Anyone else having problems with being redirected?

Motorsports banter, suggestions, ideas, and general armchair racing.

Moderators: flogger, SilverYota, JimR, Thorox

User avatar
craigb
Posts: 142
Joined: Mon Jul 14, 2008 10:44 pm
Location: Asbury, MO

Anyone else having problems with being redirected?

Post by craigb » Sat Jan 10, 2015 9:11 pm

Over the last few day, when I try to access either the forum or the main website, I get redirected to a parked domain. Anyone else having this problem?
Craig

Don
Posts: 10
Joined: Sat Feb 11, 2012 9:54 pm
Location: Mansfield MO.

Post by Don » Sun Jan 11, 2015 9:31 am

Me too. Usually the first time trying the main page, after that it works alright on the second try.

User avatar
JimR
Posts: 1204
Joined: Mon Jul 24, 2006 12:56 pm
Location: Rogers, AR

Post by JimR » Mon Jan 12, 2015 9:17 pm

Same here. Had it happen twice in the last week.
Jim Rowland - Your friendly OMR volunteer at large
'92 Sentra SE-R / '15 FR-S / '04 Silverado HD

User avatar
SilverYota
Posts: 501
Joined: Tue Mar 11, 2008 7:03 pm
Location: Springfield, MO
Contact:

Post by SilverYota » Tue Jan 13, 2015 10:14 am

If this happens again to anyone can you please take a screenshot (crtl + Print Scrn) and post the picture here. I have had it a few times happen in the past and just assumed the servers were under maint.
Matt Longpine
'88 MR2

User avatar
craigb
Posts: 142
Joined: Mon Jul 14, 2008 10:44 pm
Location: Asbury, MO

Post by craigb » Tue Jan 13, 2015 11:23 am

Image

When being redirected, the URL changes from www.omrscca.org to some HTML code, then switches to the one in the screen capture. I haven't had enough time to select the HTML code to try and dissect it. The only thing I have caught is the word META.
Craig

User avatar
craigb
Posts: 142
Joined: Mon Jul 14, 2008 10:44 pm
Location: Asbury, MO

Post by craigb » Tue Jan 13, 2015 7:50 pm

Alright, tried on my older computer at home and was able to snag the HTML code that appears just before the redirect in the URL bar:

Code: Select all

data:text/html,%3Chtml%3E%3Cmeta%20http-equiv=%22refresh%22%20content=%220;%20url=http://96e4c3658d4cb4b559057995ae5a382c.com/process/route/82318738.html%22%3E%3C/html%3E
Craig

User avatar
SilverYota
Posts: 501
Joined: Tue Mar 11, 2008 7:03 pm
Location: Springfield, MO
Contact:

Post by SilverYota » Wed Jan 14, 2015 1:23 pm

Okay, that is definitely not what I have seen in the past. We will look into it when there is some free time.

BTW anyone with webmaster experience that would be willing to help update/moderate please send a PM or email to me.
Matt Longpine
'88 MR2

User avatar
craigb
Posts: 142
Joined: Mon Jul 14, 2008 10:44 pm
Location: Asbury, MO

Post by craigb » Wed Jan 14, 2015 7:28 pm

The only info I could find that is similar is this:

https://www.badwarebusters.org/main/itemview/32778

It might be hidden in one of the 100s of PHP files that run the website or something else entirely.
Craig

User avatar
craigb
Posts: 142
Joined: Mon Jul 14, 2008 10:44 pm
Location: Asbury, MO

Post by craigb » Thu Jan 15, 2015 12:11 pm

Had a friend take a look at the site and he found this:

Image

He says it's not always there (explains why only redirects sometimes). He also wondered what builds the index page?
Craig

User avatar
JimR
Posts: 1204
Joined: Mon Jul 24, 2006 12:56 pm
Location: Rogers, AR

Post by JimR » Thu Jan 22, 2015 9:46 pm

The content management system is Joomla, and not the latest version. We had someone point out a potential malware issue with OMR's Joomla in 2013. Searching redirects and our version turns up similar issues in the Joomla forums. I don't doubt that we're vulnerable.

Perhaps back up the content and replace with a fresh version of Joomla. Or save the text, and scrap it for a newer version or find a CMS that even novices like me can help maintain.

Do we have any server-saavy volunteers in the house?
Jim Rowland - Your friendly OMR volunteer at large
'92 Sentra SE-R / '15 FR-S / '04 Silverado HD

User avatar
Thorox
Posts: 79
Joined: Wed Apr 23, 2014 8:18 pm
Location: Mulberry, Kansas
Contact:

Post by Thorox » Fri Jan 23, 2015 9:08 pm

I removed some bad code from the Joomla configuration file, are we still seeing issues?

I am willing to upgrade to the newest Joomla, or help migrate to something like WordPress if desired.
______________
Jay Hodges
'94 Springfield Dyno built Miata * '95 Prelude
Image

User avatar
craigb
Posts: 142
Joined: Mon Jul 14, 2008 10:44 pm
Location: Asbury, MO

Post by craigb » Sat Jan 24, 2015 10:08 am

I was just redirected when I clicked on the bookmark I have saved for the forum. (http://www.omrscca.org/forum/)
Craig

User avatar
Thorox
Posts: 79
Joined: Wed Apr 23, 2014 8:18 pm
Location: Mulberry, Kansas
Contact:

Post by Thorox » Sat Jan 24, 2015 10:11 am

Looks like there are about 3,000 files infected with the code...
______________
Jay Hodges
'94 Springfield Dyno built Miata * '95 Prelude
Image

User avatar
craigb
Posts: 142
Joined: Mon Jul 14, 2008 10:44 pm
Location: Asbury, MO

Post by craigb » Sat Jan 24, 2015 10:12 am

:shock: That's impressive.
Craig

User avatar
Thorox
Posts: 79
Joined: Wed Apr 23, 2014 8:18 pm
Location: Mulberry, Kansas
Contact:

Re: Anyone else having problems with being redirected?

Post by Thorox » Mon Jan 26, 2015 10:38 am

I am upgrading the CMS and the forum today... If anyone experiences any issues, feel free to let me know.
______________
Jay Hodges
'94 Springfield Dyno built Miata * '95 Prelude
Image

Post Reply

Who is online

Users browsing this forum: No registered users and 6 guests