X
Tap here to go to the mobile version of the site.
Your Firefox is out of date and may contain a security risk! Upgrade Firefox

Support Forum

When clicking on a link within a website, Firefox randomly redirects to various sites

Posted

I believe this is some sort of Malware/Spyware issue. System has been scanned multiple time with Microsoft Security Essentials, Malwarebytes, and Spybot. I've run a restore to last known good and scanned in Safe Mode. MS Security Essentials and Spybot initially found and cleaned a couple of things. All subsequent scans have been clean. Reset Firefox to the default settings. Cleared History and Cookies multiple times. Uninstalled Firefox and manually deleted any Mozilla and Firefox directories in Program Files, Program Files (x86), and subdirectories of USERS\[myusername]\appdata, followed by a clean Firefox installation. The problem occurred just after midnight and then just now. With both events, the selected link should have been to a page within the website. Instead, the browser was redirected externally. Firefox browser history for both events follows:
Event 1
Name:Neuropathy: Living With Peripheral Neuropathy, , location: http://www.neuropathy.org/site/PageServer?pagename=Living_Neuropathy.
Name: Loading mdlinx.com, URL: http://63178.xml.premiumxml.com/xml/click/?m=63178&f=444229&r=1490767884&p=0&h=mdlinx.com
Name: (field is empty), URL: http://search.smartsuggestor.com/tbredir.php?url=uggc%3A%2F%2Fqp1r.o261fif5.pbz%2Fpg%3Firefvba%3D1.0.0%26raHEY%3DUAUh%2B81ZKyTfHTeSpC%2BhdfianRDmwv3hS3YDdfGXfm9SvnSI3zkY3fRTWwAh6RDbqERnp%2Bnl2aBOJdlrgk%2B4dvj2BPBACGHqG6M4motUhC3PwfJYWhuSxGjnckpFnI%2FF4DfCWEARN7hZ0IWYRnW6UFOG%2FE1%2BvQ5RdS6t2UXfJwt28%2FHXDQSe%2FGNah8exRJ1l6ePHpB5MCODYEGR6YdoRA85EfO3Nxk%2FH%26dhrelvq%3D16009427748%26egcvq%3D64.72.223.60_255828p301n2o4o39nqp0q3nps7051p9%26nqvq%3D1%26vaivq%3D81257037%26nzcfp%3D81%26nzcfpgvq%3D2%26hcvq%3D%26betxj%3Dareir%2520qvfrnfrf%2520cnva%2520arhebcnguvp%2520crevcureny%2520yvivat%26pngvq%3D134736%26pevq%3D1362638%26sf%3Dr-kzy-48%26gf%3Dr-kzy-48%26co%3D970.0%26gkvq%3D133013000%26nqia%3Dzqyvak.pbz%252Scnva%26vvp%3D63579023%3B81257034%3B81257035%3B81257036%3B81257037%26clpvq%3D36s3opo9-862n-42s1-n788-3qo1or0n9nnr%26clcbf%3D1%26pnzcgf%3D0%26ngfy%3D1%26ngfvq%3D1021388%26gfcho%3D1021377%26chcv%3D10540%26chf1v%3D111%26zg%3D7%26pc%3D0.1100%2C29194%2C347066%2C1%2Ccho_guvaxgnax2-63178%2Careir%2520qvfrnfrf%2520cnva%2520arhebcnguvp%2520crevcureny%2520yvivat%2Conpxsvyy_pbaqhpvir%2Fy%3DPBAQ&kw=areir+qvfrnfrf+cnva+arhebcnguvp+crevcureny+yvivat
Name: Page Loading... URL: http://2.81257037.ampnetwork.net/?sid=M1B%2BXH0PB3x%2FRD9HBkQoI1gLQWtjC3gBZV0HfTIFeQUBR3t0GEVEemcBdQliVwZzMgF9GgRYZX4HRF1sZ09%2B

Event 2
Name: Romney: GOP convention theme against Obama will be “nice guy, failed President” « Hot Air, URL: http://hotair.com/archives/2012/08/27/romney-gop-convention-theme-against-obama-will-be-nice-guy-failed-president/
Name: Loading cialis.com...URL: http://63178.xml.premiumxml.com/xml/click/?m=63178&f=444229&r=2133952938&p=0&h=cialis.com
Name: (field was blank) URL: http://search.smartsuggestor.com/tbredir.php?url=uggc%3A%2F%2Foevqtr.nzr.nqznexrgcynpr.arg%2Fpg%3Firefvba%3D1.0.0%26raHEY%3DE48b3EeGpwIstSbSDRIfpt7yc3lnSHklSqFO5viyhP1WNUr5UrzbiH9cQ4%2B1FBcfw%2BxCdHJMEdW0hPfwE7xQUMCV5NRpXL9we2l2xvYhLT1%2F%2FML6G7PVgtBvL2779Sx%2FD1Sx3ITlfT5NLMXT4y7X4Ssck5YTI0JkKjVHXAwQ8I0GRzyXER1teq%2FXRRUxHm6MiD7AJVVghMEqdcm1YjW9NjRBncys4yRIB7%2FqH5YH6myFLn7QauStmli%2Bv%2FyqwJjHTaHfqdlQ%2Fe4WIfssdITdbkr%2BTNJldNHsyOY0lBfeEy%2BIoaZr4AW33IDrFITTpfjnqReK0jYZVQfSR7oRoolir5fENTqFQAZoArJScNM4TksvmkKUPtUvX6DTioi2CimiFZ0pvXLXrU6MxgivdzwPKXe8JO3YBus172f%2B9hgZrmhGnXws4De7IzWWLu2XiephnPKopTw%2FYMdxraCjgXriB%2FPqUW%2BA%2BAKGjuYidpnpvhGuoy3rG0EFHRLBeCxgWSRKjhyVV1NO5pcerwcuyPzMskspcf8haLGjWAXm2NXfdDD38%2FXDCmJ9JJ4PTd3XASKA2WVnLNOhn75tY72BV4KVkeRTgiD4h3E4pb%2FLOZr2ef3%2B%2FDXnSu%2B7IHpMux5A%2BhaE44nZRthHOBagKt0Hu1CBy6LB2%2BjrBuLvbCfKqEsgHLB0NtqPfZMY4pX2U4PPmtiao7lK630ecY2ZjjmND2YuvxsE9NOnDCKMs3fbBjXBVzEB1RTRUg7VDBu5UaPOwTtU0D3E58sotppCrVyoBG3F%2FN%3D%3D%26dhrelvq%3D16191907328%26egcvq%3D64.72.223.60_255828p301n2o4o39nqp0q3nps7051p9%26nqvq%3D28506%26vaivq%3D81257037%26nzcfp%3D81%26nzcfpgvq%3D2%26hcvq%3D%26betxj%3Drq%2520zbeevffrl%2520bonzn%2520arjf%2520ebzarl%2520cbyy%26pngvq%3D0%26pevq%3D675680461%26sf%3Dr-kzy-44%26gf%3Dr-kzy-44%26co%3D240.0%26gkvq%3D121013000%26nqia%3Dpvnyvf.pbz%26vvp%3D63579023%3B81257034%3B81257035%3B81257036%3B81257037%26clpvq%3Dahyy%26clcbf%3D0%26ngfy%3D1%26ngfvq%3D1021388%26gfcho%3D1021377%26chcv%3D10540%26chf1v%3D111%26zg%3D10%26pc%3D0.0590%2C2104289839%2C0%2C0%2Ccho_guvaxgnax2-63178%2Crq%2520zbeevffrl%2520bonzn%2520arjf%2520ebzarl%2520cbyy%2Conpxsvyy_pbaqhpvir%2Fy%3DPBAQ&kw=rq+zbeevffrl+bonzn+arjf+ebzarl+cbyy
Name: (field empty) URL: http://1901503733.1504.1.verifyclick.info/fp?ip=64.72.223.60&q=ed+morrissey+obama+news+romney+poll&ua=Mozilla%2F5.0+%28Windows+NT+6.1%3B+WOW64%3B+rv%3A14.0%29+Gecko%2F20100101+Firefox%2F14.0.1&ts=1346079626353&sig=nqJxiOnjc5ULBxaak4mJ8ZY19QOlA7zPp_tqRGKjsjyLFDfEBICZ7M7XxcAWdBvDvkvC7GCM0Xkv4-GRQZqbOjs3CFE#url=http%3A%2F%2F1901503733.1504.1.verifyclick.info%2Fre%2FwOIrz-HibpELEBSakcDXqY51sF_-WP-R6qUqWzT86z-bDS-bXcPfvpXMzp0GdxnOuUPXuGiWhCBtvL3DRMjaZiFuWBXD2OdV1n0tzSXvsSsh5lsnhKNESLsoOTRlLxK4idiRW-Sq1pmQVrvib3ElVIOYSGjzbpTwvtMkWwPi9-E_XvZ1yg_ebsAlArqsK5PjWGFOQ0A
Name: Loading cialis.com...URL: http://63940.xml.premiumxml.com/xml/click/?m=63940&f=444219&r=374750105&p=0&h=cialis.com
Name: (field is empty) URL: http://results.wisdomstation.com/tbredir.php?url=uggc%3A%2F%2F67.201.62.25%2Fvaqrk2.ugzy%3Fd%3Drq%2520zbeevffrl%2520bonzn%2520arjf%2520ebzarl%2520cbyy%26h%3D1-8EV1RHdOn0XN%26n%3D00101%2520Sversbk%252S14.0.1%26gv%3D1346079626%26e%3DpzImqJk0pl53nKAxo21mqTS0nJ9hYzAioD%26u%3Dsd228%26y%3DZN%26pv%3D31144%7C63940%7C9833%26v%3D1078517564%26qrf%3DnUE0pQbiYmNhpv5gp24hL29gYm9fMQ00qzchnJS1EzqVM3ueJIA6D3plnwyMK3AKMKAcDGqVq3IbrxplExgeJHV5G3qaLxkRpGV0oGWJFUx4L21wLIcKZ2gaMGR0pRccraISoQWVIKO6AIcRAmqiAP1HGmAvBI9lLJ1Aq2p4JRgIGyuToSquLKAkn254IRWlExSjEaASHHE6DmAVnx9aLmH1ZaEaq3IcL2ycoTp1nR5OEH9koUc5A3EvMQOPHaWynz9FrR9xFyAhZScKrUEfGTSDnJq2Hzp3MxMfBTA1JJyZqSp0FIx5pQqGA05ZnzEPAJH5qSI5K0EQLGSzrxgbZHgMMzkVoJMJAyMyATI0paWnn19yM0y3BIEODzM2Gx9kARk5AxqZL3bkIQAPLKt3ZIMMFI9SZmu6LJ1uI0c3qSSQD2EsH1ALLmIgoRyuJKymZTEMZQp0BUWAMmuFD1EfZHSEMz41D1qZq294o254JSyCFxR0HHcgGacDHIxmIaMmJSqDnSATpGN3pUWVHySZKmZmGP10nwyaoUO0nHgBEKEUpKqBFj&kw=rq+zbeevffrl+bonzn+arjf+ebzarl+cbyy
Name: About Erectile Dysfunction (ED) and Benign Prostatic Hyperplasia (BPH) - CIALIS (tadalafil) tablets URL: http://www.cialis.com/Pages/about-ed-and-bph.aspx?WT.srch=1
With both events, the back arrow returned me to the original web page where I was able to continue browsing.

The search results on Google and my computer for the file, 63178.xml were negative. (Windows Explorer is configured to show all hidden and system files.) Google-search results for premiumxml.com were negative. Firefox Help site search for the xml file and premiumxml.com were negative. Several days ago, nstalled a Firefox ad-blocker add-in was added. The ad-blocker stopped some rather annoying and occasionally pornographic ad pop-ups.

I must admit to being completely stumped on this one.

Modified by cor-el

Additional System Details

This started when...

After the update to version 14.0.1

Installed Plug-ins

  • Shockwave Flash 11.4 r402
  • Adobe Shockwave for Director Netscape plug-in, version 11.6.6.636
  • Adobe PDF Plug-In For Firefox and Netscape 10.1.4
  • Google Update
  • NPRuntime Script Plug-in Library for Java(TM) Deploy
  • Next Generation Java Plug-in 10.5.1 for Mozilla browsers
  • Adobe Shockwave for Director Netscape plug-in, version 11.6.5.635
  • The QuickTime Plugin allows you to view a wide variety of multimedia content in Web pages. For more information, visit the QuickTime Web site.
  • NVIDIA 3D Vision Streaming plugin for Mozilla browsers
  • NVIDIA 3D Vision plugin for Mozilla browsers
  • 5.1.10411.0
  • iTunes Detector Plug-in
  • AmazonMP3DownloaderPlugin 1.0.15
  • GEPlugin
  • Adobe Shockwave for Director Netscape plug-in, version 11.5.9.620
  • The plug-in allows you to open and edit files using Microsoft Office applications
  • Office Authorization plug-in for NPAPI browsers

Application

  • User Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:14.0) Gecko/20100101 Firefox/14.0.1

More Information

Application Basics
Name
Firefox
Version
14.0.1
User Agent
Mozilla/5.0 (Windows NT 6.1; WOW64; rv:14.0) Gecko/20100101 Firefox/14.0.1
Profile Folder
Show Folder
Enabled Plugins
about:plugins
Build Configuration
about:buildconfig
Crash Reports
about:crashes
Memory Use
about:memory
Extensions
Name
Version
Enabled
ID
Adblock Plus
2.1.2
true
{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
HP Smart Web Printing
4.51
false
smartwebprinting@hp.com
Important Modified Preferences
Name
Value
browser.cache.disk.capacity
1048576
browser.cache.disk.smart_size.first_run
false
browser.cache.disk.smart_size_cached_value
1048576
browser.places.smartBookmarksVersion
4
browser.startup.homepage
www.google.com
browser.startup.homepage_override.buildID
20120713134347
browser.startup.homepage_override.mstone
14.0.1
extensions.lastAppVersion
14.0.1
gfx.direct3d.prefer_10_1
true
keyword.URL
http://www.google.com/search?q=
network.cookie.prefsMigrated
true
places.database.lastMaintenance
1346020956
places.history.expiration.transient_current_max_pages
104858
plugin.disable_full_page_plugin_for_types
application/pdf,application/vnd.adobe.xfdf,application/vnd.fdf,application/vnd.adobe.xdp+xml
privacy.donottrackheader.enabled
true
privacy.sanitize.migrateFx3Prefs
true
security.warn_viewing_mixed
false
Graphics
Adapter Description
NVIDIA GeForce GT 430
Vendor ID
0x10de
Device ID
0x0de1
Adapter RAM
1023
Adapter Drivers
nvd3dumx,nvwgf2umx,nvwgf2umx nvd3dum,nvwgf2um,nvwgf2um
Driver Version
8.17.13.142
Driver Date
5-15-2012
Direct2D Enabled
true
DirectWrite Enabled
true (6.1.7601.17789)
ClearType Parameters
ClearType parameters not found
WebGL Renderer
Google Inc. -- ANGLE (NVIDIA GeForce GT 430) -- OpenGL ES 2.0 (ANGLE 1.0.0.1041)
GPU Accelerated Windows
3/3 Direct3D 10
AzureBackend
direct2d
JavaScript
Incremental GC
1
Library Versions
Expected minimum version
Version in use
NSPR
4.9
4.9
NSS
3.13.5.0 Basic ECC
3.13.5.0 Basic ECC
NSS Util
3.13.5.0
3.13.5.0
NSS SSL
3.13.5.0 Basic ECC
3.13.5.0 Basic ECC
NSS S/MIME
3.13.5.0 Basic ECC
3.13.5.0 Basic ECC

jscher2000
  • Top 10 Contributor
2365 solutions 20923 answers

Can you check your connection setting in case your browsing is redirecting through a proxy?

orange Firefox button or classic Tools menu > Options > Advanced

On the "Network" mini-tab, click the "Settings" button. What do you have here, and does selecting No Proxy make any difference?

Question owner

Good Idea! I had forgotten Firefox even had this setting. I always make certain IE is set to No Proxy as part of a post-OS or post-browser update/installation. By the way, IE is having the same problem though so it's possible something installed a stealth proxy server to randomly redirect both browsers. I was going to return to the IE problem once I'd resolved the Firefox problem. So, I'll look into a proxy-related issue. In the mean time, I've modified Firefox. Will report back on what I find.

cor-el
  • Top 10 Contributor
  • Moderator
10755 solutions 96800 answers

Do a malware check with some malware scanning programs on the Windows computer.
You need to scan with all programs because each program detects different malware.
Make sure that you update each program to get the latest version of their databases before doing a scan.

You can also do a check for a rootkit infection with TDSSKiller.

See also:

If using various malware scanners does not fix it or if you are blocked from installing those scanners then ask advice at a forum that specializes in malware removal.

Vero-D 0 solutions 1 answers

Hi. I'm having this problem too. I'm being redirected at anytime, it can be from a bookmark page, from typing on the address bar, from a Google search, it doesn't matter but it is getting very annoying.

I changed my DNS to an openDNS, but the problem persisted. I installed and ran ClamXav, it didn't find any malware or problem. I decided to create a new airport connection with openDNS. The problems is still going on.

On Firefox's Network settings I have "No Proxy selected". The problems is still present.

Any suggestions in what to do next? Please, help me! This situation is getting very annoying.

MacBook OS X 10.5.8

jscher2000
  • Top 10 Contributor
2365 solutions 20923 answers

Hi Vero-D, it could be an add-on. A standard diagnostic to bypass interference by extensions (and some custom settings) is to try Firefox's Safe Mode.

First, I recommend backing up your Firefox settings in case something goes wrong. See Back up and restore information in Firefox profiles. (You can copy your entire Firefox profile folder somewhere outside of the Mozilla folder.)

Next, restart Firefox in Firefox's Safe Mode (Troubleshoot Firefox issues using Safe Mode) using

Help > Restart with Add-ons Disabled

In the dialog, click "Start in Safe Mode."

If the site works correctly, this points to one of your extensions or custom settings as the problem.

To also disable add-ons, you can try here:

Tools > Add-ons > Plugins category

Do the redirections continue?

zither99 0 solutions 1 answers

Helpful Reply

Thank You for the tip to run in safe mode.

The redirects stopped, and after disabling all plugins when not in safe mode the redirection stopped.

Upon further investigation, I deleted all plugins, but at that point the redirection continued. At that point a "Flash Plugin" was found under the Extensions tab. Once that was removed the redirection stopped completely.

Afterwards a clean instal of Flash, Java, and Silverlight was performed with no redirection currently.