# Chrome just flagged this site as malware for me **URL:** \ **Category:** About This Message Board\ **Created:** [May 13, 2014, 2:39pm UTC](https://boards.straightdope.com/t/chrome-just-flagged-this-site-as-malware-for-me/688352 "2014-05-13T14:39:19Z")\ **Posts on this page:** 20\ **Page:** 10
**Author:** ![ZipperJJ](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/zipperjj/32/211_2.png) [@ZipperJJ](https://boards.straightdope.com/u/ZipperJJ)\ **Post date:** [May 15, 2014, 4:14am UTC](https://boards.straightdope.com/t/chrome-just-flagged-this-site-as-malware-for-me/688352/181 "2014-05-15T04:14:53Z")
> [@Siam\_Sam](#): > > Dunno if I was infected. But I got the warning. That’s got nothing to do with whether or not you view ads. It only has to do with whether or not you use a browser that subscribes to Google’s “badware” warnings. ---
**Author:** ![AaronX](https://avatars.discourse-cdn.com/v4/letter/a/7bcc69/32.png) [@AaronX](https://boards.straightdope.com/u/AaronX)\ **Post date:** [May 15, 2014, 6:04am UTC](https://boards.straightdope.com/t/chrome-just-flagged-this-site-as-malware-for-me/688352/182 "2014-05-15T06:04:14Z")
> [@Siam\_Sam](#): > > Dunno if I was infected. But I got the warning. They throw the warning to everyone, without consideration for users’ safety precautions like antivirus or adblock. It’s not customised for the user. In fact, I think there was only one malicious ad, meaning the odds of actually getting it were quite low (\<1%, I guess), but that was enough to flag the site. Seems odd that they do this on a site basis, when it would be much more efficient to note the ad provider and flag everything by that provider. It would, er, greatly encourage them to prevent bad ads as well. I know some malware is on the site itself, not from ads; there’s no reason they can’t flag on either basis. ---
**Author:** ![aldiboronti](https://avatars.discourse-cdn.com/v4/letter/a/9fc348/32.png) [@aldiboronti](https://boards.straightdope.com/u/aldiboronti)\ **Post date:** [May 15, 2014, 6:58am UTC](https://boards.straightdope.com/t/chrome-just-flagged-this-site-as-malware-for-me/688352/183 "2014-05-15T06:58:45Z")
> [@AaronX](#): > > They throw the warning to everyone, without consideration for users’ safety precautions like antivirus or adblock. It’s not customised for the user. In fact, I think there was only one malicious ad, meaning the odds of actually getting it were quite low (\<1%, I guess), but that was enough to flag the site. > > Seems odd that they do this on a site basis, when it would be much more efficient to note the ad provider and flag everything by that provider. It would, er, greatly encourage them to prevent bad ads as well. I know some malware is on the site itself, not from ads; there’s no reason they can’t flag on either basis. Google doesn’t flag a site for one malicious ad. And the danger was not only present yesterday. Over the last 3 months it’s found a whole bunch of malware, that’s why the flag went up. And I’m bloody grateful that Google does this. From upthread someone posted the details from Google. > [@](#): > > Of the 15895 pages we tested on the site over the past 90 days, 76 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2014-05-13, and the last time suspicious content was found on this site was on 2014-05-13. > Malicious software includes 77 exploit(s). Successful infection resulted in an average of 2 new process(es) on the target machine. > > Malicious software is hosted on 3 domain(s), including [bingoco.net/](http://bingoco.net/), [amplifyactionset.net/](http://amplifyactionset.net/), stanstraight.pw/. > > This site was hosted on 1 network(s) including AS22772 (LOGIN). ---
**Author:** ![aceplace57](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/aceplace57/32/3500_2.png) [@aceplace57](https://boards.straightdope.com/u/aceplace57)\ **Post date:** [May 15, 2014, 7:34am UTC](https://boards.straightdope.com/t/chrome-just-flagged-this-site-as-malware-for-me/688352/184 "2014-05-15T07:34:29Z")
The problem is still here. As usual McAfee immediately puts a black bar on Firefox. “We tested this page and blocked content that comes from potentially dangerous or suspicious sites.” Every day. Every time I visit the SDMB. Won’t be long and Google will block the site again. Their test is probably similar to what McAfee does. Whatever gets blocked doesn’t impact the actual message postings. I see them fine. I’m not clicking View All Blocked Content to find out. :dubious: I’m running Flashblock. Not running AdBlock. Maybe its time that I do? ---
**Author:** ![kayaker](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/kayaker/32/441_2.png) [@kayaker](https://boards.straightdope.com/u/kayaker)\ **Post date:** [May 15, 2014, 11:45am UTC](https://boards.straightdope.com/t/chrome-just-flagged-this-site-as-malware-for-me/688352/185 "2014-05-15T11:45:02Z")
> [@Merneith](#): > > What a crap analogy. I agree. 'Twas _your_ analogy, though. > [@Merneith](#): > > If your fire alarm goes off, you don’t solve the problem by taking out the battery. If your browser says there’s malware on a site, that’s not the time to lower your security standards. ---
**Author:** ![aldiboronti](https://avatars.discourse-cdn.com/v4/letter/a/9fc348/32.png) [@aldiboronti](https://boards.straightdope.com/u/aldiboronti)\ **Post date:** [May 15, 2014, 12:28pm UTC](https://boards.straightdope.com/t/chrome-just-flagged-this-site-as-malware-for-me/688352/186 "2014-05-15T12:28:11Z")
> [@aceplace57](#): > > The problem is still here. As usual McAfee immediately puts a black bar on Firefox. “We tested this page and blocked content that comes from potentially dangerous or suspicious sites.” > > Every day. Every time I visit the SDMB. Won’t be long and Google will block the site again. Their test is probably similar to what McAfee does. > > Whatever gets blocked doesn’t impact the actual message postings. I see them fine. I’m not clicking View All Blocked Content to find out. :dubious: > > I’m running Flashblock. Not running AdBlock. Maybe its time that I do? I wouldn’t dream of coming to this site now without an adblocker. It’s far too risky, even for a member. Nor would I recommend this site to a friend who wasn’t computer-savvy. If they keep the same ad supplier I’d be putting my friend’s computer in harm’s way. ---
**Author:** ![kayT](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/kayt/32/3633_2.png) [@kayT](https://boards.straightdope.com/u/kayT)\ **Post date:** [May 15, 2014, 1:12pm UTC](https://boards.straightdope.com/t/chrome-just-flagged-this-site-as-malware-for-me/688352/187 "2014-05-15T13:12:34Z")
Can an ad infect your computer with a virus just by showing up on your screen? Or do you have to click on something? ---
**Author:** ![RaftPeople](https://avatars.discourse-cdn.com/v4/letter/r/6f9a4e/32.png) [@RaftPeople](https://boards.straightdope.com/u/RaftPeople)\ **Post date:** [May 15, 2014, 1:58pm UTC](https://boards.straightdope.com/t/chrome-just-flagged-this-site-as-malware-for-me/688352/188 "2014-05-15T13:58:45Z")
You do not need to click on something. ---
**Author:** ![kayT](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/kayt/32/3633_2.png) [@kayT](https://boards.straightdope.com/u/kayT)\ **Post date:** [May 15, 2014, 4:48pm UTC](https://boards.straightdope.com/t/chrome-just-flagged-this-site-as-malware-for-me/688352/189 "2014-05-15T16:48:03Z")
Can you tell me how that works? Having an ad appear on my screen can infest my computer how? ---
**Author:** ![hajario](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/hajario/32/171_2.png) [@hajario](https://boards.straightdope.com/u/hajario)\ **Post date:** [May 15, 2014, 4:53pm UTC](https://boards.straightdope.com/t/chrome-just-flagged-this-site-as-malware-for-me/688352/190 "2014-05-15T16:53:00Z")
> [@kayT](#): > > Can you tell me how that works? Having an ad appear on my screen can infest my computer how? [This](http://en.wikipedia.org/wiki/Malvertising) Wikipedia article does a good job of explaining it. ---
**Author:** ![levdrakon](https://avatars.discourse-cdn.com/v4/letter/l/49beb7/32.png) [@levdrakon](https://boards.straightdope.com/u/levdrakon)\ **Post date:** [May 15, 2014, 5:01pm UTC](https://boards.straightdope.com/t/chrome-just-flagged-this-site-as-malware-for-me/688352/191 "2014-05-15T17:01:47Z")
> [@hajario](#): > > [This](http://en.wikipedia.org/wiki/Malvertising) Wikipedia article does a good job of explaining it. This part is interesting: > [@](#): > > Lastly, users can push companies and websites to scan advertisements before making them active on their webpages. I wonder how difficult it would be for this board to scan ads here prior to making them active. ---
**Author:** ![kayT](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/kayt/32/3633_2.png) [@kayT](https://boards.straightdope.com/u/kayT)\ **Post date:** [May 15, 2014, 5:19pm UTC](https://boards.straightdope.com/t/chrome-just-flagged-this-site-as-malware-for-me/688352/192 "2014-05-15T17:19:17Z")
According to the Wikipedia article the infection happens when the ad is clicked on. Here is the quote: “Websites or web publishers unknowingly incorporate a corrupted or malicious advertisement into their page. Once the advertisement is in place, and visitors begin clicking on it, their computer can become infected: ‘the user clicks on the ad to visit the advertised site, and instead is directly infected or redirected to a malicious site. These sites trick users into copying viruses or spyware usually disguised as Flash files, which are very popular on the web.’” I still don’t see any way the infection can happen without the ad being clicked on. I do see how the website gets infected but not how a person’s computer can be infected without some action other than just passively having an ad appear on screen. What am I missing? ---
**Author:** ![dzeiger](https://avatars.discourse-cdn.com/v4/letter/d/46a35a/32.png) [@dzeiger](https://boards.straightdope.com/u/dzeiger)\ **Post date:** [May 15, 2014, 5:53pm UTC](https://boards.straightdope.com/t/chrome-just-flagged-this-site-as-malware-for-me/688352/193 "2014-05-15T17:53:50Z")
> [@kayT](#): > > I still don’t see any way the infection can happen without the ad being clicked on. I do see how the website gets infected but not how a person’s computer can be infected without some action other than just passively having an ad appear on screen. What am I missing? Ads can incorporate various scripting functions, Flash, or other things that automatically run when you just visit the page the ads are on. So if there’s a security vulnerability in Flash, for example, the ad can exploit that vulnerability because it runs when you visit the page the ad is on. Most ads nowadays aren’t just a HTML link, each one is effectively a full little program running on your machine. ---
**Author:** ![ftg](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ftg/32/2801_2.png) [@ftg](https://boards.straightdope.com/u/ftg)\ **Post date:** [May 15, 2014, 7:13pm UTC](https://boards.straightdope.com/t/chrome-just-flagged-this-site-as-malware-for-me/688352/194 "2014-05-15T19:13:16Z")
1. You don’t have to click on a malware ad to get infected. However, it is a lot easier to exploit holes that do require clicking than ones that don’t. The non-click holes are less common and more regularly patched. There are so many need-to-click holes being found all the time that those are just plain hard to keep up with. 2. Adobe is notoriously bad at software quality. Flash, Reader, etc., are just poorly designed and unmaintainable messes. Even their new cloud service is [out of service](http://www.pcworld.com/article/2155621/adobe-creative-cloud-suffering-extended-outage.html) since Wednesday afternoon. (Which puts a really big hurt on their clients, who should have known better.) Adobe products are so bad that malware writers rather spend time finding holes in their products than Microsoft’s. 1. Ad services don’t host the ads. They don’t see the ads. They just provide a service to websites that says link to something from this other site. This saves them hosting costs. The actual ad providers have to provide their own site and bandwidth. This also reduces bottlenecks of millions of ads being fed every second since they are distributed from many remote sites. Neither the ad service nor the Dope can reliably do their own ad scanning under this system. Malware distributors have been known display “safe” ads to address blocks associated with the ad service and the end site. If things are going to ever change for the better, this remote ad hosting crap has to end. People need to bite the bullet. The ad services need to host, scan, and distribute 100% of the ads. Sites like the Dope need to only sign with services that implement this policy. Otherwise, this nonsense will continue and ad blockers will only continue to gain ground to the detriment of web sites. ---
**Author:** ![rsa](https://avatars.discourse-cdn.com/v4/letter/r/839c29/32.png) [@rsa](https://boards.straightdope.com/u/rsa)\ **Post date:** [May 15, 2014, 8:10pm UTC](https://boards.straightdope.com/t/chrome-just-flagged-this-site-as-malware-for-me/688352/195 "2014-05-15T20:10:17Z")
From the wiki article: > [@](#): > > “The interesting thing about infections delivered through malvertising is that it does not require any user action (like clicking) to compromise the system and it does not exploit any vulnerabilities on the website or the server it is hosted from… infections delivered through malvertising silently travel through Web page advertisements.” **[7]** From footnote **[7]** “Five-month malvertising campaign serves up silent infections”. Infosecurity. Reed Exhibitions. Retrieved 18 March 2013. [Here](http://www.infosecurity-magazine.com/view/30706/fivemonth-malvertising-campaign-serves-up-silent-infections/) > [@](#): > > Users with the latest Java update (Java 7 update 13) are no longer at risk through silent exploitation. Keep your software up-to-date. ---
**Author:** ![spinky](https://avatars.discourse-cdn.com/v4/letter/s/59ef9b/32.png) [@spinky](https://boards.straightdope.com/u/spinky)\ **Post date:** [May 15, 2014, 8:33pm UTC](https://boards.straightdope.com/t/chrome-just-flagged-this-site-as-malware-for-me/688352/196 "2014-05-15T20:33:01Z")
> [@Merneith](#): > > They’ve demonstrated that they don’t mind inconveniencing us. Shit is apparently never going to get fixed until it starts inconveniencing _them_. Ain’t that the truth. ---
**Author:** ![AaronX](https://avatars.discourse-cdn.com/v4/letter/a/7bcc69/32.png) [@AaronX](https://boards.straightdope.com/u/AaronX)\ **Post date:** [May 16, 2014, 4:46am UTC](https://boards.straightdope.com/t/chrome-just-flagged-this-site-as-malware-for-me/688352/197 "2014-05-16T04:46:47Z")
> [@ftg](#): > > Even their new cloud service is [out of service](http://www.pcworld.com/article/2155621/adobe-creative-cloud-suffering-extended-outage.html) since Wednesday afternoon. (Which puts a really big hurt on their clients, who should have known better.) Wow. Is this… retribution or something? This is beyond inept and bad luck. ---
**Author:** ![Measure\_for\_Measure](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/measure_for_measure/32/557_2.png) [@Measure\_for\_Measure](https://boards.straightdope.com/u/Measure_for_Measure)\ **Post date:** [May 16, 2014, 6:24am UTC](https://boards.straightdope.com/t/chrome-just-flagged-this-site-as-malware-for-me/688352/198 "2014-05-16T06:24:05Z")
> [@rsa](#): > > Keep your software up-to-date. That means flash and windows update. If you don’t need it, uninstall Java entirely. It’s a POS security wise. If you do need it, then keep it up to date. There are a number of .pdf viewers not made by Adobe. I’m unclear about their relative safety, though I will express distrust of a company that would even think of having macros run automatically when a file is opened as Adobe (and Microsoft) once did. ---
**Author:** ![scabpicker](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/scabpicker/32/8268_2.png) [@scabpicker](https://boards.straightdope.com/u/scabpicker)\ **Post date:** [May 16, 2014, 9:29am UTC](https://boards.straightdope.com/t/chrome-just-flagged-this-site-as-malware-for-me/688352/199 "2014-05-16T09:29:35Z")
I generally agree with **Merneith** ’s admonition to not turn off the check for badsites in your browser. However, I turned the Google badsites checking off in my browser for 3 reasons: 1. I run [noscript](http://noscript.net/) in Firefox (on Linux), and keep the sites that are allowed very narrow. It prevents the browser from loading java/javascript/Flash on any site that you haven’t already allowed. I disallow several sites that noscript allows by default. Other than that, I load javascript/flash/java as needed. It makes browsing a little primitive, and sometimes a pain if I want to watch a video or order something, but it’s worth it for many reasons. I originally did it because I was sick of sites’ Flash ads grinding my ancient laptop’s processor to a halt. After a few weeks of enjoying it, I realized that _those extensions are the most common routes of infection_. Now, nothing is totally secure, and I’m sure there will probably be an exploit for someone’s HTML interpreter soon, but closing off the common routes will make you generally safe. 2. I’m sure the data is reasonably anonymous, but I don’t see any reason to report every site I visit to any central point. There’s no way that at least the site you’re visiting and your IP isn’t being sent to the server providing the block list, Google has the capability and inclination to store it, and I don’t trust any private entity to resist the urge to collect/use this data. 3. If you are going to block content, and you can identify the original source, why block a third party? The reports provided show that they know the original domain the infections came from, why block someone who is an unwitting consumer of a malicious source? Perhaps you could make the argument that if everyone reports that they are blocked, the consumer of the malicious source will no longer be unwitting, and stop using the source. I’d say that might work, blocking the domain and IP address that the software was originating from also would work. The people distributing malicious software could change domain names, but that would probably also get around the ad services removing them. * * * If you’re not doing something very similar to item 1, don’t worry about 2 or 3. Getting your machine owned can be much worse than leaking some paltry data or not visiting your favorite message board for a day. Trust me, I’m a professional. ---
**Author:** ![Kimballkid](https://avatars.discourse-cdn.com/v4/letter/k/b5a626/32.png) [@Kimballkid](https://boards.straightdope.com/u/Kimballkid)\ **Post date:** [May 16, 2014, 9:32pm UTC](https://boards.straightdope.com/t/chrome-just-flagged-this-site-as-malware-for-me/688352/200 "2014-05-16T21:32:12Z")
Just got the warning again after two days or so of no warning. Firefox 29 with AdBlock FWIW. [Previous page](https://boards.straightdope.com/t/chrome-just-flagged-this-site-as-malware-for-me/688352.md?page=9) [Next page](https://boards.straightdope.com/t/chrome-just-flagged-this-site-as-malware-for-me/688352.md?page=11)