Drupal and Joomla also hacked?...

[skully]

I know word press sites were hacked, I found new folder (F0x) that seems to indicate Drupal and Joomla may be infected also.

 

See screen shot of F0xConfig2 folder below...

 

[wolstech]

I saw those as well. I have to look through the accounts listed inside though in order to see if they're actually hacked. The WHMCS ones are unlikely to be affected since that program is prohibited and won't even run here.

 

EDIT: Just confirmed that 2 of the Joomla sites listed inside that folder are also compromised...  

 

Also, how are you able to still see that folder when you're suspended?

[skully]

I had made screen grab earlier while looking at directory.... before suspension