When clicking on a link within a website, Firefox randomly redirects to various sites
I believe this is some sort of Malware/Spyware issue. System has been scanned multiple time with Microsoft Security Essentials, Malwarebytes, and Spybot. I've run a restore to last known good and scanned in Safe Mode. MS Security Essentials and Spybot initially found and cleaned a couple of things. All subsequent scans have been clean. Reset Firefox to the default settings. Cleared History and Cookies multiple times. Uninstalled Firefox and manually deleted any Mozilla and Firefox directories in Program Files, Program Files (x86), and subdirectories of USERS\[myusername]\appdata, followed by a clean Firefox installation. The problem occurred just after midnight and then just now. With both events, the selected link should have been to a page within the website. Instead, the browser was redirected externally. Firefox browser history for both events follows:
Name:Neuropathy: Living With Peripheral Neuropathy, , location: http://www.neuropathy.org/site/PageServer?pagename=Living_Neuropathy.
Name: Loading mdlinx.com, URL: http://63178.xml.premiumxml.com/xml/click/?m=63178&f=444229&r=1490767884&p=0&h=mdlinx.com
Name: Page Loading... URL: http://2.81257037.ampnetwork.net/?sid=M1B%2BXH0PB3x%2FRD9HBkQoI1gLQWtjC3gBZV0HfTIFeQUBR3t0GEVEemcBdQliVwZzMgF9GgRYZX4HRF1sZ09%2B
Name: Romney: GOP convention theme against Obama will be “nice guy, failed President” « Hot Air, URL: http://hotair.com/archives/2012/08/27/romney-gop-convention-theme-against-obama-will-be-nice-guy-failed-president/
Name: Loading cialis.com...URL: http://63178.xml.premiumxml.com/xml/click/?m=63178&f=444229&r=2133952938&p=0&h=cialis.com
Name: (field empty) URL: http://1901503733.1504.1.verifyclick.info/fp?ip=22.214.171.124&q=ed+morrissey+obama+news+romney+poll&ua=Mozilla%2F5.0+%28Windows+NT+6.1%3B+WOW64%3B+rv%3A14.0%29+Gecko%2F20100101+Firefox%2F14.0.1&ts=1346079626353&sig=nqJxiOnjc5ULBxaak4mJ8ZY19QOlA7zPp_tqRGKjsjyLFDfEBICZ7M7XxcAWdBvDvkvC7GCM0Xkv4-GRQZqbOjs3CFE#url=http%3A%2F%2F1901503733.1504.1.verifyclick.info%2Fre%2FwOIrz-HibpELEBSakcDXqY51sF_-WP-R6qUqWzT86z-bDS-bXcPfvpXMzp0GdxnOuUPXuGiWhCBtvL3DRMjaZiFuWBXD2OdV1n0tzSXvsSsh5lsnhKNESLsoOTRlLxK4idiRW-Sq1pmQVrvib3ElVIOYSGjzbpTwvtMkWwPi9-E_XvZ1yg_ebsAlArqsK5PjWGFOQ0A
Name: Loading cialis.com...URL: http://63940.xml.premiumxml.com/xml/click/?m=63940&f=444219&r=374750105&p=0&h=cialis.com
Name: (field is empty) URL: http://results.wisdomstation.com/tbredir.php?url=uggc%3A%2F%2F126.96.36.199%2Fvaqrk2.ugzy%3Fd%3Drq%2520zbeevffrl%2520bonzn%2520arjf%2520ebzarl%2520cbyy%26h%3D1-8EV1RHdOn0XN%26n%3D00101%2520Sversbk%252S14.0.1%26gv%3D1346079626%26e%3DpzImqJk0pl53nKAxo21mqTS0nJ9hYzAioD%26u%3Dsd228%26y%3DZN%26pv%3D31144%7C63940%7C9833%26v%3D1078517564%26qrf%3DnUE0pQbiYmNhpv5gp24hL29gYm9fMQ00qzchnJS1EzqVM3ueJIA6D3plnwyMK3AKMKAcDGqVq3IbrxplExgeJHV5G3qaLxkRpGV0oGWJFUx4L21wLIcKZ2gaMGR0pRccraISoQWVIKO6AIcRAmqiAP1HGmAvBI9lLJ1Aq2p4JRgIGyuToSquLKAkn254IRWlExSjEaASHHE6DmAVnx9aLmH1ZaEaq3IcL2ycoTp1nR5OEH9koUc5A3EvMQOPHaWynz9FrR9xFyAhZScKrUEfGTSDnJq2Hzp3MxMfBTA1JJyZqSp0FIx5pQqGA05ZnzEPAJH5qSI5K0EQLGSzrxgbZHgMMzkVoJMJAyMyATI0paWnn19yM0y3BIEODzM2Gx9kARk5AxqZL3bkIQAPLKt3ZIMMFI9SZmu6LJ1uI0c3qSSQD2EsH1ALLmIgoRyuJKymZTEMZQp0BUWAMmuFD1EfZHSEMz41D1qZq294o254JSyCFxR0HHcgGacDHIxmIaMmJSqDnSATpGN3pUWVHySZKmZmGP10nwyaoUO0nHgBEKEUpKqBFj&kw=rq+zbeevffrl+bonzn+arjf+ebzarl+cbyy
Name: About Erectile Dysfunction (ED) and Benign Prostatic Hyperplasia (BPH) - CIALIS (tadalafil) tablets URL: http://www.cialis.com/Pages/about-ed-and-bph.aspx?WT.srch=1
With both events, the back arrow returned me to the original web page where I was able to continue browsing.
The search results on Google and my computer for the file, 63178.xml were negative. (Windows Explorer is configured to show all hidden and system files.) Google-search results for premiumxml.com were negative. Firefox Help site search for the xml file and premiumxml.com were negative. Several days ago, nstalled a Firefox ad-blocker add-in was added. The ad-blocker stopped some rather annoying and occasionally pornographic ad pop-ups.
I must admit to being completely stumped on this one.
Modified by cor-el
Additional System Details
This started when...
After the update to version 14.0.1
- Shockwave Flash 11.4 r402
- Adobe Shockwave for Director Netscape plug-in, version 188.8.131.526
- Adobe PDF Plug-In For Firefox and Netscape 10.1.4
- Google Update
- NPRuntime Script Plug-in Library for Java(TM) Deploy
- Next Generation Java Plug-in 10.5.1 for Mozilla browsers
- Adobe Shockwave for Director Netscape plug-in, version 184.108.40.2065
- The QuickTime Plugin allows you to view a wide variety of multimedia content in Web pages. For more information, visit the QuickTime Web site.
- NVIDIA 3D Vision Streaming plugin for Mozilla browsers
- NVIDIA 3D Vision plugin for Mozilla browsers
- iTunes Detector Plug-in
- AmazonMP3DownloaderPlugin 1.0.15
- Adobe Shockwave for Director Netscape plug-in, version 220.127.116.110
- The plug-in allows you to open and edit files using Microsoft Office applications
- Office Authorization plug-in for NPAPI browsers
- User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:14.0) Gecko/20100101 Firefox/14.0.1
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:14.0) Gecko/20100101 Firefox/14.0.1
HP Smart Web Printing
Important Modified Preferences
NVIDIA GeForce GT 430
ClearType parameters not found
Google Inc. -- ANGLE (NVIDIA GeForce GT 430) -- OpenGL ES 2.0 (ANGLE 18.104.22.1681)
GPU Accelerated Windows
3/3 Direct3D 10
Expected minimum version
Version in use
22.214.171.124 Basic ECC
126.96.36.199 Basic ECC
188.8.131.52 Basic ECC
184.108.40.206 Basic ECC
220.127.116.11 Basic ECC
18.104.22.168 Basic ECC
Can you check your connection setting in case your browsing is redirecting through a proxy?
orange Firefox button or classic Tools menu > Options > Advanced
On the "Network" mini-tab, click the "Settings" button. What do you have here, and does selecting No Proxy make any difference?
Good Idea! I had forgotten Firefox even had this setting. I always make certain IE is set to No Proxy as part of a post-OS or post-browser update/installation. By the way, IE is having the same problem though so it's possible something installed a stealth proxy server to randomly redirect both browsers. I was going to return to the IE problem once I'd resolved the Firefox problem. So, I'll look into a proxy-related issue. In the mean time, I've modified Firefox. Will report back on what I find.
Do a malware check with some malware scanning programs on the Windows computer.
You need to scan with all programs because each program detects different malware.
Make sure that you update each program to get the latest version of their databases before doing a scan.
- http://www.malwarebytes.org/mbam.php - Malwarebytes' Anti-Malware
- http://www.superantispyware.com/ - SuperAntispyware
- http://www.microsoft.com/security/scanner/en-us/default.aspx - Microsoft Safety Scanner
- http://www.microsoft.com/windows/products/winfamily/defender/default.mspx - Windows Defender: Home Page
- http://www.safer-networking.org/en/index.html - Spybot Search & Destroy
You can also do a check for a rootkit infection with TDSSKiller.
- "Spyware on Windows": http://kb.mozillazine.org/Popups_not_blocked
If using various malware scanners does not fix it or if you are blocked from installing those scanners then ask advice at a forum that specializes in malware removal.
Hi. I'm having this problem too. I'm being redirected at anytime, it can be from a bookmark page, from typing on the address bar, from a Google search, it doesn't matter but it is getting very annoying.
I changed my DNS to an openDNS, but the problem persisted. I installed and ran ClamXav, it didn't find any malware or problem. I decided to create a new airport connection with openDNS. The problems is still going on.
On Firefox's Network settings I have "No Proxy selected". The problems is still present.
Any suggestions in what to do next? Please, help me! This situation is getting very annoying.
MacBook OS X 10.5.8
Hi Vero-D, it could be an add-on. A standard diagnostic to bypass interference by extensions (and some custom settings) is to try Firefox's Safe Mode.
First, I recommend backing up your Firefox settings in case something goes wrong. See Back up and restore information in Firefox profiles. (You can copy your entire Firefox profile folder somewhere outside of the Mozilla folder.)
Next, restart Firefox in Firefox's Safe Mode (Troubleshoot Firefox issues using Safe Mode) using
Help > Restart with Add-ons Disabled
In the dialog, click "Start in Safe Mode."
If the site works correctly, this points to one of your extensions or custom settings as the problem.
To also disable add-ons, you can try here:
Tools > Add-ons > Plugins category
Do the redirections continue?
Thank You for the tip to run in safe mode.
The redirects stopped, and after disabling all plugins when not in safe mode the redirection stopped.
Upon further investigation, I deleted all plugins, but at that point the redirection continued. At that point a "Flash Plugin" was found under the Extensions tab. Once that was removed the redirection stopped completely.
Afterwards a clean instal of Flash, Java, and Silverlight was performed with no redirection currently.