How can I get rid of Clicksor Gmail hijacking?

Question

I'm having trouble with what appears to be mentioned in this article from The Washington Post, "New Tool to Automate Cookie Stealing from Gmail, Others".

I found a few threads but I still get this website hijacking most adsense content, and the very annoying popup window/tab. How can I get rid of clicksor?

Here's what I have in my /etc/hosts file:

127.0.0.1   localhost
127.0.1.1   home

# The following lines are desirable for IPv6 capable hosts
::1     localhost ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
ff02::3 ip6-allhosts
http://ads.clicksor.com 0.0.0.0

I installed and scanned using ClamAV, and it said there was nothing. What it does is actually clickjack which redirects through 'results.google-analytics.com' and brings up some random page.

Answer 1

It is highly unlikely that the old (and I believe now-fixed) insecure-cookie problem described in that link is anything to do with it. Can you please describe the effects you are seeing in more detail?

Clicksor are an online ad company of generally poor reputation; it is possible they might be redirected to by some kind of spyware. Check your machine is clean.

If you are trying to block ads.clicksor.com in your Hosts file, the above won't work. You need to list the address first and then the hostname (not full URL):

0.0.0.0  ads.clicksor.com

Answer 2

Clicksor does not endorse or participate in any acts of hijacking or hacking. If you are an existing advertiser or publisher, please send us your account id along with detailed description of the issue and we can help you solve your needs.

Best regards,

Clicksor_CS