Originally Posted by Tucson BBQ Fan
Yesterday and today, on several occasions, while browsing new posts, I have had the SMF site change to a fake message saying that Microsoft Antivirus has detected unusual activity and I need to clean my PC immediately. This is a fake message, and if you click on the link, it infects your machine. I run Norton Antivirus (not Microsoft) and it catches it and blocks it. The attacking computer is listed as 18.104.22.168
DO NOT CLICK on the message to clean your computer!
Thanks for the heads up, Tuscon.
If you do click on the fake or rogue AV message you'll probably be directed to a web site where you'll need to purchase an AV program to get rid of a "virus" that probably isn't on your computer in the first place. If you chose not to purchase the program they won't go away and will hold your computer hostage until you pay the ransom. When you ultimately purchase the program, you're out the money and they have your CC info.
The IP shown is located in Lyon, France and the ISP is French telecom company Tiscali-France/Iliad Enterprises in Paris. From what I could tell with a quick check, only SMF and a couple other US based forum type web sites have been hacked recently.