What's up with Yahoo?

December 14, 2007 6:57 PM

What's up with Yahoo! Am I alone or are there problems?

I use yahoo as my main search engine. Lately, when i search for the most mundane of terms, I get redirected to www.alfasort.com, that redirects me to some random site similar to what I am actually looking for.

I even tried searching for Ask Metafilter and after clicking on the number 1 link (ask.metafilter.com) it returned me to the yahoo home page.

Is this a Yahoo! problem or a problem for bach's computer?

posted by bach to Computers & Internet (13 answers total)

Sounds like spyware/browser hijacking to me. My search for "boots" comes up with this innocuous looking page.
posted by i less than three nsima at 7:00 PM on December 14, 2007

Browser Helper Object.

Use Ad-Aware or similar to clean.
posted by dhartung at 7:31 PM on December 14, 2007

Response by poster: I should add that I have a MacBook Pro running 10.4.11 and this occurs in both firefox and safari as well as Microsoft Explorer 5.2 (unsupported)
posted by bach at 8:56 PM on December 14, 2007

I wonder if you've been set up to use a proxy without your knowledge? That would apply identically to all browsers.
posted by Steven C. Den Beste at 9:09 PM on December 14, 2007

Your computer, or your ISP... If Yahoo had a major problem I'd know about it.
posted by zengargoyle at 9:41 PM on December 14, 2007

sounds like spyware. In my experience Adaware and such look nice, but never ever work on any serious spyware problem. You can try, but what tends to actually work is specific solutions:

google "www.alfasort.com spyware" or something similar, if it's a common spyware someone has made a specific fix for it I bet.
posted by drjimmy11 at 10:50 PM on December 14, 2007

It's just you. I'm surprised by it but you seem to be the victim of malware. I've never seen anything like that on the Mac. Have you installed any software recently, or allowed your computer to be used by someone else who might have done? A weird codec or something? Have you checked your hosts file, anything funny in there?
posted by evariste at 11:54 PM on December 14, 2007

Does it happen when you use a different net connection? If not, then it sounds like a proxy/DNS problem elsewhere. If it's still messed up, try switching your DNS to OpenDNS to see if that solves it, and check in the network settings for any obvious proxies.

Did you try out any software/settings that does stuff like anonymising your net connection?
posted by malevolent at 12:44 AM on December 15, 2007

I can think of three possibilities....

1) A proxy that is redirecting your search
2) Your Host file is changing your search
3) Your DNS is redirecting your search.

#1 and #3 are easy enough to check.

If you go to your System settings>network settings....you need to make sure two areas are 'clear'
See this image. All these things should be empty (in the picture some of them are checked.

Your DNS settings should be clear too .

Let us know how those work for you and we'll go from there.
posted by filmgeek at 5:06 AM on December 15, 2007

Best answer: alfasort is hosted at Esthost, which is a sure sign it's run by Russian malware gangs.

Probably you've been hit by a DNS hijacker, redirecting your DNS queries to one of Esthost's servers (typically at 85.255.11x.xxx), which then sends you to a variety of PPC scams and other rubbish.

The most common way these are being installed at the moment is through the CWS.VCodec group's fake codecs (it is claimed your browser needs to install a video codec in order to play a movie, but when you install it there is no codec, only a malware package including the DNS hijacker, and many other bad things if you're unlucky). The other way is through browser exploits, but these rarely target Macs, whereas the VCodec scam does now.
posted by BobInce at 5:14 AM on December 15, 2007

You probably got hit with one of the latest Quicktime Vulnerabilities. Macs are not untouchable, you'll start seeing more of these types of things as their market share grows.

The reason you're only seeing this on Yahoo is likely either due to it being your default search/homepage or because they still have a rather large presence outside of the US where Google is currently dominating. Then again, you didn't say if you've actually tried any other search engine to see if they're behaving the same way.
posted by o0o0o at 10:52 AM on December 15, 2007

Best answer: Oh, and I hate to break it to you, but you can't trust that computer at all anymore. Don't do online banking, check into any important accounts - anything. You have no idea what was installed on there or what has already been sent from your computer. If you want to be safe, it's time to wipe and start over. Sorry.
posted by o0o0o at 11:02 AM on December 15, 2007

Response by poster: Archive and reinstalled the system software. First time that I've ever been hit by one of these...and I've been using Macs since 1988.

Yahoo works as it should. Am I safe? Or do I need to do a complete nuke and pave and completely reformat?

Thanks for all of your assistance.
posted by bach at 10:27 PM on December 15, 2007