[Forum] Problem with Conditional Redirect

[CaptainBlue]

I've done a recent upgrade to vb 4.2.0 Patch Level 1 and I've checked out the suspicious files, etc. but whenever anyone accesses the forum from a search on Google, etc. or from their webmail, they get redirected to http:// minkof. sellclassics .com/

The site is at zrxocboard.com - try Googling it for yourselves and then try accessing directly.

I've had a look at the main PHP files for suspicious eval code but can't find anything and as I said, vBulletin doesn't seem to have any issues. I've also checked the .htaccess file as well.

Any ideas?

[Trevor Hannant]

Have you checked all your plugins and made sure that you knwo what they are. All plugins should tie into a relevant Product - if there's anything that doesn't, double check it and remove if you don't know what it is.

[CaptainBlue]

Yep. Done that and the only plug-in/product left is vBAdvanced which again is the latest version.

[CaptainBlue]

Any other advice?

[Matthew Gordon]

Here's a good post for checking for malicious code: https://www.vbulletin.com/forum/show...=1#post2245651

You can also try running this script which can clean up infected templates if they were edited directly in the database.

[CaptainBlue]

Done all that. Everything comes up fine. Still getting the redirects from Google to minkof. sellclassics .com

[TheLastSuperman]

Done all that. Everything comes up fine. Still getting the redirects from Google to minkof. sellclassics .com

This is pretty much a compiled version of several useful posts from over time, you'll see some thing Matthew listed here as well - https://www.vbulletin.com/forum/cont...vBulletin-Site

The only other thing I can think of is... it's something they have hidden within your datastore... not 100% sure though but they have hidden something since it keeps acting this way. Please use the guide above and ensure you have ran the tests thoroughly .

[CaptainBlue]

Done all of those. Still redirecting.

[Matthew Gordon]

Make a support ticket with access to your site so it can be looked at more closely.