Jump to content


RarePalmSeeds

Photo

Redirected from Google search??


  • Please log in to reply
48 replies to this topic

#1 Patrick

Patrick

    Rank: TRUNKING

  • IPS MEMBER
  • 931 posts
  • Gender:Male
  • Location:Oakley, California.

Posted 25 January 2012 - 09:52 AM

Hi Mods.

I have this intermittent issue. If I do a google search from their webpage and click one of the various palmtalk links it gives me, it will redirect me to a different site- same site every time.

BUT! It only happens every now and then. Maybe a couple times a month with my amount of computer usage. Let's say I only get redirected like 3-5% of the time.

I keep pretty up to date on my computer, spyware, antivirus, general maintenance, etc.. I can't say that it's NOT my computer, but I'm relatively certain it is not. I'm well aware of malware that redirects on a more regular basis. I have no other re-direct issues whatsoever (or malware, as far as I know)

What puts up a red flag for me is that this ONLY happens on Palmtalk links, and it's only occasionally. And it always takes me to the same site. Sorry, I did not get the site on this incident, but I will remember and take note the next time it happens. Will post that next time.

It is always the same, takes me to some advertisement website with a popup window of some sort. I never read any of it. I just always hit the back button, re-click on the same palmtalk link and this website loads up the second time around.

I wonder if anyone else has had this sort of issue? Is there such thing as some sort of nusiance "parasite" website leeching on the palmtalk server? Am I just spinning plates?Posted Image

Well, thanks.
  • 0
Oakley, California
55 Miles E-NE of San Francisco, CA
Solid zone 9, I can expect at least one night in the mid to low twenties every year.
Hot, dry summers. Cold, wet winters.

PalmTalk Advertising

#2 PANGEA EXPRESS

PANGEA EXPRESS

    Rank: JUVENILE

  • IPS MEMBER
  • 314 posts
  • Gender:Male
  • Location:San Francisco and Healdsburg

Posted 25 January 2012 - 11:36 AM

i get the same problem when i google palmtalk. Most of the links are spammy
  • 0

- Eric Arneson 

 

f752331e-3c08-44d4-81e6-65e770e5eb43_zps


#3 PALM MOD

PALM MOD

    Moderator

  • Administrator
  • 2,686 posts
  • Gender:Male
  • Location:Hawaii - Big Island

Posted 25 January 2012 - 11:38 AM

This was a problem in the past, but was supposedly fixed about 4-6 weeks ago. Has this happened to you since then? And, do you regularly clear your cache? If not, please clear your cache and let me know if it happens again - and as you mentioned - save the URL of any site you are redirected to with any other info that would be pertinent.
  • 0
Thanks to those of you who help make this a fun and friendly forum.

#4 Kim

Kim

    Learning by heart

  • IPS DIRECTOR
  • 5,368 posts
  • Gender:Female
  • Location:San Diego, California USA and Pahoa, Hawaii USA

Posted 25 January 2012 - 12:31 PM

http://url123.info/e875cd64

Popup window appears with following message and no apparent way to close:

"Please complete a survey from our sponsors below to view this content.

Save Over $500 a Year on Car Insurance!
Find Out How to Save on Car Insurance!
Upgrade to Internet Explorer 9!
Download and Play The Brain Game!

This website has been temporarily locked. In order to unlock it, you must fill out one of the surveys above completely. These surveys take approximately 30 seconds to 1 minute to complete. After a survey is completed, you will have access to all content on this site for 24 hours."

The main page is greyed out, but I can read a heading: "URL 123, Chopping long links smaller...etc etc... Then above what looks like a full page of print, "Link is missing
This link does not exist yet or it has been removed for some reason." Then there is what appears to be an article about Windows.

Off the upper right-hand corner of the window is a ? (not an x to close the window) Clicking on that takes you to another popup:
http://www.dollarade...verlay_help.php

"
How Does This Work?
This website requires you to complete a short offer in order to view their content.

Completing an offer is simple:

1.Click the link of an offer that interests you. There will be 1-4 offers listed in total you may choose from.
2.Fill out the offer using your real information and continue until you reach the last page.
3.Enjoy your content which will be automatically unlocked! It may take up to 30 seconds to validate.
If the content is still locked after 30 seconds, please try a different offer from the list.

Close this window"

I found this by searchin on Google for "Butiagrus" which listed several PT links, and I clicked on one from January 2012.

I had to close the browser window. Now I will clear my cache and see what happens...
  • 0

Kim Cyr

Between the beach and the bays, Point Loma, San Diego, California USA
and on a 300 year-old lava flow, Pahoa, Hawaii, USA
All characters appearing in this work are fictitious. Any resemblance to real persons, living or dead, is purely coincidental
anm23bea44cd09109b5.gif


#5 Kim

Kim

    Learning by heart

  • IPS DIRECTOR
  • 5,368 posts
  • Gender:Female
  • Location:San Diego, California USA and Pahoa, Hawaii USA

Posted 25 January 2012 - 12:36 PM

After clearing my cache, then going to Google and clicking on the same link, it took me directly to the PT thread. Clearing cookies and cache seems to solve the problem.
  • 0

Kim Cyr

Between the beach and the bays, Point Loma, San Diego, California USA
and on a 300 year-old lava flow, Pahoa, Hawaii, USA
All characters appearing in this work are fictitious. Any resemblance to real persons, living or dead, is purely coincidental
anm23bea44cd09109b5.gif


#6 Patrick

Patrick

    Rank: TRUNKING

  • IPS MEMBER
  • 931 posts
  • Gender:Male
  • Location:Oakley, California.

Posted 25 January 2012 - 04:37 PM

I clear my cache pretty regularly and this redirect just happened maybe yesterday. I think I cleared my cache maybe two days ago.Posted Image


Like I said though, It's not too big a deal for me, I just hit "back" and it clears; but I just wanted to bring it up in case it was a problem for Palmtalk in general.

I will be vigilant and report all findings!Posted Image
  • 0
Oakley, California
55 Miles E-NE of San Francisco, CA
Solid zone 9, I can expect at least one night in the mid to low twenties every year.
Hot, dry summers. Cold, wet winters.

#7 PALM MOD

PALM MOD

    Moderator

  • Administrator
  • 2,686 posts
  • Gender:Male
  • Location:Hawaii - Big Island

Posted 25 January 2012 - 06:33 PM

http://url123.info/e875cd64

Popup window appears with following message and no apparent way to close:

"Please complete a survey from our sponsors below to view this content.

Save Over $500 a Year on Car Insurance!
Find Out How to Save on Car Insurance!
Upgrade to Internet Explorer 9!
Download and Play The Brain Game!

This website has been temporarily locked. In order to unlock it, you must fill out one of the surveys above completely. These surveys take approximately 30 seconds to 1 minute to complete. After a survey is completed, you will have access to all content on this site for 24 hours."

The main page is greyed out, but I can read a heading: "URL 123, Chopping long links smaller...etc etc... Then above what looks like a full page of print, "Link is missing
This link does not exist yet or it has been removed for some reason." Then there is what appears to be an article about Windows.

Off the upper right-hand corner of the window is a ? (not an x to close the window) Clicking on that takes you to another popup:
http://www.dollarade...verlay_help.php

"
How Does This Work?
This website requires you to complete a short offer in order to view their content.

Completing an offer is simple:

1.Click the link of an offer that interests you. There will be 1-4 offers listed in total you may choose from.
2.Fill out the offer using your real information and continue until you reach the last page.
3.Enjoy your content which will be automatically unlocked! It may take up to 30 seconds to validate.
If the content is still locked after 30 seconds, please try a different offer from the list.

Close this window"

I found this by searchin on Google for "Butiagrus" which listed several PT links, and I clicked on one from January 2012.

I had to close the browser window. Now I will clear my cache and see what happens...

Thanks for the info Kim - back to the drawing board.
  • 0
Thanks to those of you who help make this a fun and friendly forum.

#8 BS Man about Palms

BS Man about Palms

    This TVR is trapped in my garage by PALMS!

  • IPS MEMBER
  • 16,517 posts
  • Gender:Male
  • Location:Oceanside, CA.

Posted 26 January 2012 - 09:23 PM

yep... I get the same thing lately... never used to.
  • 0
Zone 10a at best after 2007 AND 2013, on SW facing hill, 1 1/2 miles from coast in Oceanside, CA. 30-98 degrees, and 45-80deg. about 95% of the time.

"The great workman of nature is time."
"Genius is nothing but a great aptitude for patience."
-George-Louis Leclerc de Buffon-

#9 Moose

Moose

    Rank: SETTING SEED

  • IPS MEMBER
  • 4,934 posts
  • Gender:Male
  • Location:Coral Gables, FL

Posted 27 January 2012 - 03:15 AM

yep... I get the same thing lately... never used to.



Is it another Russian infiltration? :unsure:
  • 0
Coral Gables, FL 8 miles North of Fairchild USDA Zone 10B

#10 buccaneers37

buccaneers37

    Rank: JUVENILE

  • IPS MEMBER
  • 343 posts
  • Gender:Male
  • Location:Brandon, Florida

Posted 27 January 2012 - 05:46 AM

It does this to me, although I rarely log into Palm Talk this way unless I am looking up a specific palm on Google and it refers me to a discussion on PT. However, I was using two different friend's computers in the last week to get on Palm Talk (setting up one new member), and both re-directed me the first time I tried to get on. Hitting the back space multiple times to get back to Google and then clicking the PT link again gets you right in.

Wayne
  • 0
52% 9B / 42% 10A / 6% "Other"

Posted Image

#11 iwan

iwan

    Rank: FLOWERING

  • FORUM MEMBER
  • 1,022 posts

Posted 14 March 2012 - 06:58 PM

I have noticed this recently on my wife's ipad using Safari. I don't normally go to PT from google, but have seen this. I figured my wife had installed some app that was causing the spam.
  • 0
Robert

Madera, CA (central San Joaquin valley)
9A

#12 mnorell

mnorell

    Rank: TRUNKING

  • FORUM MEMBER
  • 597 posts
  • Gender:Male
  • Location:Big Pine Key, FL and Natchez, MS

Posted 15 March 2012 - 03:40 PM

I have the same experience going back a good long time, always this "123" page with a popup. Just tried it on a new search and got it again. (Chrome, Win7 x64)
  • 0

Michael Norell

Big Pine Key, Florida | 24° 40' N 81° 21' W | elev. 4.5 ft. | Zone 11b | Calcareous substrate
- avg annual min. approx. 48F | Jan 65/75F, July 83/89F | Historical extreme: approx. 41F

Natchez, Mississippi | 31° 33' N 91° 24' W | elev. 220 ft.| zone 9a | Downtown/river-adjacent microclimate | Loess substrate
- avg min. 23F / lows: 24F | 27 | 23 | 23 | 24 | 18 | 23 | 27 | 27 | 18 (2013-14) | Jan 43/61F, July 73/93F | Extreme: 2.5F (1899)


#13 PALM MOD

PALM MOD

    Moderator

  • Administrator
  • 2,686 posts
  • Gender:Male
  • Location:Hawaii - Big Island

Posted 15 March 2012 - 06:48 PM

Apparently those Russians are at it again. I'll see what I can do.
  • 0
Thanks to those of you who help make this a fun and friendly forum.

#14 Kennybenjamin

Kennybenjamin

    Rank: TRUNKING

  • IPS MEMBER
  • 995 posts
  • Gender:Male
  • Location:SEQ, Australia

Posted 23 March 2012 - 02:10 AM

Yep I have been having the same problem? Not too concerning but a little annoying! Mainly from iPad or I phone?
  • 0

#15 LJG

LJG

    Lavoixia macrocarpa

  • IPS DIRECTOR
  • 6,560 posts
  • Gender:Male
  • Location:Vista, CA

Posted 10 April 2012 - 07:21 PM

Is this ever going to be fixed? This is an issue as it prevents other people from finding PT from Search Engines and it is a security risk in that it attempts to load scripts onto your computer.
  • 0
Len

Vista, CA (Zone 10a)
Shadowridge Area

"Show me your garden and I shall tell you what you are."
-- Alfred Austin

#16 PALM MOD

PALM MOD

    Moderator

  • Administrator
  • 2,686 posts
  • Gender:Male
  • Location:Hawaii - Big Island

Posted 17 April 2012 - 12:59 AM

Is this ever going to be fixed? This is an issue as it prevents other people from finding PT from Search Engines and it is a security risk in that it attempts to load scripts onto your computer.

This will be the third time that we have been hacked again after deleting the exploit. I have again located and removed the offending inserted code that I believe is causing the redirect. And I have a theory as to how the hackers are inserting it.

Please tell me if it is indeed fixed, and immediately notify me if you notice it is again at play. That way I will have a much better chance of tracking down any pathway in the logs. I do not notice this redirect because of the skin I use (it is only in the default skin), and because of the way I access the forum - so I need your help to alert me when it is happening. If you notice this happening again, please double check that you have first cleared your cache recently before letting me know.
  • 0
Thanks to those of you who help make this a fun and friendly forum.

#17 1000shadesOFgreen

1000shadesOFgreen

    Rank: JUVENILE

  • FORUM MEMBER
  • 367 posts
  • Gender:Male
  • Location:Southern California

Posted 17 April 2012 - 06:38 AM

No problems this morning. Looks like the problem is fixed for now.
  • 0

Grant
Long Beach, CA


#18 PALM MOD

PALM MOD

    Moderator

  • Administrator
  • 2,686 posts
  • Gender:Male
  • Location:Hawaii - Big Island

Posted 17 April 2012 - 06:44 PM

No problems this morning. Looks like the problem is fixed for now.

Thanks, I can use some help with this one.
  • 0
Thanks to those of you who help make this a fun and friendly forum.

#19 apaandssa

apaandssa

    Rank: SETTING SEED

  • IPS DIRECTOR
  • 2,583 posts
  • Gender:Female
  • Location:Virginia Beach, VA and Las Marias, PR

Posted 23 May 2012 - 04:53 AM


No problems this morning. Looks like the problem is fixed for now.

Thanks, I can use some help with this one.

Thanks for fixing the nuisance redirect from my work computer...Still fixed as of yesterday.
  • 0
Cindy Adair

#20 Trópico

Trópico

    Rank: SETTING SEED

  • IPS MEMBER
  • 2,185 posts
  • Gender:Male
  • Location:Orlando, FL

Posted 23 May 2012 - 08:44 AM

I'd still love to save $500 on car insurance... :crying:
  • 0
Frank

Zone 9b pine flatlands
humid/hot summers; dry/cool winters
with yearly freezes

#21 PALM MOD

PALM MOD

    Moderator

  • Administrator
  • 2,686 posts
  • Gender:Male
  • Location:Hawaii - Big Island

Posted 23 May 2012 - 10:27 AM

Are you inferring that you are still getting that redirect? If so, please let me know.
  • 0
Thanks to those of you who help make this a fun and friendly forum.

#22 1000shadesOFgreen

1000shadesOFgreen

    Rank: JUVENILE

  • FORUM MEMBER
  • 367 posts
  • Gender:Male
  • Location:Southern California

Posted 24 May 2012 - 06:30 AM

No redirects for me since you fixed the problem a month ago. Hopefully the car insurance joke was just that.
  • 0

Grant
Long Beach, CA


#23 PALM MOD

PALM MOD

    Moderator

  • Administrator
  • 2,686 posts
  • Gender:Male
  • Location:Hawaii - Big Island

Posted 24 May 2012 - 09:36 AM

No redirects for me since you fixed the problem a month ago. Hopefully the car insurance joke was just that.

Thanks Grant - the feedback is helpful.
  • 0
Thanks to those of you who help make this a fun and friendly forum.

#24 NApalm

NApalm

    Rank: FLOWERING

  • FORUM MEMBER
  • 1,132 posts
  • Gender:Male
  • Location:Logan QLD Australia

Posted 23 November 2012 - 03:50 AM

Hi Mods,

Sorry to be the bearer of bad news but this just happened to me! Thought you should know
  • 0

#25 PALM MOD

PALM MOD

    Moderator

  • Administrator
  • 2,686 posts
  • Gender:Male
  • Location:Hawaii - Big Island

Posted 23 November 2012 - 03:42 PM

Hi Mods,

Sorry to be the bearer of bad news but this just happened to me! Thought you should know

Thanks for the info. Any chance it could be a cached page?
  • 0
Thanks to those of you who help make this a fun and friendly forum.

#26 Rafael

Rafael

    Rank: FLOWERING

  • IPS MEMBER
  • 1,780 posts
  • Gender:Male
  • Location:Ovar, Portugal

Posted 24 November 2012 - 04:06 PM


Hi Mods,

Sorry to be the bearer of bad news but this just happened to me! Thought you should know

Thanks for the info. Any chance it could be a cached page?

It is also happening to me, and the page is the same one.
  • 0
Furadouro, coastline, zone 9b. Ovar, zone 10a.
PORTUGAL
http://www.palmtalk....showtopic=20668
http://www.palmtalk....ar-january2012/

#27 _Keith

_Keith

    Rank: SETTING SEED

  • IPS MEMBER
  • 8,659 posts
  • Gender:Male
  • Location:South Louisiana (Zone 9a)

Posted 24 November 2012 - 05:22 PM

This has been on going for 2 or 3 years.
  • 0

In my post I sometimes express "MY" opinion.   Please do not feel insulted if your opinion differs from my opinion.  That is fine.  You get to have one, I get to have one.  Its kind of like they teach you in Kindergarten, but we don't even have to share.  Any data in this post is provided 'as is' and in no event shall I be liable for any damages, including, without limitation, damages resulting from accuracy or lack thereof, insult, or lost profits or revenue, claims by third parties or for other similar costs, or any special, incidental, or consequential damages arising out of my opinion or the use of this data. The accuracy or reliability of the data is not guaranteed or warranted in any way and I disclaim liability of any kind whatsoever, including, without limitation, liability for quality, performance, merchantability and fitness for a particular purpose arising out of the use, or inability to use my data.  Other terms may apply.


#28 NApalm

NApalm

    Rank: FLOWERING

  • FORUM MEMBER
  • 1,132 posts
  • Gender:Male
  • Location:Logan QLD Australia

Posted 25 November 2012 - 03:53 AM

Sorry, i'm not that computer savy to check the cache. It just happened again to me though if that's helpful?
  • 0

#29 PALM MOD

PALM MOD

    Moderator

  • Administrator
  • 2,686 posts
  • Gender:Male
  • Location:Hawaii - Big Island

Posted 25 November 2012 - 02:45 PM

Sorry, i'm not that computer savy to check the cache. It just happened again to me though if that's helpful?

Thanks for the response. I have confirmed a similar script from the last one has been reinserted somehow, and in a different location that I can not yet find. It is an interesting exploit, only activated on the first search from a "new" user (or cleaned browser). And after looking around, it is widespread with loads of conflicting info - most notably on the competing software (vBulletin) to ours.

There are even several sites set up claiming and explaining how this "Google Redirect" is a trojan on your own computer (not so), and then offers a fix that if downloaded is its own virus.

I'm working on it - but getting nowhere so far.
  • 0
Thanks to those of you who help make this a fun and friendly forum.

#30 PALM MOD

PALM MOD

    Moderator

  • Administrator
  • 2,686 posts
  • Gender:Male
  • Location:Hawaii - Big Island

Posted 25 November 2012 - 10:57 PM

Well that was fun. For anyone interested, the script for another exploit was inserted on 11/9 after being clean since May. It was very sophisticated in its coding and disguised itself as code for an Invision Power Board Firewall within one of the config.php files, and tied to the actual javascript in one of the language php files. I was lucky one of the more knowledgeable techs was willing to take the time and help me. I just couldn't find it since it was hidden so cleverly.

I was assured the new security patch released around that same time should keep us clean until the next vulnerability is discovered by these evildoers.

If it pops up again, don't hesitate to let me know. It is not something I will know is happening.
  • 0
Thanks to those of you who help make this a fun and friendly forum.

#31 NApalm

NApalm

    Rank: FLOWERING

  • FORUM MEMBER
  • 1,132 posts
  • Gender:Male
  • Location:Logan QLD Australia

Posted 25 November 2012 - 11:59 PM

Wow! Well done. Thanks for all the behind the scenes work you and the other mods do.
  • 0

#32 turfpro01

turfpro01

    Rank: SEEDLING

  • IPS MEMBER
  • 170 posts
  • Gender:Male
  • Location:Visalia, CA

Posted 26 November 2012 - 08:47 AM

Still does it to me sends me to the same page everytime http://url4short.info/e875cd64
  • 0

#33 PALM MOD

PALM MOD

    Moderator

  • Administrator
  • 2,686 posts
  • Gender:Male
  • Location:Hawaii - Big Island

Posted 26 November 2012 - 12:09 PM

Still does it to me sends me to the same page everytime http://url4short.info/e875cd64

Darn - you are right. It is back. Either they have a back door or a file that will re-write it back in. Back to the drawing board. :(

Thanks for letting me know.
  • 0
Thanks to those of you who help make this a fun and friendly forum.

#34 PALM MOD

PALM MOD

    Moderator

  • Administrator
  • 2,686 posts
  • Gender:Male
  • Location:Hawaii - Big Island

Posted 26 November 2012 - 09:08 PM

It has again been fixed. I will check over the next few days to make sure it has not returned. But after that, if you experience this problem please notify me - or I might not become aware of it. Thanks in advance for any help.
  • 0
Thanks to those of you who help make this a fun and friendly forum.

#35 Kathryn

Kathryn

    Rank: FLOWERING

  • IPS DIRECTOR
  • 1,827 posts
  • Gender:Female
  • Location:New Orleans

Posted 27 November 2012 - 04:31 PM

I was directed to another page when I tried from a google search on my mac book a few minutes ago.
  • 0

#36 CardiffPalmNut

CardiffPalmNut

    Rank: JUVENILE

  • IPS MEMBER
  • 483 posts
  • Gender:Male
  • Location:Cardiff by the Sea

Posted 28 November 2012 - 07:59 PM

Happened to me again today
  • 0
Aloha!

Always looking for "Palms of Paradise"

Cardiff by the Sea 10b 1/2
1/2 mile from the Blue Pacific

#37 Firepalm

Firepalm

    Rank: SEEDLING

  • FORUM MEMBER
  • 167 posts
  • Gender:Male
  • Location:Oceanside, CA

Posted 29 November 2012 - 11:17 AM

I used to have this problem and then it went away for six months or so, but have started seeing it again the last few days. Cleared out my cache, etc. and it is still happening. Must be a nasty little virus, worm, whatever...
  • 0

#38 Turtile

Turtile

    Rank: SEEDLING

  • IPS MEMBER
  • 162 posts
  • Gender:Male
  • Location:Delaware 7a/b

Posted 30 November 2012 - 08:52 PM

It has again been fixed. I will check over the next few days to make sure it has not returned. But after that, if you experience this problem please notify me - or I might not become aware of it. Thanks in advance for any help.


It might be in the database.
  • 0
Zone 7a/b Delaware
Unusual Plants

#39 PALM MOD

PALM MOD

    Moderator

  • Administrator
  • 2,686 posts
  • Gender:Male
  • Location:Hawaii - Big Island

Posted 30 November 2012 - 09:41 PM


It has again been fixed. I will check over the next few days to make sure it has not returned. But after that, if you experience this problem please notify me - or I might not become aware of it. Thanks in advance for any help.


It might be in the database.


Thanks - at this point I know where it is and how to eradicate it. However, I have been waiting for 4 days for the web host to take the necessary steps to the server before I can begin. And they are not being co-operative - despite repeated requests.
  • 0
Thanks to those of you who help make this a fun and friendly forum.

#40 Turtile

Turtile

    Rank: SEEDLING

  • IPS MEMBER
  • 162 posts
  • Gender:Male
  • Location:Delaware 7a/b

Posted 01 December 2012 - 06:10 AM

Thanks - at this point I know where it is and how to eradicate it. However, I have been waiting for 4 days for the web host to take the necessary steps to the server before I can begin. And they are not being co-operative - despite repeated requests.


Are you locked in with them for a certain amount of time? I switched to KnownHost back in January and the customer support has been amazing.
  • 0
Zone 7a/b Delaware
Unusual Plants




0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users