Google search for knoppix forum ends up on firestore72 sometimes

[Denver Dave]

It doesn't always happen, but sometimes, when I do a search with firefox 21, knoppix 7.0.5, from the google.com site for knoppix forum and then I click on the first result, instead of going to this forum, I end up on:

http://filestore72.info/download.php?id=a0cd929c

very strange, does not happen each time, but happened several times and I watch carefully what I click on.

If I click the back button and click again, I end up properly on this forum. Wonder if the form or my software may have been hacked. No real harm, just click the back arrow and select again, but weird.

Wonder if anyone else has observed this?

[Clinton]

I don't seem to see any problem, Dave.

This is a known issue when a site's htaccess file has been compromised. Ours seems fine. It is also caused when the user's PC has been compromised. A Google redirect can be a caused by a hijacked browser or something as simple as a compromised hosts file on a Windows PC.

Please let us know when you've solved this.

[utu]

Greetings, Dave & Clinton.

If the unwanted URL that occurs is always (or often) the same, you might
try adding that URL to NoScript, to see if that solves your problem.

[Denver Dave]

I didn't see this thread at first and created a duplicate thread. I have the same issue. Here is my experience:

Hacked by filestore72.info?

It doesn't seem to happen everytime, but occasionally, when I do a google search for the knoppix forum and click on the result, the first time I am redirected to filestore72.info.

I'm not sure why this is happening or if my Linux 7.0.5, Firefox 21 or the knoppix.net/forum is causing this. Not a big deal, I, do the search again and end up where I want, but something is definitely going on - has happened for a while.

This link: Vbulletin hacked redirected to filestore72.info sure sounds similar:
http://www.vbulletin.com/forum/forum...lestore72-info

[Clinton]

Thanks for your feedback. I'll do some more digging into this to see if there's a security issue anywhere that needs to be fixed.

[Werner P. Schulz]

I don't believe that there is a security issue of the forum software.

I type in the address line of Firefox "www.google.com". Google changes the content of my Firefox address line to

https://www.google.de

Now I type in the Google searchline "knoppix forum"Immediately Google changes the content of my Firefox address line to

https://www.google.de/#gs_rn=18
&gs_ri=psy-ab
&cp=12
&gs_id=du
&xhr=t
&q=knoppix+forum
&es_nrs=true
&pf=p
&sclient=psy-ab
&oq=knoppix+foru
&gs_l=
&pbx=1
&bav=on.2,or.r_qf.
&bvm=bv.48340889,d.Yms
&fp=c77708117ee4b91c
&biw=915
&bih=600

The first hit for me is "Startseite - Knoppix Forum | www. KnoppixForum .de". The URL Google gives me for this site is

http://www.google.de/url?sa=t
&rct=j
&q=
&esrc=s
&source=web
&cd=1
&cad=rja
&sqi=2
&ved=0CC0QFjAA
&url=http%3A%2F%2Fwww.knoppixforum.de%2F
&ei=M-XLUcy0BIiYtQbf94FQ
&usg=AFQjCNHY0F8VVU1L1uGqlIaziYKSxw1Awg
&bvm=bv.48340889,d.Yms

As you can see, Google does so many obscure things in the background, why not lead you astray?

[Clinton]

There have been some other vbulletin based forums that have had this problem. It's not impossible for it to happen at the server level as well as at the Google level so it's always worth checking these things.

[Denver Dave]

When I have observed the redirection it has been when I'm using knoppix 7.0.5 and firefox.

I'll test occasionally with XP - so far, no redirection with XP and firefox

Let's try again with knoppix .... booting up...
- did a google search for knoppix and forum - hovered over link, observed said knoppix.net/forum - redirected to filestore72.info
- hit back button and clicked on link again
- this time ended up on knoppix forum as I should
- closed firefox
- opened firefox, searched, clicked and went to forum as it should
- shutdown and restart laptop with linux - search, click, on forum as I should
- might be once per day, will retest on a different day But first http://www.vbulletin.com/forum/forum...lestore72-info

The script only redirect in the first time the browser have cleaned cache and temps I'm not sure how to clear knoppix temp files, but I'll do firefox Interesting

- interesting edit / preferences in knoppix firefox, but tools / options in xp - sigh
- anyway, went to cnn.com, cleared recent history
- close browser
- opened firefox under knoppix 7.0.5, went to google, did the search for knoppix and forum, clicked on the link and redirected to filestore72.info like the post on the vbulletin said it would

- So redirection happens if first search of the day or if clear cache

- let's try clearing cache and clicking on a different website on the google search
- did search for knoppix forum and clicking on linuxforums.org instead
- browser went to linuxforums.org

- clearing cache - google search knoppix forums
- click on knoppix.net/forum - redirected to filestore72.info

[Werner P. Schulz]

Second try:
With "knoppix forum net" in the Google search line I've got

for the first hit

Forum - Knoppix

and the URL given by Google for this site

http://www.google.de/url?sa=t
&rct=j
&q=
&esrc=s
&source=web
&cd=1
&cad=rja
&ved=0CC0QFjAA
&url=http%3A%2F%2Fknoppix.net%2Fforum%2F
&ei=OoDMUZPJD4GytAb-_ICICg
&usg=AFQjCNFlgOf9TUOBCIwIvqSfNvurjbSUog
&bvm=bv.48572450,d.Yms

leads me to

http://filestore72.info/download.php?id=a0cd929c

for the second hit

The Knoppix . net Forums

and the URL given by Google for this site

http://www.google.de/url?sa=t
&rct=j
&q=
&esrc=s
&source=web
&cd=2
&cad=rja
&ved=0CDgQFjAB
&url=http%3A%2F%2Fknoppix.net%2Fforum%2Fforums%2F3-The-Knoppix.net-Forums
&ei=OoDMUZPJD4GytAb-_ICICg
&usg=AFQjCNHuY84bYCFnCvYkMd10jQQI2FKVIA
&bvm=bv.48572450,d.Yms

leads me to

http://knoppix.net/forum/forums/3-The-Knoppix.net-Forums

[Denver Dave]

XP Firefox fooled me - with XP, firefox 22 - cleared cache first and duplicated the redirect. Might mean knoppix is off the hook.

On knoppix 7.0.5 - opened iceweasel instead of firefox and duplicated the redirect with iceweasel to infostore.