In the past two weeks I have been wrestling with the so called “Google Redirect Virus’. Yes you can Google this phrase and find many blogs of people in the same situation. All these blogs talk about how to remove this in Windows. But I am Linux guy. How did this thing get in my Ubuntu Linux?
Well! I do think the whole thing started with me. I do have computers here that are running Windows and are on the Internet. I just recently installed an anti-virus software and scanned the system. It found 255 cookies related to web browsing.
What does this virus or malware look like? if you search on your website, cast-cebu.org, then click on the link, you get redirected to a completely different site. The mouseover link shows a very long URL with many parameters. Other sites have a direct URL to the site. I search for many days on this Google redirect thing and find no solution that makes sence. They all say the problem is on my computer. Lets look at the evidence.
1. Different search engines show the same behavior.
2. Different browsers show the same behavior.
3. Different computers show the same behavior.
4. Different sites show Different behavior. For me, my site is infected, others are not.
The problem has nothing to do with Google. This is not the Google Redirect Virus. All the other search engines exhibit the same behavior. Nothing to do with my computer or browser. So the problem must be else ware. Maybe my website host, a dns server, my website or my local router.
I do have a dhcp(Dynamic Host Configuration Program) server and DNS(Dynamic Name Server) router installed on my Linux box. I need this because I host a local Dynamic IP website. URL http://tetra-wonderland.dlinkddns.com I use this to communicate to my customers and try out new programs I write. Anyway I checked this all out looking for recent changes via a changed date codes on the files. Found nothing. My connection to the Internet is via a cable modem. The modem has no configurations to set. I strike out there. Going further back in the chain, I change the my DNS default Internet name server. The problem is still there. Only one more thing to check, my site. But what could be the malware on my site and how would it get there?
I now go back to Google and search on ‘hosted website malware’. I run into a post that explains a malware that is encoded into all php files. This is code at the beginning of each <?php tag. It looks something like this ‘eval(base64_decode’(Google this phrase). It is then followed by a long list of characters that make on sense. Yes! I found the code string in all my site PHP files. Now I download the complete website. I manuals edit each PHP file with Bluefish and removed the malicius code. That fixed the problem, but is it the final cure? How do I know that I got all files clean.
Today I Google more about removing the eval malware and find web site you can pay to remove malware. Sites with Linux code to auto remove the code string and sites to check if you are infected. I now think I have learned enough that I am smarter than the bad guys that infected my site. Mmmm! Can I reserve my judgment on that statement. I may want to change it later. I still need to know is how the perpetrators got into my website?