48 replies to this topic

[Patrick]

Hi Mods.

I have this intermittent issue. If I do a google search from their webpage and click one of the various palmtalk links it gives me, it will redirect me to a different site- same site every time.

BUT! It only happens every now and then. Maybe a couple times a month with my amount of computer usage. Let's say I only get redirected like 3-5% of the time.

I keep pretty up to date on my computer, spyware, antivirus, general maintenance, etc.. I can't say that it's NOT my computer, but I'm relatively certain it is not. I'm well aware of malware that redirects on a more regular basis. I have no other re-direct issues whatsoever (or malware, as far as I know)

What puts up a red flag for me is that this ONLY happens on Palmtalk links, and it's only occasionally. And it always takes me to the same site. Sorry, I did not get the site on this incident, but I will remember and take note the next time it happens. Will post that next time.

It is always the same, takes me to some advertisement website with a popup window of some sort. I never read any of it. I just always hit the back button, re-click on the same palmtalk link and this website loads up the second time around.

I wonder if anyone else has had this sort of issue? Is there such thing as some sort of nusiance "parasite" website leeching on the palmtalk server? Am I just spinning plates?

Well, thanks.

[PANGEA EXPRESS]

i get the same problem when i google palmtalk. Most of the links are spammy

[PALM MOD]

This was a problem in the past, but was supposedly fixed about 4-6 weeks ago. Has this happened to you since then? And, do you regularly clear your cache? If not, please clear your cache and let me know if it happens again - and as you mentioned - save the URL of any site you are redirected to with any other info that would be pertinent.

[Kim]

http://url123.info/e875cd64

Popup window appears with following message and no apparent way to close:

"Please complete a survey from our sponsors below to view this content.

Save Over $500 a Year on Car Insurance!
Find Out How to Save on Car Insurance!
Upgrade to Internet Explorer 9!
Download and Play The Brain Game!

This website has been temporarily locked. In order to unlock it, you must fill out one of the surveys above completely. These surveys take approximately 30 seconds to 1 minute to complete. After a survey is completed, you will have access to all content on this site for 24 hours."

The main page is greyed out, but I can read a heading: "URL 123, Chopping long links smaller...etc etc... Then above what looks like a full page of print, "Link is missing
This link does not exist yet or it has been removed for some reason." Then there is what appears to be an article about Windows.

Off the upper right-hand corner of the window is a ? (not an x to close the window) Clicking on that takes you to another popup:
http://www.dollarade...verlay_help.php

"
How Does This Work?
This website requires you to complete a short offer in order to view their content.

Completing an offer is simple:

1.Click the link of an offer that interests you. There will be 1-4 offers listed in total you may choose from.
2.Fill out the offer using your real information and continue until you reach the last page.
3.Enjoy your content which will be automatically unlocked! It may take up to 30 seconds to validate.
If the content is still locked after 30 seconds, please try a different offer from the list.

Close this window"

I found this by searchin on Google for "Butiagrus" which listed several PT links, and I clicked on one from January 2012.

I had to close the browser window. Now I will clear my cache and see what happens...

[Kim]

After clearing my cache, then going to Google and clicking on the same link, it took me directly to the PT thread. Clearing cookies and cache seems to solve the problem.

[Patrick]

I clear my cache pretty regularly and this redirect just happened maybe yesterday. I think I cleared my cache maybe two days ago.


Like I said though, It's not too big a deal for me, I just hit "back" and it clears; but I just wanted to bring it up in case it was a problem for Palmtalk in general.

I will be vigilant and report all findings!

[PALM MOD]

http://url123.info/e875cd64

Popup window appears with following message and no apparent way to close:

"Please complete a survey from our sponsors below to view this content.

Save Over $500 a Year on Car Insurance!
Find Out How to Save on Car Insurance!
Upgrade to Internet Explorer 9!
Download and Play The Brain Game!

This website has been temporarily locked. In order to unlock it, you must fill out one of the surveys above completely. These surveys take approximately 30 seconds to 1 minute to complete. After a survey is completed, you will have access to all content on this site for 24 hours."

The main page is greyed out, but I can read a heading: "URL 123, Chopping long links smaller...etc etc... Then above what looks like a full page of print, "Link is missing
This link does not exist yet or it has been removed for some reason." Then there is what appears to be an article about Windows.

Off the upper right-hand corner of the window is a ? (not an x to close the window) Clicking on that takes you to another popup:
http://www.dollarade...verlay_help.php

"
How Does This Work?
This website requires you to complete a short offer in order to view their content.

Completing an offer is simple:

1.Click the link of an offer that interests you. There will be 1-4 offers listed in total you may choose from.
2.Fill out the offer using your real information and continue until you reach the last page.
3.Enjoy your content which will be automatically unlocked! It may take up to 30 seconds to validate.
If the content is still locked after 30 seconds, please try a different offer from the list.

Close this window"

I found this by searchin on Google for "Butiagrus" which listed several PT links, and I clicked on one from January 2012.

I had to close the browser window. Now I will clear my cache and see what happens...

Thanks for the info Kim - back to the drawing board.

[BS Man about Palms]

yep... I get the same thing lately... never used to.

[Moose]

yep... I get the same thing lately... never used to.

Is it another Russian infiltration?

[buccaneers37]

It does this to me, although I rarely log into Palm Talk this way unless I am looking up a specific palm on Google and it refers me to a discussion on PT. However, I was using two different friend's computers in the last week to get on Palm Talk (setting up one new member), and both re-directed me the first time I tried to get on. Hitting the back space multiple times to get back to Google and then clicking the PT link again gets you right in.

Wayne

[iwan]

I have noticed this recently on my wife's ipad using Safari. I don't normally go to PT from google, but have seen this. I figured my wife had installed some app that was causing the spam.

[mnorell]

I have the same experience going back a good long time, always this "123" page with a popup. Just tried it on a new search and got it again. (Chrome, Win7 x64)

[PALM MOD]

Apparently those Russians are at it again. I'll see what I can do.

[Kennybenjamin]

Yep I have been having the same problem? Not too concerning but a little annoying! Mainly from iPad or I phone?

[LJG]

Is this ever going to be fixed? This is an issue as it prevents other people from finding PT from Search Engines and it is a security risk in that it attempts to load scripts onto your computer.

[PALM MOD]

Is this ever going to be fixed? This is an issue as it prevents other people from finding PT from Search Engines and it is a security risk in that it attempts to load scripts onto your computer.

This will be the third time that we have been hacked again after deleting the exploit. I have again located and removed the offending inserted code that I believe is causing the redirect. And I have a theory as to how the hackers are inserting it.

Please tell me if it is indeed fixed, and immediately notify me if you notice it is again at play. That way I will have a much better chance of tracking down any pathway in the logs. I do not notice this redirect because of the skin I use (it is only in the default skin), and because of the way I access the forum - so I need your help to alert me when it is happening. If you notice this happening again, please double check that you have first cleared your cache recently before letting me know.

[1000shadesOFgreen]

No problems this morning. Looks like the problem is fixed for now.

[PALM MOD]

No problems this morning. Looks like the problem is fixed for now.

Thanks, I can use some help with this one.

[apaandssa]

No problems this morning. Looks like the problem is fixed for now.

Thanks, I can use some help with this one.

Thanks for fixing the nuisance redirect from my work computer...Still fixed as of yesterday.

[Trópico]

I'd still love to save $500 on car insurance...

[PALM MOD]

Are you inferring that you are still getting that redirect? If so, please let me know.

[1000shadesOFgreen]

No redirects for me since you fixed the problem a month ago. Hopefully the car insurance joke was just that.

[PALM MOD]

No redirects for me since you fixed the problem a month ago. Hopefully the car insurance joke was just that.

Thanks Grant - the feedback is helpful.

[NApalm]

Hi Mods,

Sorry to be the bearer of bad news but this just happened to me! Thought you should know

[PALM MOD]

Hi Mods,

Sorry to be the bearer of bad news but this just happened to me! Thought you should know

Thanks for the info. Any chance it could be a cached page?

[rafael]

Hi Mods,

Sorry to be the bearer of bad news but this just happened to me! Thought you should know

Thanks for the info. Any chance it could be a cached page?

It is also happening to me, and the page is the same one.

[_Keith]

This has been on going for 2 or 3 years.

[NApalm]

Sorry, i'm not that computer savy to check the cache. It just happened again to me though if that's helpful?

[PALM MOD]

Sorry, i'm not that computer savy to check the cache. It just happened again to me though if that's helpful?

Thanks for the response. I have confirmed a similar script from the last one has been reinserted somehow, and in a different location that I can not yet find. It is an interesting exploit, only activated on the first search from a "new" user (or cleaned browser). And after looking around, it is widespread with loads of conflicting info - most notably on the competing software (vBulletin) to ours.

There are even several sites set up claiming and explaining how this "Google Redirect" is a trojan on your own computer (not so), and then offers a fix that if downloaded is its own virus.

I'm working on it - but getting nowhere so far.

[PALM MOD]

Well that was fun. For anyone interested, the script for another exploit was inserted on 11/9 after being clean since May. It was very sophisticated in its coding and disguised itself as code for an Invision Power Board Firewall within one of the config.php files, and tied to the actual javascript in one of the language php files. I was lucky one of the more knowledgeable techs was willing to take the time and help me. I just couldn't find it since it was hidden so cleverly.

I was assured the new security patch released around that same time should keep us clean until the next vulnerability is discovered by these evildoers.

If it pops up again, don't hesitate to let me know. It is not something I will know is happening.

[NApalm]

Wow! Well done. Thanks for all the behind the scenes work you and the other mods do.

[turfpro01]

Still does it to me sends me to the same page everytime http://url4short.info/e875cd64

[PALM MOD]

Still does it to me sends me to the same page everytime http://url4short.info/e875cd64

Darn - you are right. It is back. Either they have a back door or a file that will re-write it back in. Back to the drawing board.

Thanks for letting me know.

[PALM MOD]

It has again been fixed. I will check over the next few days to make sure it has not returned. But after that, if you experience this problem please notify me - or I might not become aware of it. Thanks in advance for any help.

[Kathryn]

I was directed to another page when I tried from a google search on my mac book a few minutes ago.

[CardiffPalmNut]

Happened to me again today

[Firepalm]

I used to have this problem and then it went away for six months or so, but have started seeing it again the last few days. Cleared out my cache, etc. and it is still happening. Must be a nasty little virus, worm, whatever...

[Turtile]

It has again been fixed. I will check over the next few days to make sure it has not returned. But after that, if you experience this problem please notify me - or I might not become aware of it. Thanks in advance for any help.

It might be in the database.

[PALM MOD]

It has again been fixed. I will check over the next few days to make sure it has not returned. But after that, if you experience this problem please notify me - or I might not become aware of it. Thanks in advance for any help.

It might be in the database.

Thanks - at this point I know where it is and how to eradicate it. However, I have been waiting for 4 days for the web host to take the necessary steps to the server before I can begin. And they are not being co-operative - despite repeated requests.

[Turtile]

Thanks - at this point I know where it is and how to eradicate it. However, I have been waiting for 4 days for the web host to take the necessary steps to the server before I can begin. And they are not being co-operative - despite repeated requests.

Are you locked in with them for a certain amount of time? I switched to KnownHost back in January and the customer support has been amazing.