cancel
Showing results for 
Search instead for 
Did you mean: 

tig.mokie1.com

FIXED
jab1
Legend
Posts: 16,817
Thanks: 5,339
Fixes: 248
Registered: ‎24-02-2012

tig.mokie1.com

Not a problem, because it doesn't stop anything, but if I log in to the members centre, as I do every so often, then log out but leave the tab 'live' - i.e don't totally close it, I get 'transferring data from www.tig.mokie1.com' at the bottom of my screen, and permanently spinning 'loading' spinner.

Is this normal, or is it related to the fact that I have Ad-Muncher installed, and this site is trying to load an ad?

John
28 REPLIES 28
rongtw
Seasoned Hero
Posts: 6,973
Thanks: 1,541
Fixes: 12
Registered: ‎01-12-2010

Re: tig.mokie1.com

@jab1 it ok for me ? , it must be something your end .

Do you run Malwerebytes ?

Asus ROG Hero Vii Z97 , Intel i5 4690k ,ROG Asus Strix 1070,
samsung 850evo 250gig , WD black 2 TB . Asus Phoebus sound ,
16 gig Avexir ram 2400 , water cooling Corsair H100i gtx ,
Corsair 750HXI Psu , Phanteks Enthoo pro case .
jab1
Legend
Posts: 16,817
Thanks: 5,339
Fixes: 248
Registered: ‎24-02-2012

Re: tig.mokie1.com

@rongtw - thanks for that.

Yes, I run MWB once a week, usually Friday night, but I'll run it tonight and see if it finds anything.

If I cancel the loading, it doesn't seem to have any bad effects, but I'd still like to know what is? Any PN staff care to comment?

 

John
jab1
Legend
Posts: 16,817
Thanks: 5,339
Fixes: 248
Registered: ‎24-02-2012

Re: tig.mokie1.com

@rongtw - Ran Malwarebytes and AVG last night, neither found anything, and I still get the 'tig.mokie1.com' box until I hit the stop loading page button.

John
rongtw
Seasoned Hero
Posts: 6,973
Thanks: 1,541
Fixes: 12
Registered: ‎01-12-2010

Re: tig.mokie1.com

its defiantly a redirect virus Sad     possibly related to this  http://computerfixguide.com/how-to-delete-t-mookie1-com-from-computer/

Asus ROG Hero Vii Z97 , Intel i5 4690k ,ROG Asus Strix 1070,
samsung 850evo 250gig , WD black 2 TB . Asus Phoebus sound ,
16 gig Avexir ram 2400 , water cooling Corsair H100i gtx ,
Corsair 750HXI Psu , Phanteks Enthoo pro case .
jab1
Legend
Posts: 16,817
Thanks: 5,339
Fixes: 248
Registered: ‎24-02-2012

Re: tig.mokie1.com

Not doubting you personally, @rongtw, but that removal site looks suspicious to me Wink - I never like places that ask me to install programs I don't know, especially when the 'manual' steps are lacking in detail, until you get to these programs.

As I have said, the loading icon can be stopped, by clicking 'stop loading this page', and I have NO ads, or redirects.

Weird that it only appears on my Member Centre page as well - nowhere else.

More research required, methinks.

John
Anonymous
Not applicable

Re: tig.mokie1.com

@jab1 - You could go all debug on this and open a Web Console if using FireFox there’s an Net tab that will show you where the page is going and what it’s attempting to get, this might give you an insight as to what it is up to.

jab1
Legend
Posts: 16,817
Thanks: 5,339
Fixes: 248
Registered: ‎24-02-2012

Re: tig.mokie1.com

@Anonymous - using Waterfox, but maybe if I get some time, I'll try that. My other option of course, is to not visit the Members Centre.Smiley

John
Anonymous
Not applicable

Re: tig.mokie1.com

@jab1 - Waterfox has the same Developer options as FireFox but I think it would be a worthwhile exercise and are you referring to the Plusnet Member Centre?

jab1
Legend
Posts: 16,817
Thanks: 5,339
Fixes: 248
Registered: ‎24-02-2012

Re: tig.mokie1.com

@Anonymous - Yep, I know WaterFox is just fireFox X64 - I will be doing it later. Yes, I am referring to the Plusnet Member Centre - it does not appear to be happening anywhere else.

John
Anonymous
Not applicable

Re: tig.mokie1.com

@jab1 - I've just had a snoop myself and I see references to *.mookie1.com who appear to be a corporate branding organisation in the US but not tig.mokie1.com. Do you have your glasses on?

jab1
Legend
Posts: 16,817
Thanks: 5,339
Fixes: 248
Registered: ‎24-02-2012

Re: tig.mokie1.com

@Anonymous -yup, do have specs on, and yup, I missed an 'o' out of the thread title Wink

In your opinion, should I be worried?

John
Anonymous
Not applicable

Re: tig.mokie1.com

Mmm, I don't think that's for me to answer @jab1. When I realised you were referring to the Plusnet Member Centre I black holed the domain and sub domains I saw in the console but with a re-test and viewing the console output I see no reference to them even though the requests should still be there even if they resolve to a black hole!

When I send a domain to a black hole this is what I see in my debug console on FF.

Black Holed

So I would expect similar for the *.mooke1.com URLs

jab1
Legend
Posts: 16,817
Thanks: 5,339
Fixes: 248
Registered: ‎24-02-2012

Re: tig.mokie1.com

Asking google what it is, I got this link: https://webcookies.org/cookies/tlg.mookie1.com/3137880

Guessing admuncher is preventing it, as I have set the program to block whatever it can safely.

John
Anonymous
Not applicable

Re: tig.mokie1.com

So going back to message 12 I think the answer to that is now Yes.