http://l000pback.co m/pay.html

finnpark

Hello All,

Bit of a query. Whenever I connect to my eircom ISP via Mozilla Firfox a seperate page opens also with this web address: http://l00pback.c om/pay.html

Can any1 tell me whats causing this. The title of the page is: "You have been paid".

Thanks for any help.

<edit> Broke the url, so nobody gets malware from this post - Gerry </edit>

optikus-prime

Try downloading ad-aware or checking for viruses, it sounds like a browser hijack or malware hijacking your browser

OfflerCrocGod

NO ONE click on that link no matter what browser you are using.

Fenster

Ehh, a bit late now. What's the story with it?

OfflerCrocGod

It downloads something straight to my desktop, using Firefox.....it's one of the nightly builds from a Taiwanese guy who ads ActiveX support so it may be ActiveX. I can't see how it works. Anyone else with Firefox get stuff downloaded to their desktop when clicking that link?
[php]<script language="JavaScript">
var ticket = true;
var autoCloseTimeoutHandle;

function go(){
if (ticket) {
parent.mt_clickthru();
}
}

function err(){
if ( typeof parent.mt_tries != 'number' ) return true;
if ( parent.mt_tries > parent.mtrslib_retry ){
go();
}else{
ticket = false;
parent.mt_tries++;
popup();
}
}

function popup(){
alert( "You must click Yes to access this content." );
window.location.reload()
}
</script>[/php]parent.mt_clickthru(); it must be inside the CODEBASE "http://www.mt-download.com/MediaTicketsInstaller.cab"....I really don't know nothing about Javascript though so I may be wrong - if anyone can figure it out I'd be interested. I may try file a bug with Bugzilla for this if I can figure out if it's a bug or not

Fenster

Nope, nothing.

Then again, I consider anything with ActiveX in it to be..unclean..so I didn't get that nightly. :cool:

Johnny_the_fox

OfflerCrocGod wrote:

NO ONE click on that link no matter what browser you are using.

finnpark - edited the link on your first post!!!!!!! :eek:

OfflerCrocGod

Johnny_the_fox wrote:

finnpark - edited the link on your first post!!!!!!! :eek:

It's alright it's just me I use a different build then from the majority of pople using Firefox. Fenster confirmed it - it looks like ActiveX support which I have in my build is what may be triggering the download, lol I'm allowing MS holes to be ported over to my browser :rolleyes:

finnpark

Thanks everyone for the advice. I must download Noadaware to my PC and also the index.dat removal tool. My PC is also running extremely slow:( and I think this could be causing this. Is there anyway that this popup could be costing me money-ie a dialer. Thanks again.