Browser hijacking warning on Nexus!

[Darkrder]

Hard to describe, the page sort of went black as if redirecting, but it still said "Nexus (Not Responding)" at the top. I didn't get redirected to another page, so it more closely behaved like a freeze.

[buddah]

I was redirected both times to a bogus site claiming my PC was infected and that it was running a scan. I couldn't close the page. A "warning" pop up forced FF to freeze and stay open and in the end, I had to use the task manager both times to close it.

 

I'm really using just basic plug ins in my browser. Nothing fancy. Adobe Acrobat, Java, Quicktime, Real Player, Shockwave. That's about it really. To answer one of the next spate of questions: No, I have not changed anything in my browser today or indeed in the last month at least.

 

 

That does sound like a hijacking......using an exploit in java if memory serves.....it says what you say and is almost impossible to close. Ran across it just the other day.....it is a scam, allowing it to run with give you a bug.......removing it is a mother, unless you buy their removal tool.

 

Try logging out and deleting you cookies and cache for this site. Log back in and see if it happens again, the way that one works is you pick it up innocently embedded in a page and it does not execute until java is used, then it redirects you to their page.

 

In case you did get a bug, go to the ms windows update site and download and execute the latest malware removal tool and run it.

 

If it is something on the site....we have to wait for Dark0ne to check that out, nno one else has access to the server logs and some other interesting places to check to see if it originated here.

 

I checked yoour page, all the tabs, downloaded the file....looked at the admin functions, checked the ratings and comments and had no trouble.

 

Buddah

[buddah]

Hard to describe, the page sort of went black as if redirecting, but it still said "Nexus (Not Responding)" at the top. I didn't get redirected to another page, so it more closely behaved like a freeze.

 

 

Although I have not seen one for a while, it may have been a IPS Driver error causing it to hang up. We had been under a Dos//DDos attack for a time and on the 14th, Dark0ne added in some new security to preclude the Dos getting through unimpeded and it seems to have done the trick and almost eliminated the IPS errors.

 

I know I will freeze mine if I have too many tabs open.......something over 60 and I will lock up tight requiring a hard restart of the computer to clear it, but that is not specific to this site and it happens at various places.....I chase links to downloads and keep all tabs open to back track and I just push it out till the allocated assets are depleted and then I pay for it.

 

I downloaded 50 files earlier tonight, no problems...cleared a dozen reports out of the site admin section, some forum reports and have had no issues.

 

Buddah

[WhoGuru]

Well, so far so good. I logged out, cleared the cache and logged back in. I've not gotten redirected again yet and I visited several download pages including the ones I was jacked on earlier.

 

Now, the copy of Java we're using is, I believe, the latest version or latest but one. I'll have to check. We check for updates monthly for the plug ins. Is this exploitable weakness a property of the newer versions or older?

 

 

 

 

Edit: Just checked. I was using the last most recent version. Just updated to the newest.

[buddah]

It was in a previous version of java, and was fixed a while ago...if you are using an older version that may be it. Or it could be a new one. I work indirectly for MS...don't hate me, the company I work for is in partnership with MS for HSI/DSL. I read it off the company white board (a technician based info board, where we keep each other informed of problems and solutions) a few weeks back.

 

Although the exploit is directed at IE, because of the common base files that Firefox uses, it can also get hijacked.

 

If any one else gets that redirect, please let us know so we can have a look.

 

Buddah

[WhoGuru]

Well, if the problem was sorted out of older versions of Java then it appears to have resurfaced in a newer version as I was using the most recent but one until 20 minutes ago.

 

I'm not an MS hater. You're safe. :biggrin: I happen to like it...most of the time. LOL

 

If I hear from anyone else that they've had this problem, I'll be sure to direct them here and let you know. Thanks for the help!

 

~Red

[WhoGuru]

Well, Nexus just tried to hijack my browser again. I was doing a search for a mod at the time. When I hit enter to start the search, I got a pop up asking me if I was sure I wanted to navigate away from the page.

 

Once again, I was forced to use the Task Manager to kill FireFox as the bloody pop up wouldn't let me close the page. It didn't manage to actually redirect me this time, so I'll attribute that to my having upgraded Java to it's most recent version.

 

Has anyone taken a look at this yet? I wonder how many others have experienced this problem but, as most people do, not bothered to post anything about it.

 

I know you guys have your hands full daily so I appreciate any help you can give. The download pages are cooperating again for me now, but that it keeps happening tells me there's a bug lurking somewhere.

 

Thanks again.

~Red

[Dark0ne]

If this happens again and is at all possible please take a printscreen of what you are seeing and try to get a picture of the ad that is doing this as well and send it to me or attach it in this thread. It will make finding the culprit advertiser that much easier to find and remove!

 

Thank you!

[buddah]

Well, Nexus just tried to hijack my browser again. I was doing a search for a mod at the time. When I hit enter to start the search, I got a pop up asking me if I was sure I wanted to navigate away from the page.

 

Once again, I was forced to use the Task Manager to kill FireFox as the bloody pop up wouldn't let me close the page. It didn't manage to actually redirect me this time, so I'll attribute that to my having upgraded Java to it's most recent version.

 

Has anyone taken a look at this yet? I wonder how many others have experienced this problem but, as most people do, not bothered to post anything about it.

 

I know you guys have your hands full daily so I appreciate any help you can give. The download pages are cooperating again for me now, but that it keeps happening tells me there's a bug lurking somewhere.

 

Thanks again.

~Red

 

 

Yes Dark0ne is aware of this and is looking into a solution. It only happens to a few people, and is usually triggered here where java is heavily used.

 

Here is one of the possible causes:

 

The user's computer is infected with adware/spyware/a virus that is calling up infected pages at random or when certain criteria are met

 

Since the issue is not widespread, this may be the probable cause.

 

It could also have other sources, which are another issue completely...I hope not.

 

Buddah

 

Edit: Speak of the devil!

[WhoGuru]

:wallbash: Ugh. I should have thought to grab a screenshot of the page. I WILL remember to do so the next time it happens. Thank you very much for taking the time to respond.

 

My PC is currently clean. Whenever something like this happens, the first thing we do is check for viruses/spyware/malware etc... My husband is a bit of a paranoid about that type of thing. :biggrin:

 

Thanks again guys and I will be sure to grab a screenshot next time. :thanks:

 

~Red