Very, very strange malware. Please help me

[scorcher]

Hello
Sory for my grammar, but english insn't my native language. I'm from Poland.

I have very, very strange type of malware. This thing works only from links from google/facebook, only few times per hours/days. I haven't this alert (!), but my users told me that I have virus on site.

Now:
1. please go to google, type "sportowa zgora" and go to sportowa.zgora.pl (no direct, from google!)
or
2. go to: https://www.facebook.com/sportowazgorapl and click one of link to my site

You will have virus alert and redirect to adultfinder. Now the most interesting this. You will have this only once! If you try do this second, third... time, you will have clean site.

I don't know why. Maybe I'm not expert in security, but I tryied everything. EVERYTHING! Every tutorial from "site hack", download site and scan, clamscan nad maldet on my VPS. EVERYTHING and nothing found. I search eval, base64_decode, gzipdeflate... NOTHING

Please help me because I haven't any ideas

[numinousmedia]

It's been my experience that scanners like the ones you've tried will not always find infections. Just because these scanners don't report finding an infection, doesn't mean it isn't there. This sort of Google/Facebook redirection hack is pretty common, especially with Joomla 1.5 sites.

You need to follow the directions located here: http://forum.joomla.org/viewtopic.php?f=432&t=475313

It's time consuming and tedious, but the process does work.

[leolam]

Visit myjoomla.com to make your life easier

Leo