3

I have a site which automatically adding hidden links under contact us page and other 3 pages.

i removed all the Malware codes but it still renaming on that pages, i also checked in database but no sign can't find any signature.

this is the links appear on page

<div id="xXQrAdjTl" style="position: absolute; top: -1004px; left: -1540px; width: 307px;"><a href="http://buycialisonlinepharmacys.com" title="Address">buy cheap cialis without a prescription</a></div><div id="ncRJZxHun" style="display: none"><a href="http://genericcialisnoprescriptions.com" title="where to buy cialis online">click here</a></div><div id="fEBXspOQy" style="display: none"><a href="http://buyviagraintheusa.com" title="buy viagra safley">buy viagra in uk</a></div><div id="xkjzURHcT" style="position: absolute; top: -1406px; left: -1219px; width: 312px;"><a href="http://orderviagraonlines.com" title="can you buy viagra at walmart">where to buy viagra us</a></div><div id="uOowZjjxU" style="display: none"><a href="http://buycialis24hs.com" title="buy cialis jelly online">buy cialis jelly online</a></div><div id="azLaUHwiz" style="position: absolute; top: -1139px; left: -1339px; width: 381px;"><a href="http://cialisonline24hs.com" title="cialis">how to buy cialis online</a></div><div id="MOJlSmEJB" style="position: absolute; top: -1827px; left: -1499px; width: 395px;"><a href="http://genericcialissale.com" title="buy cialis jelly">cialis 20mg</a></div><div id="kgfcUmRGa" style="position: absolute; top: -1828px; left: -1180px; width: 335px;"><a href="http://viagrageneric24hs.com" title="viagra non generic">buy sildenafil online</a></div><div id="IRDsypfZH" style="position: absolute; top: -1307px; left: -1933px; width: 366px;"><a href="http://viagragenericsale.com" title="viagra no prescription non generic">buy viagra Canada</a></div><div id="ZCqjPbqoe" style="position: absolute; top: -1887px; left: -1018px; width: 312px;"><a href="http://viagraonline24hs.com" title="side effects">viagra online here</a></div><div id="bjWiPvCoY" style="display: none"><a href="http://buygenericzithromax2013.com" title="zithromax buy no prescription">buy zithromax online cheap</a></div><div id="boFBzznoh" style="display: none"><a href="http://orderzithromaxonline24h.com" title="zithromax buy canada">zithromax</a></div>

i checked the site with http://sitecheck.sucuri.net/results/www.delmaproduction.nl/nl/

they gives security warning.

site url is www.delmaproduction.nl

i also disable the javascript on browser and check but still this links appears, also checked on those all template files no luck even remove base64 codes.

using joomfish and ARTIO Joom Sef as main extensions

anyone know how to fix this. thank you

suneth
  • 53
  • 2
  • 6

3 Answers3

3

There's a chance your site has been hacked. Suggest you use a tool such as MyJoomla to scan your site and use the instructions on the Joomla Docs Wiki to help recover your site.

Michael
  • 992
  • 8
  • 19
1

Thanks for sharing this !

I had the same problem and also found an index file without an extension in the libraries/joomla/cache/handler folder. I first deleted it but then I got a totally blank homepage !

I recreated an empty index file with permission set to 444, hope that will do the trick until I finally migrate to the newer Joomla version.

olivier
  • 11
  • 1
0

i Solve that, it's on libraries/joomla/cache/. some files created without extension called index

suneth
  • 53
  • 2
  • 6