22 replies to this topic

[Jintan]

Is this more than just Blogger (although I am not familiar with that site)? Redirects to rogue software is more likely but I had never really heard of redirecting to Spyware Doctor. If you would, when you get redirected to that site copy the address in the address bar and paste it here (copy it to an open Notepad then transfer later).


I would not have information about non-IE browser preference settings, so the bast I can offer when seeing the following in HijackThis is to mention to you that if you yourself did not set these, then you can fix them with HijackThis (it would restore default settings). I assume you have Netscape also, and although a Mozilla product am not sure how that might interact with FF.

N3 - Netscape 7: user_pref("browser.startup.homepage", "file:///C:/Documents%20and%20Settings/Russ/My%20Documents/Personal/startpage.html"); (C:\Documents and Settings\Russ\Application Data\Mozilla\Profiles\default\wxpl46jr.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5Csearchplugins%5CSBWeb_02.src"); (C:\Documents and Settings\Russ\Application Data\Mozilla\Profiles\default\wxpl46jr.slt\prefs.js)

[spamgirl]

Is this more than just Blogger (although I am not familiar with that site)?

Yes - it happens on random sites that seem to have nothing to do with each other... many times it happens on my own sites.

Redirects to rogue software is more likely but I had never really heard of redirecting to Spyware Doctor. If you would, when you get redirected to that site copy the address in the address bar and paste it here (copy it to an open Notepad then transfer later).

I did that, but as I went to copy it the site changed and emptied my clipboard next time I'll take a screencap lol

I would not have information about non-IE browser preference settings, so the bast I can offer when seeing the following in HijackThis is to mention to you that if you yourself did not set these, then you can fix them with HijackThis (it would restore default settings). I assume you have Netscape also, and although a Mozilla product am not sure how that might interact with FF.

N3 - Netscape 7: user_pref("browser.startup.homepage", "file:///C:/Documents%20and%20Settings/Russ/My%20Documents/Personal/startpage.html"); (C:\Documents and Settings\Russ\Application Data\Mozilla\Profiles\default\wxpl46jr.slt\prefs.js)
N3 - Netscape 7: user_pref("browser.search.defaultengine", "engine://C%3A%5CProgram%20Files%5CNetscape%5Csearchplugins%5CSBWeb_02.src"); (C:\Documents and Settings\Russ\Application Data\Mozilla\Profiles\default\wxpl46jr.slt\prefs.js)

Netscape is gone, I removed it last night before the redirect happened again. I did set both those preferences myself, anyway...

Edited by spamgirl, 08 August 2007 - 02:19 PM.

[Jintan]

If you could capture some info on that redirect perhaps it would help with where we should be looking.

[spamgirl]

If you could capture some info on that redirect perhaps it would help with where we should be looking.

As soon as it happens again I will - problem is it only happens every 2 weeks or so... I'll update this thread as soon as it does.

[Jintan]

I wasn't aware it is so infrequent - that is more likely to be something on the site itself than on your computer. But yes, post back when it happens again to be sure.

[spamgirl]

I wasn't aware it is so infrequent - that is more likely to be something on the site itself than on your computer. But yes, post back when it happens again to be sure.

The issue is that it happens on different sites (FOX news, blogger, CNN, my own sites, eBay a few times...), and I use the same sites every day (I'm not much of a surfer)... you'd think if it was related to any of those sites, and was on a "timer" to happen later (and thus on a different site) that it would happen more frequently? Or, at least, at the same time of day as I do the same things every day (boy, am I boring :/ )

[Jintan]

The rarity of the event, and the fact it is not a more questionable software being suggested, less and less suggests infection than some particular site activity, but capture the info and let's see. Don't post in this thread until then so I will more readily see the new response (of course unless something new occurs).

[spamgirl]

It happened again... I've attached a pic of what came up in order - after that last one I just ctrl-alt-deleted. I was on CNN.com

Attached Thumbnails

•