1. This site uses cookies. By continuing to use this site, you are agreeing to our use of cookies. Learn More.

Anyone else getting 404 pages redirected to 404bucks?

Discussion in 'BlackHat Lounge' started by GreyWolf, Oct 14, 2011.

  1. GreyWolf

    GreyWolf Executive VIP Jr. VIP

    Joined:
    Aug 17, 2009
    Messages:
    1,930
    Likes Received:
    5,387
    Gender:
    Male
    Occupation:
    Artist / Craftsman
    Location:
    sitting at my PC
    For the last week I've been dealing with a browser hijack. Any time I get a 404 error my browser is redirected to 404bucks.com

    I've tried to search google, but even just including 404 in the search criteria causes the redirect as well. When the search results come up I have to click the stop button to keep the serp page from getting redirected to 404bucks.

    I've run malwarebytes, spybot, avira, etc. and nothing is finding the malware. Searched the registry and couldn't find anything related to 404bucks or even anything that looks like it would cause redirects for 404 errors.

    The 404bucks page is powered by admedia. I called the contact number just for the hell of it, but of course the operator has no clue who to transfer me to. lol I doubt it's actually directly their fault anyway, it looks more like an affiliate is probably spreading some malware that does the redirect.

    I'll try to catch the online support for admedia later to at least report the affiliate is spreading malware. I'm sure it's probably against their tos. lol
    This is the page being redirected to
    Code:
    http://404bucks.com/landing/?affId=IywxMjI&domainname=www.google.com
    so the affid is IywxMjI. I'll probably do a negative review campaign against 404bucks later if I feel like it, also specifying the affid being used. But that doesn't help me now.

    For now I just want to figure out how to get rid of it. I'm usually really good at rooting out malware and adware but this one is really pissing me off.
     
    Last edited: Oct 14, 2011
  2. GreyWolf

    GreyWolf Executive VIP Jr. VIP

    Joined:
    Aug 17, 2009
    Messages:
    1,930
    Likes Received:
    5,387
    Gender:
    Male
    Occupation:
    Artist / Craftsman
    Location:
    sitting at my PC
    LOL. Since I included 404 bucks in this thread, even this page is getting redirected now. I have to be quick and hit the stop button just to stay on the thread or else I end up on the 404bucks page again.

    Bastard hijackers. :zx11pisse
     
  3. mrdexter

    mrdexter Junior Member

    Joined:
    May 20, 2011
    Messages:
    184
    Likes Received:
    63
    HiJackThis log?

    Failing that I use a USBCD4Win to boot to a pre installation environment and scan from there.
     
  4. Ronbo

    Ronbo Newbie

    Joined:
    Oct 6, 2011
    Messages:
    0
    Likes Received:
    0
    Has anyone figured out how to get rid of this? Seems to only happen in FF, and it seems to get worse as time goes by. Now, if I even enter 404bucks in Google search, I get the search results but then I'm immediately redirected away and can't get back. This thing is a butt kicker and no one seems to be able to figure it out...
     
  5. Hostwinds

    Hostwinds Power Member UnGagged Attendee Enterprise Member

    Joined:
    May 17, 2010
    Messages:
    766
    Likes Received:
    544
    Occupation:
    C.E.O.
    Location:
    Oklahoma
    Home Page:
    This should be resolved
     
  6. GreyWolf

    GreyWolf Executive VIP Jr. VIP

    Joined:
    Aug 17, 2009
    Messages:
    1,930
    Likes Received:
    5,387
    Gender:
    Male
    Occupation:
    Artist / Craftsman
    Location:
    sitting at my PC
    Yeah it is. Or at least it kind of is anyway. :)

    Yeah nothing identified the problem for me. Spybot s&d, malwarebytes, avg, avira and a few others did'nt find anything at all.

    I finally just disabled all the ff addons and toolbars I had and the problem went away. Since then I've reenabled the ones that I actually do use and the problem hasn't come back. I was going to reenable the toolbars as well to see which one it was, but most of them are just gone completely, so I don't know specifically which one it was.

    Not sure which plugin or toolbar it was because I just disabled all of them and then updated FF. Since I reenabled all the addons without any problem, I'm pretty sure it was probably a toolbar.

    You might try disabling each of your toolbars one at a time till you find the one causing it. If that doesn't help then move on to each of the addons. If you isolate it down to a specific toolbar or addon then please come back to post that info in this thread as well.