title: Expression Engine Site hacked - Locate redirect
body: <p>I have an Expression Engine website of I try to clean up. The database has been given many new users so it seems the database has been hacked / links added. One mayor issue is that the site when clicked in Google is being bypassed. All visitors are being redirected to another website. Here is the search : <a href="http://tinyurl.com/72nzutj" rel="nofollow">http://tinyurl.com/72nzutj</a> . First site is the one in question.. The site they are redirected to is <a href="http://sweepstakesandcontestsinfo.com/nl-in.php?nnn=555" rel="nofollow">http://sweepstakesandcontestsinfo.com/nl-in.php?nnn=555</a> 
  I have been trying to find this redirect in all files and the database, but I have had no luck. It is not a .htaccess redirect, that I have checked and confirmed. But I have not been able to locate a JScript or PHP redirect in the files nor database as of yet.. Probably well hidden because of a base64 or packed encryption. Ideas?</p>
  
  <p>NB no clean database version available</p>