• Some of the links on this forum allow SMF, at no cost to you, to earn a small commission when you click through and make a purchase. Let me know if you have any questions about this.

SMF web seems to be infected with a virus

tucson bbq fan

Smoking Fanatic
330
21
Joined Jun 30, 2013
Yesterday and today, on several occasions, while browsing new posts, I have had the SMF site change to a fake message saying that Microsoft Antivirus has detected unusual activity and I need to clean my PC immediately.  This is a fake message, and if you click on the link, it infects your machine.  I run Norton Antivirus (not Microsoft) and it catches it and blocks it.  The attacking computer is listed as 212.83.155.47, 80

DO NOT CLICK on the message to clean your computer!
 

dward51

Master of the Pit
OTBS Member
2,869
529
Joined Nov 24, 2011
I'm not seeing it here, but I'm heavily protected.

I used to run a couple of web sites and I suspect it creeped in via the code for one of the adds.  I've seen that before.  If that is the case, the problem is not with SMF forum but with the add vendor or product company code, not Jeff's.
 

Victor

Fire Starter
62
16
Joined Jul 18, 2012
Yep,

My Norton app blocks the redirected page before it loads.
 

dward51

Master of the Pit
OTBS Member
2,869
529
Joined Nov 24, 2011
What redirected page?

Just curious, but what browser are you guys running?  I'm on firefox and not seeing any of this (but I also have a paid subscription to the site and may not be getting the adds you are seeing).
 

bmudd14474

Legendary Pitmaster
Staff member
Administrator
Moderator
OTBS Member
★ Lifetime Premier ★
Group Lead
8,691
1,107
Joined Jun 1, 2008
We have reported this issue. Its not aSMF issue per say its with the ad's that run on the site. They hope to have it resolved soon.

Also anytime you see a issue like this if you go to www.smokingmeatforums.com/feedback you can report it so that if a mod isn't on it alerts the ones that need to know.

Thanks
 

turnersdad

Newbie
5
10
Joined Nov 3, 2013
Thank you for this update! I have also had this problem with the Micosoft  message over the last weeks.

Mike.
 

Victor

Fire Starter
62
16
Joined Jul 18, 2012
 
What redirected page?

Just curious, but what browser are you guys running?  I'm on firefox and not seeing any of this (but I also have a paid subscription to the site and may not be getting the adds you are seeing).
I'm running Internet Explorer 9 with Norton Security Suite. Norton has detected this issue only while I'm on the SMF site. I have no problems anywhere else at all. Norton alerts me with the following message..."Fake App Attack: Fake Av Website 20"...The following text was extracted from a Norton forum:
[h1]"Re: Fake App Attack: Fake Av Website 20[/h1]
‎05-03-201207:59 PM

Hi ConstanceGrace,

This type of attack is commonly associated with fake antivirus scans that attempt to trick you into downloading malware that pretends to be a security or system maintenance product. Norton has blocked the loading of the page before you were able to click on anything that might lead to trouble. Even so, it is often a good idea to update your virus definitions by running LiveUpdate, and then run a scan, just to make sure that no harm was done."

**********************************************************************************

This is not a brand new game.
 

dls1

Smoking Fanatic
800
105
Joined Jun 6, 2012
 
Yesterday and today, on several occasions, while browsing new posts, I have had the SMF site change to a fake message saying that Microsoft Antivirus has detected unusual activity and I need to clean my PC immediately.  This is a fake message, and if you click on the link, it infects your machine.  I run Norton Antivirus (not Microsoft) and it catches it and blocks it.  The attacking computer is listed as 212.83.155.47

DO NOT CLICK on the message to clean your computer!
Thanks for the heads up, Tuscon.

If you do click on the fake or rogue AV message you'll probably be directed to a web site where you'll need to purchase an AV program to get rid of a "virus" that probably isn't on your computer in the first place. If you chose not to purchase the program they won't go away and will hold your computer hostage until you pay the ransom. When you ultimately purchase the program, you're out the money and they have your CC info.

The IP shown is located in Lyon, France and the ISP is French telecom company Tiscali-France/Iliad Enterprises in Paris. From what I could tell with a quick check, only SMF and a couple other US based forum type web sites have been hacked recently.

Be careful.
 

bmudd14474

Legendary Pitmaster
Staff member
Administrator
Moderator
OTBS Member
★ Lifetime Premier ★
Group Lead
8,691
1,107
Joined Jun 1, 2008
 
Yesterday and today, on several occasions, while browsing new posts, I have had the SMF site change to a fake message saying that Microsoft Antivirus has detected unusual activity and I need to clean my PC immediately.  This is a fake message, and if you click on the link, it infects your machine.  I run Norton Antivirus (not Microsoft) and it catches it and blocks it.  The attacking computer is listed as 212.83.155.47

DO NOT CLICK on the message to clean your computer!
Thanks for the heads up, Tuscon.

If you do click on the fake or rogue AV message you'll probably be directed to a web site where you'll need to purchase an AV program to get rid of a "virus" that probably isn't on your computer in the first place. If you chose not to purchase the program they won't go away and will hold your computer hostage until you pay the ransom. When you ultimately purchase the program, you're out the money and they have your CC info.

The IP shown is located in Lyon, France and the ISP is French telecom company Tiscali-France/Iliad Enterprises in Paris. From what I could tell with a quick check, only SMF and a couple other US based forum type web sites have been hacked recently.

Be careful.
For the record SMF has not been hacked. Its the ad company that SMF uses but these ads don't touch our database.
 

cliffcarter

Master of the Pit
OTBS Member
Group Lead
2,253
238
Joined Feb 28, 2010
I am getting this again today, twice in the last 15 minutes
 

tropics

Epic Pitmaster
OTBS Member
★ Lifetime Premier ★
13,808
5,503
Joined Jun 25, 2014
I am getting a redirect to scan my PC I never open any thing that pops up.

http://www.reimageplus dot com/

This is the only web site I am getting it on Hope it can be blocked.

Richie
 

Latest posts

Hot Threads

Top Bottom
  AdBlock Detected

We noticed that you're using an ad-blocker, which could block some critical website features. For the best possible site experience please take a moment to disable your AdBlocker.