Re directed

[bobbruce]

Just checking if anyone else is getting diverted to another web site from here. Whatever I click on it sends me to that page for a few seconds before it redirects me to another site. I thought it might be my phone but it only seems to be happening from this site.

[Futtocks]

Not me - all working normally.

[Old Frightful]

What's the other site, out of interest?, as long as it's not a    site, obviously.

[amm]

What's the other site, out of interest?, as long as it's not a    site, obviously.

 e-cigs

[Dave T]

I was getting re-directed on Friday. Was a google help page, looked dodgy and then my work filter kicked in on it.

[bobbruce]

What's the other site, out of interest?, as long as it's not a site, obviously.

Lemode magazine and no it's not one of those mags.

[ckn]

Hmmm... can't see anything obvious but then I can only see the front-end website admin pages.  I'll hit report on this and get John to have a look under the hood.

 

Site taking far longer to load pages than normal but it does go to the right page eventually, that might just be that my system is quite heavily locked down to stop cross-site issues and most nasties.

[Saintslass]

Yep.  I'm getting lemonade magazine with an ad that takes over the page.  I've assumed it was malware on my computer and am presently scanning to hunt for infected files but it may not be me if others are getting something similar.  I can't get rid of the page once its showing except by going back to the previous webpage I was looking at, and it's intermittent, showing up on different threads and sometimes not at all.

[John Drake]

I'm looking into this. I've submitted a support request to a company that monitors the site for malware and other problems on our behalf, which is currently reporting no errors, to double check if these issues are being caused by our website, or are local to the user's own computer.

 

I can't replicate the above problems myself on either my work or home PC right now, which suggests the latter, but I'll report back once Sucuri.net have responded to my support request.

 

As an aside, a few weeks back a laptop computer I also use at work ended up being infected with all kinds of malware after I installed a commonly used FTP client called FileZilla on it (it seems FileZilla, which previously had a very good reputation online, now bundles all kinds of ###### with its installer, and even when you ask it not to, it still forces malware onto your system when you install. It's likely other 'free' programs are doing likewise as they make money for bundling such ###### with their installers).

 

At this point, on that laptop I did have exactly the same problem users are reporting above, but not just when viewing TRL, on a host of other sites too, which would quite randomly redirect me to other websites, that it turn, were downloading even more ###### onto the laptop without my knowledge and under the radar of the anti-virus/firewall program it was running.

 

The primary culprit was a program named 'Vosteran' and the bad news is it is an absolute nightmare to get rid off once you have it lodged in your system, not least because it acts as a backdoor to allow other malware to be installed so eliminating Vosteran alone doesn't cure the problem.

 

Not even a full Norton Security scan would get rid of it all, and eventually I had to call in a computer whizz who spent quite some time dredging through root files and the registry to finally erase all trace of Vosteran and its associated garbage.

 

Now the laptop works perfectly and is generating no problems at all when viewing TRL or any other site, all further suggesting that these problems are local to affected computers and not to do with the website(s) you're trying to view.

 

As I say, I'll report back once I know for certain it isn't TRL causing these issues but in the meantime, you might want to check if your computer has been infested with Vosteran and if so, Google search for the means to start getting rid of it, because if my experience is anything to go by, a security software scan won't do it alone.

[ckn]

I now run all such "freeware" programmes in a VM that I can trash as needed and overwrite with a clean, locked down base image.  The version of Filezilla I use is from 2011, it's a known-good version but it doesn't half nag about being out of date.

 

One thing to check is any target you've used a proven flawed tool to upload to, it's probably got a few hidden nasties of its own.

[Saintslass]

Well, I've run two deep searches of my system and neither have brought up any infected files but the problem continues and has now appeared on another site so it looks like I have a pain in the backside buried in my files somewhere.  I haven't a clue what to do so it's off to an IT whizz and on to my credit card!

[ckn]

Advice for those with not much IT expertise: If you're using Firefox then add noscript as an add on then only authorise sites you trust. It's a bit of a pain at times but it adds an extra layer of protection.

[bobbruce]

Don't know if this makes any difference but I'm on a iPhone rather than a laptop and as I say it doesn't happen anywhere else

[Old Frightful]

 e-cigs

My paranoia about this flying over my head due to me not being very bright has disappeared.

 

Having read the Big Bad Wolf thread, I now understand this joke.

 

That is all.

[gingerjon]

Well, I've run two deep searches of my system and neither have brought up any infected files but the problem continues and has now appeared on another site so it looks like I have a pain in the backside buried in my files somewhere.  I haven't a clue what to do so it's off to an IT whizz and on to my credit card!

 

I had an issue a little while ago that malware and scans didn't turn up.  Turned out it was as simple as a new extension (called Shopper or somesuch) turning up in Google Chrome settings.

[John Drake]

I've had a response from Sucuri.net who have asked the following questions for those who are experiencing the redirect problems. If those affected could post their responses to each question in this thread I will feed them back, thanks.

 

1. Their browser and operating system. At this time I can only see the iPhone report from one user. Do the rest who see the redirects use the iPhone too?

2. What do they do to get the redirect? E.g. Open forum site (no redirect). Then click any link and get redirected. Or click some specific link and get redirected.

3. Is this reproducible? I.e. every time that they click on links, they get redirected.

4. Which site are they getting redirected? "e-sig" or "magazine" is not a good answer. We need exact site address (URL). Screenshot will also help.

5. If they are getting redirected on mobile only, then is this happening only on the 3G network, or the same redirect occurs when they are on Wi-Fi?

[Dave T]

I was using chrome on my work laptop. 

 

It only happened a few times and is now not an issue, maybe our security software has fixed it. Will take a screenshot if it happens again.

[John Drake]

Sucuri.net have now come back to me with the following explanation.

 

Looks like this thread is related to your issue:

https://productforums.google.com/forum/#!topic/adsense/szfNNkPrkLI%5B1-25-false%5D

Seems to be some malwertising campaign that hijacked Google AdSense ads:

Some important quotes from the thread:

"This ad is a known bad ad and our malvertising team is actively working on blocking it across the network as we speak. In addition to blocking it via your account, please do file feedback directly with AdWords here: https://support.google.com/adwords/troubleshooter/4578507"

Thanks for sending us this information. I've forwarded it to the AdWords malvertising team for their ongoing investigation. At this point, the redirect issue is known and our engineers are currently working on a fix as we speak. It appears to be one source that is changing destination URLs. Hopefully a permanent fix should be delivered today or ASAP."

So it looks like

1. connected to Google ads

2. Fixed by Google during the weekend.

[bobbruce]

Yeah hasn't been happening today so hopefully that's sorted it.

[Saintslass]

Sorry I didn't contribute to this thread as I was having a nightmare but I was at work and so couldn't post on here and anyway, my little netbook had by that time already been taken to computer hospital where it is still and now I'm borrowing a laptop.  My problems hadn't gone away.  They were there again this morning before my netbook went away so although the scans said I didn't have infected files I think I probably did have as my security software will have been out of date and anyway wasn't specifically installed against malware. 

 

I've been online since 1996 and this is the very first time I've had a virus problem of any kind.  I'm usually well on the ball but I've been caught out it would seem.  Annoying thing is too that when I mentioned it at work my boss said I should have brought it in for the work's IT guy to fix, for free.  Grrr!!  Oh well.  What's £45 between friends eh?

[bobbruce]

Looks like I've spoken too soon as it's now happening again.

[Bedford Roughyed]

Are you using an App or safari to view the site?

[Saintslass]

Looks like I've spoken too soon as it's now happening again.

Is it just on this site or on other sites too?  I was having problems on three sites in the end so I figured I'd become infected even if I didn't start out that way.  I'm on a borrowed laptop now and have no problems at all (so far anyway).

[bobbruce]

I've had a response from Sucuri.net who have asked the following questions for those who are experiencing the redirect problems. If those affected could post their responses to each question in this thread I will feed them back, thanks.

1. Their browser and operating system. At this time I can only see the iPhone report from one user. Do the rest who see the redirects use the iPhone too?

2. What do they do to get the redirect? E.g. Open forum site (no redirect). Then click any link and get redirected. Or click some specific link and get redirected.

3. Is this reproducible? I.e. every time that they click on links, they get redirected.

4. Which site are they getting redirected? "e-sig" or "magazine" is not a good answer. We need exact site address (URL). Screenshot will also help.

5. If they are getting redirected on mobile only, then is this happening only on the 3G network, or the same redirect occurs when they are on Wi-Fi?

1/ As I said mines the iphone

2/ I can get onto the main screen ok but once I click on a section like cross code or the RL forum or any thread on them it will usually redirect me. It might take 3/4 goes to get on sometimes more but once I get on its then ok until I click on something else.

3/ yeah more or less every time but after a few goes I can get through.

4/the main one is lemode-mgz.com but it does go to others but they are all similar sites

5/ I think both 3G and wifi

[Saintslass]

1/ As I said mines the iphone

2/ I can get onto the main screen ok but once I click on a section like cross code or the RL forum or any thread on them it will usually redirect me. It might take 3/4 goes to get on sometimes more but once I get on its then ok until I click on something else.

3/ yeah more or less every time but after a few goes I can get through.

4/the main one is lemode-mgz.com but it does go to others but they are all similar sites

5/ I think both 3G and wifi

That lemode thing was the main one for me too but there were a couple of others. One was obsessed with a male health ad.  This morning I couldn't stay on any thread longer than about 30 seconds in the end although the main screen was fine.