Jump to content
IMPORTANT ANNOUNCEMENT ABOUT LOGGING IN ×
  • WELCOME GUEST

    It looks as if you are viewing PalmTalk as an unregistered Guest.

    Please consider registering so as to take better advantage of our vast knowledge base and friendly community.  By registering you will gain access to many features - among them are our powerful Search feature, the ability to Private Message other Users, and be able to post and/or answer questions from all over the world. It is completely free, no “catches,” and you will have complete control over how you wish to use this site.

    PalmTalk is sponsored by the International Palm Society. - an organization dedicated to learning everything about and enjoying palm trees (and their companion plants) while conserving endangered palm species and habitat worldwide. Please take the time to know us all better and register.

    guest Renda04.jpg

Redirected from Google search??


Patrick

Recommended Posts

Hi Mods.

I have this intermittent issue. If I do a google search from their webpage and click one of the various palmtalk links it gives me, it will redirect me to a different site- same site every time.

BUT! It only happens every now and then. Maybe a couple times a month with my amount of computer usage. Let's say I only get redirected like 3-5% of the time.

I keep pretty up to date on my computer, spyware, antivirus, general maintenance, etc.. I can't say that it's NOT my computer, but I'm relatively certain it is not. I'm well aware of malware that redirects on a more regular basis. I have no other re-direct issues whatsoever (or malware, as far as I know)

What puts up a red flag for me is that this ONLY happens on Palmtalk links, and it's only occasionally. And it always takes me to the same site. Sorry, I did not get the site on this incident, but I will remember and take note the next time it happens. Will post that next time.

It is always the same, takes me to some advertisement website with a popup window of some sort. I never read any of it. I just always hit the back button, re-click on the same palmtalk link and this website loads up the second time around.

I wonder if anyone else has had this sort of issue? Is there such thing as some sort of nusiance "parasite" website leeching on the palmtalk server? Am I just spinning plates?blink.gif

Well, thanks.

Oakley, California

55 Miles E-NE of San Francisco, CA

Solid zone 9, I can expect at least one night in the mid to low twenties every year.

Hot, dry summers. Cold, wet winters.

Link to comment
Share on other sites

This was a problem in the past, but was supposedly fixed about 4-6 weeks ago. Has this happened to you since then? And, do you regularly clear your cache? If not, please clear your cache and let me know if it happens again - and as you mentioned - save the URL of any site you are redirected to with any other info that would be pertinent.

Thanks to those of you who help make this a fun and friendly forum.

Link to comment
Share on other sites

http://url123.info/e875cd64

Popup window appears with following message and no apparent way to close:

"Please complete a survey from our sponsors below to view this content.

Save Over $500 a Year on Car Insurance!

Find Out How to Save on Car Insurance!

Upgrade to Internet Explorer 9!

Download and Play The Brain Game!

This website has been temporarily locked. In order to unlock it, you must fill out one of the surveys above completely. These surveys take approximately 30 seconds to 1 minute to complete. After a survey is completed, you will have access to all content on this site for 24 hours."

The main page is greyed out, but I can read a heading: "URL 123, Chopping long links smaller...etc etc... Then above what looks like a full page of print, "Link is missing

This link does not exist yet or it has been removed for some reason." Then there is what appears to be an article about Windows.

Off the upper right-hand corner of the window is a ? (not an x to close the window) Clicking on that takes you to another popup:

http://www.dollarade.com/overlay_help.php

"

How Does This Work?

This website requires you to complete a short offer in order to view their content.

Completing an offer is simple:

1.Click the link of an offer that interests you. There will be 1-4 offers listed in total you may choose from.

2.Fill out the offer using your real information and continue until you reach the last page.

3.Enjoy your content which will be automatically unlocked! It may take up to 30 seconds to validate.

If the content is still locked after 30 seconds, please try a different offer from the list.

Close this window"

I found this by searchin on Google for "Butiagrus" which listed several PT links, and I clicked on one from January 2012.

I had to close the browser window. Now I will clear my cache and see what happens...

Kim Cyr

Between the beach and the bays, Point Loma, San Diego, California USA
and on a 300 year-old lava flow, Pahoa, Hawaii, 1/4 mile from the 2018 flow
All characters  in this work are fictitious. Any resemblance to real persons, living or dead, is purely coincidental.

Link to comment
Share on other sites

After clearing my cache, then going to Google and clicking on the same link, it took me directly to the PT thread. Clearing cookies and cache seems to solve the problem.

Kim Cyr

Between the beach and the bays, Point Loma, San Diego, California USA
and on a 300 year-old lava flow, Pahoa, Hawaii, 1/4 mile from the 2018 flow
All characters  in this work are fictitious. Any resemblance to real persons, living or dead, is purely coincidental.

Link to comment
Share on other sites

I clear my cache pretty regularly and this redirect just happened maybe yesterday. I think I cleared my cache maybe two days ago.rage.gif

Like I said though, It's not too big a deal for me, I just hit "back" and it clears; but I just wanted to bring it up in case it was a problem for Palmtalk in general.

I will be vigilant and report all findings!indifferent0025.gif

Oakley, California

55 Miles E-NE of San Francisco, CA

Solid zone 9, I can expect at least one night in the mid to low twenties every year.

Hot, dry summers. Cold, wet winters.

Link to comment
Share on other sites

http://url123.info/e875cd64

Popup window appears with following message and no apparent way to close:

"Please complete a survey from our sponsors below to view this content.

Save Over $500 a Year on Car Insurance!

Find Out How to Save on Car Insurance!

Upgrade to Internet Explorer 9!

Download and Play The Brain Game!

This website has been temporarily locked. In order to unlock it, you must fill out one of the surveys above completely. These surveys take approximately 30 seconds to 1 minute to complete. After a survey is completed, you will have access to all content on this site for 24 hours."

The main page is greyed out, but I can read a heading: "URL 123, Chopping long links smaller...etc etc... Then above what looks like a full page of print, "Link is missing

This link does not exist yet or it has been removed for some reason." Then there is what appears to be an article about Windows.

Off the upper right-hand corner of the window is a ? (not an x to close the window) Clicking on that takes you to another popup:

http://www.dollarade.com/overlay_help.php

"

How Does This Work?

This website requires you to complete a short offer in order to view their content.

Completing an offer is simple:

1.Click the link of an offer that interests you. There will be 1-4 offers listed in total you may choose from.

2.Fill out the offer using your real information and continue until you reach the last page.

3.Enjoy your content which will be automatically unlocked! It may take up to 30 seconds to validate.

If the content is still locked after 30 seconds, please try a different offer from the list.

Close this window"

I found this by searchin on Google for "Butiagrus" which listed several PT links, and I clicked on one from January 2012.

I had to close the browser window. Now I will clear my cache and see what happens...

Thanks for the info Kim - back to the drawing board.

Thanks to those of you who help make this a fun and friendly forum.

Link to comment
Share on other sites

yep... I get the same thing lately... never used to.

Zone 10a at best after 2007 AND 2013, on SW facing hill, 1 1/2 miles from coast in Oceanside, CA. 30-98 degrees, and 45-80deg. about 95% of the time.

"The great workman of nature is time."   ,  "Genius is nothing but a great aptitude for patience."

-George-Louis Leclerc de Buffon-

I do some experiments and learning in my garden with palms so you don't have to experience the pain! Look at my old threads to find various observations and tips!

Link to comment
Share on other sites

yep... I get the same thing lately... never used to.

Is it another Russian infiltration? :unsure:

Coral Gables, FL 8 miles North of Fairchild USDA Zone 10B

Link to comment
Share on other sites

It does this to me, although I rarely log into Palm Talk this way unless I am looking up a specific palm on Google and it refers me to a discussion on PT. However, I was using two different friend's computers in the last week to get on Palm Talk (setting up one new member), and both re-directed me the first time I tried to get on. Hitting the back space multiple times to get back to Google and then clicking the PT link again gets you right in.

Wayne

52% 9B / 42% 10A / 6% "Other"

Brandon.gif

Link to comment
Share on other sites

  • 1 month later...

I have noticed this recently on my wife's ipad using Safari. I don't normally go to PT from google, but have seen this. I figured my wife had installed some app that was causing the spam.

Robert

Madera, CA (central San Joaquin valley)

9A

Link to comment
Share on other sites

I have the same experience going back a good long time, always this "123" page with a popup. Just tried it on a new search and got it again. (Chrome, Win7 x64)

Michael Norell

Rancho Mirage, California | 33°44' N 116°25' W | 287 ft | z10a | avg Jan 43/70F | Jul 78/108F avg | Weather Station KCARANCH310

previously Big Pine Key, Florida | 24°40' N 81°21' W | 4.5 ft. | z12a | Calcareous substrate | avg annual min. approx 52F | avg Jan 65/75F | Jul 83/90 | extreme min approx 41F

previously Natchez, Mississippi | 31°33' N 91°24' W | 220 ft.| z9a | Downtown/river-adjacent | Loess substrate | avg annual min. 23F | Jan 43/61F | Jul 73/93F | extreme min 2.5F (1899); previously Los Angeles, California (multiple locations)

Link to comment
Share on other sites

Apparently those Russians are at it again. I'll see what I can do.

Thanks to those of you who help make this a fun and friendly forum.

Link to comment
Share on other sites

Yep I have been having the same problem? Not too concerning but a little annoying! Mainly from iPad or I phone?

Link to comment
Share on other sites

  • 3 weeks later...

Is this ever going to be fixed? This is an issue as it prevents other people from finding PT from Search Engines and it is a security risk in that it attempts to load scripts onto your computer.

Len

Vista, CA (Zone 10a)

Shadowridge Area

"Show me your garden and I shall tell you what you are."

-- Alfred Austin

Link to comment
Share on other sites

Is this ever going to be fixed? This is an issue as it prevents other people from finding PT from Search Engines and it is a security risk in that it attempts to load scripts onto your computer.

This will be the third time that we have been hacked again after deleting the exploit. I have again located and removed the offending inserted code that I believe is causing the redirect. And I have a theory as to how the hackers are inserting it.

Please tell me if it is indeed fixed, and immediately notify me if you notice it is again at play. That way I will have a much better chance of tracking down any pathway in the logs. I do not notice this redirect because of the skin I use (it is only in the default skin), and because of the way I access the forum - so I need your help to alert me when it is happening. If you notice this happening again, please double check that you have first cleared your cache recently before letting me know.

Thanks to those of you who help make this a fun and friendly forum.

Link to comment
Share on other sites

No problems this morning. Looks like the problem is fixed for now.

Thanks, I can use some help with this one.

Thanks to those of you who help make this a fun and friendly forum.

Link to comment
Share on other sites

  • 1 month later...

No problems this morning. Looks like the problem is fixed for now.

Thanks, I can use some help with this one.

Thanks for fixing the nuisance redirect from my work computer...Still fixed as of yesterday.

Cindy Adair

Link to comment
Share on other sites

I'd still love to save $500 on car insurance... :crying:

Frank

 

Zone 9b pine flatlands

humid/hot summers; dry/cool winters

with yearly freezes

Link to comment
Share on other sites

Are you inferring that you are still getting that redirect? If so, please let me know.

Thanks to those of you who help make this a fun and friendly forum.

Link to comment
Share on other sites

No redirects for me since you fixed the problem a month ago. Hopefully the car insurance joke was just that.

Grant
Long Beach, CA

Link to comment
Share on other sites

No redirects for me since you fixed the problem a month ago. Hopefully the car insurance joke was just that.

Thanks Grant - the feedback is helpful.

Thanks to those of you who help make this a fun and friendly forum.

Link to comment
Share on other sites

  • 5 months later...

Hi Mods,

Sorry to be the bearer of bad news but this just happened to me! Thought you should know

Thanks for the info. Any chance it could be a cached page?

Thanks to those of you who help make this a fun and friendly forum.

Link to comment
Share on other sites

Hi Mods,

Sorry to be the bearer of bad news but this just happened to me! Thought you should know

Thanks for the info. Any chance it could be a cached page?

It is also happening to me, and the page is the same one.

Link to comment
Share on other sites

This has been on going for 2 or 3 years.

In my post I sometimes express "my" opinion. Warning, it may differ from "your" opinion. If so, please do not feel insulted, just state your own if you wish. Any data in this post is provided 'as is' and in no event shall I be liable for any damages, including, without limitation, damages resulting from accuracy or lack thereof, insult, or any other damages

Link to comment
Share on other sites

Sorry, i'm not that computer savy to check the cache. It just happened again to me though if that's helpful?

Thanks for the response. I have confirmed a similar script from the last one has been reinserted somehow, and in a different location that I can not yet find. It is an interesting exploit, only activated on the first search from a "new" user (or cleaned browser). And after looking around, it is widespread with loads of conflicting info - most notably on the competing software (vBulletin) to ours.

There are even several sites set up claiming and explaining how this "Google Redirect" is a trojan on your own computer (not so), and then offers a fix that if downloaded is its own virus.

I'm working on it - but getting nowhere so far.

Thanks to those of you who help make this a fun and friendly forum.

Link to comment
Share on other sites

Well that was fun. For anyone interested, the script for another exploit was inserted on 11/9 after being clean since May. It was very sophisticated in its coding and disguised itself as code for an Invision Power Board Firewall within one of the config.php files, and tied to the actual javascript in one of the language php files. I was lucky one of the more knowledgeable techs was willing to take the time and help me. I just couldn't find it since it was hidden so cleverly.

I was assured the new security patch released around that same time should keep us clean until the next vulnerability is discovered by these evildoers.

If it pops up again, don't hesitate to let me know. It is not something I will know is happening.

Thanks to those of you who help make this a fun and friendly forum.

Link to comment
Share on other sites

Still does it to me sends me to the same page everytime http://url4short.info/e875cd64

Darn - you are right. It is back. Either they have a back door or a file that will re-write it back in. Back to the drawing board. :(

Thanks for letting me know.

Thanks to those of you who help make this a fun and friendly forum.

Link to comment
Share on other sites

It has again been fixed. I will check over the next few days to make sure it has not returned. But after that, if you experience this problem please notify me - or I might not become aware of it. Thanks in advance for any help.

Thanks to those of you who help make this a fun and friendly forum.

Link to comment
Share on other sites

Happened to me again today

Aloha!

 

Always looking for "Palms of Paradise"

 

Cardiff by the Sea 10b 1/2

1/2 mile from the Blue Pacific

Link to comment
Share on other sites

I used to have this problem and then it went away for six months or so, but have started seeing it again the last few days. Cleared out my cache, etc. and it is still happening. Must be a nasty little virus, worm, whatever...

Link to comment
Share on other sites

It has again been fixed. I will check over the next few days to make sure it has not returned. But after that, if you experience this problem please notify me - or I might not become aware of it. Thanks in advance for any help.

It might be in the database.

Zone 7a/b Delaware

Unusual Plants

Link to comment
Share on other sites

It has again been fixed. I will check over the next few days to make sure it has not returned. But after that, if you experience this problem please notify me - or I might not become aware of it. Thanks in advance for any help.

It might be in the database.

Thanks - at this point I know where it is and how to eradicate it. However, I have been waiting for 4 days for the web host to take the necessary steps to the server before I can begin. And they are not being co-operative - despite repeated requests.

Thanks to those of you who help make this a fun and friendly forum.

Link to comment
Share on other sites

Thanks - at this point I know where it is and how to eradicate it. However, I have been waiting for 4 days for the web host to take the necessary steps to the server before I can begin. And they are not being co-operative - despite repeated requests.

Are you locked in with them for a certain amount of time? I switched to KnownHost back in January and the customer support has been amazing.

Zone 7a/b Delaware

Unusual Plants

Link to comment
Share on other sites

Create an account or sign in to comment

You need to be a member in order to leave a comment

Create an account

Sign up for a new account in our community. It's easy!

Register a new account

Sign in

Already have an account? Sign in here.

Sign In Now



  • Recently Browsing

    • No registered users viewing this page.
×
×
  • Create New...