Social Icons

Pages

Showing posts with label Blog Hijack Intentional Install. Show all posts
Showing posts with label Blog Hijack Intentional Install. Show all posts

Thursday, 9 May 2013

Blogger Blogs Redirecting To "opromo . com"

This week, we're seeing a new stream of problem reports, from blog owners whose blogs are, once again, mysteriously redirecting their readers to unknown destinations.
When I open my blog, it automatically directs to another search engine display.

This appears to be yet one more gadget, willingly installed by many Blogger blog owners, which is now redirecting uninterested viewers. The target of the redirection, this week, is a parked domain website (ie, "search engine display") - for a product which was apparently installed, willingly, by the blog owners.

It appears that the "opromo . com" free visitor meter is the latest victim of expiring domain registrations.

Overview for opromo.com

Registrar Info
Name PDR LTD. D/B/A PUBLICDOMAINREGISTRY.COM
Whois Server whois.PublicDomainRegistry.com
Referral URL http://www.PublicDomainRegistry.com
Status clientTransferProhibited

Important Dates
Expires On May 09, 2013
Registered On May 09, 2006
Updated On May 09, 2013
People who earlier installed the Opromo free visitor meter will need to uninstall it, as it's apparently no longer operational. Reliable replacements would be SiteMeter and StatCounter - as well as Google Analytics.

From what we've seen, identification and removal of the problem code seems to be straightforward - just access the dashboard "Layout" menu wizard, find the gadget identified, and remove it.

As always, you are advised to clear cache and restart the browser, after removal and before testing for success. If the gadget makes your dashboard redirect, before you can remove the redirecting code, use a well protected browser, like Firefox with NoScript, to block the redirection.

>> Top

Friday, 1 March 2013

Blogger Blogs Redirecting To "scmplayer . net"

This week, we're seeing a new stream of problem reports, from blog owners whose blogs are, once again, mysteriously redirecting their readers to unknown destinations.
When I open my blog, it automatically directs to another website, which is SCM Music Player.

This appears to be yet one more gadget, willingly installed by many Blogger blog owners, which is now redirecting uninterested viewers. The target of the redirection, in this case, is a website which is simply a commercial advertisement - for the product which was apparently installed, willingly, by the blog owners.

The website in question, "scmplayer . net", unlike some previous episodes of this nature, does not appear to be expired.
Overview for scmplayer.net

Registrar Info
Name GODADDY.COM, LLC
Whois Server whois.godaddy.com
Referral URL http://registrar.godaddy.com
Status clientDeleteProhibited, clientRenewProhibited,
clientTransferProhibited, clientUpdateProhibited

Important Dates
Expires On March 25, 2014
Registered On March 25, 2011
Updated On December 13, 2011

If we use a text only browser, such as an HTTP trace utility, the problem code is easily identified. Here's a redacted example, taken from the latest forum problem report.
<div class='widget HTML' id='HTML1'>
<div class='widget-content'>
<!-- SCM Music Player http : // scmplayer . net -->
<script type="text/javascript" src="http : // scmplayer . net/script . js"
data-config="{'skin':'skins/aquaOrange/skin.css','volume':50,'autoplay':true,'shuffle':true,'repeat':1,'placement':'top','showplaylist':false,'playlist':[{'title':'Waves','url':'http://youtu.be/IFS0Eo1eh6Y'},{'title':'Money Trees','url':'http://youtu.be/jSXiNdTbTA4'},{'title':'Keep it Moving','url':'http://youtu.be/XqRC_Fh--js'},{'title':'Find Away','url':'http://www.youtube.com/watch?v=KS6zq6_iMCk'},{'title':'Do your Love','url':'http://www.youtube.com/watch?v=2zVwbgXaMRo'},{'title':'Bitch Don%27t Kill My Vibe','url':'http://www.youtube.com/watch?v=OcYvaLIgjTk'},{'title':'True Livin','url':'http://youtu.be/wMFHqqiR3Co'}]}" ></script>
<!-- SCM Music Player script end -->


From what we've seen so far, identification and removal of the problem code seems to be straightforward - just access the dashboard "Layout" menu wizard, find the gadget identified, and remove it.

As always, you are advised to clear cache and restart the browser, after removal and before testing. If the gadget makes your dashboard redirect before you can un install the misbehaving code, use a well protected browser, like Firefox with NoScript, to block the redirection.

>> Top