SE chain redirections

[polonus]

See: SE visitors redirects on npo-bazalt dot ru

Chain of redirects found:

to: htxp://jbtconsultinggroup.com/components/com_user/views/login/tmpl/1/all3.php
jbtconsultinggroup.com is reported by Google as suspicious
56 sites infected with redirects to this URL

to: htxp://alfsystem.com.my/includes/domit/1.php
alfsystem.com.my is reported by Google as suspicious
827 sites infected with redirects to this URL

to: htxp://www.csra.de/includes/domit/1.php
www.csra.de is reported by Google as suspicious
346 sites infected with redirects to this URL

to: htxp://google.ru
42 sites infected with redirects to this URL

Sucuri scan has the redirection there also covered neatly

Site needs updating Joomla CMS, that is outdated.
Joomla Version 1.6.x     for: htxp://npo-bazalt.ru/language/en-GB/en-GB.ini 

ISSUE DETECTED     DEFINITION     INFECTED URL
Internal Server Error   php-error-headers-already-sent   htxp://npo-bazalt.ru/index.php
Internal Server Error   php-error-headers-already-sent   htxp://npo-bazalt.ru/index.php/o-nas
Website Malware   mw-redirection121?v3   htxp://npo-bazalt.ru/index.php/o-nas/obshchaya-informatsiya
Website Malware   mw-redirection121?v3   htxp://npo-bazalt.ru/index.php/o-nas/nasha-tsel
Internal Server Error   php-error-headers-already-sent   htxp://npo-bazalt.ru/index.php/o-nas/nasha-strategiya
Website Malware   mw-redirection121?v3   htxp://npo-bazalt.ru/index.php/o-nas/kontakty

Known javascript malware. Details: http://sucuri.net/malware/php-error-headers-already-sent
<b>Warning</b>:  session_start() [<a href='function.session-start'>function.session-start</a>]: Cannot send session cookie - headers already sent by (output started at /wXw/npobazal/www/htdocs/includes/defines.php(1) : eval()'d code:4) in <b>/wXw/npobazal/www/htdocs/libraries/joomla/session/session.php</b> on line <b>462</b><br />

polonus

[polonus]

Se redirection and suspicious code on site: http://killmalware.com/perlgate.com/#
Detected HTTP redirection to htxp://javsiu.ru/in.cgi?5.
SE visitors redirects
Visitors from search engines are redirected
to: hxtp://javsiu.ru/in.cgi?5
48 sites infected with redirects to this URL
Sucuri's confirms:
ISSUE DETECTED   DEFINITION   INFECTED URL
Website Malware   malware-entry-mwht291?v18   http://perlgate.com/404javascript.js
Website Malware   malware-entry-mwht291?v18   http://perlgate.com
Website Malware   MW:HTA:7   http://perlgate.com
Known javascript malware. Details: http://sucuri.net/malware/malware-entry-mwht291?v18
Location: htxp://javsiu.ru/in.cgi?5
Going to IP I get Site Temporarily Unavailable

We apologize for the inconvenience. Please contact the webmaster/ tech support immediately to have them rectify this.
error id: "bad_httpd_conf"  ( DreamHost) -> http://sameid.net/ip/173.236.180.63/  95 domains on one and same IP
cgi vulnerabilties to be handled: http://wiki.dreamhost.com/Troubleshooting_Hacked_Sites

polonus