SMF web seems to be infected with a virus

  • Some of the links on this forum allow SMF, at no cost to you, to earn a small commission when you click through and make a purchase. Let me know if you have any questions about this.
SMF is reader-supported. When you buy through links on our site, we may earn an affiliate commission.

tucson bbq fan

Smoking Fanatic
Original poster
Jun 30, 2013
332
27
Tucson, Arizona
Yesterday and today, on several occasions, while browsing new posts, I have had the SMF site change to a fake message saying that Microsoft Antivirus has detected unusual activity and I need to clean my PC immediately.  This is a fake message, and if you click on the link, it infects your machine.  I run Norton Antivirus (not Microsoft) and it catches it and blocks it.  The attacking computer is listed as 212.83.155.47, 80

DO NOT CLICK on the message to clean your computer!
 
I'm not seeing it here, but I'm heavily protected.

I used to run a couple of web sites and I suspect it creeped in via the code for one of the adds.  I've seen that before.  If that is the case, the problem is not with SMF forum but with the add vendor or product company code, not Jeff's.
 
What redirected page?

Just curious, but what browser are you guys running?  I'm on firefox and not seeing any of this (but I also have a paid subscription to the site and may not be getting the adds you are seeing).
 
We have reported this issue. Its not aSMF issue per say its with the ad's that run on the site. They hope to have it resolved soon.

Also anytime you see a issue like this if you go to www.smokingmeatforums.com/feedback you can report it so that if a mod isn't on it alerts the ones that need to know.

Thanks
 
 
What redirected page?

Just curious, but what browser are you guys running?  I'm on firefox and not seeing any of this (but I also have a paid subscription to the site and may not be getting the adds you are seeing).
I'm running Internet Explorer 9 with Norton Security Suite. Norton has detected this issue only while I'm on the SMF site. I have no problems anywhere else at all. Norton alerts me with the following message..."Fake App Attack: Fake Av Website 20"...The following text was extracted from a Norton forum:
[h1]"Re: Fake App Attack: Fake Av Website 20[/h1]
‎05-03-201207:59 PM

Hi ConstanceGrace,

This type of attack is commonly associated with fake antivirus scans that attempt to trick you into downloading malware that pretends to be a security or system maintenance product. Norton has blocked the loading of the page before you were able to click on anything that might lead to trouble. Even so, it is often a good idea to update your virus definitions by running LiveUpdate, and then run a scan, just to make sure that no harm was done."

**********************************************************************************

This is not a brand new game.
 
 
Yesterday and today, on several occasions, while browsing new posts, I have had the SMF site change to a fake message saying that Microsoft Antivirus has detected unusual activity and I need to clean my PC immediately.  This is a fake message, and if you click on the link, it infects your machine.  I run Norton Antivirus (not Microsoft) and it catches it and blocks it.  The attacking computer is listed as 212.83.155.47

DO NOT CLICK on the message to clean your computer!
Thanks for the heads up, Tuscon.

If you do click on the fake or rogue AV message you'll probably be directed to a web site where you'll need to purchase an AV program to get rid of a "virus" that probably isn't on your computer in the first place. If you chose not to purchase the program they won't go away and will hold your computer hostage until you pay the ransom. When you ultimately purchase the program, you're out the money and they have your CC info.

The IP shown is located in Lyon, France and the ISP is French telecom company Tiscali-France/Iliad Enterprises in Paris. From what I could tell with a quick check, only SMF and a couple other US based forum type web sites have been hacked recently.

Be careful.
 
 
Yesterday and today, on several occasions, while browsing new posts, I have had the SMF site change to a fake message saying that Microsoft Antivirus has detected unusual activity and I need to clean my PC immediately.  This is a fake message, and if you click on the link, it infects your machine.  I run Norton Antivirus (not Microsoft) and it catches it and blocks it.  The attacking computer is listed as 212.83.155.47

DO NOT CLICK on the message to clean your computer!
Thanks for the heads up, Tuscon.

If you do click on the fake or rogue AV message you'll probably be directed to a web site where you'll need to purchase an AV program to get rid of a "virus" that probably isn't on your computer in the first place. If you chose not to purchase the program they won't go away and will hold your computer hostage until you pay the ransom. When you ultimately purchase the program, you're out the money and they have your CC info.

The IP shown is located in Lyon, France and the ISP is French telecom company Tiscali-France/Iliad Enterprises in Paris. From what I could tell with a quick check, only SMF and a couple other US based forum type web sites have been hacked recently.

Be careful.

For the record SMF has not been hacked. Its the ad company that SMF uses but these ads don't touch our database.
 
I am getting this again today, twice in the last 15 minutes
no_no.gif
mad.gif
 
SmokingMeatForums.com is reader supported and as an Amazon Associate, we may earn commissions from qualifying purchases.

Latest posts

Hot Threads

Clicky