100s of rogue hidden links keep appearing on Mobius index.php page
-
-
- Robert Vanraamsdonk
- Newbie
- Posts: 2
- Thanks: 0
-
Hi forum members,
Quite by accident I discovered that my site home page http://www.informedconsulting.nl contained literally thousands of rogue links inserted in a hidden <p> tag at the bottom of my Joomla Mobius index.php page. Cleaning the page gets rid of all links for a while. However, a mysterious persistent comment tag
<!-- 1206227288 -->
keeps appearing at the very bottom of the page. This tag may or may not be innocent...? All I know is that the hidden links start accruing again only a couple of hours the page has been cleansed. Besides this being a royal pain, I am worried that this will ultimately harm our current favourable ranking with Google.
Any advice on how to tackle this issue would be greatly appreciated. By the time this is posted, you can most likely see the contamination yourself by viewing my homepage source in your browser. Thanks for your response!
Robert - Last Edit: 16 years 1 month ago by Robert Vanraamsdonk.
-
-
-
- GollumX
- Elite Rocketeer
- Posts: 2817
- Thanks: 0
-
Your site has been hacked, and the comment tag you see is an "innocent" timestamp.
EDIT: I note your use of the JoomSEF SEF extension. This extension, if not the paid one, inputs hidden links which definitely damage your site's SEO.
Kanga Internet forked this extension with the intention of producing a SEF extension free of hidden links for the Joomla community but once everyone started using theirs, they put in their own hidden links.
Some info at forum.joomla.org/viewtopic.php?f=262&t=264108
Ninjoomla are currently considering forking it again to kick hidden links for good (If we do, will be released free of cost of course)
In any case, you currently have a few options:
1.) Get an early version of the Kanga JoomSEF component (old ones don't have hidden links)
2.) Pay for the Artio JoomSEF patch... if you pay they will send you a link-free one.
3.) Choose an entirely different SEF extension instead. I've had good results with sh404SEF.
I may still be totally wrong... your site COULD be hacked... but lets first eliminate JoomSEF as a possibility. - Last Edit: 16 years 1 month ago by GollumX.
- Say no to Internet Explorer 6.
twitter.com/mark_up
-
-
-
- James Bush
- Hero Rocketeer
- Posts: 299
- Thanks: 0
- IT Implentation, Marketing, Business consulting
-
Interesting... I was just asked to take over a site that has a similar issue. While going through the site URL's sitemap I notices many, many urls such as "
domainname.com/index.php?option=com_wrap...Fviroja%2F&Itemid=68
" . There is only one extension on this site....and I read the reviews concerning them on extensions.joomla ...and there is nothing mentioned here concerning this. There are no ill effects on the site and the links do not appear anywhere. I've done site:url and there are no links in there as well...
Anybody can shorten my search for what the hack was, I'd appreciate it.
Hi Gollum....long time... - Stan
There's plenty of room for all of God's creatures.
Right next to the mashed potatoes.
-
-
-
- GollumX
- Elite Rocketeer
- Posts: 2817
- Thanks: 0
-
Hi James, good to see you again
www.obrasmecanicasch.com/
Your site has certainly been hacked.
Best bet is to go through the Joomla Recovery checklist (I think it's a sticky in the security section of Joomla.org forums.)
In the meantime...
- change all passwords, including your FTP and cpanel ones.
- change all permissions for all files and folders on under public_html to 644 for files and 755 for folders.
- Uninstall the sitemap extension, and delete any menu items that lead to the wrapper component.
- Update all extensions to the latest versions. Update Joomla to 1.5.1 or 1.0.15.
- Check that there are no unfamiliar files in the site root, administrator, and images folders (malicious files can be planted anywhere permissions allow, but are commonly found in these locations.)
- Change your passwords again.
Sorry I can't help more then that, but every case is unique. - Say no to Internet Explorer 6.
twitter.com/mark_up
-
-
-
- James Bush
- Hero Rocketeer
- Posts: 299
- Thanks: 0
- IT Implentation, Marketing, Business consulting
-
www.obrasmecanicasch.com/
; is NOT my site.. it was merely an example of the links being generated. In other words... (replace domainname.com)
domainname.com/index.php?option=com_wrap...Fviroja%2F&Itemid=68 "
is an example of the link being generated..... NOT a link to the site in question. There are about 20 sites or so in the links. I looked at obramecaniscasch.com before I posted and saw it had been hacked... and followed a few other links as well....all of them with the same message as is on obramecaniscasch.com .
Passwords were changed before I posted. There is no Sitemap extension. The only extension is a forms extension. It is not peculiar to the wrapper content...again that was only a sample.
Joomla is @ 1.51 as are all extensions.
I'll start looking at code and db tomorrow... - Stan
There's plenty of room for all of God's creatures.
Right next to the mashed potatoes.
-
-
-
- GollumX
- Elite Rocketeer
- Posts: 2817
- Thanks: 0
-
Yup, looks like someone planted links in your site... to that other hacked site. If you or the previous admin didn't, then the assumption is that your site was hacked.
There are a few security extensions on the JED you might consider trying. - Say no to Internet Explorer 6.
twitter.com/mark_up
-
Time to create page: 0.039 seconds