Seneste svar på firefox goes to Mgasavezz4.com How can I stop this?https://support.mozilla.org/da/questions/6718332010-05-15T13:51:10-07:00I noticed the same thing on 2 sites today. I didn't pay any attention to the first but I took notice2010-05-15T13:51:10-07:00AnonymousUserhttps://support.mozilla.org/da/questions/671833?page=2#answer-23615<p>I noticed the same thing on 2 sites today. I didn't pay any attention to the first but I took notice when I had it happen again on <a href="http://heartzones.com" rel="nofollow">heartzones.com</a>. I immediately recognized that <a href="http://megasavezz4.com" rel="nofollow">megasavezz4.com</a> is a scam site. Here's what I've done and/or discovered in trying to narrow down the problem:
</p><p>1. I immediately blocked the entire <a href="http://megasavezz4.com" rel="nofollow">megasavezz4.com</a> domain via OpenDNS to prevent anything on my network from connecting to it.
</p><p>2. I restarted Firefox in safemode and went to <a href="http://heartzones.com" rel="nofollow">heartzones.com</a>. The redirect happened again, leading me to believe that it was unlikely a rogue Firefox add-on. (Since I use Linux, the most likely form of infection for me would be the browser).
</p><p>3. I disabled Javascript and reloaded the page. The redirect did not happen. This strengthened my suspicion that the infection may not be on computer but the web site itself.
</p><p>4. With the <a href="http://megasavezz4.com" rel="nofollow">megasavezz4.com</a> blocked on my network, I tried accessing <a href="http://heartzones.com" rel="nofollow">heartzones.com</a> from another computer (presumably not infected with anything my laptop might be infected with). It also tried to redirect to <a href="http://megasavezz4.com" rel="nofollow">megasavezz4.com</a>, so either both computers were infected (unlikely) or the problem was with the web site.
</p><p>5. I did a CTRL+U to look at the sourcecode of <a href="http://heartzones.com" rel="nofollow">heartzones.com</a>. Since redirects only happened with Javascript turned on, I looked for suspicious looking scripts in the page. Everything looked fine until I got to the bottom of the page and found: . This looked suspicious and when I did a web search for it I found numerous sites linking this code to infected web sites.
</p><p>6. <a href="http://holasionweb.com/oo.php" rel="nofollow">http://holasionweb.com/oo.php</a> contains Javascript to assign browser cookies and redirect the browser to <a href="http://www3.burhot33-td.net" rel="nofollow">http://www3.burhot33-td.net</a>, which in turn probably links off to <a href="http://mgasavezz4.com" rel="nofollow">mgasavezz4.com</a> or another site that eventually ends up there.
</p><p>At this point, I'd say that itlooks like the infection is on web sites you are visiting. Try looking at the source code of the site that is redirecting you and see if you can find the above code in it. Please post your findings so we can compare notes.
</p>This isn't limited to Windows. It's also affecting my Linux-based Firefox 3.6.3 even when run in saf2010-05-15T12:37:03-07:00AnonymousUserhttps://support.mozilla.org/da/questions/671833?page=2#answer-23616<p>This isn't limited to Windows. It's also affecting my Linux-based Firefox 3.6.3 even when run in safe-mode.
</p>i have the same problem. it happened when my brother show a picture. what happened yet?? do i have a2010-05-15T07:24:36-07:00AnonymousUserhttps://support.mozilla.org/da/questions/671833?page=2#answer-23617<p>i have the same problem. it happened when my brother show a picture. what happened yet?? do i have a virus now? if yes, what can i do now?
</p>I believe it is coming from a site you visit. I just shut down my site, it's been hacked. Avast tagg2010-05-15T02:21:08-07:00AnonymousUserhttps://support.mozilla.org/da/questions/671833?page=2#answer-23618<p>I believe it is coming from a site you visit. I just shut down my site, it's been hacked. Avast tagged it as a trojan and blocked the redirect. Did a little research, found out a php script has been added that redirects. Also adds a cookie to your browser. While Avast blocked the redirect, the cookies passed through to Firefox.
</p><p>In my case, my site also was redirecting to www4. <a href="http://suitcase52td.net" rel="nofollow">suitcase52td.net</a>, which also redirects to Rogue Anti-Virus. Check out this site, about halfway down the page under the heading "<a href="http://indesignstudioinfo.com/ls.php" rel="nofollow">indesignstudioinfo.com/ls.php</a>".
</p><p><a href="http://stopmalvertising.com/malvertisements/update-on-the-latest-wordpress-hack/all-pages" rel="nofollow">http://stopmalvertising.com/malvertisements/update-on-the-latest-wordpress-hack/all-pages</a>
</p><p>Hope this helps
</p>Yikes - talk about scare tactics, it won't let go! Just got hijacked by the megasave4zz and will t2010-05-14T23:58:05-07:00AnonymousUserhttps://support.mozilla.org/da/questions/671833?page=2#answer-23619<p>Yikes - talk about scare tactics, it won't let go! Just got hijacked by the megasave4zz and will try to use ctr-alt-del to get out - then plan to scan, wish me luck
</p>Correct url is: http://www2.megasavezz4.com
2010-05-14T18:59:33-07:00AnonymousUserhttps://support.mozilla.org/da/questions/671833#answer-23620<p>Correct url is: <a href="http://www2.megasavezz4.com" rel="nofollow">http://www2.megasavezz4.com</a>
</p>I haven't seen anything like this for a few years. Just pops up out of nowhere. Happened on both my 2010-05-14T18:11:06-07:00AnonymousUserhttps://support.mozilla.org/da/questions/671833#answer-23621<p>I haven't seen anything like this for a few years. Just pops up out of nowhere. Happened on both my machines. Firefox 3.6.3 on Ubuntu Linux and Firefox 3.6.3 on Vista....
</p>AGV picked up the opening of www2.megasavezz4.com and blocked it but it has popped back up twice mor2010-05-14T16:02:35-07:00AnonymousUserhttps://support.mozilla.org/da/questions/671833#answer-23622<p>AGV picked up the opening of <a href="http://www2.megasavezz4.com" rel="nofollow">www2.megasavezz4.com</a> and blocked it but it has popped back up twice more. Anyone have any suggestions to stop the attack?
</p>I am having the same problem. I clicked a Google search result and I got redirected to this malware 2010-05-14T11:09:08-07:00AnonymousUserhttps://support.mozilla.org/da/questions/671833#answer-23623<p>I am having the same problem. I clicked a Google search result and I got redirected to this malware site (http)://<a href="http://www2.megasavezz4.com/" rel="nofollow">www2.megasavezz4.com/</a> but this bad site also showed in the browser history: (http)://<a href="http://www1.checker26-pd.xorg.pl/" rel="nofollow">www1.checker26-pd.xorg.pl/</a>
</p><p>I am using Firefox 3.5.5 on Windows XP.
</p>You suggestion to crash firefox ASAP is a good one. that is what i have done but so far there must b2010-05-14T10:44:35-07:00AnonymousUserhttps://support.mozilla.org/da/questions/671833#answer-23624<p>You suggestion to crash firefox ASAP is a good one. that is what i have done but so far there must be something to block it or remove it better than that
</p>I tried spyware scanning using HitmanPro. No result. This is an obvious danger site. if you get di2010-05-14T10:43:19-07:00AnonymousUserhttps://support.mozilla.org/da/questions/671833#answer-23625<p>I tried spyware scanning using HitmanPro. No result. This is an obvious danger site. if you get directed there you get a windows looking screen that says you are infected and it must scan. then a green bar shows scanning. I delete my last 4 hours in firefox.
</p><pre> and it is only in firefox. at least internetexpl has not yet been infected
</pre>Are you only directed to this site when using Firefox, or does it happen in other browsers (such as 2010-05-14T03:22:30-07:00zzxchttps://support.mozilla.org/da/questions/671833#answer-23626<p>Are you only directed to this site when using Firefox, or does it happen in other browsers (such as Internet Explorer) as well?
</p><p>The first step I would recommend is scanning for spyware, as spyware is the most common cause of redirection to malicious websites.
</p>
<ol><li> Download a spyware scanner - I would recommend the free version of <a href="http://www.malwarebytes.org" rel="nofollow">malware bytes</a>
</li><li> Run a full scan, and post back with what is found. Remove any spyware it finds.
</li><li> See if you are still redirected.
</li></ol>Same here. Use ctrl-alt-del to quit firefox, else you'll get a virus :-(
2010-05-14T03:12:17-07:00AnonymousUserhttps://support.mozilla.org/da/questions/671833#answer-23627<p>Same here. Use ctrl-alt-del to quit firefox, else you'll get a virus&nbsp;:-(
</p>THIS SITE ( megasavezz4.com ) CONTAIN VIRUSES !!! Do not open it ! It's false antyvirus&nb2010-05-14T02:46:10-07:00AnonymousUserhttps://support.mozilla.org/da/questions/671833#answer-23628<p>THIS SITE ( <a href="http://megasavezz4.com" rel="nofollow">megasavezz4.com</a> ) CONTAIN VIRUSES&nbsp;!!! Do not open it&nbsp;! It's false antyvirus&nbsp;!
</p>wtf
2010-05-14T01:20:09-07:00AnonymousUserhttps://support.mozilla.org/da/questions/671833#answer-23629<p>wtf
</p>