Strange Redirects

[Iceaxe]

Anyone else getting strange redirects when clicking on Bogley links?

Because I'm getting strange redirects and the only place it's happening is Bogley and one other forum I visit running the same type software.... it's happening on two of my computers and I have run every virus scan I have and my computer is clean..... it's happening in both iExplorer and Firefox....

So I'm starting to think the problem is not on my computer....

[accadacca]

Nah, not for me. Where are the links taking you? Examples please.

[Iceaxe]

Usually it tries to open up a second window.... but my firewall blocks the second window from loading so I just get the typical webpage not found screen....

I'll take a screen shot and post next time it takes me to an actual webpage.... it's not redirecting to porn....

[Sombeech]

Not for me either. Can you show a link and where it took you?

Are they taking you to another bogley thread, or off site?

[accadacca]

Sounds like Malware... :ne_nau:

[Iceaxe]

Last click took me here:

http://wordslife.com/ads.php

And I've done every scan imaginable to try and find the problem.....

[Deathcricket]

Last click took me here:

http://wordslife.com/ads.php

And I've done every scan imaginable to try and find the problem.....

Tried a different browser? IE or Firefox both redirect? I've seen a weird malware lately that installs a 2nd LAN connection and runs it's own DNIS server through that to generate weird crap. Almost looks like it directs you to funky sites to generate ad revenue. Check and see if you have 2 installed. Unless you have 2 LAN cards in your machine, try the other one and see if you get the redirect.Then uninstall the malware one.

[greyhair biker]

I'm having no problems whatsoever here. opened a dozen tabs at once and no prob. I like my new sony viao:nod:

[Iceaxe]

Tried a different browser? IE or Firefox both redirect? I've seen a weird malware lately that installs a 2nd LAN connection and runs it's own DNIS server through that to generate weird crap. Almost looks like it directs you to funky sites to generate ad revenue. Check and see if you have 2 installed. Unless you have 2 LAN cards in your machine, try the other one and see if you get the redirect.Then uninstall the malware one.

Yes, it redirects in both IE and Firefox. And it does it on two different computers.

[Iceaxe]

OK... someone told me my router might have been hacked...

[Iceaxe]

OK.... I think I found the malware.... or the results of the malware..... It was hidden on my router.... I've been chasing that sucker for a month and I knew my computers were clean. I found the problem by locating some strange DNS addresses on my router. I'll let you know how it goes. If anyone else has a similar problem rebooting the router to the factory defaults gets rid of it. The malware can attack if your routers password is admin or administrator, so make sure you change your router password from the factory default.

[Iceaxe]

For those of you computer nerds who are into this type of thing......
This was actually a pretty interesting virus. Someone is probably banking some major coin with it. From what I can tell my internet was routed through a proxy server..... and about every 20th click I made any where on a website running "Google Ads" I would get redirected to someone's Google Ad, even though that is not what I clicked.... but the website running google ads (in this case Bogley) was not getting the credit for the ad... the proxy server doing the redirecting was getting the credit by routing you through their webpage.....

I've dealt with viruses and malware forever.... but this one was the hardest one to find by far. Once you know what to look for it's easy to fix, but none of the scanning tools have checked your router for bogus DNS settings. Set your router password to something unique to protect yourself from becoming infected.

[DaveOU812]

I've been having this problem too. Glad I found this thread. I did the same thing you did. Tryed every scan I could come up with and it still would redirect. I'll try resetting the router today after I wake up and let you know how it goes. Thanks Ice

[Sombeech]

So you're just unplugging your router to reset? Or pushing the reset button?

[Iceaxe]

Pushed the reset button.... so that the router defaults to all the preset factory settings. Just turning on and off the router will do nothing to correct the problem.

Below is how my router should look when set correctly.

When I had the malware I noticed the following settings:

Static DNS 1: 213.109.67.166
Static DNS 2: 213.109.73.41

There might have been other settings that were messed with but these are the ones I know were messed with.

36139

[asdf]

I have been dealing with FireFox google redirect java script on one of my machines. Of course started with the basics (disable system restore... safe mode....) then scanned with

hitman pro
malware bytes
spybot
AVG

All programs find something but it always pops back up in a few hours.

Disabled java and google turns into a blank page, so its running as a script with in the browser itself. Only info I have been able to dig up has pointed me to a thread on bleepingcomputer that's only a few hours old with no reply's.. what fun.

ran combofix and just lost the google search box in FF
working on getting that back to see if its really fixed