Odd redirect behaviour

CodyG · Posted: Sun Aug 31, 2008 9:26 pm

In six years of cms stuff I've never seen this issue.

Our computer club website ....
open IE go to the website, and get redirected to Google.ca!
This doesn't happen using Firefox.
It doesn't happen on my own noteboook pc, but it does on all the clubhouse computers.
The error IE throws is: Internet Explorer cannot open the Internet site

Only registered users can see links on this board!
Get registered or login to the forums!

Operation aborted.

I thought maybe some disgruntled former webmaster had been mucking with the meta.php file, but I looked, not luck there.

In the system control panel, when I look at the site (before dns) it looks just fine.

And in firefox it looks just fine.

Any ideas why this might be happening?

Thanks.

evaders99 · Posted: Sun Aug 31, 2008 9:35 pm

Another reason could be the redirect it done in .htaccess
A lot of malicious activities are happening where .htaccess is used to redirect Google search activity to other sites

CodyG · Posted: Sun Aug 31, 2008 9:43 pm

hmm... seems to me the .htaccess has disappeared! I replaced it with a default from the new svn, until I find the backup on my old machine ... no luck bringing back the site. This is soooo odd.

CodyG · Posted: Mon Sep 01, 2008 8:38 am

I found the backup .htaccess on my old computer and put it on the problem site and the site still redirects to google.ca. As the problem isn't a problem on our test domain, nor with firefox, there must be something else. It feels like a hack. I tried googling illegal redirect to google ... but came up with little. We don't have any google ads things on our site.

Anyone with any more ideas of where I should be looking for this thing?

Susann · Posted: Mon Sep 01, 2008 9:14 am

A link to your site would help us to check this behavior.
There are 1.890.000 search results for Operation aborted IE on Google.

You can tell me the site name also via PM and I let you know what I found.

CodyG · Posted: Mon Sep 01, 2008 10:52 am

I'll do that Susann. Thanks! The email I sent via the site's Groups ...

Suddenly, some members, using Internet Explorer on Vista, on some systems, who are trying to access our website at bbc.org, are getting redirects to google.ca! Firefox, and other browsers, are not affected. Niether are a dozen other, intimatley known by me, websites, with the same CMS (Content Management System). They all work just fine. Our test site doesn't have this issue either. However, our production may have been modified.

I have been working this issue on several fronts, since last night when I returned from some vacation. After much googling ... I've got the IE issue narrowed down to a likely javascript error, or not. :{ Or, it could be something entirely different.

I'll find it eventually, but atm it is confuddling issue, without just cause.

Susann · Posted: Mon Sep 01, 2008 11:55 am

Well I don´t use Vista and I didn´t saw any strange behavior when I visited your site with IE 7. Just make sure everything is valid and there are no spaces before the opening tag.
Maybe someone can check the site with Vista and IE.

Unit1 · Worker Joined: Oct 26, 2004 Posts: 134 Location: Boston

Need the link to the site and I can test it in vista

CodyG · Posted: Tue Sep 02, 2008 3:21 pm

Well... I've got everyone at my computer club completely stumped. Resolving the site doesn't depend on o/s or browser. Some xp/IE systems work fine. Some don't. Some Vista/IE systems work fine, some don't. But some computers, particularly at our clubhouse, will not resolve our domain no matter what browser, including google's new browser chrome, linux linx, firefox or IE.

Our other domain, sharing the same IP, works just fine on all systems. So I did this test...

I renamed index.php to index_bak.php and installed an index.html in the root. It was a simple file, some text between body tags. Now, the domain resolves just fine without the redirect to google.ca. But, as soon as a replace the index.html file with the index.php file, then the redirect happens again.

So, I've now gone from thinking this was some arcane dns issue to rethinking this is some script issue. Anyone heard anything ever like this? Could it be a crack? All my files, like index.php, header.php, theme.php and even mainfile.php look just fine, but I might be missing something. Where do I look now?

Guardian2003 · Posted: Tue Sep 02, 2008 3:32 pm

Your a smart lady so I am going to assume you have checked index.php , mainfile.php etc for empty whitespace before and after the opening/closing php tags in those files.

In an earlier post you thought the root htaccess had disappeared so replaced it with a known entity, that pretty much rules out a htaccess redirect and would in any case explain why it only affects some users.

You have ruled out specific browser/OS combinations so that really only leaves us with one common element untested and that is the user IP or referrer.

Is it possibly there is something you might have set and forgotten about in NS that might be causing a redirect based on IP, referrer etc?

CodyG · Posted: Tue Sep 02, 2008 4:45 pm

Yes, I've been looking at index files, mainfile, theme files... for anything odd. But no files have had changed dates either. Would the whitespace issue cause the inconsistency of results this problem is displaying? ie: firefox doesn't mind white space but IE doesn't like it?

Thanks Guardian... hmm, NS issue it is unlikely, as all the webteam has been on holiday for a couple of weeks and this suddenly started only a couple of days ago. But as soon as I get home in a half hour, where I can access the site on my xp and one of my vista machines, I'll check it out.

CodyG · Posted: Tue Sep 02, 2008 7:08 pm

The only redirects I have going on in NS are to google.com, not google.ca And those are block redirects. There is no indication that the IPs effected are blocked, in fact, I know they are not blocked.

There are some issues... <br> instead of <br /> particularly in the older parts of code that were imported into custom modules. So, I'm going to clean up those 72 errors tonight. But could compliancy issues cause this problem? If one computer can't access the site at one location ie: clubhouse, but the same computer has no problem accessing the site at home... I just don't know. I'm completely confuddled and the website is just about useless to it's members, the majority use IE.

This really is becoming the most ornery computer problem I've had in 15 years of pushing pixels.

After fixing some <br> tags, I'm going to start deactivating blocks and modules ... stay tuned.

Any further thoughts or ideas are appreciated.

montego · Posted: Wed Sep 03, 2008 6:18 am

I wonder if your computer club's ISP has a compromised proxy? It just doesn't make sense that the same computer works in one location and not the other without it being something specific to that network.

Compliance problems are completely unrelated I believe. Also, just a side note, if the actual server is compromised, someone can change the date/timestamp back to the original value so that it doesn't look like it was tampered with. It would be best to compare the actual code. But, at the same time, that would require local account access.

wHiTeHaT · Posted: Wed Sep 03, 2008 11:32 am

could it be the .host file in windows?
a virus or whatever sended from your computerclub inside an email what also corrupted, your members pc ?

a hijack this scan, could might bring some light in the dark.
And simplest way to test is put all files of your site inside a folder called for example BAD
and upload a new raven or a simple nuke or just a html , and see what your browser does , like that you can ensure yourself it isnt the site... or it is.
Atleast it give you a direction to the problem.

Grtzz wHiTeHaT

[EDIT]ok... i readed you uploaded a simple index.html to see if got re directed , i missed that message.. sorry.
So..i come to conclusion it must be inside your distro.
unless you also try to upload a simple index.php , but i doubt it will redirect