How to navigate away from quicksand domains which hold your browser captive until you install their software?

[Tom]

On Sun, 13 Jul 2008 10:43:39 -0500, VanguardLH wrote:
> Didn't bother to test the rest as I already found one of your listed
> sites which did NOT behave as you claim for the web browser that I used
> (IE7).

I must admit, those were the last few I ran into.

But the last one occurred today (which I started putting at the top of the
list for just the type of thing you wonderfully tested!)

What happens when you try this one?
http://thecatalogfree.net

[Tom]

On Sun, 13 Jul 2008 10:00:34 -0700, David E. Ross wrote:

> Also, does not the Home button on your Personal toolbar work?
No. Nothing works except to kill firefox and not restart with all the same
tabs all over again.

The only other thing that stops the quicksand while you're still in the
browser session is to add it to the hosts file and then shift reload the
browser.

Only then does the quicksand page dump itself.

Try it yourself with the following domain which quicksanded me today!

hxxp://thecatalogfree.net

(note I obfuscated the http protocol to protect others as per lipman)

[Tom]

> 1. I opened a tab to http://thecatalogfree.net with Firefox 3.0 on WinXP
....
> 127.0.0.1 thecatalogfree.net
> 7. I then shift-reload my browser (to flush cache)
> 8. Voila! A shift-reload flushes cache & dumps the kwiksand page!

I tried this without shift reloading and the kwiksand page still locks up
the browser infinately.

So, the kwiksand page must NOT be looking at the hosts file after the first
reload which means it must be looking only in your cache which means it
must have already dumped its malicious code in your cache from the start.

Only shift reloading the browser after putting the quicksand page into the
hosts file will solve the problem.

[Tom]

On Sun, 13 Jul 2008 19:16:24 +0200, Hendrik Maryns wrote:

> If I click on this in Firefox 3 (on Linux, but that shouldn¢t make a
> difference), I get a page warning that it is a scam page, with a button
> ¡Get me out of here!¢.

That warning must be coming from the browser. That was an old link I gave
you (from my past experience).

What happened when you clicked on http://thecatalogfree.net (which I
verified today)?

Does http://thecatalogfree.net also give you that "get me outta'here"
warning?

[C A Upsdell]

Tom wrote:
> How do we get out of the browser infinite loop quicksand when we navigate
> to web pages designed to lock us in and force us to hit the "pay me" button
> (whatever they want to force you to do)?

If Windows, Ctrl Alt Delete to call up the task manager; select the
browser; kill it.

[Ed Mullen]

Tom wrote:
> On Sun, 13 Jul 2008 10:00:34 -0700, David E. Ross wrote:
>
>> Also, does not the Home button on your Personal toolbar work?
> No. Nothing works except to kill firefox and not restart with all the same
> tabs all over again.
>
> The only other thing that stops the quicksand while you're still in the
> browser session is to add it to the hosts file and then shift reload the
> browser.
>
> Only then does the quicksand page dump itself.
>
> Try it yourself with the following domain which quicksanded me today!
>
> hxxp://thecatalogfree.net
>
> (note I obfuscated the http protocol to protect others as per lipman)

403 Forbidden.

--
Ed Mullen
http://edmullen.net
I have found the paradox, that if you love until it hurts, there can be
no more hurt, only more love. - Mother Teresa

[hummingbird]

On Sun, 13 Jul 2008 10:08:48 -0700 'Tom'
wrote this on alt.comp.freeware:

>On Sun, 13 Jul 2008 17:03:54 +0100, hummingbird wrote:
>
>> Afaik the only solution is to shut the browser down and
>> enter its name in your HOSTS file, so you never go there again.


>Hummingbird has a great answer!
>
>Here's what I did when I went to an HTML kwiksand domain just now on
>Firefox 3.0 on WinXP with JavaScript and Java enabled ('cuz you need 'em
>for other pages).
>
>1. I opened a tab to http://thecatalogfree.net with Firefox 3.0 on WinXP
>2. I tried to kill the tab -> the html kwiksand prevented this
>3. I tried to go to a new tab -> the html kwiksand prevented this
>4. I tried to kill firefox -> the html kwiksand prevented this
>5. Rather than kill the firefox process in the task manager ...
>6. I now just type Start->Run->hosts and enter the domain
>127.0.0.1 thecatalogfree.net
>7. I then shift-reload my browser (to flush cache)
>8. Voila! A shift-reload flushes cache & dumps the kwiksand page!
>
>Note this one-time setup:
>1. Copy hosts to host.txt and to hosts.bck
>2. Start->Run->Regedit to add the following key-value pair:
>HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ap p Paths
>hosts.exe = c:\windows\system32\drivers\etc\hosts.txt
>
>Do this every time you are caught in HTML kwiksand!
>1. Go to the web page http://thecatalogfree.net
>2. You'll note you are stuck on that page forever
>3. Rather than control alt delete kill the Firefox browser session ...
>4. Just type Start -> Run -> hosts
>5. Enter the domain into that hosts.txt file
>127.0.0.1 thecatalogfree.net
>6. Write the hosts.txt file to hosts (overwriting the hosts file)
>8. Quick out of your text editing session (I used vim freeware)
>9. Shift Reload your browser
>10. The kwiksand web page will disappear!
>
>Woo hoo! Hummingbird found the solution to HTML kwiksand!!!!!!!!!!!!!!

Yep, you got the HOSTS syntax absolutely right in [5.] above.
Deal with these malware peddlers by blocking access to them.
It works wonders :-)


--
"All truth passes through three stages.
First, it is ridiculed, second it is violently opposed,
and third, it is accepted as self-evident"
(Arthur Schopenhauer)

[Tom]

On Mon, 14 Jul 2008 03:22:18 +1000, Me Here wrote:

> I just tried all those links using nothing but FireFox 3 with javascript
> and java enabled. All of them bar two failed to load. Of those, one
> was blocked by OpenDNS, one was blocked by FF/antivirus/spywareblaster,
> two loaded no probs although I could easily navigate away/shut them down
> (spywareiso2008). The others have been taken down.

I must admit these were in a series which, over the past weeks, I've been
keeping track of.

Let me dig today to try to hit a site that is definate for today so we can
all run the right tests!

[Bear Bottoms]

On Sun, 13 Jul 2008 12:40:22 -0500, Tom <twilson3@hotmail.com> wrote:

> hxxp://thecatalogfree.net

All kinds of bells and whistles went off and Cox intercepted it saying it
was trying to change my network settings via a Trojan. Not a nice place.
Of course, no harm was done to my computer, but I wouldn't advise anyone
to try it out.

--
Bear Bottoms
Freeware website: http://bearware.info

[Bear Bottoms]

On Sun, 13 Jul 2008 12:49:43 -0500, hummingbird <hummingbird@127.0.0.1>
wrote:

> Yep, you got the HOSTS syntax absolutely right in [5.] above.
> Deal with these malware peddlers by blocking access to them.
> It works wonders

Rather after-the-fact isn't it?

--
Bear Bottoms
Freeware website: http://bearware.info