Threat Has Being Detected. Have You Been Maliciously Attacked!

[Dandyman3]

Hey all. 
 
When I have been trying to access the forums from your standard Google Search, each day, my antivirus is popping up saying threat detected as it is trying to re-direct me to something. After a few attempts I get to the website but may be worth noting (by the way this just happens on your website only).
 
Here's the details for web developer:
 
The link it is redirecting me to on the first instance of trying to get to the website:
[links removed by moderator]
 
OBVIOUSLY DO NOT CLICK ON THE ABOVE LINKS
 
Infection URL:Mal

 

[techen]

Google once had this website has a threat but it was quickly removed, It does not shock me that some cheaper/free anti virus/firewalls will flag this website up. There's no issues with it :3
 
But of course never follow redirection cause it could be your computer thats infected. 

 

[Donya]

The links kept showing up as clickable and I couldn't seem to edit that away, so I removed them to prevent any absent-minded clicks from other users.
 
As techen said, malware will commonly try to do redirects like this. The URLs given don't look at all legitimate so I would recommend doing a virus scan on your machine and checking your browser for unwanted plugins/add-ons.

 

[Dandyman3]

The links kept showing up as clickable and I couldn't seem to edit that away, so I removed them to prevent any absent-minded clicks from other users.
 
As techen said, malware will commonly try to do redirects like this. The URLs given don't look at all legitimate so I would recommend doing a virus scan on your machine and checking your browser for unwanted plugins/add-ons.

 
It is happening every time from a Google search. If I use my Nexus or Samsung it will redirect me to the page which it attends. Is it for adverts or something? Luckily the computer blocks this. This happens on cross browser platforms and other ISP's. Looks like a typical thing webmaster normally highlights 
 
I run malware programmes along my spyware programmes and tell people how to protect there computers for a living lol 
 
--------------------------------
Edit -
Also tried on a 3g + 4g connection same results to this URL page. Free Sucuri Sitecheck flags up malware and the site being blacklisted. 
 
It is just like this scenario as seen on Wordpress support:
https/wordpress.org/support/topic/when-clicking-on-my-site-from-google-users-are-redirected

 

[Zikofski]

i do believe it is because of adverts i haven't seen this message for years did this site have adverts 3 or 4 years ago?
 
but i agree with donya check your pc/phone for virus sadly samsung OS can get viruses just like any OS

 

[Chad]

There are currently no issues with this site on Google. I get no errors or warnings when accessing it via search results.

Can you post a screen shot of what you see? The links would have been nice but it looks like they got edited out.

 

[Dandyman3]

Screenshots attached below with URL's probably easier this way then typing them:
 
From computer:
 

 
3G Connection:
 
Searching as you would your standard www.google.co.uk

 
First screen: 

 
When the screen has loaded:

 
I have other devices I can try if required. 

 

[Chad]

The url4short web site reads, "Service currently disabled due to spam complaints." so I'm guessing the issue is actually with that site rather than this one. There is likely a link to that site from here.

 

[Dandyman3]

The url4short web site reads, "Service currently disabled due to spam complaints." so I'm guessing the issue is actually with that site rather than this one. There is likely a link to that site from here. 
 
Interesting update for today. With this script I think it is somehow cookie based. It will only appear once and then you won't see it again as soon as you have be-ridden it.  Now to make sure it was none of my machines, I tried at work today, and the exact same thing happened which has made me even more confident now it wasn't something on my computer luckily as most likely suspected. But gosh knows what is causing this little scripts and like we say, if you come to this site directly using tropicalfishforums.net you will not see it. It has to be on a search engine like Bing or Google. 

 

[Chad]

I have not been able to reproduce it. I created a search on Google and Bing that I knew would bring me here and clicked the link and just went right here without issue.

 

[Dandyman3]

How strange is this. Try hit into incognito mode or another browser after clearing cache/cookies. See what result you get? 
I thought it would be ISP related if anything from above, but not, because it happens for me on a 3g/4g connection. 
 
Interesting. I am currently looking into another forum similar to what yours is built on where a user has seen the same situation I am. Hang fire for updates. 
 
Google Search > laracroftonline forums > "http/www.laracroftonline.net/" 
 
Darn. Looks like it a hit dead end. But others on the IP Board had a similar situation. They recommended running scans etc. but of course none of this actually made a difference. I am wondering why this seems like an intermittent problem. Does it just affect us in UK? 
 
Post with regards to this situation: 
http/www.sevenforums.com/system-security/317867-redirected-url4short-info-when-trying-visit-certain-site-5.html

HAHA! 
I hope this offers you the resolution! 
 
FIX >>>>>>>>>>>>>>>>.. http/peter.upfold.org.uk/blog/2013/01/15/cleaning-up-the-ip-board-url4short-mess/ <<<<<<<<<<<<<

I have not been able to reproduce it. I created a search on Google and Bing that I knew would bring me here and clicked the link and just went right here without issue.

 
See above response with a bit of digging.

 

[Chad]

I will run a scan on the form just in case. We just patched the forum with the latest software version which included a security patch. So we are up to date in that regard. However, it never hurts to triple check things. Thanks for reporting this.

 

[Dandyman3]

Ok let me know the update. Would love to see if this fixes it and can surely test it  
 
I thought I was going insane then. 
 
Interesting reading that article though. It was I suspected with relation to cookies it seems "So, I could now reproduce the issue — if I supplied the right session cookie and requested that special g=js URL, I got the spammy redirect spat back at me. Perhaps I could use this to start tracing where this code was executing."
 
That article on the Peter site is brilliant. 
 

 

[Chad]

Well if it's related to cookies you could try clearing your cash of all cookies and seeing if that takes care of the problem for you.

 

[L2wis]

Hi all,
 
Just to let you know that I also occasionally get the same as the OP, where a google link will redirect you to: url4shortinfo/16e39f8f[DO NOT COPY AND PASTE/CLICK]
 
If I go back and then click the link it then works, I've had this happen to me on my phone, tablet, home computer and work pc 

.
 
Does indeed look like the forum has had some malware injected into it.