misc.php question

[scottct1]

Hi there,

Over the last week users searching on Google and clinking on links at Google to my site have been getting redirected to MyFileStore.COM.

For the past 5 days I have been working with Sucuri.net trying to get rid of this thing... They combed my server and database and have not found anything... however I finally got a clue... and it appears that the redirect is being called by misc.php with the complete call being misc.php?v=420g=js.

My question is how do I find what its calling? I can't find and 420g anywhere. if I go to the fill url in my browser it takes me to the Smilie List.

I removed the misc.php and in doing that stopped the redirect.

So how do I find what 420g is and where its being called?

[AliMadkour]

Do you've vBSeo ? Make sure that you've latest updated version,

Also have a look at :

http://www.vbulletin.com/forum/forum/vbulletin-4/vbulletin-4-questions-problems-and-troubleshooting/389819-vbulletin-3-x-and-4-x-redirect-security-exploit

[Stubbed]

Meh.