Mobile app version of vmapp.org
Login or Join
Caterina187

: We are getting a slew of requests from IE9 for /scanImageUrl The requests are all from Internet Explorer 9 with compatibility mode turned on. We know compatibility mode is on, because of the

@Caterina187

Posted in: #InternetExplorer9

The requests are all from Internet Explorer 9 with compatibility mode turned on. We know compatibility mode is on, because of the trident attribute being sent in the user-agent string.

This just started recently.(3/28 around 6AM)

These are legitimate users, not bots, we have determined that and we cannot reproduce the issue.

Here is one new Google search result, and it appears that others are having the same issue.

10.01% popularity Vote Up Vote Down


Login to follow query

More posts by @Caterina187

1 Comments

Sorted by latest first Latest Oldest Best

 

@Cofer257

One of my coworkers started exhibit the symptoms (random requests for www.vistaprint.com/scanImageUrl from IE8), so I hopped on her computer to figure out what was causing the issue.

The problem appears to be due to a malware IE add-on called Yontoo v2.051. I doubt anyone intentionally installs the software, but, among other installers, it is bundled with "EZ Fonts" (http://downloadfreely.com/start/?p=EZ-Fonts). Disabling both parts of the add-on from IE stops the issue.

On a fresh install on EC2, the problem seemed to instead stem from "Surf Canyon" v5.0.1. Disabling Yontoo v2.052 didn't fix the problem, but disabling Surf Canyon did. In addition to the requests for scanImageUrl, Surf Canyon even causes random redirects to completely malformed URLs.

10% popularity Vote Up Vote Down


Back to top | Use Dark Theme