When I search for "thelab athome-training" on Google, and click on a link that point to my site (thelab.athome-training.com), I am redirected to http://grooogle.osa.pl

I googled and found that post:

They said:

The site is doing a conditional redirect when the referrer is Google.

So I check .htaccess and index.php, but can't found something. So I replace all the Drupal files with a fresh download, but no change.

I also did:

dnstracer -v thelab.athome-training.com

But evrything looks fine...

Many questions comes in my mind... How did they do that ? Why ? How to found the infected file ? How to prevent this from happening again?


Thank you SkeetOverFlow,

grep -r "eval(base64_decode" *

run from the root of my Drupal install, show my that files from the panel module are infected:

eval(base64_decode("ZXJyb3JfcmVwb3J0aW5nKDAp ...

In all the templates, many times in each file

But the site you link, speak about an issue with php 5.2, and I run php 5.3...

Is it possible that PHP 5.3 is also buggy?

  • 2
    This question has nothing to do with software development, so it doesn't belong on stackoverflow.
    – Dennis
    Oct 1 '11 at 22:12
  • This question involves server administration and would be a better fit for ServerFault, however, in the interest of providing a solution without migrating your question again, I would recommend you review How did they hack my Wordpress sites. Drupal and WordPress are both popular enough to be the targets of automated vulnerability scanners and the same administration principles apply to each application. If you need more info to fix the issue, please comment to request migration.
    – danlefree
    Oct 2 '11 at 1:18

This is an attack by hacker to your .htaccess file. normally it happens if you use old buggy version of PHP like PHP 5.2.x Below link will will help your how to resolve. I suggest updating PHP version.


Good luck!



You have a virus on your computer. There's nothing wrong with your site or the google search result.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.