Malware on my forums for new users

Malware on my forums for new users · by demonicus May 13th 2016, 4:24 pm

Hello there,

I have noticed that new users are getting hit with malware from a malicious site liveadexchanger.com
It doesn't hit me when I am logged in to my admin account. Is there a way to get rid of this? I think its running off some of
the people that want to visit my site.

Deadlands.forumotion.com

Re: Malware on my forums for new users · by **brandon_g** May 13th 2016, 4:44 pm

Hello,

Does the problem sound like the one in this topic: https://help.forumotion.com/t147035p30-only-topic-redirecting-to-adult-site ?

If so, may you post your report in there. If not, may you pleaase provide details, how do you know their pc is getting hit with malware? Does a message appear in the browser, do the users get an alert or something from their anti virus software (if any), has malware came up in a scan? May you provide us a screenshot of any messages, alerts or warnings you or your users may get? What browser(s) do the problems occur on? If you or your users have an anti virus software, what is it?

All these details can help us figure out what exactly the problem you or your users are having and help you fix them. Wink

-Brandon

Re: Malware on my forums for new users · by demonicus May 13th 2016, 5:41 pm

Using Malwarebytes to detect
Using Microsoft Edge Browser
Also Seems to be targeting Microsoft Edge

I've logged out and went into forums as a new user to test. My Malwarebytes is blocking that malicious site any time I change the forum page. A couple times scrolling thru pages it'll actually re-direct to some random malicious site but none are Adult that I am aware of. Any feedback or help to get rid of this will be appreciated! Smile

Re: Malware on my forums for new users · by **brandon_g** May 13th 2016, 5:56 pm

Does it sound like this problem at all then? https://help.forumotion.com/t145609-only-topic-ads-redirection-mobile-pc

If not, may you post a screen shot of what malwarebytes is telling you/the message it gives you when it blocks it?

-Brandon

Re: Malware on my forums for new users · by demonicus May 13th 2016, 6:13 pm

Heres a snapshot of Malwarebytes detecting:

Malware on my forums for new users Mbwarn12

Re: Malware on my forums for new users · by **brandon_g** May 13th 2016, 6:53 pm

Hhmm... Does this happen only when you are re directed away from your forum, or does it happen when you visit the forum and are browsing around and stuff.

One thing you can try is whitelisting your forum in Malwarebytes so that it shouldnt mistakenly target your forum (which is safe and secure) and see if it helps. If it only happens on a re direct, then I am not sure. If it happens on a re direct and/or whitelisting your forum doesnt work, try asking other users/members (if you have any) if they get the problem. If they do, then it may be a problem on our end, if they dont, then it might be on your end.

You could also try using a different browser and/or device to see if the problem occurs on the other browsers or devices as well.

Try those 2 things above and if neither work and it keeps occuring try asking any members you may have they experience the issue as well. If they expereince it as well and all else failed, report back here and I will see if it needs to be reported or not.

-Brandon

Re: Malware on my forums for new users · by Norton May 15th 2016, 7:29 pm

I asked for help here (another post) same problem redirects caused by the installation of Chromium and liveadexchanger that seem to have come bundled with Windows 10 upgrade all attempts failed, it even changed my home page and default browser to chromium. I uninstalled Chromium browser, but had great difficulty with liveadexchanger. I eventually contacted Malwarebytes Support and they assisted me in getting rid of it.
They had me download some of their to identify the threats and finally I believe they had me download Adaware from Toolslib. which did identify liveadexchanger and eliminated the redirects. I believe the liveadexchanger bypasses your antivirus programs and also mabam during the installation of Win 10.

Demonicus what you describe is exactly the same issues I was experiencing.

Re: Malware on my forums for new users · by **Shadow** May 17th 2016, 12:11 pm

Hello,

The liveadexchanger.com domain refers to the advertising code of one of our providers. This service is called under certain conditions at the banners at the top and bottom of the forums. Like many advertising agencies offering advertising formats like pop-up banners in addition, it is noted as malicious by some tools.

For information, we have temporarily replaced our usual provider that generated unwanted redirects and adult ads by this new service. As soon as the situation will be resolved with the usual service, we would replace it and by thus get rid of these warnings.

We apologize for the inconvenience,

Re: Malware on my forums for new users · by **The Godfather** May 18th 2016, 3:23 pm

Hello everyone,

For your information, we will replace the domain which is flagged as malicious by a new one (which isn't flagged as malicious) tomorrow morning. So normally alerts will disappear for you and your members.

I will keep you in touch when it will be online Malware on my forums for new users 1f609

Malware on my forums for new users 1f609

We apologize for any inconvenience to you and your community.

Re: Malware on my forums for new users · by Shek May 18th 2016, 4:02 pm

I advise you, use the VirusTotal. I did a scan, and there was no virus alerts: https://www.virustotal.com/pt/url/2be9db2f41fd50b5dd8d731ad402c9265110e130bae9a259e8505fa03e827081/analysis/1463580033/

Re: Malware on my forums for new users · by Norton May 18th 2016, 7:00 pm

Godfather Thanks!

Re: Malware on my forums for new users · by **The Godfather** May 19th 2016, 10:01 am

Hello,

The domain liveadexchanger.com has been replaced by a new one. Please, confirm us that Malwarebytes don't display alerts now Malware on my forums for new users 1f609

Re: Malware on my forums for new users · by Norton May 19th 2016, 3:34 pm

No more alerts here of late. Thanks again for addressing members concerns.

Re: Malware on my forums for new users · by demonicus May 19th 2016, 8:27 pm

Ok sorry for the delayed response. I did a few tests. As far as I can tell, It ONLY happens on Microsoft Edge when you are a Unregistered User, and You are flipping through the pages of the forum (This includes the home page). Mozilla seems to not get hit by it. Also the new one popping up in Malware bytes is ADCASH.COM. They do try to force a re-direct (Not all the time) to weird sites trying to trick you into "Installing" Flash cause its "Out of Date". So Far nothing Adult has been seen on my end. Let me know if this helps with anything. Also I see now that the ADCASH is the advertisement at the top of the page. When I spam reload if its caught by Malware bytes the advertisement doesnt show up. But I'm still wondering where the Re-directs are coming from.

I know the simple thing for me is to use Mozilla or stay logged in, But I am worried about new users that come and might see this as a threat and not come back.

Re: Malware on my forums for new users · by **The Godfather** May 20th 2016, 11:39 am

Hello demonicus,

Your message concerns the forum: http://deadlands.forumotion.com/ ? Do you see the Malwarebytes alerts today? If yes, could you please provide us with any screenshot?

About the redirections, do you have a "site under" redirection (it's kinf of a pop-up but the page appears behind the forum) or a forced and intempestive redirection (the page appears instead of the forum and you leave it).

Because when I visit your forum (http://deadlands.forumotion.com/), it's considered as inactive because it has 0 point. And on the inactive forums, there are site under ads. You can have more information on this link: https://help.forumotion.com/t145609p30-only-topic-ads-redirection-mobile-pc#1013320 Malware on my forums for new users 1f609

Best,

Re: Malware on my forums for new users · by demonicus May 20th 2016, 4:24 pm

Greetings Godfather,

Thanks for your response. I logged in this morning to get a screenshot of malware bytes for you but it appears that all things are running normal! I spam clicked, reloaded and tried to see if any problems would come up and none could be found. Thanks to everyone who helped with this! I will let you know if it happens in the future. Smile

Thanks again!

-d