CODEWITHSUNDEEP
php.htaccessmagentohttp-redirectmalware
Troels Johannesen
Troels Johannesen

Reputation: 725

Magento Hacked 302 Redirect From Google

I have a Magento webshop, which from Search engines redirects to spammy / wrong website.

The original link is http://example.com that redirects to http://www.example2.com/ but only from search engines.

If you enter the link directly in the browser it goes to the site correctly.

So it seem it's hacked and it could be the htaccess file, but there is nothing suspicious in it at all.

The question is then where and how do I find where the possible redirect is made ? Imagine it could be some sort of php code inserted? How do I in an easy find the spammy code doing this redirect?

There is nothing in index.php either.

Upvotes: 1

Views: 654

Answers (1)

hellcode
hellcode

Reputation: 2698

If you request your site without user agent, you will get:

<br />
<b>Notice</b>:  Undefined index: HTTP_USER_AGENT in <b>/var/www/coolslips.dk/public_html/includes/config.php(2) : eval()'d code(1) : eval()'d code(1) : eval()'d code(1) : eval()'d code(1) : eval()'d code(1) : eval()'d code(2) : eval()'d code</b> on line <b>3</b><br />
<br />
<b>Notice</b>:  Undefined index: HTTP_USER_AGENT in <b>/var/www/coolslips.dk/public_html/includes/config.php(2) : eval()'d code(1) : eval()'d code(1) : eval()'d code(1) : eval()'d code(1) : eval()'d code(1) : eval()'d code(2) : eval()'d code</b> on line <b>4</b><br />
<br />
<b>Notice</b>:  Undefined index: HTTP_USER_AGENT in <b>/var/www/coolslips.dk/public_html/includes/config.php(2) : eval()'d code(1) : eval()'d code(1) : eval()'d code(1) : eval()'d code(1) : eval()'d code(1) : eval()'d code(2) : eval()'d code</b> on line <b>5</b><br />
<br />
<b>Notice</b>:  Undefined index: HTTP_USER_AGENT in <b>/var/www/coolslips.dk/public_html/includes/config.php(2) : eval()'d code(1) : eval()'d code(1) : eval()'d code(1) : eval()'d code(1) : eval()'d code(1) : eval()'d code(2) : eval()'d code</b> on line <b>6</b><br />
<script type="text/javascript">window.location.href = 'http://coolslips.dk/errors/report.php?id=1151386284028&skin=default';</script>

So have a look at /var/www/coolslips.dk/public_html/includes/config.php

And have a look at your /news folder. It seems that there a some html files (e.g. /news/A-Lange.html)

Upvotes: 1

Related Questions