[SOLVED] Weird PHP Redirect on my Website

[dhowe]

I hope I am putting this in the right forum; I'm totally confused on what the problem is.  I run an EQDKP (php-based mod that allows world of warcraft gamers to track their DKP points) site here: http://www.davidbhowe.net/eqdkp3

 

As you can see, the site is working just fine (news page anyway).  However, if you click on standings on the left, it takes you here:  http://www.davidbhowe.net/eqdkp3/listmembers.php

 

So far so good... however, when the page finishes loading, I get redirected here: http://promotions.zonealarm.com/security/en-us/cdn/zaxs/20090819.htm

 

This happens to a lot of my guild members too, so I know it isn't local to my machine.  My best guess is that a security hole exists in the database or php that has allowed a bot to somehow add in that redirect.  Note, it only seems to redirect some of the time - not always.

 

Anyone have any advice?  I can't seem to find much on google that has proven useful.

 

Thank you!

-David

[ignace]

Check your source code they probably have added javascript which redirects you to that page.

[JonnoTheDev]

You have external scripts included on this page. Probably a javascript redirect.

I would put money on this adserver:

http://ads.allvatar.com/adserver/www/delivery/fl.js

[sKunKbad]

If you use a good text editor, you can set it to search through all of the files in your site, and find the link. Wherever it is, you should be able to find it. If you were hacked, it could be in an include, or even in an .htaccess file.

[dhowe]

That looks like the case - great find on the JS file... I was doing a search for the redirect URL, didn't even think to check includes/etc.

 

Good call, thank you very much!

[strietzel]

I have the same problem.

Please, could you describe how you solved this problem?

I need step by step instructions.

Thanks

[ignace]

I have the same problem.

Please, could you describe how you solved this problem?

I need step by step instructions.

Thanks

 

1. connect to your server

2. open the file in which the redirect happens

3. browse through the source code and look for any code that you did not write

4. if you find nothing then look in the directory for any unknown files (like .htaccess)

5. repeat steps 2-4 for all files and directories until you find any unknown code/file

[JonnoTheDev]

I have the same problem.

Please, could you describe how you solved this problem?

I need step by step instructions.

Thanks

 

1. connect to your server

2. open the file in which the redirect happens

3. browse through the source code and look for any code that you did not write

4. if you find nothing then look in the directory for any unknown files (like .htaccess)

5. repeat steps 2-4 for all files and directories until you find any unknown code/file

This isn't the problem. The script causing the redirect is an external file (from another url) as an include. It was included at the top of the page (advertising revenue). Look at my previous post. Just remove any includes to scripts that are not on your domain.

[ignace]

Oh I thought they had been hacked and they added malicious code.