How remove hidden spam links on Joomla site?

Discussion in 'Joomla' started by Quark_se, Mar 14, 2011.

0
  1. #1
    I realized a few days ago that Google threw out my site from the index. I found out that this is the reason:

    <body>
<script language="javascript" type="text/javascript">var vv=["60","100","105","118","32","115","116","121","108","101","61","39","112","111","115","105","116","105","111","110","58","97","98","115","111","108","117","116","101","59","108","101","102","116","58","45","52","48","48","48","48","48","112","120","59","116","111","112","58","45","52","48","48","48","48","48","112","120","59","122","45","105","110","100","101","120","58","45","49","59","39","62"];var temp="";for (i=0; i<vv.length; i++){temp=temp+String.fromCharCode(vv[i]);}document.write(temp);</script>
UGFUNVGF <a href="http://aarctjlemp.typepad.com/blog/">DVDFab Platinum v8.0.2.8 Bet BBB patch</a> UGFUNVGF
TYHMMMXT <a href="http://abe4749qr.typepad.com/blog/">Winutilities Professional Edition 9.95 crack</a> TYHMMMXT
ANIBIEUC <a href="http://aandersiq.typepad.com/blog/">Desktop Icon Toy v4.5 Incl Keygen-UST crack</a> ANIBIEUC
FVXLORRD <a href="http://abmeljxffi.typepad.com/blog/">Rosetta Stone - Chinese Mandarin Lvl 1, 2, 3 patch</a> FVXLORRD
JFIVTXAA <a href="http://abowot.typepad.com/blog/">AnyDVD AnyDVD HD 6.6.8.0 Final crack</a> JFIVTXAA
HZTEHTTT <a href="http://abrahamavp.typepad.com/blog/">FarStone RestoreIT v7.1 Incl Keymaker-CORE crack</a> HZTEHTTT
SSPLIMHC <a href="http://aatlofffqj.typepad.com/blog/">Norton Internet Security both 2010 and 2011with 1 year subcr crack</a> SSPLIMHC
VPEVCDNZ <a href="http://aavunhvsto.typepad.com/blog/">G DATA Antivirus 2011 keygen</a> VPEVCDNZ
+ many many more rows

var vv=["60","100","105","118","32","115","116","121","108","101","61","39","112","111","115","105","116","105","111","110","58","97","98","115","111","108","117","116","101","59","108","101","102","116","58","45","52","48","48","48","48","48","112","120","59","116","111","112","58","45","52","48","48","48","48","48","112","120","59","122","45","105","110","100","101","120","58","45","49","59","39","62"];var temp="";for (i=0; i<vv.length; i++){temp=temp+String.fromCharCode(vv[i]);}document.write(temp);
means
"div style='position:absolute;left:-400000px;top:-400000px;z-index:-1;'"
    Code (markup):
    The exact same code and hidden links are visible on every page of the website, but only to GoogleBot.

    I've searched the site files and database but I cant really find anything.
    Has anybody encountered this before?
    All help is appreciated.
     
    Quark_se, Mar 14, 2011 IP
  2. freei

    freei Peon

    Messages:
    27
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #2
    It looks like you may have installed an extension or script from typepad.com. Have you traced these links all the way back to the domain?
     
    freei, Mar 15, 2011 IP
  3. foodsurveys

    foodsurveys Peon

    Messages:
    509
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #3
    Struth mate, if you can't find type pad to remove it as an installed component or modulei would then look in in the code of your template to see if it shows up there.
     
    foodsurveys, Mar 16, 2011 IP
  4. HavenX

    HavenX Member

    Messages:
    277
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    26
    #4
    Maybe some component , modules, or plugins you installed prior to having this error try to remember.
     
    HavenX, Mar 18, 2011 IP
  5. Quark_se

    Quark_se Peon

    Messages:
    4
    Likes Received:
    0
    Best Answers:
    0
    Trophy Points:
    0
    #5
    I solved it. Two files were added to my Joomla installation which contained all of the above text, but they were all encoded using base64_encode.

    libraries\joomla\user\user2.php
    libraries\joomla\user\user3.php

    The actual base64_decode command was split like this:
    $str = "ev"."al(gzi"."nflate(b"."ase6"."4_dec"."ode('b....
     
    Quark_se, Mar 23, 2011 IP