Take the 2-minute tour ×
Webmasters Stack Exchange is a question and answer site for pro webmasters. It's 100% free, no registration required.

When I search for "thelab athome-training" on Google, and click on a link that point to my site (thelab.athome-training.com), I am redirected to http://grooogle.osa.pl

I googled and found that post:

They said:

The site is doing a conditional redirect when the referrer is Google.

So I check .htaccess and index.php, but can't found something. So I replace all the Drupal files with a fresh download, but no change.

I also did:

dnstracer -v thelab.athome-training.com

But evrything looks fine...

Many questions comes in my mind... How did they do that ? Why ? How to found the infected file ? How to prevent this from happening again?

Edit

Thank you SkeetOverFlow,

grep -r "eval(base64_decode" *

run from the root of my Drupal install, show my that files from the panel module are infected:

eval(base64_decode("ZXJyb3JfcmVwb3J0aW5nKDAp ...

In all the templates, many times in each file

But the site you link, speak about an issue with php 5.2, and I run php 5.3...

Is it possible that PHP 5.3 is also buggy?

share|improve this question

migrated from stackoverflow.com Oct 1 '11 at 22:21

This question came from our site for professional and enthusiast programmers.

2  
This question has nothing to do with software development, so it doesn't belong on stackoverflow. –  Dennis Oct 1 '11 at 22:12
    
This question involves server administration and would be a better fit for ServerFault, however, in the interest of providing a solution without migrating your question again, I would recommend you review How did they hack my Wordpress sites. Drupal and WordPress are both popular enough to be the targets of automated vulnerability scanners and the same administration principles apply to each application. If you need more info to fix the issue, please comment to request migration. –  danlefree Oct 2 '11 at 1:18

2 Answers 2

up vote 1 down vote accepted

This is an attack by hacker to your .htaccess file. normally it happens if you use old buggy version of PHP like PHP 5.2.x Below link will will help your how to resolve. I suggest updating PHP version.

http://www.question-defense.com/2011/01/08/finditnow-osa-pl-hack-google-search-results-redirect-to-finditnow-osa-pl-instead-of-correct-site

Good luck!

share|improve this answer

http://googleredirectvirus.biz/

You have a virus on your computer. There's nothing wrong with your site or the google search result.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.