Error Message

[Iluvbertie]

Over the last 24 hours every time I click on a page anywhere in the Forum I get a 'threat detected' and 'a threat has been blocked and quarantined' message.

In this past 24 hour period I have had over 100 items quarantined and only from this site.

This is particularly happening when the page has a video linked to it but while typing this message I have received 7 of them.

The IT people at work looked at it for me (as it happened yesterday when I was at work and I was worried) and they said it is something in this site and not already on my computer.

We use the Sophos anti-virus system.

No other site I ever go to gives me that message.

Mods and Admins - you may need to look into this as it is a worry if this site is infecting our computers. I can't give any more information as Sophos only tells me that the 'threat' has been 'detected, blocked and quarantined' and when I click on the Sophos quarantine it says 'generic PUA virus detected' and then gives me the option to clean them up. I have 12 to clean up now from this message alone - note it was 7 earlier in the message but now it is 12.

 

[JessRulz]

Thank you for bringing this to our attention, Iluvbertie. I have notified our tech team of the issue and they will investigate to see what is causing the problem.

 

[Janet H]

Thanks for the report. We don"t see anything amiss but PUA (and PUPs) can come from Ads. Ads are displayed based on your own browsing history so you might have picked up some unwanted adware.

You could run a scan with Malwarebytes (free download) to double check or trust your current security scheme. It could also be a false positive. If there were real files being blocked, they'd be in quarantine. Can you check? If you find something there let us know what the file names are so we can look further.

 

[Iluvbertie]

All the adds that pop up here also pop up on other sites but this is the only place where I am getting this message.

They are going into quarantine with the message I told you.

I have been advised by the IT staff at school that it is in this site and as you can't fix it I will have no option but to leave the site. We tested this on a number of different computers - my home computer at home, five different computers at school using different service providers and even a computer in a friend's home - the only time the message came was when I logged onto this site - no other site just this one.

Sorry - but that is the way it is.

I can't take the risk of infecting my works computers (all 400+ not to mention the over 1200 students devices that log onto the schools' system).

If I was getting the message on any other sites I would have told you but it is only on this one.

Sorry - but it is goodbye from me due to the dangers of a virus from this site.

I have enjoyed my time here but security must take precedence.

 

[Osipi]

This may be off base but thought I'd throw a few pennies in the pot.

Perhaps what happened is that the browser being used was updated and for some reason the ad blockers didn't pass muster. I've had that happen where after a update, I had to physically reconfigure my ad blocker in my browser.

I have had no trouble with ads since then.

 

[Katrianna]

That is unusual because I use Firefox with it's own ad blockers and Avira anti-virus and haven't had any problems with Royal Forums.

 

[Tatiana Maria]

Has anybody else's anti-virus detected adware or viruses?

 

[Muhler]

No, and my security settings are set "paranoid", so threats ought to have been detected.

 

[Iluvbertie]

Well we have worked out what is happening.

Through one of my 'social media accounts' - including this one - a hacker (no idea who or what) is using this site to gain access to my computer. Could be a student from the school or someone from the other side of the world.

This is increasingly a common way hackers are attacking computers to gain access to your personal information.

Just because you aren't getting a 'warning' doesn't mean you aren't being attacked according to the guys who have spent much of the last four days with my computers at home and at work trying to backdoor the problem and after working with the people at Sophos have said that this site isn't the actual problem but that outsiders are using this site - and millions of others - as ways into our computers.

So I can now post again - hurrah - and I really must thank the IT guys at work for the fantastic job they did in tracking this down for me. They have also learnt a lot about the royals from their many visits here to see if what they had tried worked. Eventually it did - we know what is causing it - I will continue to get the message but no concerns as Sophos is blocking everything from getting through.

 

[Osipi]

Whew!! I'm glad you have the problem worked out and are back among us. TRF just wouldn't be the same without you.

 

[RoyalHighness 2002]

Whew!! I'm glad you have the problem worked out and are back among us. TRF just wouldn't be the same without you.

Exactly, I'm happy you're back too.

 

[AllGone]

Glad all is safe! Cheers!

 

[Lady Nimue]

An FYI - I have for the second time today a message that pops up while on this site telling me I have a virus. It seems to pop up while I am giving an instruction, such as hitting 'post' to post a message to a thread. It happened twice today, and it has happened once before, within the last week or two.

I have never seen this alert at any other time except when on this site. I have also had my screen freeze today, and had to do a re-boot on this site.

Does this sound like a familiar problem? Something going on with the site? It's telling me the site is infested. (I have an Apple product).

 

[Missjersey]

Also have apple.....past few days I’ve been in middle of posting and get logged off. Also getting lots of apple pop ups which I have blocked in settings. Tonight I’ve been on/off probably 5 times.

 

[Osipi]

No problems here using Windows 10 and Opera with an ad blocker.

 

[Lady Nimue]

I thought a moderator would come on to explain......

 

[iceflower]

It's rather a question for our Tech Admins, hopefully one will have an answer for you!

 

[Janet H]

An FYI - I have for the second time today a message that pops up while on this site telling me I have a virus. It seems to pop up while I am giving an instruction, such as hitting 'post' to post a message to a thread. It happened twice today, and it has happened once before, within the last week or two.

I have never seen this alert at any other time except when on this site. I have also had my screen freeze today, and had to do a re-boot on this site.

Does this sound like a familiar problem? Something going on with the site? It's telling me the site is infested. (I have an Apple product).

Also have apple.....past few days I’ve been in middle of posting and get logged off. Also getting lots of apple pop ups which I have blocked in settings. Tonight I’ve been on/off probably 5 times.

Can you try restarting your computer please and see if that helps? If this persists please either take a screen shot of the message or post the contents so we can investigate. This sounds like an ad that is masquerading as a system notice to me...

 

[Missjersey]

Will do Janet H but it my phone. Apple 7

 

[Janet H]

Will do Janet H but it my phone. Apple 7

If it's a phone, then it's definitely a bad ad. Not malware but very annoying. Make sure you have the latest version of the mobile app and then cycle your phone off and then on.

 

[Lady Nimue]

Can you try restarting your computer please and see if that helps? If this persists please either take a screen shot of the message or post the contents so we can investigate. This sounds like an ad that is masquerading as a system notice to me...

Thank you. It hasn't happened since that day. The nature of what I was seeing was 'requiring' me to click on something in order to 'update' something which I refrained doing. In all instances when it popped up I closed the windows immediately. It looked like nothing one would get from Apple (I thought) though it also didn't look like an ad since it was all pale blue and grey with no text/pictures of ads or anything. Looked 'official' except something looked like it was 'running'. It was so unusual that I assumed it was something wonky. As you say: an ad that is masquerading as a system notice, and they are getting very clever! But why just on TRF site?

 

[Missjersey]

Thank you Janet H. Works like a charm!

 

[Iluvbertie]

I often get this sort of message on my PC so take the computer to the IT guys at school and they remove the virus, malware etc. It is a recurring theme. When I retire in five years I will have to leave this site for that very reason.

 

[Lady Nimue]

Interesting, just heard an analysis of Bitcoin and what 'activity' increases it's value, and apparently it is spookily like what I described: a computer's running system is 'taken over' and 'used' to 'up' the Bitcoin. I may have this a wee bit scrambled but it's in that arena. Interesting. Not at all saying that what I saw was a Bitcoin intrusion but it did remind me of what I had experienced here (and no where else at this point, which site-specific occurrence makes it notable).

P.S. I will be asking Apple about it.

I often get this sort of message on my PC so take the computer to the IT guys at school and they remove the virus, malware etc. It is a recurring theme. When I retire in five years I will have to leave this site for that very reason.

Iluvbertie, I thought you were just starting up another Master's Degree (or PhD) among many that you already have. So close to retirement! You are dedicated!

 

[Iluvbertie]

Started by Ph.D at the beginning of this year. I am due to retire in five years from teaching. Then I will do something else - as a volunteer in all likelihood but with no access to IT experts I will be leaving here and other sites which are constantly under attack. I would imagine that when I retire I will drop the internet completely as no way to remove the viruses or malware etc and will lose access to the virus protection I have now.

 

[Osipi]

Its occurred to me that I've never had this problem and realized that I never see one single ad when I'm on TRF. Not one. I also have an ad blocker installed on this system that comes with my Opera browser. Most browsers have one already installed. You just have to configure it to your liking.

 

[Lady Nimue]

I have been gone from posting on the forums over the holidays (about a month gone) and when I came back on to post yesterday I received the virus warning again: 3 times on separate sign-ins. It's definitely site specific, to this site TRF. It happens no where else (for me) on the internet.

This time I somewhat read it, and it said something about a 'Trojan Virus'. There comes a loud keening sound as well, a real sense of alarm is created and the warning states that the site I am on is 'infested' and to remove myself at once.

Anyway, it may impact my continuing on the site (not that that matters and may in fact be a good thing for me since I am being a wastrel coming on here to post) because it's very alarming when it happens, given the siren-like sound that accompanies the 'infestation' warning. FYI.

 

[Muhler]

No problem here and my security settings are set at "paranoid".

Anti-virus can sometimes act on advert banners or a java-script.

I suggest you scan your hard drive thoroughly and perhaps log in with a different browser.
If you usually use Chrome, try Firefox or Explorer and then go directly to TRF after logging in at your usual start page. And go nowhere else.
Then log out again and do a new scan.
If no serious threat is detected it's probably a glitch your anti-virus is reacting to.
Which is fine, better safe than sorry.

 

[Lady Nimue]

Thank you, Muhler. So far nothing today. I wonder what triggers it?