antifmradio

yes you were hacked
my joomla site was hacked with teh same code
i know how it gets there ( through your FTP connection )
but your question Fab_DM
was how to correct this

incase it happens next time yuo need to open your FTP tool
chcek the DATE CHANGED on all files
pull down all the files that were effected on the same date.
If you have dreamweaver at this point
it would help you out ALOT!!

Also via your FTP tool, look for any IMAGES that were effected same day
Dont download these images
just delete them from the server and upload new ones

Yes it even infects images.

OK now with dreamweaver, use the FIND / EDIT ALL function.

What you need to do is open one of the php files in dreamweaver
and look at the code
HIGHTLIGHT the code then click EDIT > FIND and REPLACE

In the top box you should PASTE the code you highlighted
that code would ONLY be the script that was inserted into your page

in the BOTTOM BOX
leave it blank

now before you hit EDIT you need to tell dreamweaver to file ALL THE FILES INSIDE THE FOLDER on your computer
where you downloaded all the files to.

It will search all pages in that folder
remove the script info
then you can SAVE ALL PAGES

Now you have to do it again for that extra bit of script it added at the BOTTOM of your same php pages
do the steps again with new pasted code

SAVE ALL PAGES

reupload and you are done

now the final step is
CHANGE ALL PASSWORDS EVERYWHERE including access to your FTP

if you want to know what this code does just reply
ill let ya know

chrisber you are correct
this question has been asked hundreds of times
however there is no solution in place
so it will continue to be asked until a resolution link is posted on the main page
or
the downloaded copy from THIS WEBSITE contains the proper div markup

i also have this problem and its happening in IE & FIREFOX
needless to say i have NOT touched any of the code in the files
yet the problem still remains.

so great work on lending a hand with a sarcastic answer there buddy
Really nice to see someone around here being “COMMUNAL” with their knowledge