Victim of redirecting?

[iceblue]

recently ive been sent to other pages while accessing some sites and i think it might be some kind of virus (trojan?) or js annoyance... anyhow does anyone have any idea what this is?

[JonnyBo]

something in your regestry... not a trojan
more like somethign got installed on your pc, and they put a little something extra in, some times through java apps

[deadkenny]

From what you've posted it's not clear what it might be. What exactly do you mean by 'redirected'. Like pop ups or your sole IE window goes to another address? Anyway, you are actually in the best position to narrow it down. I would suggest you start with a virus scan and an adware scan.

[muchmark]

I would run Ad Aware (http://www.lavasoftusa.com/) and a Anti Virus prog just to be safe.

[AllGamer]

Originally posted by iceblue
recently ive been sent to other pages while accessing some sites and i think it might be some kind of virus (trojan?) or js annoyance... anyhow does anyone have any idea what this is?

Make sure your Antivirus is working and up to date

i suggest Norton Antivirus 2003

run Ad-Aware

consider also a Firewall like

Norton Internet Security 2003

:t

[user0209]

hehe

uhh are you sure it's not the site's intention to re-direct its visitors to another page?

look into that first man. :)

[AllGamer]

Norton Internet Security 2003
and
AD Remove
will also prevent that

also it's a build in Feature of Mozilla / Opera :t

[iceblue]

i have both programs, and av auto-protect is always on whenever the comp is humming.

i just scanned 2x using ad-aware 5.80 got a few detects, and after clearing em, tried one of the sites again (this site views correctly on other comps), and still getting the same incorrect page. so i went to the ad-aware page to get the latest version, scanned again (complete scan; no new detects).

Nothing could have gotten past my auto-protect, and nothing did. the full computer scan with latest virus defs resulted in no infection found..

-i have zonealarm pro and have never been hacked before. all the errors were just program blocks, ect.

[iceblue]

Originally posted by user0209
uhh are you sure it's not the site's intention to re-direct its visitors to another page?

the site is my domain + many others. i wouldnt stick a redirect in just to pass the time.

(the above states that this page works on other computers in many different locations, and isp's)

[AllGamer]

might be a problem with your browser then

try Mozilla or Opera and see if the same happends :t

[Rocketmech]

Too me it sounds like typical website hijacking. Sometimes these sites or banners are spoofed. Next thing you know your wisked away to another site , maybe a continuous unending journey that wont stop unless you hit Control Alt Delete.
Its not really a trojan. I find that deleting all your Temp files, Temporary Internet files, all your Cookies will usually rid the problem. However, I would look in the registry RUN keys for anything unusual and delete it. If you do let us know.

HKLM\SOFTWARE\Micrsoft\Windows\CurrentVersion\Run

also \Runonce , \RunonceEX, or any "Run" variant.

The other thing is to contact the website and complain.

[iceblue]

great advice, i tried it all.. cleared temp, internet files, cookies (forgot many passwords that i needed after this), and the registry RUN keys... nothing suspicious. :D :D NEWS FLASH! :D :D while replying i fixed it! i think it may have been this trojan: QO WebDL


Downloader
This is a small program that will connect to a web site or ftp server, download and execute another trojan.


crappy norton.. i dont trust that anymore. this never happened to me before either.. definitely some mischievous kiddie that intentionally infected my comp when i wasnt around.

[Giblet Plus!]

I hate script kiddies! :p

[AllGamer]

I think your Antivirus is Broken
by that i mean
uninstall then re-install

norton has never failed to me

so it must be something wrong with the config in your PC :t

[Rocketmech]

A good idea is to run another AV. Web based is helpful. Getting a second opinion is always good. Theres a couple good free ones,

MicroTrend Housecalls
AVG
Moonsoft , The Cleaner (30day trial)

*Keep them updated.

[AllGamer]

Originally posted by Rocketmech
A good idea is to run another AV. Web based is helpful. Getting a second opinion is always good. Theres a couple good free ones,

MicroTrend Housecalls
AVG
Moonsoft , The Cleaner (30day trial)

*Keep them updated.

for example this one is FREE from Symantec
http://security.norton.com/default.asp?langid=us&venid=sym

[iceblue]

it probably never failed me. also quite easy for the intruder to simply click "disable", do his thing, and be on his merry way.. i wouldnt find out (due to the nature of this particular virus).

[iceblue]

also i occasionally run housecall to double the protection. for a long time i had the cleaner too. i practically check for updates everyday on all my virus detection software including non-av apps.

[cheekymonkey]

I had the same problem, whenever I put in www.google.co.uk I got sent to the new HP's site??!!
I contacted Google and they said nothing to do with them so I checked all the registry keys and nothing there, re-installed anti-virus (Sophos) and this PC is at work so I'm limited as to what else I could run. Our connection goes through a proxy server and a firewall and any pop-up ads are also suposed to be blocked.

The strange thing was, it didn't always do it?!

I was definitely typing it in right and sometimes it would do it, then it could be OK for a week, then do it again all day or something.

I tried deleting all temp files/cookies/everything with no luck.
I've upgraded to Win2000 from 98 now anyway and it's gone.
I found that a fresh install of Win98 did work though so it must be something in the registry or hidden away somewhere.
It never bothered me that much anyway 'cos its at work and if I typed www.google.com it was always OK.

[iceblue]

its back...!!:mad: :confused:

[AllGamer]

what is back?

[steve.p]

Think i have the same problem ,i try to go to viahardware.com and always get redirected to sudhian.com
running MCAFEE6.0, zonealarm free and adaware . All have detected nothing.

[Rocketmech]

Its my understanding that Viahardware is now Sudhian Media. Hence the redirect.

Iceblue

Are you on a LAN? Have you scanned from dos?

[Rocketmech]

Give this site a thorough look . You 'll be surprised whats around these days, and you might find whats ailing your pc.

http://www.cexx.org/adware.htm

[iceblue]

im on LAN yes (what difference does it make?)... but how am i gonna scan from dos? i dont think norton av 2002 offers dos scanning in xp. would safe mode do the same job?

[Malikorn]

For extra protection of such stuff you should try to disable active scripting which is in IE5 or 6 under the menus:tools->Internet options->security->custom level->disable active scripting... with this you ll never redirect to a page (if its not a program which runs in the background), but you will not be able to open some pages. But it is quite a good solution in our days for safer surfing ;)

[Rocketmech]

Your right, NAV 2002 does'nt offer rescue disks for W2K or XP. Its best to repair any virii with the LAN disconnected. You should reset your Firewall permissions to "prompt for access" on all ports till your sure your clean.
You have'nt told us the specifics of the websites. Are they all the same and are the redirects repeated or same? You do know that some shaddy websites do this deliberately... :eek:
I have forgotten " disable active scripting " , good call Malikorn.

[jad1097]

Norton has failed me in the past too. Always check with two or more virus scanners.