Lizamoon attack on site

byte

My website has seemingly been attacked by Lizamoon malware.

http://www.google.com/safebrowsing/diagnostic?site=theairwaves.net

From what I've gathered, the dodgy code is hidden somewhere in SQL.

Is it possible to search for certain bits of data on a MySQL database? I'm using phpMyAdmin

Any help greatly appreciated.

ressem

It relies on a SQL injection to insert itself as a script or document redirect on your web site.

After removing the current instances, before going online again you'll need to find out what input box is allowing unfiltered strings to be fed directly into the database.

So make a copy of your database and http request logs. I've not used digiweb, but presumably this can be done using the control panel.

The offending requests will have sql statements in the request line, this should help you to narrow down whether it's a mistake in a 3rd party Joomla component, or something you've written yourself that doesn't clean the input.

http://community.websense.com/blogs/securitylabs/archive/2011/03/31/update-on-lizamoon-mass-injection.aspx

There are joomla plugins like
http://extensions.joomla.org/extensions/access-a-security/site-security/site-protection/12731
which try to alert you when these injection attacks are being attempted which might also help.

byte

Thanks ressem.

Much appreciated.