# You are distributing malware **URL:** \ **Category:** About This Message Board\ **Created:** [January 15, 2017, 3:42am UTC](https://boards.straightdope.com/t/you-are-distributing-malware/777205 "2017-01-15T03:42:29Z")\ **Posts on this page:** 20\ **Page:** 3
**Author:** ![nightshadea](https://avatars.discourse-cdn.com/v4/letter/n/7ba0ec/32.png) [@nightshadea](https://boards.straightdope.com/u/nightshadea)\ **Post date:** [January 19, 2017, 5:22am UTC](https://boards.straightdope.com/t/you-are-distributing-malware/777205/42 "2017-01-19T05:22:21Z")
I just click on the “don’t let this page open more pages” option when I get that page on other sites …one of the cc’s I pay for my aunt has a misspelling squatter that brings that up so I have to get rid of it fairly often ---
**Author:** ![Evan\_Drake](https://avatars.discourse-cdn.com/v4/letter/e/b487fb/32.png) [@Evan\_Drake](https://boards.straightdope.com/u/Evan_Drake)\ **Post date:** [January 19, 2017, 5:48am UTC](https://boards.straightdope.com/t/you-are-distributing-malware/777205/43 "2017-01-19T05:48:01Z")
I don’t have these problems, but that’s merely because I’m using Linux on a regular computer rather than any mad skillz on my part; the thing is it’s none of the mods’ fault, even admins can do little without the proper permissions. It’s not even the owners’ faults, I’m sure they make very little income from this place — not that it costs much to run — and they have no interest if they have ever visited; and it’s not a question of them trying to make any money at all here, as it is that they ‘know’ advertising is normal on the internet, so they simply say: ‘_Shove some advertising on that thing_’., and they end up with the crude stuff. D’you think they _read_ these complaints, let alone read any of the rest of this site ? Internet fora are not where serious businessmen ( or politicians ) spend their time. However, more to the point: where is all the less annoying crap-free internet advertising sent by honest reputable advertising agencies ? In Wonderland ? Just maybe those agencies don’t exist, and can’t exist, since advertising, being a form of begging, is naturally too debased to offer anything better. Certainly I can’t recall ever seeing any chain advertising that was not repellent. ( As opposed to firms’ own advertisements on their own sites, which if not ideal, are always safe and always inoffensive. ) So as long as there’s any advertising there will be malware etc… And worse than that, the awfulness of the vulgar advertisements themselves. ---
**Author:** ![Dag\_Otto](https://avatars.discourse-cdn.com/v4/letter/d/439d5e/32.png) [@Dag\_Otto](https://boards.straightdope.com/u/Dag_Otto)\ **Post date:** [January 19, 2017, 5:56am UTC](https://boards.straightdope.com/t/you-are-distributing-malware/777205/44 "2017-01-19T05:56:41Z")
Cool story, bro. ---
**Author:** ![septimus](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/septimus/32/410_2.png) [@septimus](https://boards.straightdope.com/u/septimus)\ **Post date:** [January 19, 2017, 10:15am UTC](https://boards.straightdope.com/t/you-are-distributing-malware/777205/45 "2017-01-19T10:15:44Z")
There are some Trojans that corrupt browsers and _might_ be causing OP’s symptom. I have such a virus, hard to get rid of, whose severity comes and goes. Lately it hardly ever bothers me, although I did notice it yesterday at this page: [Barack Obama Surprises Josh Earnest at Final Press Briefing | TIME](http://time.com/4636826/president-obama-surprise-josh-earnest-final-briefing/) > [@](#): > > White House Press Secretary Josh Earnest held his final White House press briefing on Tuesday, an occasion that warranted a drop-in by the commander-in-chief. > > Shortly after Earnest took the podium in the James Brady Press Briefing Room at the … I copied this excerpt from Firefox; Chrome does not let me copy this page (although it does for other [time.com](http://time.com) pages). In the Chrome version, BRIEFING and SHORTLY (and another BRIEFING and an IMPORTANT further down the page) are in all-caps underlined with a green icon and a link pointing to [adnetworkperformance.com](http://adnetworkperformance.com). (I’ve taken a screenshot which I’ll email on request, but the links are very blatant – you can’t miss them.) There is another very different symptom coming from, I think, the same malware — “pop-under” ads, if that’s the right term. I’ve seen these malware-induced problems at 3 or 4 sites, _including SDMB_. IIRC, once I even saw the funny green-icon links in an SDMB post. For some reason (purging all my Chrome cookies and history?) my problem has almost disappeared; the [time.com](http://time.com) page is the only episode in several days. Perhaps this is OP’s problem. The SDMB ads are not themselves corrupt, but something at SDMB fits a pattern that this other malware can exploit. ---
**Author:** ![aldiboronti](https://avatars.discourse-cdn.com/v4/letter/a/9fc348/32.png) [@aldiboronti](https://boards.straightdope.com/u/aldiboronti)\ **Post date:** [January 19, 2017, 1:26pm UTC](https://boards.straightdope.com/t/you-are-distributing-malware/777205/46 "2017-01-19T13:26:07Z")
> [@DoperChic](#): > > The Dope used to be my favorite site, but I’m about to abandon ship altogether if I can’t even read without obnoxious pop-ups and fear of malware. I’m sorry, I find this hard to understand. Why not use an Adblocker and continue to enjoy the site? Unless, of course, for some reason you are unable to use one and then I would understand your position. ---
**Author:** ![Johnny\_Bravo](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/johnny_bravo/32/493_2.png) [@Johnny\_Bravo](https://boards.straightdope.com/u/Johnny_Bravo)\ **Post date:** [January 19, 2017, 2:02pm UTC](https://boards.straightdope.com/t/you-are-distributing-malware/777205/47 "2017-01-19T14:02:00Z")
> [@aldiboronti](#): > > You may think it a simple matter. It isn’t. [Here’s a recent article](http://www.pcworld.com/article/3039816/security/malvertising-campaigns-are-becoming-harder-to-detect.html) from a senior security researcher with Malwarebytes. It shows just how difficult it can be for even the experts to detect malware in an ad. > > I repeat, all ad providers are prey to this. None can guarantee no infected ads. Then why is the SDMB the only site in my rotation that made me switch to a different mobile browser? For **years** , literally since mobile browsing was a thing, I have tolerated ads on my phone even when using adblockers at home. This site is the **only one** that has consistently hijacked me. Certainly they’re not the only site on the universe that would hijack my phone. They’re just the only site in the universe that **I go to** that would hijack my phone, because I don’t go to shady Web sites. I refuse to believe for even a moment that the SDMB is a victim here. They’re going with shady advertisers and this is the result. I’ve never been hijacked from other sites because other sites make better choices about who they take money from. This is simple stuff. ---
**Author:** ![Jophiel](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/jophiel/32/66_2.png) [@Jophiel](https://boards.straightdope.com/u/Jophiel)\ **Post date:** [January 19, 2017, 2:06pm UTC](https://boards.straightdope.com/t/you-are-distributing-malware/777205/48 "2017-01-19T14:06:15Z")
> [@Evan\_Drake](#): > > However, more to the point: where is all the less annoying crap-free internet advertising sent by honest reputable advertising agencies ? In Wonderland ? Apparently all the other sites I visit on my phone are hosted in Wonderland because none of them send me a malware ad for a fake virus scan that locks the tab every third time I click a link. That’s a “feature” unique to the SDMB. ---
**Author:** ![Fenris](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/fenris/32/498_2.png) [@Fenris](https://boards.straightdope.com/u/Fenris)\ **Post date:** [January 19, 2017, 2:15pm UTC](https://boards.straightdope.com/t/you-are-distributing-malware/777205/49 "2017-01-19T14:15:04Z")
> [@sleestak](#): > > Well, it appears that the ‘working on a resolution’ means 'make it worse. > > Now on both of my android phones, as soon as I go to the message board the original window closes and all I get is the scary "YOUR PHONE IS INFECTED!!?!?!?!!! DOWNLOAD THIS NOW’ page that tries to download a file. This is the only site that I usually go to that is exhibiting this behavior. > > Look, it is simple. Stop the ads until you know that they are fixed. It isn’t hard. There are processes for things like this. It is called ‘testing’. Just about everyone does it. > > Then, once you know that you aren’t going to infect your users with malware, you turn the ads back on. > > Slee This also applies to iDevices ---
**Author:** ![Ed\_Zotti](https://avatars.discourse-cdn.com/v4/letter/e/fbc32d/32.png) [@Ed\_Zotti](https://boards.straightdope.com/u/Ed_Zotti)\ **Post date:** [January 19, 2017, 2:35pm UTC](https://boards.straightdope.com/t/you-are-distributing-malware/777205/50 "2017-01-19T14:35:23Z")
We acknowledge this is a problem and are trying to get to the bottom of it. As always, it’s helpful if you can provide a screen grab of the offending page, dialogue box or what have you including the URL. We apologize for the inconvenience and appreciate your patience. ---
**Author:** ![watchwolf49](https://avatars.discourse-cdn.com/v4/letter/w/e9c0ed/32.png) [@watchwolf49](https://boards.straightdope.com/u/watchwolf49)\ **Post date:** [January 19, 2017, 4:07pm UTC](https://boards.straightdope.com/t/you-are-distributing-malware/777205/51 "2017-01-19T16:07:06Z")
If this helps … I run a 2011 iMac with El Capitan 10.11.6 and Firefox 50.1.0 … and Adblock … I’ve seen none of these problems … not a single one anywhere on the internet … ---
**Author:** ![Bone](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/bone/32/407_2.png) [@Bone](https://boards.straightdope.com/u/Bone)\ **Post date:** [January 19, 2017, 4:33pm UTC](https://boards.straightdope.com/t/you-are-distributing-malware/777205/52 "2017-01-19T16:33:30Z")
As an update, we believe we’ve now isolated one cause of the redirects. Please let us know if you see this continuing and if so, the underlying details if possible. Most of the issue were with mobile browsing so platform, browser, etc. are useful information. ---
**Author:** ![Jophiel](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/jophiel/32/66_2.png) [@Jophiel](https://boards.straightdope.com/u/Jophiel)\ **Post date:** [January 19, 2017, 5:16pm UTC](https://boards.straightdope.com/t/you-are-distributing-malware/777205/53 "2017-01-19T17:16:52Z")
Just got it again. Using a LeEco Pro 3 with Chrome browser. Chrome 55.0.2883.91 Android 6.01 [Screenshot of ad](http://imgur.com/a/NQRfx) The url is hidden but it is us.26g\*\*\*\*\*45oji.pw/ymaxmqmy/index (remove asterisks) with a trailer indicating my phone make and model. ---
**Author:** ![Bone](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/bone/32/407_2.png) [@Bone](https://boards.straightdope.com/u/Bone)\ **Post date:** [January 19, 2017, 5:36pm UTC](https://boards.straightdope.com/t/you-are-distributing-malware/777205/54 "2017-01-19T17:36:33Z")
I’m sorry to hear that - I’ll forward to the appropriate folks. ---
**Author:** ![Jophiel](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/jophiel/32/66_2.png) [@Jophiel](https://boards.straightdope.com/u/Jophiel)\ **Post date:** [January 19, 2017, 5:53pm UTC](https://boards.straightdope.com/t/you-are-distributing-malware/777205/55 "2017-01-19T17:53:19Z")
Here is what [the initial pop-up](http://i.imgur.com/8s4ALKv.jpg) looks like. You have to hit Ok then you get the [second screen](http://i.imgur.com/MAw5XrO.jpg) with the product link. You can’t hit Back or otherwise return to the SDMB – you have to close the tab and open a new one. ---
**Author:** ![nightshadea](https://avatars.discourse-cdn.com/v4/letter/n/7ba0ec/32.png) [@nightshadea](https://boards.straightdope.com/u/nightshadea)\ **Post date:** [January 19, 2017, 7:08pm UTC](https://boards.straightdope.com/t/you-are-distributing-malware/777205/56 "2017-01-19T19:08:44Z")
oh ive seen those pages before because one of my card payment places has a odd name and if you misspell the name it takes ya to a place full of ads and then that pops up all ya have to do is keep clicking leave and and eventually ms edge will have a "quit letting this page make more "option and you can close it I don’t know about chrome nothings actually installed tho and its probably a hijacked page /address …most of the time unless someone tells the ad place they don’t know about it ---
**Author:** ![TBG](https://avatars.discourse-cdn.com/v4/letter/t/c89c15/32.png) [@TBG](https://boards.straightdope.com/u/TBG)\ **Post date:** [January 19, 2017, 8:01pm UTC](https://boards.straightdope.com/t/you-are-distributing-malware/777205/57 "2017-01-19T20:01:29Z")
> [@watchwolf49](#): > > If this helps … I run a 2011 iMac with El Capitan 10.11.6 and Firefox 50.1.0 … and Adblock … > > I’ve seen none of these problems … not a single one anywhere on the internet … Same, but across many Win versions and browsers. Adblocking is as, if not more, important as an antivirus these days. ---
**Author:** ![gaffa](https://avatars.discourse-cdn.com/v4/letter/g/e68b1a/32.png) [@gaffa](https://boards.straightdope.com/u/gaffa)\ **Post date:** [January 19, 2017, 8:50pm UTC](https://boards.straightdope.com/t/you-are-distributing-malware/777205/58 "2017-01-19T20:50:06Z")
Yeah, just popped up again. Very annoying. ---
**Author:** ![Barkis\_is\_Willin](https://avatars.discourse-cdn.com/v4/letter/b/a183cd/32.png) [@Barkis\_is\_Willin](https://boards.straightdope.com/u/Barkis_is_Willin)\ **Post date:** [January 19, 2017, 10:54pm UTC](https://boards.straightdope.com/t/you-are-distributing-malware/777205/59 "2017-01-19T22:54:06Z")
Viewing on my phone has been a real challenge. Keep getting directed to a screen that says I have “Four virus.” ---
**Author:** ![raventhief](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/raventhief/32/4_2.png) [@raventhief](https://boards.straightdope.com/u/raventhief)\ **Post date:** [January 19, 2017, 11:01pm UTC](https://boards.straightdope.com/t/you-are-distributing-malware/777205/60 "2017-01-19T23:01:57Z")
The hijack says to install Avira but that is not what it takes you to in the store. That antivirus seems to change. It’s been at least two different products, one a booster and one an antivirus in the store. I will update when inevitably hijacks again. ---
**Author:** ![TroutMan](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/troutman/32/6721_2.png) [@TroutMan](https://boards.straightdope.com/u/TroutMan)\ **Post date:** [January 19, 2017, 11:02pm UTC](https://boards.straightdope.com/t/you-are-distributing-malware/777205/61 "2017-01-19T23:02:04Z")
I’m getting it on my Android phone. I opened four windows viewing threads, and three of them were hijacked. Two were the screen shots that Jophiel posted in #54, and one was [this](http://imgur.com/a/JFfQy) with the page behind it in Ukrainian. [Previous page](https://boards.straightdope.com/t/you-are-distributing-malware/777205.md?page=2) [Next page](https://boards.straightdope.com/t/you-are-distributing-malware/777205.md?page=4)