Absurd probloem in theme - URL redirection problem

[techinspiration]

Hi!
In my forum http://www.techinspiration.in I'm using Bean SMF theme and before that I have used RGBB Curve theme. Now the problem is when someone or me clicks on an external link, its being redirected by another site.
For example, you can click any one from Our Partners block on Portal Left Side. The url will seems like this:

http://www.kehalim.com/aff?u=http://www.jobinformative.info/&r=597654&p=6195171

Now, this has been started from using RGBB Curve theme and spread-ed to all themes!
I don't know whether other users who are using RGBB Curve has noticed it or not!

Please, can anyone please tell me how to remove this?

[xenovanis]

How did you set up that block? As for the links, it seems that these are generated by some sort of affiliate addon?

[techinspiration]

How did you set up that block? As for the links, it seems that these are generated by some sort of affiliate addon?

no, I dont have any affiliation. I have just placed the link as

Code Select Expand

<a href="http://jobinformative.info">Job Informative</a>
Even the members and my signatures are also doing the same!

[Joker™]

i just dropped by this thread

http://www.techinspiration.in/index.php/board,1.0.html << are you using any kind of url rewritting (hope this helps you xenovanis)

[techinspiration]

i just dropped by this thread

http://www.techinspiration.in/index.php/board,1.0.html << are you using any kind of url rewritting (hope this helps you xenovanis)

No, I ain't!
One more update is that, my idea is wrong that its caused by RGBB Curve theme, bcoz just now I tested on XAMPP and its worked normal!


Any idea?

[xenovanis]

i just dropped by this thread

http://www.techinspiration.in/index.php/board,1.0.html << are you using any kind of url rewritting (hope this helps you xenovanis)

Thanks Joker Are you referring to the 1.0.html part of that url? That is generated by enabling the option for queryless urls.

I dount this is a theming or even an SMF issue. This site is an affiliate site: http://www.kehalim.com/. I'm wondering if external links in your posts are modified as well?

In addition, what sort of hosting do you have?

[techinspiration]

I'm fully confused with your question xenovanis!

what sort of hosting do you have?

I'm using WebHostingWorld.Net for hosting!

[xenovanis]

I was wondering if the affiliates were an extra of a free hosting service. Apparently not.

I noticed you switched to the default theme and the problem remains. You might want to setup a fresh install without mods on that very same server and see if this behaviour of external links continues. If not, it's most likely a mod problem.

What mods do you have installed?

[techinspiration]

Yes, I have already thought that thing!
So, I took a backup yesterday and then install a fresh version on XAMPP and restore that backup to there. But problem still exists!
About mods, SImple portal, Advertisement Management, Default avatar, pm to new members,6 Custom buttons / tabs with Sub Menus (4) and auto keywords mods. But his is not caused by mods because recently I have run again the large upgrade package of rc3 (before publishing of rc4), but the problem remains same.

In this issue,  I want to tell you that on 31st August my site was hacked!
http://www.simplemachines.org/community/index.php?topic=398498.0

[techinspiration]

Well, I found the root of the problem!
Auto Keywords 1.4 is creating this problem.
Today I upgraded to RC4 then I was testing with each mod and after installing Auto Keywords, I got the error again!
Now I'm going to upgrade once again and don't know whether It will solve the problem or not!

[techinspiration]

No, its not solved after upgrading with large upgrade package again!

What to do now?

[xenovanis]

Check your file .htaccess to see if there is anything odd there.

In addition, apart from SMF, do you have any other scripts running on your domain?

After that hack, did you simply replace your files or did you remove the old ones from the server first?

[techinspiration]

No, there is no add lines in my .htaccess file.
I have one more script running on the same hosting account, wordpress. But that doesn't have any type of problem!
Here is the address: http://blog.techinspiration.in

About the hack, that time the hacker has only modified the Index.php file so I have replaced the index.php file from one of backup.

In addition to that, I would like to say that, if I uninstall all mods then the signatures are not redirecting in that way, but after installing a single (any one) mod, its started. I have checked Settings.php file also and tried restore_settings.php but problem is the same! Even I haven't found any code with that URL in the index.php file!

[Alex' Manson]

heres something, remove ALL FILES,
upload FRESH files.

install mods except the mod that caused the problem,
don't use that mod.

-Skander.

[techinspiration]

heres something, remove ALL FILES,
upload FRESH files.

install mods except the mod that caused the problem,
don't use that mod.

Thats a good idea but its a long process!

[xenovanis]

You might want to start by searching the database and your files on server for the word "kehalim".

[techinspiration]

You might want to start by searching the database and your files on server for the word "kehalim".

Okay, I'll check that and report soon...

[Deaks]

techinspiration, do you still need assistance?

[techinspiration]

techinspiration, do you still need assistance?

Yes, I need...
The problem is still unsolved...

[Deaks]

did you find kehalim in the db or files?