=> string(186) "/homepages/38/d466970042/htdocs/clickandbuilds/Joomla/AAFBGC_Joomla/tmp/install_60e896676420b/packages/install_60e8966a3a977/site/template/crypsisb4/layouts/attachment/item/thumbnail.php" [14]=> string(183) "/homepages/38/d466970042/htdocs/clickandbuilds/Joomla/AAFBGC_Joomla/tmp/install_60e896676420b/packages/install_60e8966a3a977/site/template/system/layouts/attachment/item/thumbnail.php" [15]=> string(184) "/homepages/38/d466970042/htdocs/clickandbuilds/Joomla/AAFBGC_Joomla/tmp/install_6115600f5bfab/packages/install_611560129fbb9/site/template/crypsis/layouts/attachment/item/thumbnail.php" [16]=> string(186) "/homepages/38/d466970042/htdocs/clickandbuilds/Joomla/AAFBGC_Joomla/tmp/install_6115600f5bfab/packages/install_611560129fbb9/site/template/crypsisb3/layouts/attachment/item/thumbnail.php" [17]=> string(186) "/homepages/38/d466970042/htdocs/clickandbuilds/Joomla/AAFBGC_Joomla/tmp/install_6115600f5bfab/packages/install_611560129fbb9/site/template/crypsisb4/layouts/attachment/item/thumbnail.php" [18]=> string(183) "/homepages/38/d466970042/htdocs/clickandbuilds/Joomla/AAFBGC_Joomla/tmp/install_6115600f5bfab/packages/install_611560129fbb9/site/template/system/layouts/attachment/item/thumbnail.php" [19]=> string(188) "/homepages/38/d466970042/htdocs/clickandbuilds/Joomla/AAFBGC_Joomla/tmp/install_61b0c5344a428/packages/install_61b0c5371054e/site/template/blue_eagle5/layouts/attachment/item/thumbnail.php" [20]=> string(184) "/homepages/38/d466970042/htdocs/clickandbuilds/Joomla/AAFBGC_Joomla/tmp/install_61b0c5344a428/packages/install_61b0c5371054e/site/template/crypsis/layouts/attachment/item/thumbnail.php" [21]=> string(186) "/homepages/38/d466970042/htdocs/clickandbuilds/Joomla/AAFBGC_Joomla/tmp/install_61b0c5344a428/packages/install_61b0c5371054e/site/template/crypsisb3/layouts/attachment/item/thumbnail.php" [22]=> string(186) "/homepages/38/d466970042/htdocs/clickandbuilds/Joomla/AAFBGC_Joomla/tmp/install_61b0c5344a428/packages/install_61b0c5371054e/site/template/crypsisb4/layouts/attachment/item/thumbnail.php" [23]=> string(183) "/homepages/38/d466970042/htdocs/clickandbuilds/Joomla/AAFBGC_Joomla/tmp/install_61b0c5344a428/packages/install_61b0c5371054e/site/template/system/layouts/attachment/item/thumbnail.php" [24]=> string(184) "/homepages/38/d466970042/htdocs/clickandbuilds/Joomla/AAFBGC_Joomla/tmp/install_61d4a633969c5/packages/install_61d4a6364bf2a/site/template/crypsis/layouts/attachment/item/thumbnail.php" [25]=> string(186) "/homepages/38/d466970042/htdocs/clickandbuilds/Joomla/AAFBGC_Joomla/tmp/install_61d4a633969c5/packages/install_61d4a6364bf2a/site/template/crypsisb3/layouts/attachment/item/thumbnail.php" [26]=> string(186) "/homepages/38/d466970042/htdocs/clickandbuilds/Joomla/AAFBGC_Joomla/tmp/install_61d4a633969c5/packages/install_61d4a6364bf2a/site/template/crypsisb4/layouts/attachment/item/thumbnail.php" [27]=> string(183) "/homepages/38/d466970042/htdocs/clickandbuilds/Joomla/AAFBGC_Joomla/tmp/install_61d4a633969c5/packages/install_61d4a6364bf2a/site/template/system/layouts/attachment/item/thumbnail.php" [28]=> string(184) "/homepages/38/d466970042/htdocs/clickandbuilds/Joomla/AAFBGC_Joomla/tmp/install_62a1d9ace8402/packages/install_62a1d9afb02e0/site/template/crypsis/layouts/attachment/item/thumbnail.php" [29]=> string(186) "/homepages/38/d466970042/htdocs/clickandbuilds/Joomla/AAFBGC_Joomla/tmp/install_62a1d9ace8402/packages/install_62a1d9afb02e0/site/template/crypsisb3/layouts/attachment/item/thumbnail.php" [30]=> string(186) "/homepages/38/d466970042/htdocs/clickandbuilds/Joomla/AAFBGC_Joomla/tmp/install_62a1d9ace8402/packages/install_62a1d9afb02e0/site/template/crypsisb4/layouts/attachment/item/thumbnail.php" [31]=> string(183) "/homepages/38/d466970042/htdocs/clickandbuilds/Joomla/AAFBGC_Joomla/tmp/install_62a1d9ace8402/packages/install_62a1d9afb02e0/site/template/system/layouts/attachment/item/thumbnail.php" [32]=> string(184) "/homepages/38/d466970042/htdocs/clickandbuilds/Joomla/AAFBGC_Joomla/tmp/install_638dddd9e547d/packages/install_638ddddbb7ef1/site/template/crypsis/layouts/attachment/item/thumbnail.php" [33]=> string(186) "/homepages/38/d466970042/htdocs/clickandbuilds/Joomla/AAFBGC_Joomla/tmp/install_638dddd9e547d/packages/install_638ddddbb7ef1/site/template/crypsisb3/layouts/attachment/item/thumbnail.php" [34]=> string(186) "/homepages/38/d466970042/htdocs/clickandbuilds/Joomla/AAFBGC_Joomla/tmp/install_638dddd9e547d/packages/install_638ddddbb7ef1/site/template/crypsisb4/layouts/attachment/item/thumbnail.php" [35]=> string(183) "/homepages/38/d466970042/htdocs/clickandbuilds/Joomla/AAFBGC_Joomla/tmp/install_638dddd9e547d/packages/install_638ddddbb7ef1/site/template/system/layouts/attachment/item/thumbnail.php" [36]=> string(184) "/homepages/38/d466970042/htdocs/clickandbuilds/Joomla/AAFBGC_Joomla/tmp/install_63b5cd4e98039/packages/install_63b5cd50e8b2f/site/template/crypsis/layouts/attachment/item/thumbnail.php" [37]=> string(186) "/homepages/38/d466970042/htdocs/clickandbuilds/Joomla/AAFBGC_Joomla/tmp/install_63b5cd4e98039/packages/install_63b5cd50e8b2f/site/template/crypsisb3/layouts/attachment/item/thumbnail.php" [38]=> string(186) "/homepages/38/d466970042/htdocs/clickandbuilds/Joomla/AAFBGC_Joomla/tmp/install_63b5cd4e98039/packages/install_63b5cd50e8b2f/site/template/crypsisb4/layouts/attachment/item/thumbnail.php" [39]=> string(183) "/homepages/38/d466970042/htdocs/clickandbuilds/Joomla/AAFBGC_Joomla/tmp/install_63b5cd4e98039/packages/install_63b5cd50e8b2f/site/template/system/layouts/attachment/item/thumbnail.php" }
Question is, what do I do? Delete all these files?

We really need much clearer support from the ACYmailing team on this issue, the current blog post is completely inadequate.

Dax

Hello,
I've updated the detection script to also check for the file contents, most of the files found on your site seem legit, except for this one that can be removed:

/homepages/38/d466970042/htdocs/clickandbuilds/Joomla/AAFBGC_Joomla/media/com_acym/images/thumbnails/thumbnail_0.php.png

KevinAdam

Looks like there are other suspicious files in addition to the list above:
/media/com_acym/images/thumbnails/thumbnail_0.php.png
/api/includes/yzy5ot.php
/components/com_ajax/zwe5mz.php
/layouts/joomla/icon//zdu5nj.php
/media/com_oxujokyx/odkym2.php
/media/com_tags/js/nzvhzj.php
/templates/system/ndllng.php

Some of these files are from back in January and other in April. I guess this points to multiple attacks.

Dax

Could you try the new version of my script and tell me if these files are detected? If they are not, could you send them to me (via wetransfer or any other file sharing tool)?

KevinAdam

Hi @Dax,

I'd already deleted the /media/com_acym/images/thumbnails/thumbnail_0.php.png before updating the script.
Just updated it and the output is:
array(4) { [0]=> string(91) "/homepages/38/d466970042/htdocs/clickandbuilds/Joomla/AAFBGC_Joomla/api/includes/yzy5ot.php" [1]=> string(98) "/homepages/38/d466970042/htdocs/clickandbuilds/Joomla/AAFBGC_Joomla/components/com_ajax/zwe5mz.php" [2]=> string(97) "/homepages/38/d466970042/htdocs/clickandbuilds/Joomla/AAFBGC_Joomla/media/com_oxujokyx/odkym2.php" [3]=> string(96) "/homepages/38/d466970042/htdocs/clickandbuilds/Joomla/AAFBGC_Joomla/media/com_tags/js/nzvhzj.php" }

Dax

Could you send me the two that haven't been detected please? I'll try to refine the detection script.

layouts/joomla/icon//zdu5nj.php
media/com_tags/js/nzvhzj.php

KevinAdam

Dax
Edited to remove the link 🙂

Dax

Thank you I downloaded them, you can remove your link now 👍
I also updated the detection script, it should be able to detect all 7 files you found.

KevinAdam

Dax
With the updated script, it has now found:
array(6) { [0]=> string(91) "/homepages/38/d466970042/htdocs/clickandbuilds/Joomla/AAFBGC_Joomla/api/includes/yzy5ot.php" [1]=> string(98) "/homepages/38/d466970042/htdocs/clickandbuilds/Joomla/AAFBGC_Joomla/components/com_ajax/zwe5mz.php" [2]=> string(98) "/homepages/38/d466970042/htdocs/clickandbuilds/Joomla/AAFBGC_Joomla/layouts/joomla/icon/zdu5nj.php" [3]=> string(97) "/homepages/38/d466970042/htdocs/clickandbuilds/Joomla/AAFBGC_Joomla/media/com_oxujokyx/odkym2.php" [4]=> string(96) "/homepages/38/d466970042/htdocs/clickandbuilds/Joomla/AAFBGC_Joomla/media/com_tags/js/nzvhzj.php" [5]=> string(95) "/homepages/38/d466970042/htdocs/clickandbuilds/Joomla/AAFBGC_Joomla/templates/system/ndllng.php" }

KevinAdam

@Dax should I delete these remaining 6 files?
Also, the e-mail from this morning says "it might be wise to update your FTP, DB and SMTP accounts passwords"... is this wise or required?
Thanks for your assistance!

Dax

Yes, these 6 files can be removed.
For now, we haven't found any file trying to get the data from the Joomla configuration file, but I would still advise to change your passwords to be safe.
The SMTP and FTP part is only relevant if you configured these accounts in the Joomla global configuration (under Server => FTP Settings and Server => Mail Settings).

KevinAdam

Thank you again @Dax 🙂