# Google redirect issue

**URL:** https://forums.speedlife.net/t/google-redirect-issue/268939
**Category:** Network Information
**Created:** [April 7, 2014, 8:24am UTC](https://forums.speedlife.net/t/google-redirect-issue/268939 "2014-04-07T08:24:24Z")
**Posts on this page:** 20
**Page:** 3

<div class="post-metadata">

### Author: ![LZ1](https://avatars.discourse-cdn.com/v4/letter/l/7ab992/32.png) [@LZ1](https://forums.speedlife.net/u/LZ1)
#### Post date: [December 28, 2014, 8:02am UTC](https://forums.speedlife.net/t/google-redirect-issue/268939/41 "2014-12-28T08:02:38Z")

</div>

The DoS attack and NYSpeed actually infecting people with malware are two separate issues

---

<div class="post-metadata">

### Author: ![TradersBASE](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/tradersbase/32/5321_2.png) [@TradersBASE](https://forums.speedlife.net/u/TradersBASE)
#### Post date: [December 28, 2014, 8:09am UTC](https://forums.speedlife.net/t/google-redirect-issue/268939/42 "2014-12-28T08:09:16Z")

</div>

Yall shouldn’t have posted links to The Interview. Now we must all pay.

---

<div class="post-metadata">

### Author: ![Motocrossx23](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/motocrossx23/32/5120_2.png) [@Motocrossx23](https://forums.speedlife.net/u/Motocrossx23)
#### Post date: [December 28, 2014, 8:27am UTC](https://forums.speedlife.net/t/google-redirect-issue/268939/43 "2014-12-28T08:27:07Z")

</div>

TBH, unless you’re interested in buying a siqqq vintage cycle or checking out Drew’s build, this site has died. I remember logging in and having two pages of threads to read and now it’s nothing more than a craigslist dumping ground. It’s sad, because this used to be awesome.

---

<div class="post-metadata">

### Author: ![LZ1](https://avatars.discourse-cdn.com/v4/letter/l/7ab992/32.png) [@LZ1](https://forums.speedlife.net/u/LZ1)
#### Post date: [December 28, 2014, 9:06am UTC](https://forums.speedlife.net/t/google-redirect-issue/268939/44 "2014-12-28T09:06:51Z")

</div>

> [@Motocrossx23](#):
>
> TBH, unless you’re interested in buying a siqqq vintage cycle or checking out Drew’s build, this site has died. I remember logging in and having two pages of threads to read and now it’s nothing more than a craigslist dumping ground. It’s sad, because this used to be awesome.

Everyone is busy posting about mini vans and home builds.

---

<div class="post-metadata">

### Author: ![bing](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/bing/32/7211_2.png) [@bing](https://forums.speedlife.net/u/bing)
#### Post date: [December 28, 2014, 11:42am UTC](https://forums.speedlife.net/t/google-redirect-issue/268939/45 "2014-12-28T11:42:37Z")

</div>

we’re all growns up

---

<div class="post-metadata">

### Author: ![NYstanger](https://avatars.discourse-cdn.com/v4/letter/n/6a8cbe/32.png) [@NYstanger](https://forums.speedlife.net/u/NYstanger)
#### Post date: [February 8, 2015, 7:00pm UTC](https://forums.speedlife.net/t/google-redirect-issue/268939/46 "2015-02-08T19:00:23Z")

</div>

So now I google nyspeed and it directed me to boobies!

---

<div class="post-metadata">

### Author: ![ProgRocker](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/progrocker/32/5434_2.png) [@ProgRocker](https://forums.speedlife.net/u/ProgRocker)
#### Post date: [February 8, 2015, 10:59pm UTC](https://forums.speedlife.net/t/google-redirect-issue/268939/47 "2015-02-08T22:59:50Z")

</div>

That sounds like a good problem to have

---

<div class="post-metadata">

### Author: ![LZ1](https://avatars.discourse-cdn.com/v4/letter/l/7ab992/32.png) [@LZ1](https://forums.speedlife.net/u/LZ1)
#### Post date: [March 6, 2015, 6:54am UTC](https://forums.speedlife.net/t/google-redirect-issue/268939/48 "2015-03-06T06:54:46Z")

</div>

> **[Vbulletin myfilestore hack - Find the traces and remove them](https://club.myce.com/t/vbulletin-myfilestore-hack-find-the-traces-and-remove-them/304794)**
>
> For our Myce members - This post is to inform fellow Vbulletin owners with information from a hack we suffered from. This should not have affected our users. We have been working hard together with fellow forum owners in solving a redirection...

If you guys can’t fix it I know a guy who does security stuff

---

<div class="post-metadata">

### Author: ![bing](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/bing/32/7211_2.png) [@bing](https://forums.speedlife.net/u/bing)
#### Post date: [March 6, 2015, 6:58am UTC](https://forums.speedlife.net/t/google-redirect-issue/268939/49 "2015-03-06T06:58:45Z")

</div>

price please…

srsly

---

<div class="post-metadata">

### Author: ![bing](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/bing/32/7211_2.png) [@bing](https://forums.speedlife.net/u/bing)
#### Post date: [March 6, 2015, 4:13pm UTC](https://forums.speedlife.net/t/google-redirect-issue/268939/50 "2015-03-06T16:13:34Z")

</div>

> [@LZ](#):
>
> [http://club.myce.com/f20/vbulletin-myfilestore-hack-find-traces-remove-them-332219/](http://club.myce.com/f20/vbulletin-myfilestore-hack-find-traces-remove-them-332219/)
> 
> If you guys can’t fix it I know a guy who does security stuff

srsly… need fixed ASAP… this is redic…

had like 10 people all over me about this today

---

<div class="post-metadata">

### Author: ![TradersBASE](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/tradersbase/32/5321_2.png) [@TradersBASE](https://forums.speedlife.net/u/TradersBASE)
#### Post date: [March 7, 2015, 6:03am UTC](https://forums.speedlife.net/t/google-redirect-issue/268939/51 "2015-03-07T06:03:50Z")

</div>

It’s def not a good look to leave it be. Considering LZ’s been harping in this on & off for quite some time…shocked it’s only 10 people and they took this long to bitch.

---

<div class="post-metadata">

### Author: ![Onyx\_Z32](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/onyx_z32/32/7581_2.png) [@Onyx\_Z32](https://forums.speedlife.net/u/Onyx_Z32)
#### Post date: [March 7, 2015, 11:15am UTC](https://forums.speedlife.net/t/google-redirect-issue/268939/52 "2015-03-07T11:15:02Z")

</div>

It’s been fixed several times but keeps coming back.

If this was your basic vB forum setup we’d probably be rid of it by now.

We have this as well as other projects out for bid and we’ll find a fix eventually.

---

<div class="post-metadata">

### Author: ![TradersBASE](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/tradersbase/32/5321_2.png) [@TradersBASE](https://forums.speedlife.net/u/TradersBASE)
#### Post date: [March 7, 2015, 11:17am UTC](https://forums.speedlife.net/t/google-redirect-issue/268939/53 "2015-03-07T11:17:39Z")

</div>

It was interesting reading through all the diagnostic stages in that thread LZ posted. Seems like a pretty persistent bunch of MF’s hitting Vbull sites.

---

<div class="post-metadata">

### Author: ![Onyx\_Z32](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/onyx_z32/32/7581_2.png) [@Onyx\_Z32](https://forums.speedlife.net/u/Onyx_Z32)
#### Post date: [March 7, 2015, 11:23am UTC](https://forums.speedlife.net/t/google-redirect-issue/268939/54 "2015-03-07T11:23:20Z")

</div>

I’m personally frustrated with vB in general. If it wasn’t this it would be something else it seems.

---

<div class="post-metadata">

### Author: ![LZ1](https://avatars.discourse-cdn.com/v4/letter/l/7ab992/32.png) [@LZ1](https://forums.speedlife.net/u/LZ1)
#### Post date: [March 7, 2015, 11:52am UTC](https://forums.speedlife.net/t/google-redirect-issue/268939/55 "2015-03-07T11:52:22Z")

</div>

If you want me to take a look and tell you what needs to be secured let me know I will have free time in a week.

---

<div class="post-metadata">

### Author: ![ProgRocker](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/progrocker/32/5434_2.png) [@ProgRocker](https://forums.speedlife.net/u/ProgRocker)
#### Post date: [March 9, 2015, 4:27am UTC](https://forums.speedlife.net/t/google-redirect-issue/268939/56 "2015-03-09T04:27:51Z")

</div>

> 1. This hack is done by adding malicious code into one of the existing plugins in the manager; you will have to physically go through each plugin and see if malicious code has been appended (usually at the bottom, scroll all the way down).

> 1. This hack can be done by adding a brand new plugin containing malicious code.

> \*NOTE! The code is typically encoded and appears like a bunch of random ascii characters - (it’s base64 multiple)

> 1. HTACCESS your admincp panel - there are multiple guides for this, here is one - or you can ask your ISP to do it for you;[http://www.elated.com/articles/passw…with-htaccess/](http://www.elated.com/articles/password-protecting-your-pages-with-htaccess/)

So from the google results, the first page it goes to is .\content.php  
Avast picked up the redirect issue before I even clicked the link.

Sounds like some injected code in a plugin somewhere.

---

<div class="post-metadata">

### Author: ![TradersBASE](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/tradersbase/32/5321_2.png) [@TradersBASE](https://forums.speedlife.net/u/TradersBASE)
#### Post date: [March 9, 2015, 5:51am UTC](https://forums.speedlife.net/t/google-redirect-issue/268939/57 "2015-03-09T05:51:10Z")

</div>

> [@ProgRocker](#):
>
> So from the google results, the first page it goes to is .\content.php  
> Avast picked up the redirect issue before I even clicked the link.
> 
> Sounds like some injected code in a plugin somewhere.

[http://club.myce.com/f20/vbulletin-myfilestore-hack-find-traces-remove-them-332219/](http://club.myce.com/f20/vbulletin-myfilestore-hack-find-traces-remove-them-332219/)

Read that thread LZ posted…it was interesting how the participants worked through the breach.

---

<div class="post-metadata">

### Author: ![ProgRocker](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/progrocker/32/5434_2.png) [@ProgRocker](https://forums.speedlife.net/u/ProgRocker)
#### Post date: [March 9, 2015, 6:03am UTC](https://forums.speedlife.net/t/google-redirect-issue/268939/58 "2015-03-09T06:03:15Z")

</div>

Was the OP in that an actual security guy? The steps don’t seem that methodical (not that they have to be).

They keep referencing “hackers” which I think is a bit misleading. I’m not really sure a guy sitting behind a desk somewhere is pulling all the strings on your forum. Seems more like a driveby exploit.

---

<div class="post-metadata">

### Author: ![LZ1](https://avatars.discourse-cdn.com/v4/letter/l/7ab992/32.png) [@LZ1](https://forums.speedlife.net/u/LZ1)
#### Post date: [March 9, 2015, 6:35am UTC](https://forums.speedlife.net/t/google-redirect-issue/268939/59 "2015-03-09T06:35:52Z")

</div>

VBSeo and a few other things are vulnerable to code injection.

tgpsr or whoever can keep removing the injected code but until you mitigate whatever vulnerability is being leveraged it’s going to keep happening.

It would be nice to see the web server logs and see what modules/etc the forum is running.

---

<div class="post-metadata">

### Author: ![Onyx\_Z32](https://yyz2.discourse-cdn.com/flex034/user_avatar/forums.speedlife.net/onyx_z32/32/7581_2.png) [@Onyx\_Z32](https://forums.speedlife.net/u/Onyx_Z32)
#### Post date: [March 18, 2015, 10:21am UTC](https://forums.speedlife.net/t/google-redirect-issue/268939/60 "2015-03-18T10:21:41Z")

</div>

Alright it SHOULD be fixed. Anyone care to test it?

![http://vignette4.wikia.nocookie.net/sims/images/e/e4/Small_pet_-_Guinea_Pig.png](http://vignette4.wikia.nocookie.net/sims/images/e/e4/Small_pet_-_Guinea_Pig.png)

[Previous page](https://forums.speedlife.net/t/google-redirect-issue/268939.md?page=2)

[Next page](https://forums.speedlife.net/t/google-redirect-issue/268939.md?page=4)
