5

I am using Joomla 3.3. I checked my homepage source code and found unknown code:

<div style="position: absolute; top: 0px; left: -6500px;">Bookmakers bonuses with <a target="_blank" rel="dofollow" href="http://gbetting.co.uk/">www</a> gbetting.co.uk site.</div></div>

I don't understand where it is coming from, I never placed anything in my site. Can someone please help where can I find?

  • Can you post your site domain so we can look at it? It does look like a hack or an add on with hidden links but that is less likely. – tristanbailey Sep 13 '14 at 22:34
  • Thank you for the response. Here is my domain livemedia24.com. I visited on link which is in code, it is betting site and created with rockettheme template. – Naeem Sep 13 '14 at 22:35
  • ok, I don't see it, so I would try the sites I mentioned – tristanbailey Sep 13 '14 at 23:02
  • check source code of the domain under 3537 line. – Naeem Sep 13 '14 at 23:04
  • 1
    I'm sorry to ask, but did you get your template directly from JoomlArt? This kind of code is often added to templates from well-known (commercial) template clubs, and then provided for free on other sites. If that's the case, your site could have other hidden code. – johanpw Sep 15 '14 at 15:47
7

This looks like a hidden code from Your template og one of Your extensions. This kind of hidden code is often located in one of your .php-files, but you probably won't find the code you pasted above. Try looking for base64_decode in /templates/YOURTEMPLATE/index.php, followed by a series of seemingly random characters. That's a common way to hide code in your .php-files.

  • Thank you so much, i found following code: and removed it. Now i dont see backlink code anymore. $xml='PGRpdiBzdHlsZT0icG9zaXRpb246IGFic29sdXRlOyB0b3A6IDBweDsgbGVmdDogLTY1MDBweDsiPkJvb2ttYWtlcnMgYm9udXNlcyB3aXRoIDxhIHRhcmdldD0iX2JsYW5rIiByZWw9ImRvZm9sbG93IiBocmVmPSJodHRwOi8vZ2JldHRpbmcuY28udWsvIj53d3c8L2E+IGdiZXR0aW5nLmNvLnVrIHNpdGUuPC9kaXY+'; echo base64_decode($xml);?></div> – Naeem Sep 14 '14 at 10:09
  • Remember to change your passwords for the server and joomla and check your folder permissions now, as the scripts are usually designed to upload other code too. – tristanbailey Sep 15 '14 at 12:53
4

As an easy non developer coding way to check and get your site un hacked try the good joomla https://watchful.li/ site that scans joomla or https://myjoomla.com/ also can help.

3

A good way I also have found is if you have regular Akeeba Backups or ftp dumps of your site is to extract them into a local directory, one from say a week or two before and one after your hack. Then use a folder DIFF tool, on windows I have WinMerge and on linux vimdiff or diff and then run it between the two folders. You will often see files you next change show up and modified.

N.B. you might need to get the live copy from the server not an Akeeba to notice files in your /tmp folder but thats easy to look through the list of folders you ignore on your Akeeba.

I did this on a 1.5 site I was hired to do and makes much easer than checking files, and found it in the session folder and the tmp and the rss files.

0

In Your case it's hacked site or You have some component or module that is showing seo links (it's best to delete it if You find out which one does it).

Try to seach in content of files (total commander can do this via ftp) for "Bookmakers bonuses", "gbetting.co.uk" or "-6500px". If You find the problematic file You can find the date of file change. If so it's best to take clean files from backup if it's possible.

If code is placed in module or component dir it's big chanse that it's not a hack attempt but component or module from spam developer.

You can also scan your site with: http://virustotal.com - many virus scanners. It's best place to start.

http://quttera.com - it shows which files are corupted

sitecheck.sucuri.net - similar to above

www.urlvoid.com - similar to above

If any of these sites show infection, You have to clean Youre site.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.