Join the Mozilla’s Test Days event from Dec 2–8 to test the new Firefox address bar on Firefox Beta 134 and get a chance to win Mozilla swag vouchers! 🎁

Search Support

Avoid support scams. We will never ask you to call or text a phone number or share personal information. Please report suspicious activity using the “Report Abuse” option.

Learn More

firefox goes to Mgasavezz4.com How can I stop this?

  • 15 iimpendulo
  • 22 inale ngxaki
  • 6 views
  • Impendulo yokugqibela ngu AnonymousUser

more options

my firefox is redirected to this site....and starts a "scan" of my computer to fix "claimed" infections. My mcafee antivirus then blocks trojans. I cannot get rid of this megasavezz4/ any suggestions?

URL of affected sites

http://www2.megasavezz4.com

my firefox is redirected to this site....and starts a "scan" of my computer to fix "claimed" infections. My mcafee antivirus then blocks trojans. I cannot get rid of this megasavezz4/ any suggestions? == URL of affected sites == http://www2.megasavezz4.com

Isisombulu esikhethiweyo

I noticed the same thing on 2 sites today. I didn't pay any attention to the first but I took notice when I had it happen again on heartzones.com. I immediately recognized that megasavezz4.com is a scam site. Here's what I've done and/or discovered in trying to narrow down the problem:

1. I immediately blocked the entire megasavezz4.com domain via OpenDNS to prevent anything on my network from connecting to it.

2. I restarted Firefox in safemode and went to heartzones.com. The redirect happened again, leading me to believe that it was unlikely a rogue Firefox add-on. (Since I use Linux, the most likely form of infection for me would be the browser).

3. I disabled Javascript and reloaded the page. The redirect did not happen. This strengthened my suspicion that the infection may not be on computer but the web site itself.

4. With the megasavezz4.com blocked on my network, I tried accessing heartzones.com from another computer (presumably not infected with anything my laptop might be infected with). It also tried to redirect to megasavezz4.com, so either both computers were infected (unlikely) or the problem was with the web site.

5. I did a CTRL+U to look at the sourcecode of heartzones.com. Since redirects only happened with Javascript turned on, I looked for suspicious looking scripts in the page. Everything looked fine until I got to the bottom of the page and found: . This looked suspicious and when I did a web search for it I found numerous sites linking this code to infected web sites.

6. http://holasionweb.com/oo.php contains Javascript to assign browser cookies and redirect the browser to http://www3.burhot33-td.net, which in turn probably links off to mgasavezz4.com or another site that eventually ends up there.

At this point, I'd say that itlooks like the infection is on web sites you are visiting. Try looking at the source code of the site that is redirecting you and see if you can find the above code in it. Please post your findings so we can compare notes.

Funda le mpendulo kwimeko leyo 👍 0

All Replies (15)

more options

THIS SITE ( megasavezz4.com ) CONTAIN VIRUSES !!! Do not open it ! It's false antyvirus !

more options

Same here. Use ctrl-alt-del to quit firefox, else you'll get a virus :-(

more options

Are you only directed to this site when using Firefox, or does it happen in other browsers (such as Internet Explorer) as well?

The first step I would recommend is scanning for spyware, as spyware is the most common cause of redirection to malicious websites.

  1. Download a spyware scanner - I would recommend the free version of malware bytes
  2. Run a full scan, and post back with what is found. Remove any spyware it finds.
  3. See if you are still redirected.
more options

I tried spyware scanning using HitmanPro. No result. This is an obvious danger site. if you get directed there you get a windows looking screen that says you are infected and it must scan. then a green bar shows scanning. I delete my last 4 hours in firefox.

 and it is only in firefox.  at least internetexpl has not yet been infected
more options

You suggestion to crash firefox ASAP is a good one. that is what i have done but so far there must be something to block it or remove it better than that

more options

I am having the same problem. I clicked a Google search result and I got redirected to this malware site (http)://www2.megasavezz4.com/ but this bad site also showed in the browser history: (http)://www1.checker26-pd.xorg.pl/

I am using Firefox 3.5.5 on Windows XP.

more options

AGV picked up the opening of www2.megasavezz4.com and blocked it but it has popped back up twice more. Anyone have any suggestions to stop the attack?

more options

I haven't seen anything like this for a few years. Just pops up out of nowhere. Happened on both my machines. Firefox 3.6.3 on Ubuntu Linux and Firefox 3.6.3 on Vista....

more options

Correct url is: http://www2.megasavezz4.com

more options

Yikes - talk about scare tactics, it won't let go! Just got hijacked by the megasave4zz and will try to use ctr-alt-del to get out - then plan to scan, wish me luck

more options

I believe it is coming from a site you visit. I just shut down my site, it's been hacked. Avast tagged it as a trojan and blocked the redirect. Did a little research, found out a php script has been added that redirects. Also adds a cookie to your browser. While Avast blocked the redirect, the cookies passed through to Firefox.

In my case, my site also was redirecting to www4. suitcase52td.net, which also redirects to Rogue Anti-Virus. Check out this site, about halfway down the page under the heading "indesignstudioinfo.com/ls.php".

http://stopmalvertising.com/malvertisements/update-on-the-latest-wordpress-hack/all-pages

Hope this helps

more options

i have the same problem. it happened when my brother show a picture. what happened yet?? do i have a virus now? if yes, what can i do now?

more options

This isn't limited to Windows. It's also affecting my Linux-based Firefox 3.6.3 even when run in safe-mode.

more options

Isisombululo esiKhethiweyo

I noticed the same thing on 2 sites today. I didn't pay any attention to the first but I took notice when I had it happen again on heartzones.com. I immediately recognized that megasavezz4.com is a scam site. Here's what I've done and/or discovered in trying to narrow down the problem:

1. I immediately blocked the entire megasavezz4.com domain via OpenDNS to prevent anything on my network from connecting to it.

2. I restarted Firefox in safemode and went to heartzones.com. The redirect happened again, leading me to believe that it was unlikely a rogue Firefox add-on. (Since I use Linux, the most likely form of infection for me would be the browser).

3. I disabled Javascript and reloaded the page. The redirect did not happen. This strengthened my suspicion that the infection may not be on computer but the web site itself.

4. With the megasavezz4.com blocked on my network, I tried accessing heartzones.com from another computer (presumably not infected with anything my laptop might be infected with). It also tried to redirect to megasavezz4.com, so either both computers were infected (unlikely) or the problem was with the web site.

5. I did a CTRL+U to look at the sourcecode of heartzones.com. Since redirects only happened with Javascript turned on, I looked for suspicious looking scripts in the page. Everything looked fine until I got to the bottom of the page and found: . This looked suspicious and when I did a web search for it I found numerous sites linking this code to infected web sites.

6. http://holasionweb.com/oo.php contains Javascript to assign browser cookies and redirect the browser to http://www3.burhot33-td.net, which in turn probably links off to mgasavezz4.com or another site that eventually ends up there.

At this point, I'd say that itlooks like the infection is on web sites you are visiting. Try looking at the source code of the site that is redirecting you and see if you can find the above code in it. Please post your findings so we can compare notes.