Dan wrote:
Thanks for the replies. Oddly enough, the phenomenon has disappeared
as quickly as it came. At the risk of seeming paranoid, this makes me
think it wasn't something on my particular pc, but rather like someone
having hacked the weatherunderground site to redirect people. Hate to
sound like a "conspiracy theorist", but it's hard for me to imagine
how the redirection could simply cease if it originated on my end,
since I had basically done nothing after running the scans which came
up empty (and after which the situation persisted), not even a
reboot. Strange.
Dan
Reg Mouatt wrote:
On Sat, 16 Oct 2004 13:37:09 -0400, Dan <[EMAIL PROTECTED]>
wrote:
I'm using Mozilla Firefox 0.8 as my default browser on a win2k
machine. Today I attempted to
go to www/weatherunderground.com, a popular site I visit fairly
regularly. The weatherunderground page loaded momentarily, then I was
redirected to
http://images.specificclick.net/contents/546/layout6_720x300.html,
which
in FF appeared as a blank page. I attempted to load weatherunderground
in IE, where it loads as usual. Out of curiosity, I went to the URL of
the hijack page in IE, where it does indeed load & plays an anti-John
Edwards propaganda video. No other pages have so far been
redirected in
this way & my homepage remains Google. Regardless of one's political
leanings, rather than being swayed I can't imagine anyone being
anything
but disgusted by such a sleazy tactic. Anyway, regarding the security
aspects of this, I have run up to date Spysweeper (which runs all the
time, as does Ad-Watch) and it has found nothing. Neither have
CWShredder, AdAware or Spybot SD. Startup & running processes look
normal. A text search of both the registery & the HDD for a portion of
the hijack URL "specificclick" also yielded no result. Where/how is
this
hijacking likely to be taking place on my machine how can it be
removed?
TIA
Dan
Hi Dan,
You might like to have a look with HijackThis; available from
http://aumha.org/free.htm
Search down the left column for it and go from there.
Post the result in
http://hijackthis.de/index.php?langselect=english
or if that is not successful, try this
http://forum.aumha.org/viewforum.php?f=30&sid=879388364285a5047dd18cb97709ef64
Good luck,
Reg
Maybe not so mysterious. Maybe the servers default page was hijacked, a
process where someone hacks into the server and substitutes the default
usually the index.html page with one with a redirect to the other site.
Although not as common occurrence as in the past this still does happen.
And then the folks at weatherunderground discovered the problem and
restored their index page. Most likely had nothing to do at your end and
your browser. If you continued to be redirected where other were not I
would suggest to check and see if you had a 'hosts' file hack.
--
Take care,
Jonathan
-------------------
LITTLE WORKS STUDIO
http://www.LittleWorksStudio.com
_______________________________________________
Mozilla-security mailing list
[EMAIL PROTECTED]
http://mail.mozilla.org/listinfo/mozilla-security
