Datasearch Hijacked Browser

[Sunset100]

Some of the results of Google search on Chrome do strange things.  I click on one of the found URLs. Then I am taken to a page that says 

This site can’t be reached

clickserve.dartsearch.net refused to connect.

Search Google for clickserve dartsearch net link click

ERR_CONNECTION_REFUSED

 

I have run Malwarebytes several times but it does not find anything.  Help!!

[alvarnell]

When I go there I get this:

This is a DoubleClick advertising clickserver.

Click here for the DoubleClick home page.

Click here for privacy information.

So it would appear that Malwarebytes or some other adblocker is simply doing it's job.

[Sunset100]

I don’t see how it’s doing it’s job.  Malware has hijacked my browser and will not let me connect to a listed site. Malwarebytes has not found the maleware causing this

[treed]

Is this happening with all your Google searches, or with some specific links that are part of some searches? This does not look like the results of malware or adware. It looks like the results of a bad link turning up in the search, which does happen sometimes, and that link is being blocked by something (though I can't say what).

Can you provide an example of a URL that shows this behavior?

[Sunset100]

this is the google search URL https://www.google.com/search?q=The+Solgaard+Carry-On+Closet&oq=The+Solgaard+Carry-On+Closet&aqs=chrome..69i57j69i60l2&sourceid=chrome&ie=UTF-8.

When I cklciked on the link for Solgaard Official Site | Gear for Global Citizens‎ | solgaard.co‎ and Solgaard Lifepack Carry-On Closet | Free 2-day Shipping w/ Prime‎ I was taken to the URL https://shareasale.com/r.cfm?b=972840&u=1765696&m=70255&urllink=&afftrack=.  

I have checked both my firewall and proxy settings and that's not the problem.  I have run Malwarebytes several times and it has not found anything. 

[alvarnell]

I can't replicate your results, so there might be something new that Malwarebytes isn't finding.

Has it found anything related to Chrome prior to now?

Does the same thing happen in Safari or some other browser you have installed?

Click on the three vertical dots at the right end of your address bar and select More Tools->Extensions then give us a list of what you find there.

[Sunset100]

Answers:

Has it found anything related to Chrome prior to now? Yes, I just didn't keep a record of them.

Does the same thing happen in Safari or some other browser you have installed? Yes the same thing happens

See attached for extensions.

Extensions.pdf

[alvarnell]

10 hours ago, Sunset100 said:

Does the same thing happen in Safari or some other browser you have installed? Yes the same thing happens

So it appears we've been taking the wrong approach to this. Since it involves more than just Chrome, have you gone through the steps outlined in the pinned article at the top of this forum?: 

 

[treed]

On 2/23/2019 at 11:50 AM, Sunset100 said:

When I cklciked on the link for Solgaard Official Site | Gear for Global Citizens‎ | solgaard.co‎ and Solgaard Lifepack Carry-On Closet | Free 2-day Shipping w/ Prime‎ I was taken to the URL https://shareasale.com/r.cfm?b=972840&u=1765696&m=70255&urllink=&afftrack=.  

I was able to reproduce this with the  Solgaard Official Site | Gear for Global Citizens‎ | solgaard.co‎ link. It will redirect through either sharesale[dot]com or sportfitweb[dot]com before finally landing on the solgaard.co page. It's possible that the redirect isn't working for some reason in your case, and you end up stranded on sharesale[dot]com.

Because I'm able to see the same behavior here on a known clean Mac, this does not appear to be related to anything installed on your computer.

[Sunset100]

Interesting