• Announcements

    • IPS BIENNIAL - SARAWAK / SINGAPORE JUNE 12-19   01/23/2016

      STILL TIME TO REGISTER!!
      Don't miss this opportunity to hike through natural forest areas of Borneo to see palms in habitat led by expert guides. Experience the culture and cuisine of this exotic Southeast Asian country with fellow IPS travelers.
      In Singapore you'll experience the world's largest covered garden, Gardens by the Bay, and tour the venerable Singapore Botanic Garden. 
      You must be an IPS member to register, so sign up today. For more information click HERE (For more info of past biennials and member experiences see the BIENNIAL FORUM on Palmtalk.)   One of the exotic palms of Borneo
    • NEW FORUM - PALMS IN POTS   01/23/2016

      CHECK IT OUT BELOW I think it is self explanatory - it's right below the COLD HARDY PALMS FORUM.

Redirected from Google search??

49 posts in this topic

Hi Mods.

I have this intermittent issue. If I do a google search from their webpage and click one of the various palmtalk links it gives me, it will redirect me to a different site- same site every time.

BUT! It only happens every now and then. Maybe a couple times a month with my amount of computer usage. Let's say I only get redirected like 3-5% of the time.

I keep pretty up to date on my computer, spyware, antivirus, general maintenance, etc.. I can't say that it's NOT my computer, but I'm relatively certain it is not. I'm well aware of malware that redirects on a more regular basis. I have no other re-direct issues whatsoever (or malware, as far as I know)

What puts up a red flag for me is that this ONLY happens on Palmtalk links, and it's only occasionally. And it always takes me to the same site. Sorry, I did not get the site on this incident, but I will remember and take note the next time it happens. Will post that next time.

It is always the same, takes me to some advertisement website with a popup window of some sort. I never read any of it. I just always hit the back button, re-click on the same palmtalk link and this website loads up the second time around.

I wonder if anyone else has had this sort of issue? Is there such thing as some sort of nusiance "parasite" website leeching on the palmtalk server? Am I just spinning plates?blink.gif

Well, thanks.

0

Share this post


Link to post
Share on other sites

i get the same problem when i google palmtalk. Most of the links are spammy

0

Share this post


Link to post
Share on other sites

This was a problem in the past, but was supposedly fixed about 4-6 weeks ago. Has this happened to you since then? And, do you regularly clear your cache? If not, please clear your cache and let me know if it happens again - and as you mentioned - save the URL of any site you are redirected to with any other info that would be pertinent.

0

Share this post


Link to post
Share on other sites

http://url123.info/e875cd64

Popup window appears with following message and no apparent way to close:

"Please complete a survey from our sponsors below to view this content.

Save Over $500 a Year on Car Insurance!

Find Out How to Save on Car Insurance!

Upgrade to Internet Explorer 9!

Download and Play The Brain Game!

This website has been temporarily locked. In order to unlock it, you must fill out one of the surveys above completely. These surveys take approximately 30 seconds to 1 minute to complete. After a survey is completed, you will have access to all content on this site for 24 hours."

The main page is greyed out, but I can read a heading: "URL 123, Chopping long links smaller...etc etc... Then above what looks like a full page of print, "Link is missing

This link does not exist yet or it has been removed for some reason." Then there is what appears to be an article about Windows.

Off the upper right-hand corner of the window is a ? (not an x to close the window) Clicking on that takes you to another popup:

http://www.dollarade.com/overlay_help.php

"

How Does This Work?

This website requires you to complete a short offer in order to view their content.

Completing an offer is simple:

1.Click the link of an offer that interests you. There will be 1-4 offers listed in total you may choose from.

2.Fill out the offer using your real information and continue until you reach the last page.

3.Enjoy your content which will be automatically unlocked! It may take up to 30 seconds to validate.

If the content is still locked after 30 seconds, please try a different offer from the list.

Close this window"

I found this by searchin on Google for "Butiagrus" which listed several PT links, and I clicked on one from January 2012.

I had to close the browser window. Now I will clear my cache and see what happens...

0

Share this post


Link to post
Share on other sites

After clearing my cache, then going to Google and clicking on the same link, it took me directly to the PT thread. Clearing cookies and cache seems to solve the problem.

0

Share this post


Link to post
Share on other sites

I clear my cache pretty regularly and this redirect just happened maybe yesterday. I think I cleared my cache maybe two days ago.rage.gif

Like I said though, It's not too big a deal for me, I just hit "back" and it clears; but I just wanted to bring it up in case it was a problem for Palmtalk in general.

I will be vigilant and report all findings!indifferent0025.gif

0

Share this post


Link to post
Share on other sites

http://url123.info/e875cd64

Popup window appears with following message and no apparent way to close:

"Please complete a survey from our sponsors below to view this content.

Save Over $500 a Year on Car Insurance!

Find Out How to Save on Car Insurance!

Upgrade to Internet Explorer 9!

Download and Play The Brain Game!

This website has been temporarily locked. In order to unlock it, you must fill out one of the surveys above completely. These surveys take approximately 30 seconds to 1 minute to complete. After a survey is completed, you will have access to all content on this site for 24 hours."

The main page is greyed out, but I can read a heading: "URL 123, Chopping long links smaller...etc etc... Then above what looks like a full page of print, "Link is missing

This link does not exist yet or it has been removed for some reason." Then there is what appears to be an article about Windows.

Off the upper right-hand corner of the window is a ? (not an x to close the window) Clicking on that takes you to another popup:

http://www.dollarade.com/overlay_help.php

"

How Does This Work?

This website requires you to complete a short offer in order to view their content.

Completing an offer is simple:

1.Click the link of an offer that interests you. There will be 1-4 offers listed in total you may choose from.

2.Fill out the offer using your real information and continue until you reach the last page.

3.Enjoy your content which will be automatically unlocked! It may take up to 30 seconds to validate.

If the content is still locked after 30 seconds, please try a different offer from the list.

Close this window"

I found this by searchin on Google for "Butiagrus" which listed several PT links, and I clicked on one from January 2012.

I had to close the browser window. Now I will clear my cache and see what happens...

Thanks for the info Kim - back to the drawing board.

0

Share this post


Link to post
Share on other sites

yep... I get the same thing lately... never used to.

0

Share this post


Link to post
Share on other sites

yep... I get the same thing lately... never used to.

Is it another Russian infiltration? :unsure:

0

Share this post


Link to post
Share on other sites

It does this to me, although I rarely log into Palm Talk this way unless I am looking up a specific palm on Google and it refers me to a discussion on PT. However, I was using two different friend's computers in the last week to get on Palm Talk (setting up one new member), and both re-directed me the first time I tried to get on. Hitting the back space multiple times to get back to Google and then clicking the PT link again gets you right in.

Wayne

0

Share this post


Link to post
Share on other sites

I have noticed this recently on my wife's ipad using Safari. I don't normally go to PT from google, but have seen this. I figured my wife had installed some app that was causing the spam.

0

Share this post


Link to post
Share on other sites

I have the same experience going back a good long time, always this "123" page with a popup. Just tried it on a new search and got it again. (Chrome, Win7 x64)

0

Share this post


Link to post
Share on other sites

Apparently those Russians are at it again. I'll see what I can do.

0

Share this post


Link to post
Share on other sites

Yep I have been having the same problem? Not too concerning but a little annoying! Mainly from iPad or I phone?

0

Share this post


Link to post
Share on other sites

Is this ever going to be fixed? This is an issue as it prevents other people from finding PT from Search Engines and it is a security risk in that it attempts to load scripts onto your computer.

0

Share this post


Link to post
Share on other sites

Is this ever going to be fixed? This is an issue as it prevents other people from finding PT from Search Engines and it is a security risk in that it attempts to load scripts onto your computer.

This will be the third time that we have been hacked again after deleting the exploit. I have again located and removed the offending inserted code that I believe is causing the redirect. And I have a theory as to how the hackers are inserting it.

Please tell me if it is indeed fixed, and immediately notify me if you notice it is again at play. That way I will have a much better chance of tracking down any pathway in the logs. I do not notice this redirect because of the skin I use (it is only in the default skin), and because of the way I access the forum - so I need your help to alert me when it is happening. If you notice this happening again, please double check that you have first cleared your cache recently before letting me know.

0

Share this post


Link to post
Share on other sites

No problems this morning. Looks like the problem is fixed for now.

0

Share this post


Link to post
Share on other sites

No problems this morning. Looks like the problem is fixed for now.

Thanks, I can use some help with this one.

0

Share this post


Link to post
Share on other sites

No problems this morning. Looks like the problem is fixed for now.

Thanks, I can use some help with this one.

Thanks for fixing the nuisance redirect from my work computer...Still fixed as of yesterday.

0

Share this post


Link to post
Share on other sites

I'd still love to save $500 on car insurance... :crying:

0

Share this post


Link to post
Share on other sites

Are you inferring that you are still getting that redirect? If so, please let me know.

0

Share this post


Link to post
Share on other sites

No redirects for me since you fixed the problem a month ago. Hopefully the car insurance joke was just that.

0

Share this post


Link to post
Share on other sites

No redirects for me since you fixed the problem a month ago. Hopefully the car insurance joke was just that.

Thanks Grant - the feedback is helpful.

0

Share this post


Link to post
Share on other sites

Hi Mods,

Sorry to be the bearer of bad news but this just happened to me! Thought you should know

0

Share this post


Link to post
Share on other sites

Hi Mods,

Sorry to be the bearer of bad news but this just happened to me! Thought you should know

Thanks for the info. Any chance it could be a cached page?

0

Share this post


Link to post
Share on other sites

Hi Mods,

Sorry to be the bearer of bad news but this just happened to me! Thought you should know

Thanks for the info. Any chance it could be a cached page?

It is also happening to me, and the page is the same one.

0

Share this post


Link to post
Share on other sites

This has been on going for 2 or 3 years.

0

Share this post


Link to post
Share on other sites

Sorry, i'm not that computer savy to check the cache. It just happened again to me though if that's helpful?

0

Share this post


Link to post
Share on other sites

Sorry, i'm not that computer savy to check the cache. It just happened again to me though if that's helpful?

Thanks for the response. I have confirmed a similar script from the last one has been reinserted somehow, and in a different location that I can not yet find. It is an interesting exploit, only activated on the first search from a "new" user (or cleaned browser). And after looking around, it is widespread with loads of conflicting info - most notably on the competing software (vBulletin) to ours.

There are even several sites set up claiming and explaining how this "Google Redirect" is a trojan on your own computer (not so), and then offers a fix that if downloaded is its own virus.

I'm working on it - but getting nowhere so far.

0

Share this post


Link to post
Share on other sites

Well that was fun. For anyone interested, the script for another exploit was inserted on 11/9 after being clean since May. It was very sophisticated in its coding and disguised itself as code for an Invision Power Board Firewall within one of the config.php files, and tied to the actual javascript in one of the language php files. I was lucky one of the more knowledgeable techs was willing to take the time and help me. I just couldn't find it since it was hidden so cleverly.

I was assured the new security patch released around that same time should keep us clean until the next vulnerability is discovered by these evildoers.

If it pops up again, don't hesitate to let me know. It is not something I will know is happening.

0

Share this post


Link to post
Share on other sites

Wow! Well done. Thanks for all the behind the scenes work you and the other mods do.

0

Share this post


Link to post
Share on other sites

Still does it to me sends me to the same page everytime http://url4short.info/e875cd64

Darn - you are right. It is back. Either they have a back door or a file that will re-write it back in. Back to the drawing board. :(

Thanks for letting me know.

0

Share this post


Link to post
Share on other sites

It has again been fixed. I will check over the next few days to make sure it has not returned. But after that, if you experience this problem please notify me - or I might not become aware of it. Thanks in advance for any help.

0

Share this post


Link to post
Share on other sites

I was directed to another page when I tried from a google search on my mac book a few minutes ago.

0

Share this post


Link to post
Share on other sites

Happened to me again today

0

Share this post


Link to post
Share on other sites

I used to have this problem and then it went away for six months or so, but have started seeing it again the last few days. Cleared out my cache, etc. and it is still happening. Must be a nasty little virus, worm, whatever...

0

Share this post


Link to post
Share on other sites

It has again been fixed. I will check over the next few days to make sure it has not returned. But after that, if you experience this problem please notify me - or I might not become aware of it. Thanks in advance for any help.

It might be in the database.

0

Share this post


Link to post
Share on other sites

It has again been fixed. I will check over the next few days to make sure it has not returned. But after that, if you experience this problem please notify me - or I might not become aware of it. Thanks in advance for any help.

It might be in the database.

Thanks - at this point I know where it is and how to eradicate it. However, I have been waiting for 4 days for the web host to take the necessary steps to the server before I can begin. And they are not being co-operative - despite repeated requests.

0

Share this post


Link to post
Share on other sites

Thanks - at this point I know where it is and how to eradicate it. However, I have been waiting for 4 days for the web host to take the necessary steps to the server before I can begin. And they are not being co-operative - despite repeated requests.

Are you locked in with them for a certain amount of time? I switched to KnownHost back in January and the customer support has been amazing.

0

Share this post


Link to post
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!


Register a new account

Sign in

Already have an account? Sign in here.


Sign In Now