More on the Redirect - Where did it start ?

Just So You Know...
I am the target of  some stupidity presently.
Why ?Well when you find out, tell me because I am not enjoying
finding 5 Websites All Hit With the same Redirect Bug.

I am working as fast as I can; Blogsite by site to change the templates
and try to find the bad file and fix it.  when you find an index.php
file which has been tampered with - you know that it's not your fault.

This is the work of some very small minded person,
and I hope that they see this and understand that I am
sending them ten times the karmatic energy that they sent to me.

Yes You Ass - Ten Times to You Anything YOU Wish To ME.

hopefully I will have my sites all cleaned up by tomorrow and reopened.

Please know that whatever this is - I have nothing to do with it.

I have more facts to add to the picture

this all started yesterday from the log
this is where the first site sent me   //www.city-facts.com/q.php?affiliate=eclickbuy-timeppc&source=abc&query=Fast%20Easy%20Loan&adword=%7CFast%20Easy%20LoanABCYP - q.php

http://www.city-facts.com/q.php?affiliate=eclickbuy-timeppc&source=abc&query=Fast%20Easy%20Loan&adword=%7CFast%20Easy%20LoanABCYP

Very Interesting since I never searched for anything loan related.

ooookkkkkk,,, next on the history list is this site which followed next in the history list

//www.addresses.com/redirect.php?ReportType=44&refer=2467&qbc=Fast&geoIP=1&adword=eclickbuy-timeppc%7CFast%20Easy%20Loan

aaahhhhhh again we see this Fast Easy Loan.  the referal and affiliate info are shown so that gives us something to work with when we contact these companies.  oh certainly we will be contacting them.

then we hit this site which seems to be the referring site to these sites listed above - a spamhouse no doubt.
look at this - Yellowpages.. aaahhh we're getting somewhere now. they have money, so filing a claim against them is possible. ;)


//www.addresses.com/yellow-pages/category:Fast/location:Clinton+Township,MI/listings.html?PHPSESSID=76b5eed2d039df6e6e5bd173cd5745ae


This is the site which starts the chain of events - this is where we think it originally started, but it's hard to say as this site is non reachable directly. even blocking them in my browser didn't stop the redirect. Deep..

//www.asklots.com/jump2/?affiliate=eclickbuy&subid=timeppc&terms=fast%20easy%20loan

Again we have this eclick to buy business and fast easy loan. Get It ? I Do.

Somewhere on my surfing adventure I picked up this lil friend - so All My Friends are now being mistreated by these mischieveous assholes. not nice at all.

//www.asklots.com/jump1/?affiliate=eclickbuy&subid=timeppc&terms=fast%20easy%20loan&sid=Z571044078x8VNxQjMwUzX5gTOfRjMfhTMx8FN0gDO5MDO0ITM&a=rpyvpxohl&mr=1&rc=0&tr=Z451044342@AHaw5CajJXYlN3Lt92YuQWZlZ2ajlGbjV2LvoDc0RHa

Something tells me that if I keep looking I'll locate the source of this Whole Problem...
Hmmmm, what do you think - should we keep looking ?  I Think So,

//hegeeks.com/blogging/best-free-wordpress-theme-flexibility-theme.html

Ah Ha ! we downloaded a theme the other nite when we couldn't fix a problem with ours. well the trail starts there to the outside. this is after I was done dropping so I am basically ruling out any of the sites I visited on my card dropping on Wednesday 07/22/09.

so one way or another this must be the source of the start of the problem.
it spread someway from our editing and writing to each of the blogs we worked on.
Strange Indeed.  we shut down greasemonkey tonite to find out which pages are effected.
the redirect is on this page still - but all the others seem to be free of it.

tonite I change this template as I've already done of my three other effected blogs. yes three.. so you know there was no time for dropping, or writing. just working on this mess.

I also think something in our browser is connected to this as well.

PLEASE - If You were Redirected When you got here, Please Leave Me A  Commentand that will tell me how it's effecting my visitor count, and if others are having this problem still, since I cleaned up my page twice in the last 24 hrs.