2 Replies Latest reply on Aug 28, 2013 7:22 PM by Hayton

    Browser issue

      I continue to have my screen in Chrome directed to a website ( gzj.jsopen.net/sd/wrap ) no matter what web page I am on. It wants me to download a video player. I have run my virus scans and it has not stopped the issue. Anybody else running into this ?

        • 1. Re: Browser issue
          Peter M

          Your browser has been hijacked. no doubt caused by clicking on something bad.  See if you can activate System Restore to go back to before it started.  If necessary you can start it in Safe Mode.

           

          Also see the last link in my signature below for suggestions.

           

          Once sorted out make sure your system is totally up to date, especially browsers (all of them even if you don';t use them, IE for example if you use Firefox) and their add-ons.

          • 2. Re: Browser issue
            Hayton

            The only trustworthy reference I could find to removing this was on the Google Product forums - 1 post, 1 answer, referring the poster to https://support.google.com/websearch/answer/8091

             

            From that article, a request for Chrome users :

            If clicking a Google search result has redirected you to a suspicious site, please report the suspicious site before trying the anti-spyware software below. This will help us investigate malware activity and hopefully help prevent it in the future.

             

            All other removal guides for this redirector are on untrusted sites.

             

            And there's something strange about the domain name "jsopen.net". It seems to have been registered at the end of June and is supposedly hosted on a GoDaddy server, but a high proportion of the checking sites report a 404 when trying to access that domain. urlvoid was unable to connect, same with malwaregroup.

             

            Errors - Malwaregroup.png

             

            SiteAdvisor has a big Red warning for it, so if the poster doesn't have SA installed I suggest he gets it. The site is unknown as far as WOT and Google Safe Browsing are concerned. According to Alexa most visitors to the site are from the US and a high proportion come from Google or from YouTube.

             

            Stranger still, the subdomain "gzj.jsopen.net" is on two different servers in the Netherlands and the US. Both urlvoid and Sucuri report an error 404, although each is scanning a different server.

             

            So I think the page that the redirect is trying to send a browser to is unavailable. Possibly the site and the subdomain (on at least 3 different servers) have been taken down.

             

            As for the redirector, it may have altered a PC's HOSTS file; more likely all browsers on a PC have had an add-on or extension inserted. It should be possible to disable or remove these manually. Malwarebytes and/or AdwCleaner may be needed to clean up the system afterwards.

             

            Message was edited by: Hayton on 29/08/13 01:22:56 IST