Url4short.info Issue!

[MartinW 0]

Url4short.info is a PUP. [Potentially Unwanted Program]

 

When I fire up Chrome the first time that day and search for any site, no issues. However, when I search for Mutley's Hangar in Google and hit forum, Url4short.info rears it's ugly head along with a full page add.

 

Again, this only happens the first time I fire up Chrome that day.

 

I did mange to remove it [i thought] with the use of JRT [Junkware Removal tool] but now it's back.

 

Malwarebytes, and my regular AV don't remove it or throw it up as a threat.

 

Not sure whether it's some kind of an Issue relating to the Hangar, but curious it only occurs when I search for Mutley's Hangar. No issue with IE.

 

Anyone else getting this? 

[needles 1,011]

I just tried replicating your issue Martin but nothing untoward happened.

I'll keep my eye on it in future to see if it happens to me.

Thanks for the HU.

Brian

[MartinW 0]

Thanks Brian.

 

Had you previously used Chrome this morning though? Mysteriously it only occurs the first time. Even if I reboot, it doesn't appear again.

 

Quite baffled really.

 

It's not an ultra risky sod or anything like that, low risk, but a nuisance.

 

The other point, is that it also happens on my other PC.

[mutley 4,495]

Hi Martin

 

We have had this logged before, take a look here http://forum.mutleyshangar.com/index.php/topic/11744-spam-attack/?hl=url4short for previous discussion.

 

 

[MartinW 0]

Right, thanks Joe.

The other thread seems to suggest it's an issue with the actual Google link.

[mutley 4,495]

Agreed, I have no control over what Google tries to do with links, they obviously track everything that goes through but maybe this little gremlin forces a redirect to that site.

[mutley 4,495]

I also note that on the url4short web page their status is "Service currently disabled due to spam complaints."

[ddavid 149]

Martin, run MBAM in Safe with Networking mode - works for me.

Cheers - Dai.

[markhudson6 13]

This link may be of help.  It appears to be a problem with injected code server side.

 

http://peter.upfold.org.uk/blog/2013/01/15/cleaning-up-the-ip-board-url4short-mess/

 

M.

[MartinW 0]

Interesting Mark.

Which would explain why Malwarebytes, and my AV didn't detect it, not on my machine.

Is that right, nothing on my machine then?

Get it too on my simming machine.

[mutley 4,495]

Thanks Mark,

I had already seen that blog and checked there was no suspect code previously and again today, I've also cleared the cache.

Cheers,

Joe

[markhudson6 13]

No worries Joe.  I attempted the packet capture the guy in the article referred to, but no matter what I do I can't replicate the redirect issue in the first place.

 

M.