Hi Tim,

Clearly your file system has been hacked. I would not have deleted the db because there was no reason to assume that the db content had been compromised. There is also no reason at this point to believe that the file system was compromised due to any vulnerability in mojoPortal. In shared hosting some other app on the server could have been compromised and if the server file system permissions were not sufficiently hardened then it could write files into other applications on the server. Probably this javascript file it wrote into all your folders is malware and probably it also modified as many other files on disk as possible to add a link to the javascript file so that it could try to infect visitors of your web site.

So the errors are probably because the mojoPortal files have been modified. I would have first deleted all those javascript files then I would have uploaded the mojoPortal files for whatever version you are running to make sure the files were restored back to their correct version.

Then I would have contacted my host and asked if they know about any sites on the same server being hacked. Also I would download the IS logs and inspect them for any clues. If files were uploaded due to some fault in mojoPortal you would expect to see evidence of it in the logs.

Basically, the web process that runs your web site runs in the context of the identity of the application pool and this identity needs read permissions to the whole web tree and needs full control only of /Data and /App_Data. In an ideal world each web site would have its own application pool with a different user and that user would have the needed permissions (and be the only user other than your ftp user that has file permissions on your site) but no other sites would use the same user for the application pool. This would give process isolation and file system permissions would be isolated to the particular site. Unfortunately in the real world often many sites use the same application pool and user because having separate ones requires more server overhead in terms of memory and processes. So there could be another app running in the same app pool or as the same user and if that app is compromised it can write to other folders on the server where the user has permissions to write and thus it can copy that javascript file everywhere it can and modify as many files as possible to include the script. Also unfortunately, many hosts may make the whole web tree permissions allow full control which is more permission than needed but doing this reduces support requests for the host when people try to install applications. If the file and folder permissions were as recommended then it would not have been possible to write files anywhere except beneath /Data and App_Data, the rest of the web file tree would be read only.

So even after restoring the mojoPortal files you would need to try to find out how those files were created or they may come back again.

Hope it helps,

Joe