When I search for "thelab athome-training" on Google, and click on a link that point to my site (thelab.athome-training.com), I am redirected to
I googled and found that post:
The site is doing a conditional redirect when the referrer is Google.
So I check .htaccess and index.php, but can't found something. So I replace all the Drupal files with a fresh download, but no change.
I also did:
dnstracer -v thelab.athome-training.com
But evrything looks fine...
Many questions comes in my mind... How did they do that ? Why ? How to found the infected file ? How to prevent this from happening again?
Thank you SkeetOverFlow,
grep -r "eval(base64_decode" *
run from the root of my Drupal install, show my that files from the panel module are infected:
In all the templates, many times in each file
But the site you link, speak about an issue with php 5.2, and I run php 5.3...
Is it possible that PHP 5.3 is also buggy?