Thanks for the replies. Oddly enough, the phenomenon has disappeared as
quickly as it came. At the risk of seeming paranoid, this makes me
think it wasn't something on my particular pc, but rather like someone
having hacked the weatherunderground site to redirect people. Hate to
sound like a "conspiracy theorist", but it's hard for me to imagine how
the redirection could simply cease if it originated on my end, since I
had basically done nothing after running the scans which came up empty
(and after which the situation persisted), not even a reboot. Strange.
Dan
Reg Mouatt wrote:
On Sat, 16 Oct 2004 13:37:09 -0400, Dan <[EMAIL PROTECTED]>
wrote:
I'm using Mozilla Firefox 0.8 as my default browser on a win2k machine.
Today I attempted to
go to www/weatherunderground.com, a popular site I visit fairly
regularly. The weatherunderground page loaded momentarily, then I was
redirected to
http://images.specificclick.net/contents/546/layout6_720x300.html, which
in FF appeared as a blank page. I attempted to load weatherunderground
in IE, where it loads as usual. Out of curiosity, I went to the URL of
the hijack page in IE, where it does indeed load & plays an anti-John
Edwards propaganda video. No other pages have so far been redirected in
this way & my homepage remains Google. Regardless of one's political
leanings, rather than being swayed I can't imagine anyone being anything
but disgusted by such a sleazy tactic. Anyway, regarding the security
aspects of this, I have run up to date Spysweeper (which runs all the
time, as does Ad-Watch) and it has found nothing. Neither have
CWShredder, AdAware or Spybot SD. Startup & running processes look
normal. A text search of both the registery & the HDD for a portion of
the hijack URL "specificclick" also yielded no result. Where/how is this
hijacking likely to be taking place on my machine how can it be removed?
TIA
Dan
Hi Dan,
You might like to have a look with HijackThis; available from
http://aumha.org/free.htm
Search down the left column for it and go from there.
Post the result in
http://hijackthis.de/index.php?langselect=english
or if that is not successful, try this
http://forum.aumha.org/viewforum.php?f=30&sid=879388364285a5047dd18cb97709ef64
Good luck,
Reg
_______________________________________________
Mozilla-security mailing list
[EMAIL PROTECTED]
http://mail.mozilla.org/listinfo/mozilla-security
