A new variation of the Viagra hack has emerged.

It has affected both Joomla 1.5 and Joomla 2.5

The cause may not be a result core Joomla 2.5 (1.5 no longer supported as of Fall 2012)

Hack Description

The hack creates hidden URL on your site, example: www.yourdomain.com/buy-generic-viagra

Removal of Hack

Edit .htaccess, locate and remove these lines:

RewriteRule image.php - [L]
RewriteCond %{REQUEST_METHOD} (GET|POST)
RewriteCond %{SERVER_PORT} 80
RewriteCond %{REQUEST_URI} !(login|auth|register|secure|admin|image.|config.|include) [NC]
RewriteCond %{HTTP:servers} !(true)
RewriteCond %{REQUEST_URI} (corestemsw|ialis|iagra|cachecontrl) [NC]
RewriteRule ^.*$ /templates/system/images/image.php [L,NC]

Also remove the file: /templates/system/images/image.php

Removal URL from Google

Your URL will still be index by Google. Use Google Webmaster Tools and submit a request to remove the mentioned URL.

Your next action:

Upgrade to latest Joomla 2.5/3.x immediately. As well as upgrading all 3rd party components, unpublishing any unused components.

Hire an affordable Joomla expert

For your free, no obligation estimate please contact us today.