Help - Malicious backlinks from my website!
The SEO Bay Xrumer Forum and SEO Community.
+ Reply to Thread
Page 1 of 2 1 2 LastLast
Results 1 to 10 of 13
  1. #1
    Deckhand benchwar is an unknown quantity at this point
    Reputation:
    1

    Join Date
    10th Nov 2011
    Posts
    22
    Thanks
    13
    Thanked 1 Time in 1 Post

    [SOLVED] Help - Malicious backlinks from my website!



    Hi guys,

    I have downloaded a Joomla template and after installing the sample data, I've noticed an Horizontal scrolling. After using firebug and looked it up, i saw this div- <div id="bod">

    Inside it, couple of backlinks to Russian website and to the theme purchasing landing page.

    I tried to find this div in the template itself and even in the DB but nothing was found (I guess there is an encryption of MD5 or some...) and also when i tried to remove the div that it was seating in, it cleaned up my website from it's content.

    This is my website (not hyper link, i just need your help) - www rfinance co il

    Hope one of you guys can help me out here.

    Thanks

    Similar Threads:
    Last edited by benchwar; 13-02-2012 at 18:43.

  2. #2
    Shaman adhoc has a spectacular aura about adhoc has a spectacular aura about
    Reputation:
    172

    Join Date
    29th Mar 2011
    Posts
    429
    Thanks
    26
    Thanked 172 Times in 103 Posts
    Couldn't find your site but
    Most free warez shit you find online for paid platforms encrypt code that allows this, or more, to happen.

    To me it sounds like it may be hiding in the Javascript. You probably won't be able to find the reference to where it fill's the div because it's encrypted. Javascript is where I would start looking though if it's filling a div that is otherwise empty. The encryption will more than likely be MD5 and probably just look like a chunk of random characters that will be easy to point out when you scroll across it.


  3. #3
    Deckhand benchwar is an unknown quantity at this point
    Reputation:
    1

    Join Date
    10th Nov 2011
    Posts
    22
    Thanks
    13
    Thanked 1 Time in 1 Post
    Hi adhoc,

    Thanks for the quick reply

    I added the website in the post above, all you need to do is add dot "." where the space is.

    This is the html out put as you can see using firebug:

    HTML Code:
    <div id="bod">
    <a title="расширения Joomla 2.5" target="_blank" href="http web-creator org">расширения Joomla 
    
    2.5</a><br>
    <a title="GavickPro Joomla 2.5" target="_blank" href="http joomla-master org/gavickpro.html">GavickPro Joomla 2.5</a>
    </div>
    and this is the template div it is located in:

    HTML Code:
    <div id="connerfrontpage" style="width: <?php echo $boxwidth ?>">
    						<jdoc:include type="component" />		
    					</div>
    About JS, can i put all the div in "encrypt to md5" tool and then look it up in the JS/DB?

    Thanks

    Last edited by benchwar; 13-02-2012 at 18:14. Reason: removed links

  4. #4
    Deckhand benchwar is an unknown quantity at this point
    Reputation:
    1

    Join Date
    10th Nov 2011
    Posts
    22
    Thanks
    13
    Thanked 1 Time in 1 Post
    Solved -

    Thanks adhoc for inspiring me to look around fro the MD5 encrypted script.

    Just so others who share the same problem could find the solution to the problem, the Joomla template is OmegaTheme, Mega_peryz.

    What needs to be done is to enter this path:\public_html\templates\mega_peryz\html\com_co ntent\article\default.php

    And there, you will find 2 places where the Malicious backlinks is hiding:

    Code:
    <?php
    $str 

    'MD5 Encryption';
    echo 
    base64_decode($str);?>
    Remove Them and no more backlinks will appear in your theme


  5. The Following User Says Thank You to benchwar For This Useful Post:

    Kepperbes (27-05-2012)

  6. #5
    Shaman adhoc has a spectacular aura about adhoc has a spectacular aura about
    Reputation:
    172

    Join Date
    29th Mar 2011
    Posts
    429
    Thanks
    26
    Thanked 172 Times in 103 Posts
    Glad you fixed her up and +1 for sharing the solution.


  7. #6
    Recruit PlotHost is an unknown quantity at this point
    Join Date
    5th Dec 2011
    Location
    US
    Posts
    5
    Thanks
    0
    Thanked 0 Times in 0 Posts
    Try to use plugins/scripts/templates only from trusted sources... otherwise some bad things can happen.


  8. #7
    Recruit kasra is an unknown quantity at this point
    Join Date
    27th May 2012
    Posts
    2
    Thanks
    0
    Thanked 0 Times in 0 Posts

    hidden Russian Malicious back links in Joomla template

    Hi,
    I need ur help...please.
    I have the same problem (hidden Russian Malicious back links) with Joomla yoo_radiance .... but I can not see any hidden codes in default.php (\templates\yoo_radiance\html\com_co ntent\article\default.php
    here is the default.php codes:
    <?php
    $base = dirname(dirname(dirname(__FILE__)));
    include($base.'/config.php');
    include($warp['path']->path('layouts:'.preg_replace('/'.preg_quote($base, '/').'/', '', __FILE__, 1)));

    Would you please help me to find and get rid of these hidden codes.

    Thanks,
    kasra


  9. #8
    Big Boss kensai is a name known to all kensai is a name known to all kensai is a name known to all kensai is a name known to all kensai is a name known to all kensai is a name known to all
    Reputation:
    620

    Join Date
    8th Dec 2010
    Posts
    2,094
    Thanks
    315
    Thanked 623 Times in 303 Posts
    @kasra: IF you want to be helped on this forum, DONT POST 3 times in a row the same thing. Doing so will just lead to you being banned. Consider this a friendly warning. Next time is permaban.

    As for your problem, try search for the code in config.php for starters as its the one included on your index.php page..

    This should be on a page of its own but anyway....


  10. #9
    Recruit kasra is an unknown quantity at this point
    Join Date
    27th May 2012
    Posts
    2
    Thanks
    0
    Thanked 0 Times in 0 Posts
    Thanks for your reply Kensai,


  11. #10
    Recruit vietnamsvisadotnet is an unknown quantity at this point
    Join Date
    28th Jul 2012
    Posts
    1
    Thanks
    0
    Thanked 0 Times in 0 Posts
    Hi, my website is [Only registered and activated users can see links. ]. it is also add code:

    <div id="ja-rol"><a title="Широкоформатная печать" target="_blank" href="http://www.printer-spb.ru/content/blogsection/23/100/">Широкоформатная печать</a><br><a title="Joomla хостинг" target="_blank" href="http://tophoster.org/">Joomla хостинг</a></div>
    But i have been Fix it.

    I have some answer such as:

    The First you should use firebug on Fire fox find line have language russian: for example code my site is Широкоформатная печать. You give line language russian on [Only registered and activated users can see links. ] then you press encode and find 'JiMxMDY0OyYjMTA4MDsmIzEwODg7JiMxMDg2OyYjMTA4MjsmI zEwODY7JiMxMDkyOyYjMTA4NjsmIzEwODg7JiMxMDg0OyYjMTA 3MjsmIzEwOTA7JiMxMDg1OyYjMTA3MjsmIzExMDM7ICYjMTA4N zsmIzEwNzc7JiMxMDk1OyYjMTA3MjsmIzEwOTA7JiMxMTAwOw= ='
    The secondly, you for source code on your compurter and find it. If found you should copy code that back [Only registered and activated users can see links. ] press decode. Then comparation with code firebug website is right. You should remove it.

    I also can give you video it is helpful however it is slightly blurred. [Only registered and activated users can see links. ]

    can you send mail to me if it is nescessary. [Only registered and activated users can see links. ]



 

Visitors found this page by searching for:

http:web-creator.org

joomla russian links

remove joomla-master.org

remove http:joomla-master.org

joomla-master.org remove

http:joomla-master.org

&lt;a href=http:joomla-master.orginclude(warp[path]-&gt;path(layouts:.preg_replace(.preg_quote(base ). __file__ 1)));remove russian link from joomlaremove link joomla-master.orghttp:www.printer-spb.rucontentblogsection23100joomla hidden links in russianhow to remove backlinks in templatesrussian links in joomla templateremove russian lines from joomla templatehttp:theseobay.comlife1341-help-malicious-backlinks-my-website.htmlhttp:joomla-master.org templates* backlinks&lt;div id=bod&gt; &lt;a href=http:web-creator.orgremove hidden backlinks in joomla templatejoomla-master.org&lt;a href=http:web-creator.org target=_blank &gt;joomla 2.5&lt;a&gt;&lt;br &gt;remove href=joomla-master.orgjoomla print http:web-creator.org linkerease http:joomla-master.orgforum.html template&lt;div id=bod&gt;

Tags for this Thread