I don't know if any of you have had this happen before, but every once in awhile when I come into macinsiders.com, it has a popup come up saying my computer is unprotected and when I close it another popup comes up, and on and on, but its only when I come to this website....
And when I just came on here this time it tried to automatically redirect me to some antivirus website that my AVG refused to open so it popped up and said it was a rogue virus or soemhitng and gave me the option to just go back to my homepage


has anyone else had this problem ever coming onto this website?

It's come up before:

http://www.macinsiders.com/showthrea...ighlight=virus

She has AVG though. I just went through random links throughout the site and haven't experienced anything like that. What have you downloaded recently? Check through them and see if you downloaded something extra/unwanted.

Originally Posted by Proxy

She has AVG though. I just went through random links throughout the site and haven't experienced anything like that. What have you downloaded recently? Check through them and see if you downloaded something extra/unwanted.

but if that was the case wouldnt it happen other times? it ONLY happens when I come onto this site

Oh, I see. Missed that. Clear your Cookies, or at least for this site and close your browser. See if that fixes anything.

Hi Charbs. The site is definitely clean. What your describing is something that other users have notified me about earlier this week about fake popups coming up. We recently had an issue with one of our third-party banner advertising partners where they had a banner script that (apparently unbeknown to them) was actually forcing a redirect to a fake antivirus site with a misleading popup saying there was a virus detected and trying to get you to buy their crappy product. We've since removed what was suspected to be causing it and notified the company that we weren't at all pleased, but if you see it happen again email me directly at [email protected] om with a) the time it happened, b) a screenshot of what happened if you can, and c) the url it redirected you to if it does. If AVG pops something up, it would be coming from that redirected third-party site and not MI as we don't have any virus code on our site.

As for Norton, well that's a whole other story haha. Very unreliable. We've seen some people mention it in the past randomly popping up alerts for sites which clearly had no problems (as niteskie pointed out).

If you do get AVG or Norton alerts, please send them in so we can investigate and possibly contact the companies about it.

Thanks!

Originally Posted by Chad

Hi Charbs. The site is definitely clean. What your describing is something that other users have notified me about earlier this week about fake popups coming up. We recently had an issue with one of our third-party banner advertising partners where they had a banner script that (apparently unbeknown to them) was actually forcing a redirect to a fake antivirus site with a misleading popup saying there was a virus detected and trying to get you to buy their crappy product. We've since removed what was suspected to be causing it and notified the company that we weren't at all pleased, but if you see it happen again email me directly at [email protected] om with a) the time it happened, b) a screenshot of what happened if you can, and c) the url it redirected you to if it does. If AVG pops something up, it would be coming from that redirected third-party site and not MI as we don't have any virus code on our site.

As for Norton, well that's a whole other story haha. Very unreliable. We've seen some people mention it in the past randomly popping up alerts for sites which clearly had no problems (as niteskie pointed out).

If you do get AVG or Norton alerts, please send them in so we can investigate and possibly contact the companies about it.

Thanks!

See post #5 http://www.macinsiders.com/showthread.php?t=2557 4

Also got the fake antivirus thing recently.

I've never had multiple security related problems from a single website like I have here...

Chad, it happened to me at around 7:30 am this morning....It said that my computer is not protected and that if i don't download something it will crash. I got scared so I turned my computer off lol

Originally Posted by ViktorVaughn

See post #5 http://www.macinsiders.com/showthread.php?t=2557 4

Also got the fake antivirus thing recently.

I've never had multiple security related problems from a single website like I have here...

Hey,

@ViktorVaughn: Saw the screenshot. That seems to be something else.. it's saying there is an infected PDF? Did you click a link someone posted to a PDF or something?

The issue previously mentioned was from an ad that we believe was showing up on the homepage and would cause a basic javascript popup alert with a phony message about a virus, and then would redirect you entirely off MacInsiders and onto a fake antivirus scanning page that tried to get you to buy their product in order to remove these fake viruses that never existed.

@Manu: is that what happened to you? Or did you experience something different?

I originally thought it was the weather widget we have on our homepage that shows Hamilton's weather forecast for the new few days, however it seems only a few members are actually experiencing this, not everyone.. which makes it hard to track down. If it is still happening, my only explanation for that is that it's one of the banner ads since they are on a random rotation via a third-party. However, I have rotated through all possible ads as I'm on the site for long periods of time and haven't had any issues. We'll keep investigating it until we are absolutely sure we've found the cause.. if it happens make sure to let me know right away.

If it does happen, one way to track it down is to view your temporary internet files (if you're using IE) and sort them by date so you can see exactly what loaded in what order. You should be able to see when you loaded up macinsiders.com, and then which images and scripts loaded afterwards before you saw the message. You'll be able to see the third-party URL for the banner ad and the URLS it loaded/redirected to. Banners should never do this, but if it happens then you can track it down that way. Send me what you can if you can do this we can see what the cause was.

Chad,
What Manu is describing sounds a lot like what I emailed you about. I wanted to let you know that it happened to me again today around 10:30am. I will definately take a screen shot if it happens again!

Thanks Kathy! I've made some further changes, and removed the weather widget. Let me know if it happens again. Appreciate your help!

Originally Posted by Chad

Hey,

@ViktorVaughn: Saw the screenshot. That seems to be something else.. it's saying there is an infected PDF? Did you click a link someone posted to a PDF or something?

I didn't click on any files. I did click on a link to another page and then hit the back button - this is when it showed up, as I returned to this site. It happened again a couple days later while just browsing on macinsiders.

I remember looking into it when i got it. The "exploit.pdf" title is just the name of the threat. Its a trojan that exploits a security hole in Adobe Reader (google exploit.pdf - example: http://home.mcafee.com/VirusInfo/VirusProfile.aspx?key =248952). Presumably it tried to send this data as one of the advertisements loaded. I also looked into the URL associated with it (see screenshot) to see if anyone else had similar problems. Apparently its an advertising vendor that had someone maliciously add this to their ads or site or whatever. I havent seen it in weeks so presumably its fixed.

Who is supplying your advertising, if I may ask?

Thanks. I'll look into the exploit.pdf issue. Our ads are served by third-party provider BannerConnect. They've been notified and got back to us saying they're tracking it down and removing the problematic ad. I just sent them another message regarding the exploit.pdf as well as your screenshot. The banners were previously loaded in an iframe, and we recently switched over to loading via script tags which is safer, yet some users reported seeing it today so it must be in the banner itself (maybe a Flash ad?). Will continue investigating. Let me know if you learn anything more. I'm just thankful the code isn't on our site but is through the third-party which we can remove until it's fixed.

Hi guys. An update: The ad service we run got back to me saying one of their third-party providers RightMedia was attacked and may have been serving the bad ads. They have blocked them now, so I've put their banners back in our rotation.

I haven't seen the problem resurface. If you notice it happening again can you reply to this thread right away or email [email protected] om? Thanks!

Originally Posted by Chad

Hi guys. An update: The ad service we run got back to me saying one of their third-party providers RightMedia was attacked and may have been serving the bad ads. They have blocked them now, so I've put their banners back in our rotation.

I haven't seen the problem resurface. If you notice it happening again can you reply to this thread right away or email [email protected] om? Thanks!

Hi Chad,

It just happened to me a few minutes ago. Unfrotunately I've closed the page before remembering that you have asked for a printscreen... all I can say is that the pop-up was large, full page sized and with a bright red background.