Weird Computer Question

[gottaluvlasers]

Hey gene-

i have that hitman pro. I am running:

AVG (paid version) for internet security. Malwatre bytes, Search and destroy, Hitman pro and now TDSSKiller (which was talked about on a forum specifically for this problem) and *every single* one of those programs finds ZILCH!!! Nada!! nuttin!!

Obvioulsy, today it is back. i tried it this morning and got redirected. 1 and 1 "Tech Support" is about as useful as talking to a brick wall. the "barely speak my language" tech support person just kept reading scripts to me and finally after 46 minutes, send she will investigate the problem and email me. LOL...yeah, ok.

I *REALLLLY* need to figure this out. its bad!!!

-Marc

[White-Light]

I'm sure this is google related or malware specifically on your site. If it was general browser malware then other searches for people would result in re-directs to the search heaven site, whereas this seems to be specific to your site.

[T0mmm]

I just clicked a link to your website now from a google search, and it redirected me briefly through searchhaven to the following:
http://tdsstdstds.org/in.cgi?30&parameter=ct+lasers (note people, do NOT click this link as the domain tdsstdstds.org is bad!!!

doing a google diagnostics search came up with this; http://google.com/safebrowsing/diagn...dsstdstds.org/ (safe to click)

this was using google.co.uk, and my browser is chrome. i thought maybe some other people may be able to use this info to help you out! can't you look at the HTML code of your site (as it looks on your host server) and see if there are any malicious additions to it? but thats my novice guess. im sure flecom/etc knows a lot more than me

good luck!!

Tom

[flecom]

I'm sure this is google related or malware specifically on your site. If it was general browser malware then other searches for people would result in re-directs to the search heaven site, whereas this seems to be specific to your site.

ya but if you examine the google page its redirecting to www.ctlasers.com, nothing weird... and the searcheven site is stealing the referrer string and using it as part of their "search"

this is definitely a 1and1 thing... you could look for another host? PM me if you want to go via that route

[Phredy1]

I don't know enough about source code to decipher this, but after I got redirected (again today) I opened the redirected page's source code in Firefox.

I can't save the page with the same info showing, but here is a screencap of what the page source code showed me. Maybe this will be of some help.

The bottom 2 highlighted lines are interesting.

Gene

[swamidog]

i wonder if a compromise has taken place on your virtual server....

[flecom]

i wonder if a compromise has taken place on your virtual server....

ya thats pretty much my best guess... i went through some things on the site with Marc and I am fairly certain someone got in either via Word Press or the OSCommerce shopping cart (latter is more likely I think)

bastards

[gottaluvlasers]

with the help of frank (THANK YOU Frank!!)

i *did* find some weird shit on the server. i deleted it out of one of the directories, and lets hope that this may have fixed it!!

if you guys could clean out your cache and temp internt files and try again, it would be GREATLY appreciated!

Do a search (google, bing) and click my name under the search results and *pray* that i dont have the re-direct in there.

Thanks again everyone for your help and advice! you guys seriously are the best!

-Marc

[swamidog]

cool! you've just saved me some work. i'm currently downloading a copy of marc's site to go through the source code.

i'll keep a cache for a couple of days. if it looks like the problem is gone, i'll just dump it. if not, let me know and i'll start grepping through it for anything weird.

ya thats pretty much my best guess... i went through some things on the site with Marc and I am fairly certain someone got in either via Word Press or the OSCommerce shopping cart (latter is more likely I think)

bastards

[heroic]

I checked and it's not Google's doing. It's sending the browser to ctlasers.com same as always. Unfortunately the server is going somewhere weird. It is either:

- a DNS poisoning attack
- a domain hijack
- a misconfigured/rooted server

but it's definitely not Google; the Google cache still has the real site.