By using this site, you agree to our updated Privacy Policy and our Terms of Use. Manage your Cookies Settings.
440,466 Members | 1,309 Online
Bytes IT Community
+ Ask a Question
Need help? Post your question and get tips & solutions from a community of 440,466 IT Pros & Developers. It's quick & easy.

Hijacked Domains!

P: 5
Hello Everyone. I'm new to this forum (and to forums in general) so please be kind to me - I have a lot to learn.

My immediate problem is that some of my domains appear to have been "hijacked". More specifically, when I type in the address (www.dendroco.com is an example), I get a page offering vitamins and other junk. I am sure that this is due to some trickery having been introduced to my PC because friends don't get the same result.

The domains in question don't have active web sites but they have been set up on 'Google Apps for Domains' (maybe a clue there). I did some sleuthing and the Firefox error console logs this:

Warning: Expected declaration but found '100%'. Skipped to next declaration.
Source File: http://www.dendroco.com/css/w01/t101.css?def=Akamai%3aHostingURL%3dhttp%3a%2f%2fi. nuseek.com%7cBdyStyl%3aPageBackgroundColor%
(plus several dozen characters related to the link which I haven't pasted)

Any ideas or suggestions anyone? I would be most grateful ....
Sep 22 '07 #1
Share this Question
Share on Google+
4 Replies


pbmods
Expert 5K+
P: 5,821
Heya, John.

You might have a spyware problem. LavaSoft's free Ad-Aware does a fantastic job of removing spyware.
Sep 22 '07 #2

P: 5
Ah, yes. Forgive me: I neglected to mention that I have run numerous spyware / virus / trojan, etc., detection and removal programs, including Ad-Aware 2007, Spybot S&D, AVG anti-spyware, AVG rootkit, SpywareBlaster and Ad-Watch but to no avail.
Sep 22 '07 #3

oddjob
P: 7
I see you have already used several respected infection cleaners but, if you haven't run these already, then do so now .....

Superantispyware > http://www.superantispyware.com/

TrojanHunter > http://www.misec.net/

Download each, update them to the latest definitions, and have them run full scans on your entire systems on their default settings.

Let them fix whatever they find.


ComboFix >
http://download.bleepingcomputer.com...a/ComboFix.exe

Double click combofix.exe & follow the prompts.

Note >> Do not mouseclick combofix's window while it's running. That may cause it to stall.

When finished, it will produce a log for you. The report is called ComboFix.txt. Remember where that report is saved on your computer.

Post that log in your next reply along with a HijackThis log AND an update on how the computer is operating now.


OJ
Sep 25 '07 #4

Nepomuk
Expert 2.5K+
P: 3,112
Hello Everyone. I'm new to this forum (and to forums in general) so please be kind to me - I have a lot to learn.

My immediate problem is that some of my domains appear to have been "hijacked". More specifically, when I type in the address (www.dendroco.com is an example), I get a page offering vitamins and other junk. I am sure that this is due to some trickery having been introduced to my PC because friends don't get the same result.

The domains in question don't have active web sites but they have been set up on 'Google Apps for Domains' (maybe a clue there). I did some sleuthing and the Firefox error console logs this:

Warning: Expected declaration but found '100%'. Skipped to next declaration.
Source File: http://www.dendroco.com/css/w01/t101.css?def=Akamai%3aHostingURL%3dhttp%3a%2f%2fi. nuseek.com%7cBdyStyl%3aPageBackgroundColor%
(plus several dozen characters related to the link which I haven't pasted)

Any ideas or suggestions anyone? I would be most grateful ....
Have you checked that site with several Browsers or just with Firefox? (If not: do so!) Are you using a Proxy? (Check that, just to make sure.) Is that Proxy, if you're using one, trustworthy? (Private proxy or public proxy - if public, which one?) Is the site displayed correctly, when using this link? Do other computers use the same Internet line and if so, do they get the same page displayed?

Greetings,
Nepomuk
Sep 25 '07 #5

Post your reply

Sign in to post your reply or Sign up for a free account.