Q:

Is "seolink" a virus?

On my site there is a script after the body tag, both on frontend and adminhtml. I can't find where it is included:

It adds links in the header. Has anyone seen this?

A:

What this is:

a black hat SEO technique: these links are moved out of the visible area using JavaScript, to trick search engines

What it is not:

a virus

What it can be, given you did not add the code yourself:

the result of a hack
something, a malicious extension or theme developer added

If you did not find the code in your files and database, it's probably obfuscated. Search for "base64_decode" and "eval" in your code base and you probably find the source.
If it is from an extension or theme, compare the code with the originally downloaded files to see if it has been added by the developers or by a hacker afterwards.
If the code is already in the original files, you are lucky under the circumstances: your server has not been compromised. But you should remove the extension/theme because it cannot be trusted.
Otherwise, please refer to What should you do with the hacked installation?

