How I removed the spam links after being hacked

[sandyj]

My site was recently hacked - thanks goes to Germ who pointed out the thousands of spam links that appeared on the source of my index.php page.

 

Just wanted to share with you how I removed all those links, thus hopefully fixing the problem.

 

I found 8 suspect files in /public_html/admin/includes/languages/espanol/modules/newsletters. The were called cns, csi, kwd, lb, lock, rlf, skwd and swf (no extensions). Once I had deleted them, the links were gone.

 

Not sure if that is the solution for everyone, but hope it helps.

 

Regards Sandy

[charmed-imsure]

My site was recently hacked - thanks goes to Germ who pointed out the thousands of spam links that appeared on the source of my index.php page.

 

Just wanted to share with you how I removed all those links, thus hopefully fixing the problem.

 

I found 8 suspect files in /public_html/admin/includes/languages/espanol/modules/newsletters. The were called cns, csi, kwd, lb, lock, rlf, skwd and swf (no extensions). Once I had deleted them, the links were gone.

 

Not sure if that is the solution for everyone, but hope it helps.

 

Regards Sandy

 

 

This is really helpful. I found those files + more but they were in catalog/admin/includes/languages/english/images/buttons

took me a while to find them!

 

I have also noticed that in all of my PHP files, they all begin with this:

<?php /**/eval(base64_decode(

 

I can't recall ever seeing that before so I wonder is that normal? Or do I need to now go through all my files and delete that bit?

[germ]

My site was recently hacked - thanks goes to Germ who pointed out the thousands of spam links that appeared on the source of my index.php page.

 

Just wanted to share with you how I removed all those links, thus hopefully fixing the problem.

 

I found 8 suspect files in /public_html/admin/includes/languages/espanol/modules/newsletters. The were called cns, csi, kwd, lb, lock, rlf, skwd and swf (no extensions). Once I had deleted them, the links were gone.

 

Not sure if that is the solution for everyone, but hope it helps.

 

Regards Sandy

You either missed something or didn't plug the security leak that allowed the hack....

 

Look at your page cache in google.

 

The spam links are back.

:'(