I have a rather old Joomla site http://qlectives.eu running Joomla 1.5.17 (it is not longer in use but I want to keep it available for anyone wanting to look back at it; therefore I don't want to upgrade to 3.x if I can avoid it). Generally it works fine, but I have discovered that http://qlectives.eu/?oem=adobe-incopy-cs5-mac gives a 302 redirection to a site selling fake Adobe products. Obviously I want to stop this, but I have no idea where this redirection is being generated. I've checked the .htaccess file, which looks fine. Where else should I be looking? Is there a known hack that does this?
Really, get that Joomla installation at least up to the latest available release for that series, which would be Joomla 1.5.26 There is also a community patch which fixes a security issue found after Joomla 1.5 went EoL.
After that, make sure to check the whole site for hacked files. Refer to the official documentation what you should do when you detect a hacked site. You can request paid service from MyJoomla or similar services who can clean your site.