Virus Warning Accessing This Forum

[northwichcat]

When I Google something that brings up railforums.co.uk it doesn't go directly to rail forums but to a page that brings up a phising scam

The third result here is an example of this:
http://www.google.co.uk/search?sour....,cf.osb&fp=52532cdf87ee8221&biw=1056&bih=714

 

[185]

Seen that a few times now. Avoid.

 

[SS4]

The fourth link works though. I'm guessing it's a man in the middle attack. It goes without saying you should avoid it.
--- old post above --- --- new post below ---
edit: the third link just worked when I tried it again

 

[jonb]

I noticed some strange goings on, if you just click off it without entering information is that ok?

 

[lyesbkz]

There is a thread about this on the vBulletin support forum.

Hopefully this will be of some use to somebody.

 

[dosxuk]

It's something to do with the coding of this site (or VBB), not Google. Something is inserting some obfusicated javascript into the page when you come from a Google search which redirects you to *******4.info.

 

[fairysdad]

This happened to my site a while ago - admins: check the .htaccess file to see if anything untoward has happened in there...

 

[Jordy]

We are aware of this situation and are investigating. I recommend downloading Web of Trust (free) or similar which will prevent you from being forwarded to dodgy sites and provide a handy rating next to links.

 

[MidnightFlyer]

No problems this end.

 

[WestCoast]

Yes, I noticed that earlier today - I thought it was my laptop but the same happened on another PC.

 

[yorkie]

Is it happening to anyone now? It happened to me earlier, around 1700ish, but seems fine now.

 

[causton]

From the thread linked to in post #5, it seems to do it the first time you visit the site, then doesn't do it again (as I have experienced) - and also provides some code that seems like it would fix it!

 

[Ivo]

Works OK for me now, yes. I came across the same problem after reading about it here.

 

[Xenophon PCDGS]

I have always kept this website in my "favourites" and never had any problems, as all sites put in there are fully scanned prior to this happening.

 

[causton]

Works OK for me now, yes. I came across the same problem after reading about it here.

Same - works fine now for me eventually

 

[Statto]

Clicking on to this forum just now & i got an Virus warning, i've deleted a bit of offending the URL[so no one can accidentally click it] but kept most of it so you can id it.

Danger: Surf-Shield has detected active threats on this page and has blocked access for your protection.
The page you are trying to access has been identified as a known exploit, phishing, or social engineering web site and therefore has been blocked for your safety. Without protection, such as that in the AVG Security Toolbar and AVG, your computer is at risk of being compromised, corrupted or having your identity stolen. Please follow one of the suggestions below to continue.

URL: vertu.dnsrd.com/main.php?page=8acda6cde6
Name: Blackhole Exploit Kit (type 2111)

 

[First class]

I keep getting a message telling me I'm not allowed to view this site unless I disable Adblock, (which I don't even have installed!)

 

[sprinterguy]

I presume that it will have something to do with this?
http://www.railforums.co.uk/showthread.php?t=59782

 

[chris89]

Just accessed via Fav's on here a few moments ago and got the same error from AVG as well. Via Firefox.

Chris

 

[Anon Mouse]

I just switched on my computer an hour ago and Norton told me it had blocked an attack by a Blackhole Exploit Kit. So Full System scan in process which so far has identified 16 risks

 

[90019]

I noticed that Malwarebytes has said it's blocked a couple of things on here today, but I assumed it was just adverts it had blocked.

 

[Mike395]

Just to confirm - the forum team are aware of the issue, and are in the process of contacting the relevant people in order to get this fixed. I advise that everyone ensures their antivirus software is up-to-date in the meantime, and we would welcome any further reports in this thread or the other one that is currently running concurrently.

 

[flymo]

FYI, just had a similar occurence accessing via bookmarks.

Screenie attached for info if that is OK, please delete if not.

 

[sonic2009]

I don't know whether this is related but when i look at the Doncaster to Aberdeen thread in FTR my mobile app forces RailUk to close stating build 937 vbulletin.

 

[SS4]

Just to confirm - the forum team are aware of the issue, and are in the process of contacting the relevant people in order to get this fixed. I advise that everyone ensures their antivirus software is up-to-date in the meantime, and we would welcome any further reports in this thread or the other one that is currently running concurrently.

It could very well be a malicious script so if you turn off scripting (or use noscript) then it may help

 

[Crossover]

I have just had it as welll - not from bookmarks but the address was in history, not related to Google or such in any way. Didn't quite catch what the address was but I will try and dig it out from the server shortly and post it if I get chance

 

[Galvanize]

I got a warning of a malicious Phishing URL at about 12:30 today, when I logged in to post a trip report I'd written! Just to be on the safe side, I'm running a FULL scan!!

 

[Crossover]

On checking, ESET on the PC I am using just blocked the website, so no quarantine logs as no threat was downloaded

 

[Ivo]

See below for the message I got. As with the Google problem though, it only came up the first time!

Running an emergency scan at present. 1.25 million objects so far and nothing - I'll update when done...

 

[MidnightFlyer]

Not had a thing so far Still running a full scan anyway, but it looks totally fine from where I am. McAfee Site report still shows up as being fine, though it does say that RailUK are based in America...