Google Search Results Containing Malware

[Cyberthrasher]

Hmmm, don't know if I can update my brand new $150,000 Cisco router without a big change request.

[Beaverslayer]

Well Cyberthrasher don't worry about that big change request, as doing the hard reset on my router did nothing to change the problem.

I've done a complete scan of my computer as well and am still having the redirect happen. At this point, who knows what to do, I'll just keep closing the hijacked window when it happens.

I'm going to send Google a scathing email as well and see if that does any good.....

[Cyberthrasher]

Sounds good, they can probably use it either way

I was just outside smokin and thinkin as I do and my mind kept going back to the fact that it never happens when clicking a link from inside the forum software.....That's definitely the most complexing part.

[Johanna]

Also, when a Google link redirects once, it won't do it a second time on that computer. The link clicks true from then on- after showing the redirect page. There's nothing in the forum software out of the ordinary and I don't think the problem is on our end.

[Cyberthrasher]

I'm doing a lot of searching for "redirected url4short IPB" and getting some results.

Here's a discussion with samples of the code they found on their server. Looks like the admin here tracked it down to a common hole in several different forum packages.

http://forums.odforce.net/index.php?/topic/16575-rss-feeds-link-problem/

[Beaverslayer]

Yes, by reading the discussion on that forum, it seems the Admin found the infected code in some cache files. They stated that the code was fixed, but they had no idea as to how the code got there.

Noted also that it's the same forum software as this forum.

[Cyberthrasher]

Noted also that it's the same forum software as this forum.

That's the main thing I started searching to find it.

[Johanna]

I found a remote mysql % and deleted it, changed all passwords. Let me know if the problem continues.

[Cyberthrasher]

I found a remote mysql % and deleted it, changed all passwords. Let me know if the problem continues.

I just tried a bunch of different times and couldn't get it to happen......fingers crossed.

[hornm]

Although I didn't understand most any of this I'm glad ya'll are on the case. Kind of like an episode of scooby doo

Horn