Is there any way to prevent external sites from linking to me?

Is there any way to prevent external sites from linking to me? Nope. Google has recently flagged this site as "compromised" because some external (link farm?) sites are linking to non-existent query pages on our site. Also nope. You don't get flagged because you're being linked to; you get linked to (and flagged) because you've been compromised.

Don't be so sure your site hasn't been compromised just because the links appear dead when you visit them. I've seen CMS attacks that only deliver the compromised content to the Google Bot (for search ranking purposes) or check cookies so they only deliver compromised content to not logged in first time visitors. Everyone else gets a standard (fake) 404 page. The compromised content could be hidden in a randomly named base64 encoded file hidden who knows where. You can see examples of compromised sites with this google search: https://www.google.com/search?q=site:.edu+cymbalta-overnight-delivery

Is there any way to prevent these external sites from linking to us at all? Since a link is nothing more than a URL referenced in an HTML document, I don't think there's any way to prevent an external site from linking to yours. Sorry. I'd double check to make absolutely sure nothing has been uploaded to your webserver. Scan the entire filesystem for anything that looks weird. any idea what the motivation behind this is, other than to give me a major headache? I'm guessing that something out there thinks it was successful in uploading something to your webserver and it has generated the links as a way of keeping track of the compromise.

http://php.net/manual/en/reserved.variables.server.php you can use something like $_SERVER['HTTP_REFERER'] to get the referring page (not infallible but pretty useful in practice) and also some other similar $_SERVER variables to get the REQUEST_URI and QUERY_STRING. http://stackoverflow.com/questions/165975/determining-referer-in-php Once you have detected those values match something, you can do a number of things from presenting a special page to sending HTTP error messages of various types. You can also so a lot of http://www.htaccess-guide.com/deny-visitors-by-referrer/ - http://stackoverflow.com/questions/5151385/redirect-on-the-basis-of-referer-http-referer-htaccess, http://forums.macrumors.com/archive/index.php/t-961699.html, http://altlab.com/htaccess_tutorial.html.

Google is not incorrect about your site being compromised in some fashion. Involve a professional if you're not sure how to proceed with a proper investigation. If this site is customer facing in any way, or has access to customer data you should proceed with extreme caution.

Chiming in that your site has almost certainly been hacked, and there is a lot of information available by searching for "http://www.google.com/?q=joomla+pharma+hack" but if the advice there seems over your head, I heartily recommend biting the bullet and hiring a professional to do the cleaning, as well as doing a general security review of your site and your hosting environment.

Joining the chorus. I recently went through a Joomla compromise that sounds a lot like this one. I took the time to read through the (base64_enocded) compromise code and it was doing as ChrisHartley suggested: checking to see if the client was a search engine bot or a logged in user before executing. If you're not a capable sysadmin, it will be be hard to do the necessary analysis and cleanup, but one thing you can and should do right now is get a Google Webmaster Tools account, claim the site so you can get reports on it, and request a malware review. When that report comes back, it will include any malicious code found on the page, which might help you narrow down where in the templates the code is being invoked. If you get that far, just keep in mind that removing or cleaning a few suspect files won't necessarily fix things for good. The first Joomla crack I ever encountered left code around that did nothing but check for previously installed malicious code and quietly wrote it back into place.

Get thee to https://www.google.com/webmasters/tools/home?hl=en, register the site, then see what the Googlebot is actually viewing on your site: many injection compromises hide themselves from regular browsers. And then hire a pro to clean it up.

This happened on my Joomla site; turned out the site had been hacked (via SQL injection).