In the past week alone we've had two clients reach us about their site being hacked.
The hack injected numerous "Buy Viagra" links into their websites right below the tag. The hack only displays for User Agent Googlebot, that means if you are using Fiirefox or Internet Explorer you will not see these links when viewing the source code, only Chrome.
Upon further investigation, comparing site and original Joomla 1.5.x source code we've located the file to be located in:
