|
|
Page forwarding to malware site?
|
|
|
|
Moderator
Join Date: Jun 2000
Location: inside 128, north of 90
Status:
Offline
|
|
when I clicked on this link,
http://forums.macnn.com/89/macnn-lou...yone-tried-it/
I got sent to a site that luckily my work blocked, saying it was a malware site. I believe it was traveltray.com.
I can't reproduce the problem, so maybe I mistakenly clicked on one of the ads on the page.
|
|
|
|
|
|
|
|
|
Professional Poster
Join Date: Jun 2007
Status:
Offline
|
|
I got it too. I thought it was weird and when I went back to the thread it did not reoccur.
|
|
|
|
|
|
|
|
|
Junior Member
Join Date: Oct 2006
Location: Location:
Status:
Offline
|
|
I just clicked it for the first time and nothing happened.
Might be because I'm on a Mac, but I imagine most here are. I'm using Safari 2.0.4.
|
|
|
|
|
|
|
|
|
Addicted to MacNN
Join Date: Jul 2001
Location: Behind the dryer, looking for a matching sock
Status:
Offline
|
|
I'm on a Mac and I got sent to the site too.
|
|
|
|
|
|
|
|
|
Professional Poster
Join Date: Jun 2007
Status:
Offline
|
|
I was on a peecee (at work) and running firefox.
|
|
|
|
|
|
|
|
|
Clinically Insane
Join Date: Oct 2001
Location: San Diego, CA, USA
Status:
Offline
|
|
It would be the ad on the page doing it, I think.
|
Chuck
___
"Instead of either 'multi-talented' or 'multitalented' use 'bisexual'."
|
|
|
|
|
|
|
|
Posting Junkie
Join Date: Dec 2000
Status:
Offline
|
|
That happened to me last night on a Mac with Safari 3.0.4. I don't remember which thread did it, though, although it was most likely a banner ad on the page rather than the page itself.
|
|
|
|
|
|
|
|
|
Professional Poster
Join Date: Jan 2000
Location: Detroit
Status:
Offline
|
|
i got it just going to the main forum site this morning; firefox 2.0.0.10/windows xp. i didn't return again.
now, back home...haven't had it happen.
|
|
|
|
|
|
|
|
|
Addicted to MacNN
Join Date: Oct 2002
Location: England | San Francisco
Status:
Offline
|
|
no redirection here ... weird
|
we don't have time to stop for gas
|
|
|
|
|
|
|
|
Mac Enthusiast
Join Date: May 2005
Location: Philadelphia
Status:
Offline
|
|
No redirection here either. Mac/Firefox.
|
|
|
|
|
|
|
|
|
Posting Junkie
Join Date: Dec 2000
Status:
Offline
|
|
It's only done it to me once, and I haven't been able to get it to do that again, so I'd figure it's one of the banner ads that comes up in infrequent rotation.
|
|
|
|
|
|
|
|
|
Clinically Insane
Join Date: Apr 2007
Location: Iowa, how long can this be? Does it really ruin the left column spacing?
Status:
Offline
|
|
I was just forwarded from the main lounge page to this:
|
|
|
|
|
|
|
|
|
Professional Poster
Join Date: Mar 2002
Status:
Offline
|
|
This happened to me too. I took screen shots of all the screens and you can find it in your history.
It's an ad that is in the banner. I'm not sure, but it either comes up when you close a window or move your mouse over the banner towards something above the banner. It happened so fast I couldn't tell.
If macnn would like to have all the screen shots, let me know and I'll email them too you.
You have a asshole advertiser causing this. It only came up once and never came up again. I'll try another machine later.
|
|
|
|
|
|
|
|
|
Professional Poster
Join Date: Nov 2004
Location: eating kernel
Status:
Offline
|
|
Originally Posted by Laminar
I was just forwarded from the main lounge page to this:
That page f*cks with Safari too.
|
Signature depreciated.
|
|
|
|
|
|
|
|
Professional Poster
Join Date: Nov 2004
Location: eating kernel
Status:
Offline
|
|
Originally Posted by Buckaroo
This happened to me too. I took screen shots of all the screens and you can find it in your history.
It's an ad that is in the banner. I'm not sure, but it either comes up when you close a window or move your mouse over the banner towards something above the banner. It happened so fast I couldn't tell.
If macnn would like to have all the screen shots, let me know and I'll email them too you.
You have a asshole advertiser causing this. It only came up once and never came up again. I'll try another machine later.
Can you post them here?
|
Signature depreciated.
|
|
|
|
|
|
|
|
Addicted to MacNN
Join Date: Mar 2006
Location: California
Status:
Offline
|
|
just had this happen when I opened up the "amazing find" thread
|
|
|
|
|
|
|
|
|
Professional Poster
Join Date: Mar 2002
Status:
Offline
|
|
Originally Posted by C.A.T.S. CEO
Can you post them here?
I'll have to find a server to upload them onto. I'll try to do it tomorrow night.
|
|
|
|
|
|
|
|
|
Professional Poster
Join Date: Mar 2002
Status:
Offline
|
|
Just click on the error link above or go to your history and you can click on it again.
|
|
|
|
|
|
|
|
|
Professional Poster
Join Date: Jun 2002
Location: Southern California
Status:
Offline
|
|
Originally Posted by Laminar
I was just forwarded from the main lounge page to this:
I just got the same one and it practically hijacked Safari... I believe I got this ad once before, a few months back.
|
|
|
|
|
|
|
|
|
Moderator Emeritus
Join Date: Mar 2004
Location: Copenhagen
Status:
Offline
|
|
I got it too, just now.
I think it’s the same one as previously when this problem occurred: it redirects you three or four times, makes your browser window a tiny little blob in the upper left corner while giving you one of those annoying, “Your computer is infected with viruses, do you want to run this completely virus-free software from an unknown Internet site that just hijacked your browser in order to fix it? [ Ok | Yes ]” alerts. Once clicked (or rather: once escape has been pressed), it takes you to the actual ad site in a humongously blown up Safari window*.
Clickthrough address was the same as the one Laminar posted.
(*When the hell are they going to add that rather important ‘Prevent web sites from moving or resizing your browser window’ option to Safari?!?)
|
|
|
|
|
|
|
|
|
Posting Junkie
Join Date: Aug 2003
Location: midwest
Status:
Offline
|
|
I just had it happen too. It happened yesterday and now again today. It's this "traveltray" site with the "error detected" nonsense telling me my PC is not protected. It gives you the option of OK or CANCEL and both options take you to their site.
using Safari
|
ebuddy
|
|
|
|
|
|
|
|
Mac Elite
Join Date: Aug 2006
Location: Denver, CO
Status:
Offline
|
|
This just happend to me too.. it actually scared the sh*t out of me for a second... then I saw this post.
|
|
|
|
|
|
|
|
|
Baninated
Join Date: Oct 2002
Location: In yer threads
Status:
Offline
|
|
Originally Posted by ebuddy
I just had it happen too. It happened yesterday and now again today. It's this "traveltray" site with the "error detected" nonsense telling me my PC is not protected. It gives you the option of OK or CANCEL and both options take you to their site.
using Safari
Yeah My Windows had the virus!121 OH NOS! I actually laughed when I saw it. But was surprised to see it here.
|
|
|
|
|
|
|
|
|
Clinically Insane
Join Date: Oct 2000
Location: Los Angeles
Status:
Offline
|
|
Yup. Happened once to me so far. What ad company would let javascript dialogs in their banner ads?
|
"The natural progress of things is for liberty to yield and government to gain ground." TJ
|
|
|
|
|
|
|
|
Professional Poster
Join Date: Jun 2001
Location: Northwest Ohio
Status:
Offline
|
|
Originally Posted by Kevin
Yeah My Windows had the virus!121 OH NOS! I actually laughed when I saw it. But was surprised to see it here.
It just happened to me too. I took detailed notes on the behavior, with screenshots. I'll post them here at lunch, but whichever ad company is serving this ad needs to be dropped entirely. This makes ALL of their ads untrustworthy.
To the admins, mods, whoever: DROP THIS AD COMPANY! Don't just ask that the malware ad be removed from the rotation.
|
|
|
|
|
|
|
|
|
Professional Poster
Join Date: Jun 2001
Location: Northwest Ohio
Status:
Offline
|
|
Ok. Exact behavior of this ad.
1. Surf to a page. Ad server serves this ad, which on loading runs a JavaScript that redirects you away from the originating page (making it very hard to identify which company served the ad or which ad it was).
2. The new page resizes the browser windows to a small square and displays a popup box:
3. Clicking on either "Cancel" or "OK" causes the browser window to expand to the full dimensions of your screen resolution, and an animation runs which shows a "scan" being done. At the end of the "scan," this pops up on screen:
4. Clicking on either "Remove all" or "Ignore" causes the computer to download an ".exe" file:
If this were a windows machine and the person executed the file, it would install the software. Fortunately we're on a Mac and it doesn't affect us, but still. If I can find the ad server that served this, I think it would be best if MacNN didn't do business with that company ever again.
|
|
|
|
|
|
|
|
|
Professional Poster
Join Date: Jun 2001
Location: Northwest Ohio
Status:
Offline
|
|
(
Last edited by Person Man; Nov 30, 2007 at 01:22 PM.
)
|
|
|
|
|
|
|
|
|
Senior User
Join Date: Apr 2002
Location: Aarhus, Denmark
Status:
Offline
|
|
Yep, Iit happened to me too.. Got the exe-file sitting on my desktop, and just glad I'm not on a Windows machine.
But MacNN, you need to talk to the people in charge of your banners! This is spyware!
|
|
|
|
|
|
|
|
|
Mac Elite
Join Date: Aug 2004
Location: ------>
Status:
Offline
|
|
Me too. As this thread opened I was forwarded automatically to traveltray.com -> blessdads.com -> scanner2.malware-scan.com. ****wads.
|
|
|
|
|
|
|
|
|
Professional Poster
Join Date: Jun 2001
Location: Northwest Ohio
Status:
Offline
|
|
|
|
|
|
|
|
|
|
|
Professional Poster
Join Date: Jun 2007
Status:
Offline
|
|
Happened again when viewing this thread link
Again a peecee running firefox.
|
|
|
|
|
|
|
|
|
Professional Poster
Join Date: Jun 2007
Status:
Offline
|
|
Why aren't the mod/admins chiming in on this thread?
|
|
|
|
|
|
|
|
|
Administrator
Join Date: Mar 2000
Location: Land of the Easily Amused
Status:
Offline
|
|
forwarding the issue to the powers that be.
|
|
|
|
|
|
|
|
|
Administrator
Join Date: Dec 1998
Status:
Offline
|
|
I believe I've disabled the network that caused this ridiculous ad. Let me know if you still see it after this date/time of this post.
|
|
|
|
|
|
|
|
|
Posting Junkie
Join Date: Dec 2000
Status:
Offline
|
|
Unfortunately, I just got it a few minutes ago.
|
|
|
|
|
|
|
|
|
Professional Poster
Join Date: Jun 2001
Location: Northwest Ohio
Status:
Offline
|
|
Originally Posted by CharlesS
Unfortunately, I just got it a few minutes ago.
I just got it too. This time it redirected me to performanceoptimizer.com instead of Malware Scan.
|
|
|
|
|
|
|
|
|
Posting Junkie
Join Date: Dec 2000
Status:
Offline
|
|
|
|
|
|
|
|
|
|
|
Moderator
Join Date: Jan 2001
Location: Polwaristan
Status:
Offline
|
|
beyond the immediate topic: do you think this is an ad company just taking money from anyone, with no interest in what's going on, or have their servers been hijacked?
|
|
|
|
|
|
|
|
|
Professional Poster
Join Date: Jun 2007
Status:
Offline
|
|
They're back again, I just got some sort of performance website when I attempted to enter a thread. I had to force quit safari.
|
|
|
|
|
|
|
|
|
Mac Elite
Join Date: Aug 2007
Status:
Offline
|
|
Just got it also when trying to view the Lounge.
|
|
|
|
|
|
|
|
|
Clinically Insane
Join Date: Mar 2001
Location: yes
Status:
Offline
|
|
|
|
|
|
|
|
|
|
|
Posting Junkie
Join Date: Mar 2005
Location: Louisiana
Status:
Offline
|
|
Just happened to me for the third time. Running Mac/Safari.
|
|
|
|
|
|
|
|
|
Mac Elite
Join Date: May 2001
Location: Vancouver
Status:
Offline
|
|
Yup, just happened to me. I think I might have accidentally clicked on a banner. Traveltray is the first URL that I got directed to.
|
|
|
|
|
|
|
|
|
Fresh-Faced Recruit
Join Date: Nov 2007
Status:
Offline
|
|
Just had it happen a couple of times. The ad redirected me to: scanner2.malware-scan.com
|
|
|
|
|
|
|
|
|
Clinically Insane
Join Date: Jun 2000
Location: Union County, NJ
Status:
Offline
|
|
|
|
|
|
|
|
|
|
|
Fresh-Faced Recruit
Join Date: Jul 2007
Status:
Offline
|
|
Just happened to me as well. I haven't seen anything so obnoxious since I ditched my Windows machine last January.
|
|
|
|
|
|
|
|
|
Fresh-Faced Recruit
Join Date: Sep 2007
Status:
Offline
|
|
Just happened to me. I killed safari via the process manager, just so I don't actually download it by accident.
Question:
1) This download doesnt affect macs right?
2) I've only got ClamAv and the firewall that came with the mac, is the going to be sufficient (ok and enough sense to not provide the Admin/PW to an app I didn't download on purpose).
3) Do I have to worry (I've just migrated from the PC World in August...when the new iMacs came out)?....For some reason that popup really freaks me out
Thanks
|
|
|
|
|
|
|
|
|
Mac Elite
Join Date: Sep 2006
Location: Back in the Good Ole US of A
Status:
Offline
|
|
Just got it as well.
|
|
|
|
|
|
|
|
|
Mac Elite
Join Date: Jun 2003
Location: Newport News, VA USA
Status:
Offline
|
|
Just happened to me when trying to load the main forums page.
Ugh.
|
|
|
|
|
|
|
|
|
Posting Junkie
Join Date: Feb 2005
Location: 888500128
Status:
Offline
|
|
Originally Posted by Mekman
Just happened to me. I killed safari via the process manager, just so I don't actually download it by accident.
Question:
1) This download doesnt affect macs right?
2) I've only got ClamAv and the firewall that came with the mac, is the going to be sufficient (ok and enough sense to not provide the Admin/PW to an app I didn't download on purpose).
3) Do I have to worry (I've just migrated from the PC World in August...when the new iMacs came out)?....For some reason that popup really freaks me out
1) Nope.
2) Yes.
3) The ****ing arseholes who do this kind of thing will burn in hell, eventually - unless the cops get to them first. Don't worry.
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
Forum Rules
|
|
|
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
|
HTML code is Off
|
|
|
|
|
|
|
|
|
|
|
|