Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

Possible Duplicate:
Titles in Google results contain spammy prefixes

I have a webshop online and I have some problems with redirecting from Google.

Case 1 When I Google for my site at google.com in Iron SWR (safe Chrome version) and I click the first link I get the correct page.

Case 2 When I Google for my site at google.nl in Iron SWR (safe Chrome version) and I click the first link Google will redirect me to a spam site.

Case 3 When I Google for my site in Google Chrome and I click the first link Google will redirect me to a spam site.

Case 4 When I Google for my site in FireFox and I click the first link Google will redirect me to a spam site.

Case 5 When I Google for my site in Internet Explorer and I click the first link Google will redirect me a page that tells me the site is offline.

HELP WHAT TO DO?

I checked the .htaccess but this file is correct. I checked the index.php file but this one is also correct.

What can I do? Hacked or does Google has trouble?

share|improve this question
    
You are hacked. Restore a good backup of your site and update you Joomla installation. –  PeeHaa Jul 17 '12 at 11:57
    
@PeeHaa Yes I am hacked :( I called my provider and he said I am hit by the base64 hack. My provider moved my website to another domain with other passwords. Hopefully it works. –  Bondye Jul 17 '12 at 12:00
add comment

marked as duplicate by John Conde Jul 17 '12 at 17:00

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

2 Answers

up vote 7 down vote accepted

You are definitely hacked, hackers recently have been employing methods which make the site appear normal to a direct user, but when coming from Google will redirect to their website.

You basically need to change all your passwords, and then sift through your code. As your tags state you're using joomla you should be able to replace all the joomla core files with freshly downloaded ones. As for any themes/edits you've made, you'll have to check. Good things to look out for are base64_decode and eval calls. If you're loading templates from the database don't forget to check their too.

TBH in this situation it's normally best to do a fresh install of your CMS and start again just so you can be sure.

If you are on a shared host also notify them of the issue because it could be the fault of another site on your box!

share|improve this answer
    
You are right. In every php file is see eval(base64_decode(); –  Bondye Jul 17 '12 at 11:11
add comment

I agree with Dunhamzzz (although can't comment yet as not enough points).

A search using Bing and Google (even on different TLD (eg, co.uk,.com, .in etc) fails. So, searching for the site from an "unheard of in the west" Chinese site (Baidu) shows it works fine.

Treat as urgent and hope you didn't leave password information in your code.

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.