Forum generates malicious websites on the login page

[Khadijah]

Technical Details

Forum version : #phpBB2
Position : Founder
Concerned browser(s) : Google Chrome
Who the problem concerns : Yourself
When the problem appeared : After I have to login
Forum link : ( link is hidden, you must reply to see )

Description of problem

Hello,

Today I have been surprised when I had to log in ( once in a while we have to login also when whe select rember me ). But today when hit login the login generates a malicious website on the run lucky was blocked by Malwarebytes Antimalware since I have a premium version running but when you are not so lucky you are sure opening unwanted websites or even you can be infected. In these days you can not be sure what can happen. So I was not pleased.

here are the lines out of my rapport of the malwarbytes log. I hope you will take care such things will not be in any of the logins so whe can be infected of whatever by using the forums. thank you. With regards

Khadijah

Detection, 1-6-2016 12:33, SYSTEM, KHADIJAHDESK, Protection, Malicious Website Protection, Domain, 104.154.36.143, www.adcash.com, 61552, Outbound, C:\Program Files (x86)\Google\Chrome\Application\chrome.exe,
Detection, 1-6-2016 12:33, SYSTEM, KHADIJAHDESK, Protection, Malicious Website Protection, Domain, 104.154.36.143, www.adcash.com, 61552, Outbound, C:\Program Files (x86)\Google\Chrome\Application\chrome.exe,
Detection, 1-6-2016 12:33, SYSTEM, KHADIJAHDESK, Protection, Malicious Website Protection, Domain, 104.154.36.143, www.adcash.com, 61553, Outbound, C:\Program Files (x86)\Google\Chrome\Application\chrome.exe,

[Ange Tuteur]

Hi @Khadijah,

The warning appears to be coming from Forumotion's ad services, as I recall reporting a number of deceptive ads from adcash.com. That is most likely the reason why it's considered malicious by your anti-malware programs. I doubt Forumotion will do anything about it, but as long as you don't click these adverts your computer should be fine. My advice is to not trust advertisers that allow deceptive methods of advertising.

[Khadijah]

I did not click on the adverts I click on the login button that's sneaky imho lucky for me this is blocked but when not those are nasty ok I think it is not nice hide it under the login button to click, you have to click on it at least once in a period when you are always logged in so.

[SLGray]

Is your issue similar to this one:  https://help.forumotion.com/t145609-only-topic-ads-redirection-mobile-pc ?

[brandon_g]

I did not click on the adverts I click on the login button that's sneaky imho lucky for me this is blocked but when not those are nasty ok I think it is not nice hide it under the login button to click, you have to click on it at least once in a period when you are always logged in so.

It is not hidden under the login button. The deceptive ads ange refers to are in total different areas of your forum. The reason your malwarebytes probably went off anyway even though you didnt click the ads is because the url adscash.com will come up as your browser is loading a page on your forum because thats what your browser does. I think what happened was that your malwarebytes detected the url adscash.com as your browser was loading it among every other little background url that your browser loads up when it loads a page and when it detected your browser loading adscash.com for that millisecond it takes, it triggered that warning and blocked it.

Your device was not, however, probably in any real danger, your anti virus program just jumped into action anyway when it noticed something on its hit list, which I suppose is good.

I just wanted to put that out there. Forumotion does not place deceptive ads under your login button for users to hit without having a choice. Just wanted to make that much clear.

Have a good day, hope this can be resolved soon as well.

-Brandon

[Khadijah]

I don't think adcash is something you should wish on the forums to refer it is bad I checked on Virustotal as well and it is also not for nothing Malwarebytes block the website. It should not be exposed to members of the forums , #justsaying