website: hijacking

thefiresidecat

this whole hijacking to go to the sales page for startrek is getting VEERRRRRYYY old. if I wanted to buy star trek paraphernalia I'd go there on my own wihtout being hijacked but when I click on something to go somewhere i expect to go there. it just adds a bunch of annoying steps to get to my original destination. all it does is guarantee that even if I ever did get a bee in my bonnet that i needed some sort of star trek gear that I'd NEVER buy it from you. Please have them take that code out of the website.

Mod Note: Moved thread to Tech and changed subject line as this is a user-end issue.

armadeonx

Do you mean the banner that pops up just after you get to arcgames.com and you accidentally click the banner instead of the neverwinter window you intended to hit..?

That happens to me a lot...

thefiresidecat

nope. no banner anywhere in sight. I click on the link of where i want to be and it takes me to the webpage of the store.

kreatyve

Exactly what links are doing this? I haven't experienced this myself.

thefiresidecat

All the links it's happening to me on a regular basis just trying not navigate the forum. It seems totally random when and where it might happen. It never happens on the phone tho only when browsing on laptop

armadeonx

I must say that's never happened to me, which browser are you using?

thefiresidecat

Chrome

armadeonx

Huh same as me. I did a quick look-about and saw some advice that uninstalling/reinstalling chrome extensions can fix this but it's not something I've tested myself.

edit - a semi-test could be just disabling all of the extensions?

kreatyve

I haven't seen that happen on either computer I use. Not sure what to recommend. Maybe try getting an Ad Blocker?

omegarealities

Have you checked for Malmare? Those things slip through sometimes. Companies are getting trickier at slipping those things into installations.

thefiresidecat

malware slipping thru that ONLY takes me to a arc sales page on an arc website when accessing other things on their website? not likely. and I do use an adblocker. lol. it's not an ad popping up. I'm actually being redirected to a sales page instead of page 42 of various comments on a thread. (or something similar)

Although It also had been redirecting me to the russian version of this website for awhile when clicking links. (also weird and inexplicable)

EDIT

maybe you're not wrong.. but I don't know how it would have happened to be associated with this site only.. but I can't find that star trek sales page anywhere here. i/e it doesnt' appear to actually be an arc product.. maybe it actually has been hacked. I assumed it was just perfect world marketing but maybe it's russian hacker HAMSTER.

thefiresidecat

I just refreshed this page and got redirected there just now

Removed link as it may be virus-y.

hitting the back button doesn't take you back to where you started. you get pushed back to the generic start page for all of arc things.

zephyriah

thefiresidecat said:

I just refreshed this page and got redirected there just now

Removed link as it may be virus-y.

hitting the back button doesn't take you back to where you started. you get pushed back to the generic start page for all of arc things.

That does not appear to be a PWI/Cryptic site. I don't think they are affiliated with Connekt. So the hijack is likely coming from somewhere else.

Are you on Comcast? I ask because Comcast is listed as one of the companies connected to them.

The site is hosted in Akamai netspace, so that doesn't help narrow it down any and the whois is behind a privacy screen.

thefiresidecat

xfinity is our carrier.

thefiresidecat

well now I don't think it's the arc websites intention that I'm being redirected, but I do think this website has probably been hacked. if it were coming from me or my browser surely this would be happening from other websites and locations. not just this website and not just to that shop startrek website.

zephyriah

thefiresidecat said:

well now I don't think it's the arc websites intention that I'm being redirected, but I do think this website has probably been hacked. if it were coming from me or my browser surely this would be happening from other websites and locations. not just this website and not just to that shop startrek website.

... and if the website was hacked, it would be happening to more people.

So far, you seem to be the only one affected, so if that is the case the logical conclusion is that it is on your end. Either malware, poisoned DNS or something else. But, lacking more data points, including how many other people are really affected, it's just guesswork.

Also, just an FYI. Xfinity=Comcast You can see where it says "Xfinity from Comcast" on the website. So, I still think it could be poisoned DNS or a referral support agreement from Comcast/Xfinity feeding their users to Connekt site(s).

armadeonx

It probably won't help but you can try this just in case it's a dns log issue - open a command prompt window (if you can't see it with the Windows key, type cmd in the search box) and type:
ipconfig /flushdns (note the [space] between the g and the /) that'll just clean it up. Also as I mentioned previously, check your Chrome extensions, remove any ones you don't need and disable the rest for now.

kreatyve

Hey cat... make sure you don't have some kind of extension or app called "Savings.com" as that seems to be what's doing it.

thefiresidecat

not that I see.

kreatyve

thefiresidecat said:

not that I see.

I highly recommend you do a full virus and anti-spyware scan on your computer. It sounds like you are infected with spyware which is causing it. Spybot Search and Destroy is good. Malwarebytes is also decent. Get one and run it, remove everything it tells you to.

thefiresidecat

I have protection from a couple different fronts. I ran a spyware thing anyway. my computer is clean...

armadeonx

Did you try the extensions thing?

zebular

thefiresidecat said:

I have protection from a couple different fronts. I ran a spyware thing anyway. my computer is clean...

The information you've provided here suggests otherwise. Try other browsers, such as Microsoft Edge. If it only happens on Chrome, this is a good indicator that your Chrome Browser has been Hijacked. If it happens on multiple Browsers, then this is a good indicator that you have Malware or a Virus, or perhaps even your Hosts file has been corrupted.

If the Website had been Hijacked, every user would be subjected to the security flaw you're insinuating upon. You're the only one reporting this, so reasonable deduction would exclude this from being a Website Hijack issue and instead, is more likely a Browser Hijack, which is end-user.

thefiresidecat

it is ONLY the arc website this happens on. no other website. no other circumstance. all the scanners say i'm clean.. I'd really expect if my browser or my computer were affected other web sites would also be redirecting. I do a lot of browsing. yet not a single other website redirects. and it redirects to an oddly appropriate startrek sales page... that isn't acting like a random hack imo.

Just because I'm the only one who has said anything doesn't mean I'm the only one affected.

I just did the dns flush. no idea if it was effective yet. the redirect happens randomly lol.

armadeonx

Cool, if it does happen again though you really should try removing & reinstalling all of the extensions

kreatyve

@thefiresidecat I've done some more digging on this and I can tell you 100% without a doubt, your computer is infested with Spyware that is causing these redirects. Please get some better Spyware protection. As this is an issue on your end, we are closing this thread.