Weird redirect when accessing from Google???

[TERRA Operative]

I've been noticing a weird redirect thing happening when accessing the forums from a Google search. It happens the first click, but when you close the tab and try again, it links to the correct Toymods page.

The URL it links to is http://ad.leadbolt.net/ or similar (Don't click on it) but because I have noscript and adblock etc, I personally don't see anything anyway.


Just letting you guys know..

[greywolf]

Check your pc throughly.

[TERRA Operative]

My PC gets checked on at least a fortnightly basis, using multiple methods, and it is currently coming up clean.

It *only* happens with Toymods, no other site ever does it.

[blankspace]

A quick search on "url123 redirect" (the page that the redirect takes you to) points out it might be a vBulletin security issue.

virus redirect url123.info - vBulletin.org Forum


Same issue as in thread here > http://www.toymods.org.au/forums/for...-toolbars.html

[blakeg]

yeah its a toymods issue. only happens on toymods for me . and pc is clean

[knightrous]

Happens to me as well on both Mac and Linux systems. I run the No Script plug in on FireFox and it stalls the webpage from doing it's XSS shit. Not just toymods though, seen a few other pages I've tried to access from google do the same thing.

[Lambolica]

We are aware of this, and it appears that the recent update as of friday night didn't fix it.

If you are affected I would suggest clearing your cookies for Toymods. Thou I doubt this will help.

Cheers
Simon

[BLK_20v]

It is a server side infection, not a client one...

The vbulliten patches stops you from getting infected, but once you are infected you need to clean it manually

[Lambolica]

Yes, it is Sever side, yes there was a manual sweep done.

Will be looking at this closer again today.

Cheers
Simon.

[greywolf]

Just wanted to clarify I only said to check your PC because it's the first thing you need to confirm has been done.

I hadn't encountered the problem myself since I've been using my PC (with auto complete for the URL) so I didn't need to go to Google to find Toymods.

Anyone who has experienced the problem seen an resolution yet ?

[BLK_20v]

Nup it is still broken... if you go back though you get to toymods without the redirect.

The vbulliten patch you applied was it...

Latest version available: 4.1.11 Patch Level 1

[ShutoMax]

happens here sometimes

[Lambolica]

The Latest was 4.1.11 + the patch over that done Thursday of last week.

My guess is that the issues on the server haven't yet been fully cleansed in all the files.

Just to clarify for everyone, the issue is when clicking a link from a google search result, the search is redirected to an alternate site a % of the time (10-50% of searches). Whilst there are cookies involved, the cause is a script that has been placed in the server through a weakness in the vbulletin code somewhere, not a virus on your computers. The script appears to be mostly harmless at this stage other than what is contained on the site(s) that one is redirected to. That being said it is an inconvenience, and based on how the script is placed in the server suggests a potential threat.

Cheers
Simon

[Sam]

Although the server was patched, I found a nasty bit of javascript hiding in one of the database tables... I've removed it so hopefully the issue is resolved. There is another update available so I'll try and apply that later on tonight.

sam

[Impurist]

Pretty sure that URL123 site is trying to perform drive-by download attacks against the browser when you go there. :/ I've seen another car forum start redirecting in the last week or two too.