Google redirects only one site to Antivirus 2009

By JeffFinnan
Jul 19, 2008
  1. When I do a Google or Yahoo search for SEMCTO, it redirects to AntiVirus 2009. This is with IE and Firefox. If I put in the actual link, it goes right to there. I ask someone else to check this and she reported back that the same think occurs for her.

    Now I manage that site and loaded up one powerpoint document about a month ago. I have not changed anything else on it. It was only by chance that I got lazy and Googled SEMCTO> All my computers at home show this redirect. I quickly threw in my old router and the redirect was the same. I wanted to see if the router was infected. A week and a half ago, I had problems with Antivirus 2008 and had to reinstall windows on one of my machines.

    Any ideas? This seems different from all that I have looked at about Google redirects. Any dare try to do the SEMCTO search on Google to see if they get the same result.

    In any case, I have attached my HijackThis.log

  2. xxdanielxx

    xxdanielxx TS Rookie Posts: 1,069

    I did not see anything bad in your log. Can you rename hijackthis to crusty

    C:\Program Files\Hijackthis\HijackThis.exe

    then past a shortcut to your desktop and attach a fresh log
  3. JeffFinnan

    JeffFinnan TS Rookie Topic Starter Posts: 24

    Did as suggested.

  4. JeffFinnan

    JeffFinnan TS Rookie Topic Starter Posts: 24


    :grinthumb Okay. Figured this one out. The site was hacked. If someone did a search on semcto, it would redirect to a site that would plant a cookie as well as direct you to Antivirus 2009. It did it by changing the .htaccess file on the site. It had these lines in it:

    RewriteEngine On

    RewriteCond %{HTTP_REFERER} .*google.*$ [NC,OR]
    RewriteCond %{HTTP_REFERER} .*aol.*$ [NC,OR]
    RewriteCond %{HTTP_REFERER} .*msn.*$ [NC,OR]
    RewriteCond %{HTTP_REFERER} .*altavista.*$ [NC,OR]
    RewriteCond %{HTTP_REFERER} .*ask.*$ [NC,OR]
    RewriteCond %{HTTP_REFERER} .*yahoo.*$ [NC]
    RewriteRule .* h..p:// [R,L] (added note: I removed tt so that it would not hyperlink.)
    Errordocument 404 h..p://

    Since I manage this site I was able to remove the offending lines. A colleague of mine actually owns the site and I have left it to her to bug iPower about this. I will monitor to see if it gets changed again. It looks like it occurred only a few days ago. It looks like iPower has had this problem for some time.

  5. jojobojo

    jojobojo TS Rookie

    Hi JeffFinnan,
    I have the same issue, can you tell me where on the website do you go to find the .htaccess file. it is from within your site or from google side?

    I can not find that .htaccess any where in my website.

  6. kimsland

    kimsland Ex-TechSpotter Posts: 14,524

  7. JeffFinnan

    JeffFinnan TS Rookie Topic Starter Posts: 24

    It may have to do with how you have set up your host directory in something like Dreamweaver. You can also find it using the Cpanel from your host.

  8. kimsland

    kimsland Ex-TechSpotter Posts: 14,524

    Note my above post, was in response to another post that is now removed (someone needing help with AV2009 removal)

    Anyway, thought I'd say, you should check out: Blocking Unwanted Parasites with a Hosts File I use it on my computer

    Regarding .htaccess file on a web server, it would be nice if someone gives more detail
Topic Status:
Not open for further replies.

Similar Topics

Add New Comment

You need to be a member to leave a comment. Join thousands of tech enthusiasts and participate.
TechSpot Account You may also...