I think this is an adware question...

My main internet activity is doing Google/Yahoo searches. I'm using the book 'Google And Other Search Engines'. My major problem is that maybe one out of ten sites that show up on a search (lets say 'HDCP and Microsoft') seem to be bogus. They sound like exactly what you want, but the instant you click on such a site, you get re-directed to some differert site....usually a 'hostage' site, or one armed with a popup-type forced downloader. I'm wondering if anyone knows how to escape these sites (other than re-boot)? I'm currently using public computers, but plan to get home PC this year, and hope to have some defense against this pain in the rump before then!

Some of the risk might be mitigated by using the immunize feature of Spybot Search and Destroy. It will cause "known bad" domains to resolve to 127.0.0.1 [localhost].

Another way to prevent this, is to use either NoScript with Firefox, or disable scripting in whichever browser you are using. With NoScript, it is easy to tell the browser to allow scripts from certain sites if you decide that they are safe for use.

Although, chances of being able to do this may be slim as it is a public computer which is most likely locked down for public users..... but then again dot dot dot :p


CTO

You can certainly set FF to report redirects and let you block them.There are a variety of tools that rate sites in Google searches at least. I believe MCAfee do a free one, and possibly AVG?

You might also look at sandboxed browsing such as Sandboxie and Fortres Grand?

With public computers it is down to the administrator to set the security. You might be able to pursuade them to implement some of these options, but I wouldn't hold my breath waiting :D

Sounds like that computer's infected. Redirects are symptomatic
of trojans and viruses. If you can, check the LAN settings in
the "Connections" tab under "Internet Options" in the "Control
Panel" and see if a proxy is enabled. Trojans will often add a
proxy setting.

If it's not your PC, you should check with the admin before
toggling (changing) anything.

Give WOT a try

http://www.mywot.com

Nihil, doesnt Winpatrol also harass you if someone is trying to change your default home page?

Hi Cider,

Yes, Winpatrol monitors for system changes. I would also suggest looking at Tall Emu's (yes they really call themselves that :D) "Online Armor" which is a combined firewall and behavioural monitoring suite, and the free version of AdAware, which seems to have sharpened its act up of late, as it now scans interactively as well.

This is my wife's newest computer and it is running Wot and McAfee Site Advisor, as well as Winpatrol, Online Armor, and Avira. No problems so far.

For general internet browsing we use FF, as it has a wide range of security plugins, and will also warn you about homepage changes. There is a plug-in that will tell you (in the system tray) what site you are really on, so you can check it before entering personal or financial details.

I think that we have two basic issues here?

1. Is the site what it claims to be.
2. Does the site try to infect or hijack you?

Unfortunately, the latter frequently involves sites that are fundamentally legitimate, but have been infected themselves. The former is generally just a waste of your time unless you start clicking on links.

Bizzarely, you are probably safer surfing pr0n sites than that of your local police force! I saw a recent analysis of infected sites (>700) that showed that only 1 in 100 purported to be of an "adult" nature.

Well, that's my excuse and I'm sticking to it! :D

I also believe that part of the trick is to get familiar with search engine results?

The site may look like what you want, but is the address plausible and does the description contain anything that is obviously off topic and irrelevant?

Sites like that you don't bother to visit because it is an obvious ploy to confuse automatic content filters ;)

I would also recommend checking your browser to see if it will block redirects............FF certainly does and asks you if you want to allow it on an event by event basis.

you can download malwarebyte, it's a great soft to solve problem!

Your problem is local policy. You're not worthy enought to have any privileges on a computer. Reinstall, add a guest account, edit and the group policy.

@xtreme164

Quote:

---

you can download malwarebyte, it's a great soft to solve problem!

---

The free download version of Malwarebytes is an on demand scanner only. I agree that it can be useful in solving problems but I think that Varsel's question is how not to get the problems in the first place?

I am afraid that I cannot comment on the commercial version as I have never used it.

@The-Spec:

Quote:

---

Your problem is local policy.

---

More likely a lack of it? :D

From Varsel's original post:

Quote:

---

I'm currently using public computers, but plan to get home PC this year, and hope to have some defense against this pain in the rump before then!

---

So it is the public site's administrator's responsibility.

Quote:

---

You're not worthy enough to have any privileges on a (public) computer.

---

True, the doctrine of least privilege should apply, but I doubt if it does to many public installations as the admins couldn't give a rodent's rectum.

Quote:

---

Reinstall, add a guest account, and edit the group policy.

---

But not on a public computer.........it isn't yours. ;) Also, I don't believe that a reinstall is required. When you have your own machine use a least privilege account, and use the Windows "run as" option if you need to escalate it.

The problem would seem to be that a lot of legitimate sites redirect you for perfectly legitimate reasons. At the end of the day it is up to you, the user, to decide whether to clicky clicky?

A little common sense can go a long way............for example: "what is the name of the site?.........does that really sound like the kind of site that would have the information I am looking for?". Remember that search engines can be fooled, and frequently are :eek:

Quote:

---

Also, I don't believe that a reinstall is required.

---

Of course it is. Why sfc /scannow then replace all those rootkit'ed system components just for a few word documents.

Hell, computers are so cheap and disposable these days why not just buy another one while you're at it.

Errrrrrrrrrrrrrr................

Quote:

---

Of course it is. Why sfc /scannow then replace all those rootkit'ed system components just for a few word documents.

---

I think that one of us must have misread this post? the guy hasn't even got his own computer yet?.........he is using public libraries, school, etc. He would be a damn fool to leave any personal documents or anything on a public access system, over which he has no authority?

I also note that he is using a book on search engines.............that will tell him how they should work, but I feel that it is up to you and I to tell him how they actually work? ;)

For example, I was intrigued the other day when searching for a driver for some old bit of crap...........I got a Bhuddist site in the first 30????????

Hell, I didn't know the thing needed praying for :D