Resolving a security issue with my private virtual server

Question

When I search for "thelab athome-training" on Google, and click on a link that point to my site (thelab.athome-training.com), I am redirected to http://grooogle.osa.pl

I googled and found that post:

They said:

The site is doing a conditional redirect when the referrer is Google.

So I check .htaccess and index.php, but can't found something. So I replace all the Drupal files with a fresh download, but no change.

I also did:

dnstracer -v thelab.athome-training.com

But evrything looks fine...

Many questions comes in my mind... How did they do that ? Why ? How to found the infected file ? How to prevent this from happening again?

Edit

Thank you SkeetOverFlow,

grep -r "eval(base64_decode" *

run from the root of my Drupal install, show my that files from the panel module are infected:

eval(base64_decode("ZXJyb3JfcmVwb3J0aW5nKDAp ...

In all the templates, many times in each file

But the site you link, speak about an issue with php 5.2, and I run php 5.3...

Is it possible that PHP 5.3 is also buggy?

Answer 1

This is an attack by hacker to your .htaccess file. normally it happens if you use old buggy version of PHP like PHP 5.2.x Below link will will help your how to resolve. I suggest updating PHP version.

http://www.question-defense.com/2011/01/08/finditnow-osa-pl-hack-google-search-results-redirect-to-finditnow-osa-pl-instead-of-correct-site

Good luck!

Answer 2

http://googleredirectvirus.biz/

You have a virus on your computer. There's nothing wrong with your site or the google search result.