Ozark Mountain Region SCCA

Posted: **Sat Jan 10, 2015 9:11 pm**

Over the last few day, when I try to access either the forum or the main website, I get redirected to a parked domain. Anyone else having this problem?

Posted: **Sun Jan 11, 2015 9:31 am**

Me too. Usually the first time trying the main page, after that it works alright on the second try.

Posted: **Mon Jan 12, 2015 9:17 pm**

Same here. Had it happen twice in the last week.

Posted: **Tue Jan 13, 2015 10:14 am**

If this happens again to anyone can you please take a screenshot (crtl + Print Scrn) and post the picture here. I have had it a few times happen in the past and just assumed the servers were under maint.

Posted: **Tue Jan 13, 2015 11:23 am**

When being redirected, the URL changes from www.omrscca.org to some HTML code, then switches to the one in the screen capture. I haven't had enough time to select the HTML code to try and dissect it. The only thing I have caught is the word META.

Posted: **Tue Jan 13, 2015 7:50 pm**

Alright, tried on my older computer at home and was able to snag the HTML code that appears just before the redirect in the URL bar:

Code: Select all

data:text/html,%3Chtml%3E%3Cmeta%20http-equiv=%22refresh%22%20content=%220;%20url=http://96e4c3658d4cb4b559057995ae5a382c.com/process/route/82318738.html%22%3E%3C/html%3E

Posted: **Wed Jan 14, 2015 1:23 pm**

Okay, that is definitely not what I have seen in the past. We will look into it when there is some free time.

BTW anyone with webmaster experience that would be willing to help update/moderate please send a PM or email to me.

Posted: **Wed Jan 14, 2015 7:28 pm**

The only info I could find that is similar is this:

https://www.badwarebusters.org/main/itemview/32778

It might be hidden in one of the 100s of PHP files that run the website or something else entirely.

Posted: **Thu Jan 15, 2015 12:11 pm**

Had a friend take a look at the site and he found this:

He says it's not always there (explains why only redirects sometimes). He also wondered what builds the index page?

Posted: **Thu Jan 22, 2015 9:46 pm**

The content management system is Joomla, and not the latest version. We had someone point out a potential malware issue with OMR's Joomla in 2013. Searching redirects and our version turns up similar issues in the Joomla forums. I don't doubt that we're vulnerable.

Perhaps back up the content and replace with a fresh version of Joomla. Or save the text, and scrap it for a newer version or find a CMS that even novices like me can help maintain.

Do we have any server-saavy volunteers in the house?

Posted: **Fri Jan 23, 2015 9:08 pm**

I removed some bad code from the Joomla configuration file, are we still seeing issues?

I am willing to upgrade to the newest Joomla, or help migrate to something like WordPress if desired.

Posted: **Sat Jan 24, 2015 10:08 am**

I was just redirected when I clicked on the bookmark I have saved for the forum. (http://www.omrscca.org/forum/)

Posted: **Sat Jan 24, 2015 10:11 am**

Looks like there are about 3,000 files infected with the code...

Posted: **Sat Jan 24, 2015 10:12 am**

That's impressive.

Posted: **Mon Jan 26, 2015 10:38 am**

I am upgrading the CMS and the forum today... If anyone experiences any issues, feel free to let me know.

Ozark Mountain Region SCCA

Anyone else having problems with being redirected?

Anyone else having problems with being redirected?

Re: Anyone else having problems with being redirected?