I knew it had to come some time. There was no "It won't happen to me" attitude. I did take precautions.

1.) No extensions that have a place on the official J! vulnerable extensions list were used.
2.) Configuration.php was sitting outside of public_html
3.) Sessions folder sitting outside public_html
4.) The other stuff.. php register globals and j! emulate switched off.
5.) strong passwords.

Thank goodness he didn't deface the site.

As far as I can tell all he did was place an index.php in the domain.com/images/ folder with the following in plain text:

HACKED BY [his name and website here]

It happened on the 8th so a whole week has gone by since the intrusion.

It was pure luck that I found it as I just happened to check my google webmaster tools and was told by my old friend that there was a url that robot.txt was stopping it from crawling... images/index.php . WTF?! I said, that shouldn't be there!... sure enough I had been hacked.

Lets all hear a round of applause.

Yes, I had about 13 sites hacked..but wasn't really a big deal since they just had a fresh joomla install on them and I hadn't even gone through the setup yet. The homepage was just the install for joomla at the moment when they were hacked!LOL At first I thought it was the hackers targeting my hositng..however later I learned that it is hackers targeting joomla sites since they know exaclty what directories are 777 from when you have to chmod them for the install. Seems there are 4-5 groups each claiming fame for doing this, but seems like they are all just using a script with the name changed on it. I got hit by 2 different group names, but in the exact same way. Then later had a third alter my config file because I had left it writeable!LOL..they don't really hurt anything, just let you know where your holes are because of either your ignorance to them or that you just plain forgot to chmod it back:) The first one just placed an index.html into my root..which was very helpful to me. My hosting will automatically use an index.html as the mainpage if there is one, if not it will move on to the index.php...but after the hack I learned that I could tell it to use the index.php in the control panel, thereby speeding up the loading of my mainpage since it no longer looked for a html file and then defaulted to a php file:) Anyways, like I said, these guys really don't do any harm..they just try to get there day or 2 of fame by having their tag on your site.

Hats off to the script kiddies thinking they are hackers, but in the end turn out to be nothing more then security testers for us site owners:)

David Henderson