Good time of day! I have a question, there is a site made on Joomla link to the site . When you open the site, after 20-25 seconds it is sent to the site http://algerie-service.com/ads/ ... I searched almost everywhere on the Internet, tried to disable JavaScript in the browser did not help, I searched the altyntaraz.kz files - these are words , without result ... in .htaccesse also did not find anything (Help please ... wait

  • one
    why did you search for something on this (algerie-service.com) site? Problem to look for on your site. Do you have access to the source code of the site algerie-service.com? - KryDos
  • On my site, of course, I was looking for a problem ... altyntaraz.kz - on this site ... I have the source code. - Daniyar Artykov
  • So. Well, it's like looking for a needle in a haystack. Go grep through the files looking for the word "Refresh". grep -ri 'Refresh' путь/к/корню/сайта I think there are many lines. You need something like: header("Refresh: 12; URL = $url") - KryDos
  • > I looked in the files algerie-service.com ride) @KryDos + - Palmervan
  • Corrected the question) Palmervan ATP) @KryDos thank you very much, now I will look for ... - Daniyar Artykov

1 answer 1

Solutions:

  • look for modification in js files sorry missed the moment from the topic
  • look for modification in php in the form of eval (base64_decode ('there are a lot of letters'));
  • eliminate modification
  • here also see a discussion of the reasons for hashcode.ru/questions/192593 though you probably have a hole in joomla - zb '15
  • Thanks :) was the second option, really respect you guys, that quickly responded, and helped solve the problem))) it will be necessary to update the joomla version and change all passwords to more reliable ones. - Daniyar Artykov