X
Tap here to go to the mobile version of the site.

منتدى الدعم

How to stop redirecting

Posted

When I go to att.net to check email, firefox takes me to several other sites, one of which sends me a scare screen, hoping I will click on it. I suppose you would call this malware. Is there a setting in FireFox to prevent it from going to sites I did not ask it to?

I will try to add a screen capture of the offending screen.

Following is the history: organized with the latest url at the top

https://d1nkumj01332kz.cloudfront.net/v9/message.html?trk=pastion-taried.com&osv=Windows%207&ip=68.9.218.120&cep=Arlv8CdOOItkJhjZiqjWtc_dz4esh_NjdLQUjEkcJG4EstRKPvC-T1x-p8CLQCEKPdLVq1vAI01ZXF0ZpZb7Yrqk-J1N7cnjbPD-TGYkD6Jrpptyq-7JN5P_fGcxD-lphScPR6n1jlg-9fKPprik8NBIm2e7wnoegS_grOWQ63_RdjZ_YSBjW3EXC5Y3pSvtpHooavZBVbXvhJzV5W4ZY7j3MqYj3Upnkue8tw0QsKVvBNuW3Q99pDdumJe3x_BX&zone=1806387-3979200730-0&country=US&time=1544806702&cid=15448067011141496440142440166805814

http://nextoptim.com/script/s2iurl.php?csid=1806387&md=0&s1=13342&stamat=m%7C%2C%2Cg2E243YnoGU3BJ9GH0dEdHP3xP.810%2CiOUtIegL3mbO-vonTaZuRA0gW4cCSrDZ76LeWOYcSPw0OBHaGS1O1cpEPIc_vIDmqFZMwgZmvp7t_5_-We0_82xdkStb9eJzz2p3612WZ3D8GcOte2NQC2u-1l1Vv1oeJjLh5tYpMIitIRlmZYB_OUHCEQMF0TvPrnGRYamWNb8xLFa-Rwbd7lI548BMtLLxXdrA-RlFEzIq2U7gSNkpr7kIOe6eHUvmKh3G8DVti7euSRTqkXxvH1VzgoLlqlq7kUiq4Hiyqy8rTukaVYut9Vwsgo7YFYomkmYwGdowz_6ZcDeAC0Y4kBTg4hP5jNmRkP8egC0xHDCWWeRanOtTuS9ADCtaIwH6MBjaCYa0k07Jc4GX-6j1ieuQ4CkXZ0-85pm9uBc95JZfGlj5TNKj8A%2C%2C

https://advertisingfeed.com/click?node=1&time=1544806680&id=47&pid=8&fid=8&sid=13342&rank=0&ad=eyJ0aXRsZSI6IiIsInVybCI6IiJ9

https://serviceoperative.com/out?out=https%3A%2F%2Fcreativechecker.com%2F%3Fpid%3D8%26sid%3Dstream%26kw%3Dbuy%26f%3Dclick%26bu%3Dhttps%253A%252F%252Fserviceoperative.com%252Fclick.php%253Fkey%253Dg6xhj2igkvvbntwx10jd%2526t1%253Dzone%2526t2%253Dstream%2526t3%subzone%2526cost%253Dusdcost

https://cpmazu.com/w/1.4/1201031004.js?pubid=ba9b94jj&domain=start.att.net&t=Ag9ZUVtbcHJrcHQEHVZCRFtue3FudAQGT0hBU3Ryf3FyFGc6

https://start.att.net/

[Links deactivated by moderator.]

When I go to att.net to check email, firefox takes me to several other sites, one of which sends me a scare screen, hoping I will click on it. I suppose you would call this malware. Is there a setting in FireFox to prevent it from going to sites I did not ask it to? I will try to add a screen capture of the offending screen. Following is the history: organized with the latest url at the top https://d1nkumj01332kz.cloudfront.<!-- -->net/v9/message.html?trk=pastion-taried.com&osv=Windows%207&ip=68.9.218.120&cep=Arlv8CdOOItkJhjZiqjWtc_dz4esh_NjdLQUjEkcJG4EstRKPvC-T1x-p8CLQCEKPdLVq1vAI01ZXF0ZpZb7Yrqk-J1N7cnjbPD-TGYkD6Jrpptyq-7JN5P_fGcxD-lphScPR6n1jlg-9fKPprik8NBIm2e7wnoegS_grOWQ63_RdjZ_YSBjW3EXC5Y3pSvtpHooavZBVbXvhJzV5W4ZY7j3MqYj3Upnkue8tw0QsKVvBNuW3Q99pDdumJe3x_BX&zone=1806387-3979200730-0&country=US&time=1544806702&cid=15448067011141496440142440166805814 http://nextoptim.<!-- -->com/script/s2iurl.php?csid=1806387&md=0&s1=13342&stamat=m%7C%2C%2Cg2E243YnoGU3BJ9GH0dEdHP3xP.810%2CiOUtIegL3mbO-vonTaZuRA0gW4cCSrDZ76LeWOYcSPw0OBHaGS1O1cpEPIc_vIDmqFZMwgZmvp7t_5_-We0_82xdkStb9eJzz2p3612WZ3D8GcOte2NQC2u-1l1Vv1oeJjLh5tYpMIitIRlmZYB_OUHCEQMF0TvPrnGRYamWNb8xLFa-Rwbd7lI548BMtLLxXdrA-RlFEzIq2U7gSNkpr7kIOe6eHUvmKh3G8DVti7euSRTqkXxvH1VzgoLlqlq7kUiq4Hiyqy8rTukaVYut9Vwsgo7YFYomkmYwGdowz_6ZcDeAC0Y4kBTg4hP5jNmRkP8egC0xHDCWWeRanOtTuS9ADCtaIwH6MBjaCYa0k07Jc4GX-6j1ieuQ4CkXZ0-85pm9uBc95JZfGlj5TNKj8A%2C%2C https://advertisingfeed.<!-- -->com/click?node=1&time=1544806680&id=47&pid=8&fid=8&sid=13342&rank=0&ad=eyJ0aXRsZSI6IiIsInVybCI6IiJ9 https://serviceoperative.<!-- -->com/out?out=https%3A%2F%2Fcreativechecker.com%2F%3Fpid%3D8%26sid%3Dstream%26kw%3Dbuy%26f%3Dclick%26bu%3Dhttps%253A%252F%252Fserviceoperative.com%252Fclick.php%253Fkey%253Dg6xhj2igkvvbntwx10jd%2526t1%253Dzone%2526t2%253Dstream%2526t3%subzone%2526cost%253Dusdcost https://cpmazu.<!-- -->com/w/1.4/1201031004.js?pubid=ba9b94jj&domain=start.att.net&t=Ag9ZUVtbcHJrcHQEHVZCRFtue3FudAQGT0hBU3Ryf3FyFGc6 https://start.att.net/ ''[Links deactivated by moderator.]''
Attached screenshots

Modified by Chris Ilias

Additional System Details

Installed Plug-ins

  • Shockwave Flash 32.0 r0

Application

  • User Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:64.0) Gecko/20100101 Firefox/64.0

More Information

WestEnd
  • Top 25 Contributor
60 solutions 5379 answers

Sounds more like your clicking a malware link is what it looks like. Firefox has no control what happens when you click on links. If you don't know or requested that email mark it SPAM and inform your email provider of the email.

Sounds more like your clicking a malware link is what it looks like. Firefox has no control what happens when you click on links. If you don't know or requested that email mark it SPAM and inform your email provider of the email.
jscher2000
  • Top 10 Contributor
8702 solutions 71122 answers

Hi bob-m, sorry to hear about these sites afflicting you. I'm going to suggest some "clean-up" steps and also some practical steps if you end up on a scam page.

This could be caused by malware or a bad add-on. For that I suggest:

(1) Open the Windows Control Panel, Uninstall a Program.

After the list loads, click the "Installed on" column heading to group the infections, I mean, additions, by date. This can help in smoking out undisclosed bundle items that snuck in with some software you agreed to install. Be suspicious of everything you do not recognize/remember, as malware often uses important or innocent sounding names to discourage you from removing it.

Take out as much trash as possible here. If you're not sure, feel free to post program names or a screenshot of the list.

(2) You can view, disable, and often remove unwanted or unknown extensions on the Add-ons page. Either:

  • Ctrl+Shift+a (Mac: Command+Shift+a)
  • "3-bar" menu button (or Tools menu) > Add-ons
  • type or paste about:addons in the address bar and press Enter/Return
In the left column of the Add-ons page, click Extensions. Then cast a critical eye over the list on the right side. Any extensions Firefox installs for built-in features are hidden from this page, so everything listed here is your choice (and your responsibility) to manage. Anything suspicious or that you just do not remember installing or why? If in doubt, disable (or remove). Any improvement? <p>(3) You can search for remaining issues with the scanning/cleaning tools listed in this support article: Troubleshoot Firefox issues caused by malware. These on-demand scanners are free and take considerable time to run. If they finish quickly and especially if they require payment, you may have a serious infection. I suggest the specialized forums listed in the article in that case.

Hopefully that will flush anything on your system and in your Firefox that could be a problem.

Hi bob-m, sorry to hear about these sites afflicting you. I'm going to suggest some "clean-up" steps and also some practical steps if you end up on a scam page. ''This could be caused by malware or a bad add-on.'' For that I suggest: <p>(1) Open the Windows <strong>Control Panel</strong>, Uninstall a Program.</p> <p>After the list loads, click the "Installed on" column heading to group the infections, I mean, additions, by date. This can help in smoking out undisclosed bundle items that snuck in with some software you agreed to install. <em>Be suspicious of everything you do not recognize/remember, as malware often uses important or innocent sounding names to discourage you from removing it.</em></p> <p>Take out as much trash as possible here. If you're not sure, feel free to post program names or a screenshot of the list.</p> <p>(2) You can view, disable, and often remove unwanted or unknown extensions on the '''Add-ons page'''. Either: * Ctrl+Shift+a (Mac: Command+Shift+a) * "3-bar" menu button (or Tools menu) > Add-ons * type or paste '''about:addons''' in the address bar and press Enter/Return In the left column of the Add-ons page, click Extensions. Then cast a critical eye over the list on the right side. Any extensions Firefox installs for built-in features are hidden from this page, so everything listed here is your choice (and your responsibility) to manage. Anything suspicious or that you just do not remember installing or why? If in doubt, disable (or remove). Any improvement? <p>(3) You can search for remaining issues with the <strong>scanning/cleaning tools</strong> listed in this support article: [[Troubleshoot Firefox issues caused by malware]]. These on-demand scanners are free and take considerable time to run. If they finish quickly and especially if they require payment, you may have a serious infection. I suggest the specialized forums listed in the article in that case.</p> Hopefully that will flush anything on your system and in your Firefox that could be a problem.
jscher2000
  • Top 10 Contributor
8702 solutions 71122 answers

Helpful Reply

Hi bob-m, here's part 2.

There are numerous scams online involving support subscriptions. You certainly can't trust them to have remote access to your system when they trap you on a page with misinformation about infections and their identity (that definitely isn't a Microsoft site).

There are a few common patterns to these annoying pages, and these are some techniques for closing them without having to take drastic measures.

The "key" (ha ha) is the keyboard shortcut for closing the current tab, which is Ctrl+w (or on Mac, Command+w). Try it after each action to see whether it is available yet.

(1) Large alert dialog - lots of text, possible background voice

If you cancel this dialog (for example, by pressing the Esc key), it may reappear. After two or three appearances, Firefox should add a checkbox at the bottom of the dialog to stop the site from showing more alerts. Check that box and click OK to block further dialogs.

(2) Authentication dialog - asks for username and password

If you cancel this dialog, the page may reload and immediately show it again. Pressing the Esc key numerous times in a row can cancel the reload as well as the dialog.

(3) Reacting to mouse movement

Some pages have a script that detects when you are moving the mouse pointer up toward the tab bar and takes action to show another dialog, or moves to full screen view to hide the toolbar area. On these pages, the keyboard shortcut is essential.

Hopefully this will let you close problem pages without having to "force quit" Firefox. (I don't recommend using that method because the tab will come back during automatic crash recovery anyway.)


Often these scam pages are promoted through ad networks. As a defensive measure, you could consider using an add-on that is effective at blocking ads, such as:

https://addons.mozilla.org/firefox/addon/ublock-origin/

As with any content blocker, this will cause problems on some sites, so keep an eye on its toolbar button in case you need to make an exception to get a page to load properly.

Hi bob-m, here's part 2. There are numerous scams online involving support subscriptions. You certainly can't trust them to have remote access to your system when they trap you on a page with misinformation about infections and their identity (that definitely isn't a Microsoft site). There are a few common patterns to these annoying pages, and these are some techniques for closing them without having to take drastic measures. The "key" (ha ha) is the keyboard shortcut for closing the current tab, which is Ctrl+w (or on Mac, Command+w). Try it after each action to see whether it is available yet. (1) Large alert dialog - lots of text, possible background voice If you cancel this dialog (for example, by pressing the Esc key), it may reappear. After two or three appearances, Firefox should add a checkbox at the bottom of the dialog to stop the site from showing more alerts. Check that box and click OK to block further dialogs. (2) Authentication dialog - asks for username and password If you cancel this dialog, the page may reload and immediately show it again. Pressing the Esc key numerous times in a row can cancel the reload as well as the dialog. (3) Reacting to mouse movement Some pages have a script that detects when you are moving the mouse pointer up toward the tab bar and takes action to show another dialog, or moves to full screen view to hide the toolbar area. On these pages, the keyboard shortcut is essential. Hopefully this will let you close problem pages without having to "force quit" Firefox. (I don't recommend using that method because the tab will come back during automatic crash recovery anyway.) ---- Often these scam pages are promoted through ad networks. As a defensive measure, you could consider using an add-on that is effective at blocking ads, such as: https://addons.mozilla.org/firefox/addon/ublock-origin/ As with any content blocker, this will cause problems on some sites, so keep an eye on its toolbar button in case you need to make an exception to get a page to load properly.

Question owner

I took your advice and looked at the Uninstall page. One that looks suspicious is called "Mozilla Maintenance Service" Installed 11/30/18. Unless you tell me this is legit, I will delete it.

I took your advice and looked at the Uninstall page. One that looks suspicious is called "Mozilla Maintenance Service" Installed 11/30/18. Unless you tell me this is legit, I will delete it.
jscher2000
  • Top 10 Contributor
8702 solutions 71122 answers

Helpful Reply

bob-m said

I took your advice and looked at the Uninstall page. One that looks suspicious is called "Mozilla Maintenance Service" Installed 11/30/18. Unless you tell me this is legit, I will delete it.

The Mozilla Maintenance Service is a companion program Firefox uses to bypass the old Windows Vista (and later) UAC prompts for installing updates. So it's legit, but on the other hand, Firefox can live without it.

''bob-m [[#answer-1181243|said]]'' <blockquote> I took your advice and looked at the Uninstall page. One that looks suspicious is called "Mozilla Maintenance Service" Installed 11/30/18. Unless you tell me this is legit, I will delete it. </blockquote> The Mozilla Maintenance Service is a companion program Firefox uses to bypass the old Windows Vista (and later) UAC prompts for installing updates. So it's legit, but on the other hand, Firefox can live without it.