Взлом (залили шелл) и наблюдения в логах - Безопасность сайтов на Joomla

125.253.118.88 - - [27/Apr/2013:11:23:55 +0600] "POST /index.php?nn_qp=1&url=http://www.nonumber.nl/ HTTP/1.0" 200 26 "-" "Mozilla/5.0 (Windows; U; Windows NT 6.0; ja; rv:1) Gecko/20110403 Firefox/3.6a1pre"
125.253.118.88 - - [27/Apr/2013:11:24:00 +0600] "POST /images/j.php HTTP/1.0" 200 183 "-" "Mozilla/5.0 (Windows; U; Windows NT 6.0; ja; rv:1) Gecko/20110403 Firefox/3.6a1pre"
125.253.118.88 - - [27/Apr/2013:11:24:03 +0600] "POST /images/j.php HTTP/1.0" 200 174 "-" "Mozilla/5.0 (Windows; U; Windows NT 6.0; ja; rv:1) Gecko/20110403 Firefox/3.6a1pre"
125.253.118.88 - - [27/Apr/2013:11:24:05 +0600] "GET /images/jos_ihxu.php HTTP/1.0" 200 35674 "-" "Mozilla/5.0 (Windows; U; Windows NT 6.1; ja; rv:1.9.2a1pre) Gecko/20090403 Firefox/3.6a1pre"

if (isset($_REQUEST['nn_qp'])) 
{
header("Location: http://natribu.org/"); 

exit;
}

find ./ -type f -name "*.js" -exec chmod 444 {} \;

find ./ -type f -name "*.php" -exec chmod 644 {} \;

BAN IP

195.16.226.202
65.202.239.135
194.242.59.43
175.107.185.52
91.192.171.51
91.232.96.17
89.218.192.128
109.254.21.92
109.92.101.23
178.125.150.102
76.164.194.90
178.125.205.189
218.58.83.232
173.208.45.178
123.235.79.15
188.143.232.84
209.68.4.185
145.100.191.24
108.170.86.114
201.18.37.26
194.206.227.78
195.42.102.25
5.149.214.15
201.151.156.254
83.140.154.254 
14.0.70.161
199.19.249.196
219.87.157.2
212.118.244.162
132.68.13.33
67.210.109.185
95.211.224.38
188.136.172.129
14.0.70.138
211.144.72.154 
24.212.204.53
24.155.88.186
210.157.20.86
85.47.52.202 
65.213.70.116 
2.50.44.226
61.174.9.250 
195.54.62.22
189.62.114.139
111.223.228.99
108.40.88.122
186.92.130.189
91.146.35.50
94.242.233.80
94.41.170.29
94.242.233.47
213.171.204.130
213.108.248.110
65.36.241.79
188.16.4.170
175.107.185.52
108.168.159.58
94.23.14.30
82.145.44.49
87.73.2.26
142.90.107.59
212.143.93.29
216.162.21.129
178.137.234.238
178.219.249.252
79.133.136.204
125.253.118.88

if (isset($_REQUEST['nn_qp'])) 
{
header("Location: http://natribu.org/"); 

exit;
}

nn_qp

<?php
if (isset($_REQUEST['nn_qp'])) 
{
header("Location: http://natribu.org/"); 

exit;
}
/**
* @version		$Id: index.php 14401 2010-01-26 14:10:00Z louis $
* @package		Joomla
* @copyright	Copyright (C) 2005 - 2010 Open Source Matters. All rights reserved.
* @license		GNU/GPL, see LICENSE.php
* Joomla! is free software. This version may have been modified pursuant
* to the GNU General Public License, and as distributed it includes or
* is derivative of works licensed under the GNU General Public License or
* other free or open source software licenses.
* See COPYRIGHT.php for copyright notices and details.
*/

// Set flag that this is a parent file
define( '_JEXEC', 1 );

define('JPATH_BASE', dirname(__FILE__) );