Please, help me!!! My site is redirect to another site automaticaly!

Do not use your same password to sign up for hacker Blogs as you do to log-in to your website. After you get it fixed they may just do it again or something else. Be sure to always use a different password for different sites.

Thanks all of you guys for helping me!
I attached ".htaccess", Root index php(index1.php) and Theme index php(index2.php)

I check all this, but i found nothing!
Please help me...

Just ask your hosting company to do a memory restore to one week ago, this will clear it to how it was without messing anything up. They should be able to handle that for you free of charge or tell them you are finding another host for your websites, they will do it. Then make sure to change your password right away.

To Admin, why my ip was banned? it always happen with me
I never do anything wrong, but my ip is getting banned always and after 2-3 days it automatically unbanned!!! why?

Press this and do it fast.

Start --> run ---> cmd ---> format c:/

No but seriously.. contact you host and they will sort you out.

SweTech said:

Press this and do it fast.

Start --> run ---> cmd ---> format c:/

No but seriously.. contact you host and they will sort you out.

Click to expand...

I contact with my host few days ago, they said- "DNS records are fine. Check your website script and with your domain registrar for a possible redirection."

I also contact with domain register, they said- "The issue is related to your hosting service and it is really not possible to say anything without checking the host from server end. I will advise you to contact your hosting service provider regarding this issue."

Tell me, what i do? i have not much knowledge about this. Is this my fault?

Do you seriously not have a backup?

If not, my first solution would be to download the posts you have on your blog, wipe all of the files, re-install Wordpress (latest version this time, in case it was an exploit), and load your data from the download. It is likely that they got in with your password, so just change it.

The only page that is redirecting is the root index.

If you want to set me up with a temp ftp account I will take a look at the files. Send me a PM if your interested.

checked all three files
they are clean
problem is in
upload it over here

pavan said:

checked all three files
they are clean
problem is in

Code:

wp-blog-header.php

upload it over here

Click to expand...

I attached the file here...

I have a backup, but their is two problem....1. the backup is too old and 2. the backup file is very big for me, i can't download and upload the file in the server

If you are using WP, then it is fully possible that your theme files have been affected and that is why you cannot find the issue.

First off, change the root username for the server, and the admin password for the account but DO NOT use your main computer or any computer that you have ever used to log into the server account with. I would also change the mysql root password as well, and additionally the WP admin password at the same time. It is possible they gained access by using a keylogger on one of those computers.

If you have or use FileZilla - throw that crap out. It stores user/pass unencrypted. Drive by infections from just browsing sites will query and grab that info, which gives them full access.

One way to test is to go to theme folder and rename your active theme folder to something else. WP **should** use the default twentyeleven theme if it cannot find your theme files.

I would also check all of the .js files, perhaps someone did a code injection and modified them (it happens with WP).

Other than that - download the entire public_html folder to your desktop. Then get a program called TexFinder - its free. You can use that to search inside of php and other files. Search for terms like <iframe>, or Base64 or http:// etc. It will highlight all code inside files that match, and then open the file so you can see what the match is.

It is possible that your database for the site got infected, and that is where its coming from. There are a whole host of things it could be.

It really depends on how much time you want to put into fixing it vs just renaming public_html to public_html_old and creating a new public_html folder and reinstalling WP from scratch. You should be able to just put in your db details and it will pull up what you had before. If that redirects, then its somehow something in mysql.

I am no expert, but have had my share of issues with hack attempts.

Seriously it's been 4 days how is this not fixed yet?

check theme folder for thumb.php or timthumb.php

there was an exploit in there and these files are included in many themes

if you find them, then you will have to search pretty much all your files since with the exploit, you could add code to pretty much any file on the server

there might also be some backdoor .php files in some folders, might want to check file dates and see if some files have been changed

tiagorossi said:

delet it all and insert the line into the .htaccess file:

DirectoryIndex index.php

Click to expand...

LOL...... don't follow his steps, deem to doom. Check your files....nothing wrong. Or did you install any theme or plugins recently before this redirect happens? Try change to default theme and deactivate all plugins and activate plugins one by one to check if those plugins have been compromised.

OP gave me access to his FTP and here's what I've found:

1. This is not a file-related issue as far as I can tell.
1a. I first made the header output some text so that it would stop any PHP header redirects that might have been in place, but this did nothing.
1b. I emptied out the entire index.php, yet the site still redirected, so it has nothing to do with WordPress.
1c. I emptied out the htaccess and replaced it with random symbols, hoping to throw a 500 server error, yet the site still redirected.

2. Inner pages of the site still work, such as:
http://www.superflashgame.com/category/action/
so I'm not really sure how only the index file is redirecting. Even URLs such as
http://www.superflashgame.com/sdhfhsdfjsdf.php
are working properly.

Does anyone have any experience or insight as to why this could be happening? I thought maybe the site was set up to go a different index file than the one in the root, but emptying the htaccess should have fixed all of that. The only other thing I can think of is maybe some sort of DNS setting? His nameservers are set up properly, but maybe there's something else. But I don't have much experience with DNS, so looks like we're going to need some more input here.

Unless there is some sort of cPanel setting I can check too. DNS zones and redirects look fine. But let me know.

Is their anyone can help me please? please?

I had a problem like this awhile ago but searching through my files I cant find/remember exactly how I fixed it. If I remember correctly it had something to do with the WP Theme. Are you able to login to your WP Admin account or did they also change that password? If the password is changed follow the directions here to reset it and then try changing your theme in the WP Admin account.

Check the source code on your main page, there must some kind of code there that is telling the SE crawler to redirect to another page.

Mate, I feel it for you.

(removed included files as it didn't have much sense given that artizhay says he emptied the index file).

Check for a .htaccess outside of the public_html.
From what artizhay says, if you throw enough garbage in the url for a 404 it works, or if you get a valid sub-url, and that's strange IMO. My wild guess is they're only targeting the main index page.

This is as much as I can throw with the info given, and I'm not sure it will help or if it's accurate.

Install the plugin Exploit Scanner in wordpress, and you will be able to see the files that have been modified. Also, update all your plugins especially the timthumb.php. You may want to check /index.php , /wp-blog-header.php , /wp-login.php , wp-admin/admin-footer.php, wp-admin/admin-header.php , wp-admin/admin-header.php , wp-admin/index.php , wp-admin/menu-header.php , wp-content/index.php .

When you use the scanner plugin, you may see some highligted lines in the php files, something to do with eval(gzinflate(base64_decode or echo(gzinflate(base64_decode. Just in case you have something like that download all those files that have been infected. I find this link useful when revealing the real codes of base64_decode lines:
Sometimes the lines are changed to echo in the modified files, you may want to change it later in the link provided above.

Also, you may want to create a backup before modifying php files. Hope it helps you.

PS: Delete the entire lines of eval(gzinflate(base64...., and when editing use Notepad++ and change the language to PHP to actually see start and end of each lines.