Page 3 of 7

This forum been hacked?

Posted: Sat Dec 30, 2017 6:18 pm
by dhobbs
I had this problem too, but as I said only with chrome.
I reinstalled chrome, downloaded malwarebytes, avast antivirus and all clear.
Even a hard reset didn't make much difference.
Advice was to reset your advertising id, but that didn't work.
Only going to Firefox worked for me.

I would personally like to know how the redirect works and whether it's a site or a browser issue.
Mine started when using photobucket, but eventually progressed to all sites.

This forum been hacked?

Posted: Sat Dec 30, 2017 8:26 pm
by Tcochrane92
Just got this.

Link it took me to was this:

http://secure.kingmonology.info/swp/uk/ ... 2KL00IOA00

And got this message:
SmartSelectImage_2017-12-30-19-24-44.png
SmartSelectImage_2017-12-30-19-24-44.png (116.38 KiB) Viewed 3049 times
Hope that helps

This forum been hacked?

Posted: Sat Dec 30, 2017 8:32 pm
by sp3ctre
What part of the forum were you on at the time? Did it appear when you were on a page or when you clicked a link?

This forum been hacked?

Posted: Sat Dec 30, 2017 8:34 pm
by Tcochrane92
sp3ctre wrote: Sat Dec 30, 2017 8:32 pmWhat part of the forum were you on at the time? Did it appear when you were on a page or when you clicked a link?
I loaded the New Posts page directly from a Bookmark saved on my phone (didn't navigate there from Z4 homepage)

This forum been hacked?

Posted: Sat Dec 30, 2017 8:35 pm
by sp3ctre
Tcochrane92 wrote: Sat Dec 30, 2017 8:34 pm
sp3ctre wrote: Sat Dec 30, 2017 8:32 pmWhat part of the forum were you on at the time? Did it appear when you were on a page or when you clicked a link?
I loaded the New Posts page directly from a Bookmark saved on my phone (didn't navigate there from Z4 homepage)
Interesting... can you replicate it every time?

This forum been hacked?

Posted: Sat Dec 30, 2017 8:37 pm
by Tcochrane92
sp3ctre wrote: Sat Dec 30, 2017 8:35 pm
Tcochrane92 wrote: Sat Dec 30, 2017 8:34 pm
sp3ctre wrote: Sat Dec 30, 2017 8:32 pmWhat part of the forum were you on at the time? Did it appear when you were on a page or when you clicked a link?
I loaded the New Posts page directly from a Bookmark saved on my phone (didn't navigate there from Z4 homepage)
Interesting... can you replicate it every time?
No, it seems to be random. Maybe one in every twenty times?

This forum been hacked?

Posted: Sat Dec 30, 2017 9:08 pm
by Tcochrane92
Now I'm getting this error message:
SmartSelectImage_2017-12-30-20-02-10.png
Only get error messages and adverts like that on this webpage

This forum been hacked?

Posted: Sat Dec 30, 2017 9:08 pm
by Tcochrane92
Now I'm getting this error message:
SmartSelectImage_2017-12-30-20-02-10.png
SmartSelectImage_2017-12-30-20-02-10.png (99.69 KiB) Viewed 3037 times
Only get error messages and adverts like that on this webpage

This forum been hacked?

Posted: Sat Dec 30, 2017 9:19 pm
by Buckz
Tcochrane92 wrote: Sat Dec 30, 2017 8:34 pm
sp3ctre wrote: Sat Dec 30, 2017 8:32 pmWhat part of the forum were you on at the time? Did it appear when you were on a page or when you clicked a link?
I loaded the New Posts page directly from a Bookmark saved on my phone (didn't navigate there from Z4 homepage)
Same here, I have a bookmark for new posts and thats how I get to the forum, wouldn't surprise me if it's that link only.

This forum been hacked?

Posted: Sat Dec 30, 2017 9:23 pm
by sp3ctre
Tcochrane92 wrote: Sat Dec 30, 2017 9:17 pmNow I'm getting this error message:
Don't worry about that, that was my fault... oops!

Worth removing those bookmarks and setting them up again? Seems to be a common theme.

This forum been hacked?

Posted: Mon Jan 01, 2018 3:40 pm
by greg81
Tcochrane92 wrote: Sat Dec 30, 2017 8:26 pmJust got this.

Link it took me to was this:

http://secure.kingmonology.info/swp/uk/ ... 2KL00IOA00

And got this message:
SmartSelectImage_2017-12-30-19-24-44.png

Hope that helps
I'm also getting this one, plus the Asda gift card one. Only on this forum and also installed avast.and everything clear on my phone.

Chrome on Android. No particular areas of the forum and it's very random when it happens. Don't get this on any other websites

This forum been hacked?

Posted: Mon Jan 01, 2018 4:13 pm
by sp3ctre
I have never used Android so I'm not sure what is possible, but is it possible to get a "page source" of the page where the popup originates from (the new posts screen, it seems)? I can't find any reference to these sites in the code, and I cannot replicate it on Windows, Mac OS or IOS.

This forum been hacked?

Posted: Mon Jan 01, 2018 5:20 pm
by greg81
Sure, I'll hook up to the android SDK next time I get it and see what info I can get

This forum been hacked?

Posted: Mon Jan 01, 2018 5:24 pm
by sp3ctre
greg81 wrote: Mon Jan 01, 2018 5:20 pmSure, I'll hook up to the android SDK next time I get it and see what info I can get
Appreciated. Difficult to diagnose when I don’t have access to the platform.

This forum been hacked?

Posted: Wed Jan 03, 2018 9:46 pm
by greg81
Funnily enough I've not seen this in the past few days. May well be related to the ssl cert you've installed. Will keep an eye on it still