Help with hacked site 2.0 RC3

[TeeJay]

I helped set a site up for some friends at www.lfr-wales.co.uk
I've noticed that if accessed by the above URL all seems fine but Google search results point to (CAREFUL WITH THIS FOLLWING LINK, IT RE-DIRECTS) www.lfr-wales.co.uk/index.php

Accessing via the second url results in a redirect to a dodgy site which contains threats

I need to find where this has been compromised and fix it as fast as possible


Any help guys ?

I really need it

Thanks

[Stuck CAPS]

Go into CPanel, or whatever you use to manage your site, go into wherever the redirects are, and delete the redirect to the page it shouldn't go to.

[TeeJay]

Thanks but how do I know where the redirects are ?

I assumed it would be in one of the .php files or in the db ?

[kat]

I don't get redirected.

I'm on your site, Legal Forest Riders, as I type.

I'm on the forum, too, with no hassles.

Opera 10.60.

Both links.

[xenovanis]

Try index.php (in your forum root) first and compare it with the index.php from the installationpackage for 2.0 RC3.

Also, in the file .htaccess, do you see any oddities?

[kat]

As I don't get redirected, maybe your browser's been compromised.

Can you try another?

[TeeJay]

Thanks for the quick responses guys

Now this is getting very strange

I doubt it's my browser as the problem was reported to me by someone else (who I have no connection with)
I checked it for myself and got the same result

WARNING! before following the step below make sure you have your page and virus scanners running...

Do a UK search in Google for "Legal Forest Riders", find the link to the lfr website as above and click it

Changed the index.php file to the original one (before ezportal install) then swapped it back again to the suspect version and the url www.lfr-wales.co.uk/index.php no longer re-directs but the Google link does

[TeeJay]

I don't get redirected.

I'm on your site, Legal Forest Riders, as I type.

I'm on the forum, too, with no hassles.

Opera 10.60.

Both links.

It only happens if you follow the search result in Google

[TeeJay]

As I don't get redirected, maybe your browser's been compromised.

Can you try another?

Yes
It happens in Both Internet Explorer and Firefox

[xenovanis]

I've had something similar. You should report this to Google.

[TeeJay]

Try index.php (in your forum root) first and compare it with the index.php from the installationpackage for 2.0 RC3.

Also, in the file .htaccess, do you see any oddities?

Thanks
I couldn't see anything in the file and don't have a .htaccess file

Weird how after swapping out the file for the orginal and then swapping back again it doesn't happen if accessed directly but still does in the Google results link ?

[kat]

Yeah. Google's been hacked!

[TeeJay]

I've had something similar. You should report this to Google.

It really is odd
I'm reluctant to report it to Google until I can verify that it has nothing to do with the LFR site for fear of Google dropping it out of their searches

[xenovanis]

It's been a while now, I can't quite recall what it exactly was and what I did. Early dementia, I suppose 

Lemme search and think some more for you before you report it. I'll get back on this.

[TeeJay]

Many thanks folks

Yeah
Google hacked 

I reckon that'd get on the international news pretty fast


Damned weird though, still can't figure it

Three seperate people getting the same result on three seperate PC/Macs none of which share any files other than all using the same forum

Does Sherlock happen to be here somewhere ?

[kat]

It Google. No question.

The only thing to do is contact them.

Gawd knows how, though.

Maybe here?

http://www.google.com/support/websearch/bin/request.py?form_type=user&stage=fm&user_type=user&contact_type=privacy&hl=en

[TeeJay]

It Google. No question.

The only thing to do is contact them.

Gawd knows how, though.

Maybe here?

Sorry, I thought you was joking 
Can that really happen ?

[kat]

Not only has it happened, they also got a virus, a while back. As, indeed, did Microsoft.

Just tell them what's happening. That might not be the right place, but you've got to start somewhere.

Your link's fine, so how could it not be them?

Give them a shout. Nothing to lose, ay?

PS. If you want me to check through your files, just in case, PM me some FTP details and I'll get on it, in the morning.

Please, read this, first:

http://www.simplemachines.org/community/index.php?topic=228940.0

[xenovanis]

I really can't remember 

Anyway, see if this is helpfull:
http://googlewebmastercentral.blogspot.com/2009/01/open-redirect-urls-is-your-site-being.html
http://www.google.com/support/webmasters/bin/answer.py?hl=en&answer=93713

[busterone]

Further confirmation. I was not redirected using your link with FF, IE8, nor with Opera. It looks to be Google.