My site (joomla in Unix) has been hacked and I deleted every js, php files I’ve found, generally with eval(gzinflate(base64_decode,etc, but I still get results with viagra words in google’s description when I search for site:mysite viagra . I already check log files and used firebug Page spoeed activity to see something strange, but nothing, also in Webmasters tools, Labs, check as Googlebot, but nothing. I can’t see any viagra words in cached pages or in the real page, only in description of google results. How can I find the malware? Where else can I look for or is there any online check website to detect this? Any other ideas, please?! Thanks a lot
The Firefox add-on “Live HTTP Headers” lets you watch redirects as they happen.
Try choosing one of the “viagra” pages in a Google search result, and click on the link to go to your site from there. Once you get to your site, click to a 2nd page. See if either of the two pages redirects to a weird page selling drugs. (I’m assuming you only have viagra pages, no viruses or other malware. If there’s malware on your site, you must be much more careful, as you probably know.)
Once Google has received pages from your site containing “viagra” in the text, it can take a while for those pages to disappear from the index, even after you’ve cleaned them.
The viagra pages were likely in the files you deleted (with the base64 code in them). Those pages might only have been shown to Googlebot and to visitors coming from search engine results, so that many visitors would never see them.
Make sure your Joomla main index page (index.php?) hasn’t been tampered with. Check it against a known-good copy of the original. Make sure it doesn’t include a page from your site that it shouldn’t normally include. The code might not look particularly suspicious, except that it includes a page, with a normal-looking name, that it shouldn’t.
