A troyan js redirect in my domain :( - Joomla! Forum - community, help and support

problem description :: forum post assistant (v1.2.3) : 13th december 2012 wrote:hosting advise me have troyan js redirector

last php error(s) reported :: forum post assistant (v1.2.3) : 13th december 2012 wrote:[07-nov-2012 01:16:01 europe/berlin] php fatal error: call undefined function imagettfbbox() in /home/armagain/public_html/components/com_aicontactsafe/includes/captcha/captcha.php on line 366

forum post assistant (v1.2.3) : 13th december 2012 wrote:

basic environment :: wrote:joomla! instance :: joomla! 2.5.8-stable (ember) 8-november-2012
joomla! platform :: joomla platform 11.4.0-stable (brian kernighan) 03-jan-2012
joomla! configured :: yes | read-only (444) | owner: armagain (uid: 1/gid: 1) | group: armagain (gid: 1) | valid for: 2.5
configuration options :: offline: 0 | sef: 1 | sef suffix: 0 | sef rewrite: 0 | .htaccess/web.config: yes | gzip: 0 | cache: 0 | ftp layer: 0 | ssl: 0 | error reporting: default | site debug: 0 | language debug: 0 | default access: 1 | unicode slugs: 0 | database credentials present: yes

host configuration :: os: linux | os version: 2.6.18-308.13.1.el5pae | technology: i686 | web server: apache/2.2.23 (unix) mod_ssl/2.2.23 openssl/0.9.8e-fips-rhel5 mod_bwlimited/1.4 mod_perl/2.0.6 perl/v5.8.8 | encoding: gzip,deflate,sdch | doc root: /home/armagain/public_html | system tmp writable: yes

php configuration :: version: 5.3.18 | php api: cgi-fcgi | session path writable: yes | display errors: 1 | error reporting: 22519 | log errors to: error_log | last known error: 07th november 2012 01:16:01. | register globals: | magic quotes: | safe mode: | open base: | uploads: 1 | max. upload size: 12m | max. post size: 8m | max. input time: 60 | max. execution time: 30 | memory limit: 64m

mysql configuration :: version: 5.5.27-cll (client:5.5.27) | host: --protected-- (--protected--) | collation: latin1_swedish_ci (character set: latin1) | database size: 614.87 kib | #of tables:  104

detailed environment :: wrote:php extensions :: core (5.3.18) | date (5.3.18) | ereg () | libxml () | openssl () | pcre () | sqlite3 (0.7-dev) | zlib (1.1) | bcmath () | calendar () | ctype () | curl () | dom (20031129) | filter (0.11.0) | ftp () | gd () | hash (1.0) | iconv () | spl (0.2) | json (1.2.1) | mbstring () | mcrypt () | mysql (1.0) | mysqli (0.1) | session () | standard (5.3.18) | posix () | reflection ($id: 593a0506b01337cfaf9f63ebc12cd60523fc2c41 $) | phar (2.0.1) | simplexml (0.1) | sockets () | imap () | tokenizer (0.1) | xml () | xmlreader (0.1) | xmlwriter (0.1) | zip (1.11.0) | cgi-fcgi () | timezonedb () | pdo (1.0.4dev) | pdo_sqlite (1.0.1) | sqlite (2.0-dev) | pdo_mysql (1.0.2) | ioncube loader () | zend engine (2.3.0) |
potential missing extensions :: suhosin |

switch user environment (experimental) :: php cgi: yes | server su: yes | php su: yes | custom su (litespeed/cloud/grid): yes
potential ownership issues: no

folder permissions :: wrote:core folders :: images/ (755) | components/ (755) | modules/ (755) | plugins/ (755) | language/ (755) | templates/ (755) | cache/ (755) | logs/ (755) | tmp/ (755) | administrator/components/ (755) | administrator/modules/ (755) | administrator/language/ (755) | administrator/templates/ (755) |

elevated permissions (first 10) ::

extensions discovered :: wrote:components :: site :: red dwarf (1.0.0) | com_wrapper (2.5.0) | com_mailto (2.5.0) |
components :: admin :: com_categories (2.5.0) | com_templates (2.5.0) | aicontactsafe (2.0.19.stable) | aicontactsafe - link (1.0.10.stable) | aicontactsafe - form (1.0.15.stable) | aicontactsafe module (1.0.13.stable) | aicontactsafe (1.0.0) | com_phocagallery (3.2.2) | com_languages (2.5.0) | com_redirect (2.5.0) | com_messages (2.5.0) | com_admin (2.5.0) | com_media (2.5.0) | com_checkin (2.5.0) | poweradmin (1.1.4) | com_search (2.5.0) | akeeba (3.6.10) | com_modules (2.5.0) | com_joomlaupdate (2.5.0) | com_content (2.5.0) | com_banners (2.5.0) | imageshow (4.4.0) | imageshow (4.4.0) | com_config (2.5.0) | com_login (2.5.0) | com_cache (2.5.0) | com_cpanel (2.5.0) | com_menus (2.5.0) | com_users (2.5.0) | com_xmap (2.3.0) | com_plugins (2.5.0) | com_installer (2.5.0) | com_finder (2.5.0) | com_weblinks (2.5.0) | com_newsfeeds (2.5.0) |

modules :: site :: mod_random_image (2.5.0) | mod_finder (2.5.0) | mod_articles_category (2.5.0) | mod_custom (2.5.0) | bt google maps (1.1.0) | mod_users_latest (2.5.0) | mod_articles_categories (2.5.0) | mod_articles_archive (2.5.0) | mod_whosonline (2.5.0) | mod_weblinks (2.5.0) | mod_login (2.5.0) | mod_footer (2.5.0) | mod_wrapper (2.5.0) | mod_banners (2.5.0) | mod_related_items (2.5.0) | mod_menu (2.5.0) | mod_stats (2.5.0) | mod_breadcrumbs (2.5.0) | mod_languages (2.5.0) | mod_articles_latest (2.5.0) | mod_search (2.5.0) | mod_syndicate (2.5.0) | mod_feed (2.5.0) | mod_articles_popular (2.5.0) | jsn imageshow (4.4.0) | mod_articles_news (2.5.0) | mod_phocagallery_image (3.2.0) |
modules :: admin :: mod_custom (2.5.0) | mod_title (2.5.0) | mod_poweradmin (1.1.4) | mod_login (2.5.0) | mod_submenu (2.5.0) | mod_menu (2.5.0) | mod_status (2.5.0) | mod_logged (2.5.0) | mod_toolbar (2.5.0) | mod_version (2.5.0) | mod_popular (2.5.0) | mod_feed (2.5.0) | jsn imageshow quick icons (4.4.0) | mod_multilangstatus (2.5.0) | mod_latest (2.5.0) | mod_quickicon (2.5.0) |

plugins :: site :: plg_editors-xtd_image (2.5.0) | button - imageshow (4.4.0) | plg_editors-xtd_readmore (2.5.0) | plg_editors-xtd_article (2.5.0) | plg_editors-xtd_pagebreak (2.5.0) | plg_jmonitoring_akeebabackup_t (1.0) | theme classic (1.1.6) | theme slider (1.0.5) | source picasa (1.1.3) | plg_user_contactcreator (2.5.0) | plg_user_joomla (2.5.0) | plg_user_profile (2.5.0) | system - jsn imageshow (4.4.0) | system - dioscouri (3.7.0) | plg_system_p3p (2.5.0) | system - jsn poweradmin (1.1.4) | plg_system_languagecode (2.5.0) | plg_system_debug (2.5.0) | plg_system_jsnframework (1.0.4) | plg_system_log (2.5.0) | plg_system_remember (2.5.0) | plg_system_redirect (2.5.0) | plg_system_highlight (2.5.0) | plg_system_sef (2.5.0) | plg_system_cache (2.5.0) | plg_system_logout (2.5.0) | plg_system_languagefilter (2.5.0) | plg_finder_categories (2.5.0) | plg_finder_weblinks (2.5.0) | plg_finder_contacts (2.5.0) | plg_finder_content (2.5.0) | plg_finder_newsfeeds (2.5.0) | content - jsn imageshow (4.4.0) | plg_content_vote (2.5.0) | plg_content_geshi (2.5.0) | plg_content_loadmodule (2.5.0) | plg_content_finder (2.5.0) | plg_content_joomla (2.5.0) | plg_content_pagebreak (2.5.0) | plg_content_emailcloak (2.5.0) | plg_content_pagenavigation (2.5.0) | xmap - sobipro plugin (2.0.2) | xmap - content plugin (2.0.4) | xmap - mosets tree plugin (2.0.2) | xmap - kunena plugin (2.0.2) | xmap - virtuemart plugin (2.0.1) | xmap - weblinks plugin (2.0.1) | plg_quickicon_joomlaupdate (2.5.0) | plg_quickicon_extensionupdate (2.5.0) | plg_editors_tinymce (3.5.4.1) | plg_editors_codemirror (1.0) | plg_extension_joomla (2.5.0) | plg_captcha_recaptcha (2.5.0) | plg_authentication_gmail (2.5.0) | plg_authentication_joomla (2.5.0) | plg_authentication_ldap (2.5.0) | plg_search_categories (2.5.0) | plg_search_weblinks (2.5.0) | plg_search_contacts (2.5.0) | plg_search_content (2.5.0) | plg_search_newsfeeds (2.5.0) |

templates discovered :: wrote:templates :: site :: jsn_epic_free (4.5.0) | beez_20 (2.5.0) | beez5 (2.5.0) |
templates :: admin :: hathor (2.5.0) | bluestork (2.5.0) |

in other domain have same problem. other troyan js redirector.

can me?

problem description :: forum post assistant (v1.2.3) : 13th december 2012 wrote:hosting advise me have troyan js redirector

forum post assistant (v1.2.3) : 13th december 2012 wrote:

basic environment :: wrote:joomla! instance :: joomla! 2.5.8-stable (ember) 8-november-2012
joomla! platform :: joomla platform 11.4.0-stable (brian kernighan) 03-jan-2012
joomla! configured :: yes | writable (644) | owner: armagain (uid: 1/gid: 1) | group: armagain (gid: 1) | valid for: 2.5
configuration options :: offline: 0 | sef: 1 | sef suffix: 0 | sef rewrite: 0 | .htaccess/web.config: yes | gzip: 0 | cache: 0 | ftp layer: 0 | ssl: 0 | error reporting: default | site debug: 0 | language debug: 0 | default access: 1 | unicode slugs: 0 | database credentials present: yes

host configuration :: os: linux | os version: 2.6.18-308.13.1.el5pae | technology: i686 | web server: apache/2.2.23 (unix) mod_ssl/2.2.23 openssl/0.9.8e-fips-rhel5 mod_bwlimited/1.4 mod_perl/2.0.6 perl/v5.8.8 | encoding: gzip,deflate,sdch | doc root: /home/armagain/public_html/interweb.com.es | system tmp writable: yes

php configuration :: version: 5.3.18 | php api: cgi-fcgi | session path writable: yes | display errors: 1 | error reporting: 22519 | log errors to: error_log | last known error: | register globals: | magic quotes: | safe mode: | open base: | uploads: 1 | max. upload size: 12m | max. post size: 8m | max. input time: 60 | max. execution time: 30 | memory limit: 64m

mysql configuration :: version: 5.5.27-cll (client:5.5.27) | host: --protected-- (--protected--) | collation: latin1_swedish_ci (character set: latin1) | database size: 1.36 mib | #of tables:  171

detailed environment :: wrote:php extensions :: core (5.3.18) | date (5.3.18) | ereg () | libxml () | openssl () | pcre () | sqlite3 (0.7-dev) | zlib (1.1) | bcmath () | calendar () | ctype () | curl () | dom (20031129) | filter (0.11.0) | ftp () | gd () | hash (1.0) | iconv () | spl (0.2) | json (1.2.1) | mbstring () | mcrypt () | mysql (1.0) | mysqli (0.1) | session () | standard (5.3.18) | posix () | reflection ($id: 593a0506b01337cfaf9f63ebc12cd60523fc2c41 $) | phar (2.0.1) | simplexml (0.1) | sockets () | imap () | tokenizer (0.1) | xml () | xmlreader (0.1) | xmlwriter (0.1) | zip (1.11.0) | cgi-fcgi () | timezonedb () | pdo (1.0.4dev) | pdo_sqlite (1.0.1) | sqlite (2.0-dev) | pdo_mysql (1.0.2) | ioncube loader () | zend engine (2.3.0) |
potential missing extensions :: suhosin |

switch user environment (experimental) :: php cgi: yes | server su: yes | php su: yes | custom su (litespeed/cloud/grid): yes
potential ownership issues: no

folder permissions :: wrote:core folders :: images/ (755) | components/ (755) | modules/ (755) | plugins/ (755) | language/ (755) | templates/ (755) | cache/ (755) | logs/ (755) | tmp/ (755) | administrator/components/ (755) | administrator/modules/ (755) | administrator/language/ (755) | administrator/templates/ (755) |

elevated permissions (first 10) ::

extensions discovered :: wrote:components :: site :: ocean (1.0.0) | com_wrapper (2.5.0) | com_mailto (2.5.0) |
components :: admin :: jcomments (2.3.0) | com_categories (2.5.0) | com_templates (2.5.0) | aicontactsafe (2.0.19.stable) | aicontactsafe - link (1.0.10.stable) | aicontactsafe - form (1.0.15.stable) | aicontactsafe module (1.0.13.stable) | aicontactsafe (1.0.0) | com_phocagallery (3.2.2) | com_languages (2.5.0) | com_redirect (2.5.0) | com_messages (2.5.0) | com_admin (2.5.0) | com_media (2.5.0) | com_checkin (2.5.0) | poweradmin (1.2.4) | com_search (2.5.0) | akeeba (3.6.10) | com_modules (2.5.0) | com_joomlaupdate (2.5.0) | com_content (2.5.0) | com_banners (2.5.0) | imageshow (4.5.1) | imageshow (4.5.1) | com_config (2.5.0) | virtuemart_allinone (2.0.12f) | com_login (2.5.0) | com_cache (2.5.0) | com_cpanel (2.5.0) | com_menus (2.5.0) | com_users (2.5.0) | com_xmap (2.3.0) | com_plugins (2.5.0) | com_installer (2.5.0) | ecb currency converter (1.0) | virtuemart (-) | com_finder (2.5.0) | com_weblinks (2.5.0) | com_newsfeeds (2.5.0) |

modules :: site :: mod_random_image (2.5.0) | mod_finder (2.5.0) | mod_articles_category (2.5.0) | mod_custom (2.5.0) | bt google maps (1.1.0) | mod_users_latest (2.5.0) | mod_articles_categories (2.5.0) | mod_virtuemart_search (2.0.12f) | mod_articles_archive (2.5.0) | mod_whosonline (2.5.0) | mod_weblinks (2.5.0) | mod_login (2.5.0) | mod_virtuemart_category (2.0.12f) | mod_footer (2.5.0) | mod_wrapper (2.5.0) | mod_banners (2.5.0) | mod_related_items (2.5.0) | mod_menu (2.5.0) | mod_stats (2.5.0) | mod_breadcrumbs (2.5.0) | mod_languages (2.5.0) | mod_virtuemart_manufacturer (2.0.12f) | mod_articles_latest (2.5.0) | mod_search (2.5.0) | mod_virtuemart_currencies (2.0.12f) | mod_syndicate (2.5.0) | mod_feed (2.5.0) | mod_articles_popular (2.5.0) | virtuemart shopping cart (2.0.12f) | mod_virtuemart_product (2.0.12f) | jsn imageshow (4.5.1) | mod_articles_news (2.5.0) | mod_phocagallery_image (3.2.0) |
modules :: admin :: mod_custom (2.5.0) | mod_title (2.5.0) | mod_poweradmin (1.2.4) | mod_login (2.5.0) | mod_submenu (2.5.0) | mod_menu (2.5.0) | mod_status (2.5.0) | mod_logged (2.5.0) | mod_toolbar (2.5.0) | mod_version (2.5.0) | mod_popular (2.5.0) | mod_feed (2.5.0) | jsn imageshow quick icons (4.5.1) | mod_multilangstatus (2.5.0) | mod_latest (2.5.0) | mod_quickicon (2.5.0) |

plugins :: site :: plg_editors-xtd_image (2.5.0) | button - imageshow (4.5.1) | plg_editors-xtd_jcommentsoff (1.0) | plg_editors-xtd_readmore (2.5.0) | plg_editors-xtd_article (2.5.0) | plg_editors-xtd_pagebreak (2.5.0) | plg_editors-xtd_jcommentson (1.0) | plg_jmonitoring_akeebabackup_t (1.0) | theme classic (1.1.9) | source picasa (1.1.3) | plg_user_contactcreator (2.5.0) | plg_user_joomla (2.5.0) | plg_user_jcomments (1.0) | plg_user_profile (2.5.0) | vm payment - authorize.net aim (2.0.12f) | vm payment plugin moneybookers (2.0.6) | vm - payment, payzen (2.0.8c) | vm - payment, klarna (2.0.12f) | vm payment plugin moneybookers (2.0.6) | vm payment plugin moneybookers (2.0.6) | vmpayment_paypal (2.0.12f) | vmpayment_moneybookers (2.0.6) | vm payment plugin moneybookers (2.0.6) | vm payment plugin moneybookers (2.0.6) | vm payment plugin moneybookers (2.0.6) | vmpayment_standard (2.0.12f) | vm - payment, systempay (2.0.8c) | vm payment plugin moneybookers (2.0.6) | vmpayment_heidelpay (12.09) | vm payment plugin moneybookers (2.0.6) | system - jsn imageshow (4.5.1) | plg_system_p3p (2.5.0) | system - jsn poweradmin (1.2.4) | plg_system_languagecode (2.5.0) | plg_system_debug (2.5.0) | plg_system_jsnframework (1.1.7) | plg_system_log (2.5.0) | plg_system_remember (2.5.0) | plg_system_redirect (2.5.0) | plg_system_highlight (2.5.0) | plg_system_sef (2.5.0) | plg_system_cache (2.5.0) | plg_system_logout (2.5.0) | plg_system_jcomments (1.0) | plg_system_languagefilter (2.5.0) | plg_finder_categories (2.5.0) | plg_finder_weblinks (2.5.0) | plg_finder_contacts (2.5.0) | plg_finder_content (2.5.0) | plg_finder_newsfeeds (2.5.0) | content - jsn imageshow (4.5.1) | plg_content_vote (2.5.0) | plg_content_geshi (2.5.0) | plg_content_loadmodule (2.5.0) | plg_content_finder (2.5.0) | plg_content_joomla (2.5.0) | plg_content_pagebreak (2.5.0) | plg_content_emailcloak (2.5.0) | plg_content_jcomments (1.0) | plg_content_pagenavigation (2.5.0) | xmap - sobipro plugin (2.0.2) | xmap - content plugin (2.0.4) | xmap - mosets tree plugin (2.0.2) | xmap - kunena plugin (2.0.2) | xmap - virtuemart plugin (2.0.1) | xmap - weblinks plugin (2.0.1) | plg_quickicon_joomlaupdate (2.5.0) | plg_quickicon_extensionupdate (2.5.0) | plg_editors_tinymce (3.5.4.1) | plg_editors_codemirror (1.0) | plg_extension_joomla (2.5.0) | plg_captcha_recaptcha (2.5.0) | vmshipment_weight_countries (2.0.12f) | plg_authentication_gmail (2.5.0) | plg_authentication_joomla (2.5.0) | plg_authentication_ldap (2.5.0) | jcomments - autosubscribe (2.1) | vmcustom_stockable (2.0.12f) | vmcustom - specification (2.0.12f) | vmcustom - textinput (2.0.12f) | plg_search_categories (2.5.0) | plg_search_weblinks (2.5.0) | plg_search_contacts (2.5.0) | plg_search_content (2.5.0) | plg_search_virtuemart (2.0.12f) | plg_search_jcomments (1.0) | plg_search_newsfeeds (2.5.0) |

templates discovered :: wrote:templates :: site :: beez_20 (2.5.0) | allrounder-j1.6 (1.4) | ju_stremit (2.5) | beez5 (2.5.0) |
templates :: admin :: hathor (2.5.0) | bluestork (2.5.0) |