Weird Redirect on Site

[norb]

Lately a few of us have been noticing that when we go to the norbsoftdev home page, we get auto redirected to google. It just started recently and there have not been any site changes. It does not happen in IE, but most of the others. If anyone has any info on this we would be very appreciative.

[roscrans]

I use FireFox most to the time. I had no problem with being redirected to Google until I installed the Google Tool Bar in firefox. Until I installed the tool bar, I could type in norbsoftdev in the address bar and firefox would autofill the rest of the address and take me there. Now, when I type anything less than the full address in the address bar, Google shows up with a search screen for norbsoftdev.

Hope that helps since I haven't found a way to get rid of this annoying feature.

[norb]

I think that I found and fixed it. The template that we use was hacked. I do not know how. But it looks like it was trying to get search hits to another site. Actually, the site seems much faster now

[Chamberlain]

norb wrote:

I think that I found and fixed it. The template that we use was hacked. I do not know how. But it looks like it was trying to get search hits to another site. Actually, the site seems much faster now

Norb,

The site does seem to move quicker now !



Chamberlain

[norb]

After using the site for a few days, I see how much that hack was slowing it down. It's a huge difference for me. It was a clever hack, but I don't know how they did it. They modded one of our files and inserted another one. How they got access to the server is beyond my knowledge. But now I'm a little smarter about this and know where to look if the site starts to slow down again.

[Michael Slaunwhite]

Hi.

I never have never been redirected, but I did experience a critical error when trying to access your site yesterday. I never got the error code to send to you, I was too quick with the mouse.

later!

[norb]

They did it again!!! Ran the site tonight and it asked to install a cookie from an ad site so I knew something was wrong. It was the same hack, so it was easy to fix. But how the heck are these guys gaining access to our web pages?

[Marching Thru Georgia]

Norb wrote:

But how the heck are these guys gaining access to our web pages?

Most likely, the server's been hacked.

[norb]

Only lr and I have ftp access to the entire site. I have a pretty strong pass and I assume lr does too. I thinks it a Joomla hack. I've been doing some searching on it. You can tell it's happened if you view the source of the home page and see unescape or unecrypt eval, javascript. It's very quick to clean up now. I see other joomla sites with the same problem. So it's a weakness in joomla probably that I have to discover.

[Marching Thru Georgia]

Norb:
Google, Joomla backdoor. Plenty to read.