Tek-Tips is the largest IT community on the Internet today!

Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!

  • Congratulations Chriss Miller on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!

pop-up on fresh apache server install

Status
Not open for further replies.

denisl

Technical User
Jun 18, 2001
36
US
I just installed apache on RH 2.4.

I pointed my browser at the url and I get a pop up. I thought maybe it was my PC but I'm using a different computer now and again I get the same pop up.

How can I identify if this popup is being initiated from my linux apache webserver?

link is
The web port was opened on my firewall for literally 10 minutes. I accessed the above link maybe 5 times within a minute then all of a sudden... pop-up!
 
This is the code that is displaying the page:

Code:
<HTML><HEAD>
<META NAME="description" CONTENT="talkship.com">
<META NAME="keywords" CONTENT="">
</HEAD>
<FRAMESET border=0 rows="100%,*" frameborder="no" marginleft=0 margintop=0 marginright=0 marginbottom=0>
<frame src="[URL unfurl="true"]http://ww2.talkship.com:8000"[/URL] scrolling=auto frameborder="no" border=0 noresize>
<frame topmargin="0" marginwidth=0 scrolling=no marginheight=0 frameborder="no" border=0 noresize>
</FRAMESET>
</HTML>

Any idea where that could have come from? Have you tried replacing your index page with another one to see if it happens again?
 
My index.htm is very simple. I don't have any content yet.

Code:
[root@RAMAIR html]# pwd
/var/[URL unfurl="true"]www/html[/URL]
[root@RAMAIR html]# cat index.htm
RAMAIR Apache
Webserver!
[root@RAMAIR html]#

I'm running my apache server to listen on port 8000. I'm using to forward talkship.com to ww2.talkship.com:8000 because my ISP blocks port 80.

It appears that they adware is on my linux server. I don't even know how to identify it let alone remove it.

Thanks for you help.
 
Here's what I get when I "view source"

Code:
<HTML><HEAD>
<META NAME="description" CONTENT="talkship.com">
<META NAME="keywords" CONTENT="">
</HEAD>
<FRAMESET border=0 rows="100%,*" frameborder="no" marginleft=0 margintop=0 marginright=0 marginbottom=0>
<frame src="[URL unfurl="true"]http://ww2.talkship.com:8000"[/URL] scrolling=auto frameborder="no" border=0 noresize>
<frame src="/pop-src-page.script" topmargin="0" marginwidth=0 scrolling=no marginheight=0 frameborder="no" border=0 noresize>
</FRAMESET>
</HTML>

The pop-src-page.script and entire index page looks like it's being intercepted and coming from somewhere else.

Code:
[root@RAMAIR var]# find / -name pop-src-page.script
[root@RAMAIR var]#

How could this be?
 
I sent an email to zoneedit.. Looks like they were bought out and are now a POS service. Time to go elseware..

Dear Sir,

The popup ads are a recent addition to our free web forwarding service.
ZoneEdit was recently purchased by Dotster, and it's their policy to include popup ads on free accounts that use web forwarding.

With the purchase of one zone credit, popup ads are disabled. One zone credit is $10.95, and quantity discounts are available.

Let me know if you still have any other questions. Thank you.

Best Regards,
Grace
ZoneEdit Support
 
Status
Not open for further replies.

Part and Inventory Search

Sponsor

Back
Top