HobbyKing.com New Products Flash Sale
Reply
Thread Tools
Old Mar 01, 2012, 10:33 AM
Wherever you go there you are
7oneWo1f's Avatar
United States, MN, Minneapolis
Joined Nov 2011
8,455 Posts
Suggestion
URL bar highjacking

Please end this. When I am on rcgroups, and go to the URL bar to type in a new site, it launches a new window. RCGroups is the only site that does this. I assume you found a clever way to do this, but bad site feature in my view.

Also, another suggestion....add a MY RCGroups button at the bottom of the thread, not just at the top, to help on touch screen devices.
7oneWo1f is offline Find More Posts by 7oneWo1f
Reply With Quote
Sign up now
to remove ads between posts
Old Mar 01, 2012, 01:10 PM
RCGroups tech support
Mike Kolesnikov's Avatar
Joined May 2002
3,437 Posts
I can assure you it's not something we would add to the site. It looks like an effect of malware on your computer.
What is being loaded in that newly opened window? What browser do you use?
Mike Kolesnikov is offline Find More Posts by Mike Kolesnikov
Administrator
Reply With Quote
Old Mar 01, 2012, 03:18 PM
Wherever you go there you are
7oneWo1f's Avatar
United States, MN, Minneapolis
Joined Nov 2011
8,455 Posts
Quote:
Originally Posted by Mike Kolesnikov View Post
I can assure you it's not something we would add to the site. It looks like an effect of malware on your computer.
What is being loaded in that newly opened window? What browser do you use?
The site I typed into the old bar. E.g., I type google.com, a new window launches, and goes to google. The new window would only pop up if I were at rcgroups.

Is it perhaps advertiser code?

I just double checked, and it's not doing it now. Strange, it's been doing it for a few days.

I am pretty sure I am not infected with anything, but I'll run some scans tonight.

OS is windows 7 64-bit. I use both the 32-bit and 64-bit of IE, and I didn't bother to notice which version it occured on, but right now it's not happening on either.
7oneWo1f is offline Find More Posts by 7oneWo1f
Reply With Quote
Old Mar 02, 2012, 11:59 AM
RCGroups tech support
Mike Kolesnikov's Avatar
Joined May 2002
3,437 Posts
Could it be that you pressed CTRL-ENTER instead of just ENTER? I don't know for IE but Firefox launches the site in a new window on that key combo. Maybe IE does that, too.
Mike Kolesnikov is offline Find More Posts by Mike Kolesnikov
Administrator
Reply With Quote
Old Mar 03, 2012, 05:10 PM
Wherever you go there you are
7oneWo1f's Avatar
United States, MN, Minneapolis
Joined Nov 2011
8,455 Posts
I tried that, and it didn't reproduce the behavior. I've tried many other approaches, and have been unable to reproduce it. So if it was malware, it was self-healing (or is in hiding).

You can close this issue, I'll let you know if I ever learn more.
7oneWo1f is offline Find More Posts by 7oneWo1f
Reply With Quote
Old Mar 14, 2012, 09:36 AM
Wherever you go there you are
7oneWo1f's Avatar
United States, MN, Minneapolis
Joined Nov 2011
8,455 Posts
It's doing it again. Here is the source from view source. This time it is doing it with IE 9 64-bit version.

<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
<html xmlns="http://www.w3.org/1999/xhtml" dir="ltr" lang="en">
<head>
<base href="http://www.rcgroups.com/forums/"></base>
<script type="text/javascript">
var ad_zones = new Array(
'zone:66',
'zone:126',
'zone:131',
'zone:156',
'zone:160',
'zone:161'
);
</script>
<style type="text/css" id="vbulletin_css">
/**
* vBulletin 3.8.4 CSS
* Style: 'RCGroups Beta'; Style ID: 40
*/
@import url("clientscript/vbulletin_css/style-ba574a62-00040.css");
</style>
<link rel="stylesheet" type="text/css" href="clientscript/vbulletin_important.css?v=384" />


<script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/yui/2.7.0/build/yahoo-dom-event/yahoo-dom-event.js?v=384"></script>
<script type="text/javascript" src="http://ajax.googleapis.com/ajax/libs/yui/2.7.0/build/connection/connection-min.js?v=384"></script>
<script type="text/javascript">
<!--
var SESSIONURL = "";
var SECURITYTOKEN = "1331735529-679c9119871968c43a1e5ec3e7f5136e6b35a0e5";
var IMGDIR_MISC = "http://static.rcgroups.net/forums/images/beta/misc";
var vb_disable_ajax = parseInt("0", 10);
//--></script>
<script type="text/javascript" src="http://static.rcgroups.net/forums/clientscript/vbulletin_global.js?v=384"></script>
<script type="text/javascript" src="http://static.rcgroups.net/forums/clientscript/newstyle.js?v=1"></script>
<script type="text/javascript" src="http://static.rcgroups.net/forums/clientscript/vbulletin_menu.js?v=384b"></script>

<script type="text/javascript">
<!--
if (typeof(ad_zones) == 'undefined') var ad_zones = new Array();
ad_zones.push('zone:172');
ad_zones.push('400x25,_campaignid:2747');
ad_zones.push('zone:143'); ad_zones.push('zone:174');
ad_zones.push('zone:98');
ad_zones.push('zone:168');

ad_zones.push('clientid=1004');
var what = '';
for (var i in ad_zones) what += ad_zones[i] + '!';
document.write ("<" + "script language='JavaScript' type='text/javascript' src='");
document.write ("http://decals.rcgroups.net/adjsc.php?z=" + what);
document.write ("&amp;block=1&amp;source=index");
document.write ("'><" + "/script>");
//--></script>

<script type="text/javascript">
var _gaq = _gaq || [];
_gaq.push(['_setAccount', 'UA-106064-1']);
_gaq.push(["_setCustomVar", 1, "forumid", "0", 3]);
_gaq.push(["_setCustomVar", 2, "member", "true", 3]);
_gaq.push(['_setSiteSpeedSampleRate', 2]);
_gaq.push(['_trackPageview']);
(function() {
var ga = document.createElement('script'); ga.type = 'text/javascript'; ga.async = true;
ga.src = ('https:' == document.location.protocol ? 'https://ssl' : 'http://www') + '.google-analytics.com/ga.js';
var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(ga, s);
})();
</script>

<!-- attachment thumbnails for IE -->
<!--[if lte IE 7]>
<style type="text/css">
.thumbwrap li, .thumbwrap {
display: inline;
_height: 0;
}
</style>
<![endif]-->

<!-- fix prefix display in stupid IE -->
<!--[if IE]>
<style type="text/css">
td.alt2 > a > span.cats { display:inline-block; cursor: pointer; }
</style>
<![endif]-->

<meta http-equiv="Content-Type" content="text/html; charset=ISO-8859-1" />

<meta name="keywords" content="rc,r/c,radio,remote,control,model,electric,plane,aircra ft,fuel,airplane,heli,nitro,car,foamy,parkflyer,li po,battery,brushless,video,gallery" />
<meta name="description" content="RC Groups - the most active Radio Control model community: electric and fuel rc airplanes,rc helis,rc boats and rc cars. Features discussion forums, blogs, videos and classifieds." />
7oneWo1f is offline Find More Posts by 7oneWo1f
Reply With Quote
Old Mar 14, 2012, 09:37 AM
Wherever you go there you are
7oneWo1f's Avatar
United States, MN, Minneapolis
Joined Nov 2011
8,455 Posts
The text was too long so I had to cut it. Let me know I saved the whole thing.

I'm guessing one of your ad servers is putting in what they think is clever code.
7oneWo1f is offline Find More Posts by 7oneWo1f
Reply With Quote
Old Mar 14, 2012, 09:42 AM
Administrator
Jim T. Graham's Avatar
United States, TN, Nashville
Joined Mar 2002
11,445 Posts
We have nothing on the site that does what you are describing. If we did it would be removed immediately. Also, no other user has this issue. I'm curious to see what Mike can figure out from the code your provided.
Jim T. Graham is offline Find More Posts by Jim T. Graham
Administrator
Reply With Quote
Old Mar 14, 2012, 09:44 AM
Wherever you go there you are
7oneWo1f's Avatar
United States, MN, Minneapolis
Joined Nov 2011
8,455 Posts
It's not doing it on the 32-bit version of IE9, but was still on the 64-bit. After I closed all instances of and re-opened the 64-bit version, it stopped doing it too. But before I closed all instances, it would do it (repeated experiments).
7oneWo1f is offline Find More Posts by 7oneWo1f
Reply With Quote
Old Mar 14, 2012, 02:00 PM
RCGroups tech support
Mike Kolesnikov's Avatar
Joined May 2002
3,437 Posts
There is nothing malicious in the saved HTML you sent me. I checked every script and they all belong to the page. I also checked it with several online virus scanners and they showed nothing.

From what you describe (i.e. issue gone after the browser restart), it's an issue with your computer setup.
Mike Kolesnikov is offline Find More Posts by Mike Kolesnikov
Administrator
Reply With Quote
Old Mar 14, 2012, 02:21 PM
Wherever you go there you are
7oneWo1f's Avatar
United States, MN, Minneapolis
Joined Nov 2011
8,455 Posts
Quote:
Originally Posted by Mike Kolesnikov View Post
There is nothing malicious in the saved HTML you sent me. I checked every script and they all belong to the page. I also checked it with several online virus scanners and they showed nothing.

From what you describe (i.e. issue gone after the browser restart), it's an issue with your computer setup.
Thanks for looking into this. I'm not sure what to say. Scripts can be dynamically changed on the adservers. Other more popular websites including the startribune and drudgereport.com have had malware spread via adservers. I'm not saying this is malware...nothing other than the strange behavior occurs with regard to the periodic URL bar causing launch of new window. Would you like me to continue providing feedback if it recurs? Or should I just drop it.

UPDATE: It's doing it again. Could it just be buggy code? E.g., if you click on an advertiser, it launches a new window. Perhaps the same code isn't being closed properly, and causes IE9 to misbehave when I type in an address in the URL bar?
7oneWo1f is offline Find More Posts by 7oneWo1f
Last edited by 7oneWo1f; Mar 14, 2012 at 02:32 PM.
Reply With Quote
Old Mar 15, 2012, 01:33 PM
RCGroups tech support
Mike Kolesnikov's Avatar
Joined May 2002
3,437 Posts
Quote:
Originally Posted by N6145k View Post
Thanks for looking into this. I'm not sure what to say. Scripts can be dynamically changed on the adservers. Other more popular websites including the startribune and drudgereport.com have had malware spread via adservers. I'm not saying this is malware...nothing other than the strange behavior occurs with regard to the periodic URL bar causing launch of new window. Would you like me to continue providing feedback if it recurs? Or should I just drop it.

UPDATE: It's doing it again. Could it just be buggy code? E.g., if you click on an advertiser, it launches a new window. Perhaps the same code isn't being closed properly, and causes IE9 to misbehave when I type in an address in the URL bar?
The HTML code in the page has no way to control the browser behavior when you interact with the location bar. It's by design. It would be a major security issue otherwise.

I wish I could help you with this, but I just don't see how it's a site issue.
Mike Kolesnikov is offline Find More Posts by Mike Kolesnikov
Administrator
Reply With Quote
Old Mar 15, 2012, 01:43 PM
Wherever you go there you are
7oneWo1f's Avatar
United States, MN, Minneapolis
Joined Nov 2011
8,455 Posts
No problem. If it's an IE issue I guess I'll eventually find the solution once I figure out the correct combination of terms to google.
7oneWo1f is offline Find More Posts by 7oneWo1f
Reply With Quote
Reply


Thread Tools

Similar Threads
Category Thread Thread Starter Forum Replies Last Post
Discussion url bipe22 Site Chat 2 Feb 29, 2012 07:45 PM
For Sale msr fly bar bethelflier8036 Aircraft - Electric - Helis (FS/W) 2 Feb 28, 2012 08:09 AM
Discussion url test JimHSoars Test Forum 1 Feb 15, 2012 07:49 PM
Suggestion Find URL and post it Leroy Gardner Site Suggestions / Complaints 4 Feb 14, 2012 09:51 PM