PC Accelerate Pro virus "Upgrade Flash Player" virus pop-up during registration process.

Technical Details

Forum version : #phpBB3
Position : Founder
Concerned browser(s) : Mozilla Firefox, Google Chrome, Safari
Who the problem concerns : All members
When the problem appeared : It happened to me and to someone else signing up during registration process
Forum link : ( link is hidden, you must reply to see )

Description of problem

During the registration process of a separate non-founder account for myself on my forum, I noticed a pop-up window appeared in my Safari (mac) browser telling me I needed to upgrade my Adobe Flash Player. I did not discover this pop-up until later in my session and so did not connect it to the registration process for my forum.

Today I received the following message after someone I invited to join the forum went through the registration process yesterday (Aug 16, 2017). He is on a PC so I am not sure which browser he is using, but it is not Safari:

" I followed these [registration] steps and want to warn people that I got a malware virus. There is a pop-up that is difficult to discern between the registration process (as it asks you to update your Flash information before continuing, but actually installs a PC Accelerate Pro virus. I have cleaned it off my system, but let people know to NOT choose the "Upgrade Flash Player" option. Also, if anyone has gotten the virus, let me know and I will send instructions on how to clean it. I work in the computer security industry and even I got hit, so I imagine others will get hit as well. Fortunately, I also know how to recognize these things and how to clean them."

I can verify that this man is indeed a computer security expert, so his message is entirely credible. If you want more information, let me know exactly what you want me to ask him for.

I need you folks to check my forum's registration process for this virus. I have paid to turn off ads *within* my forum, but I note that there is an ad that appears on both the login and registration pages. I believe that ad area was the source of the problem. THEREFORE, I suggest that the quickest way to eliminate this problem is to entirely remove that ad area and any ads on both of these two pages immediately, at least for my forum and probably for all forums. I think that that is the quickest way to eliminate this periodic threat, and I officially request that you do this at least for my forum. I cannot risk asking more people to register if some proportion of them are likely to be exposed to this virus threat through the ad area on these two pages and when I have already paid to remove ads from within my forum. I will even pay you to eliminate these ad areas, if you will let me know how to do that. :-)

Thank you!

Steve

Do you mean these?

https://help.forumotion.com/t147997-only-topic-malicious-inappropriate-ads

https://help.forumotion.com/t145609-only-topic-ads-redirection-mobile-pc

SLGray, thank you for your reply. I've looked at your two articles and believe the first article on malicious ads is the one that applies. I will forward that article to my registrant and see if he can pick up any info for us.

As it happened, I was reading other sites after creating my first post entry in this topic earlier today and lo and behold got a similar pop-up. I was able to harvest one URL from that "Upgrade Flash Player" ad pop-up. I am adding the url here but have left off the "http://" beginning and have put quotes around it, which I hope will deactivate it. I hope that's OK with you: "testpconly12.videosearchingtoupdates.website./dl.php?pcl=xWuiuCDxz9dTIs-FDZ_YFdLQHXkCatUxvUcSwylPheI.&cid=1502985544110935115035873208981597&pubid=1242764&conversion_id=15029861052802&app_id=100&lp_id=1972&v=revmacnew&stub_name=1585&v_id=dnFtI_rLD72x3dxjf44A6vX4H_qVhXC6liVbpxfcsks.&lpp=%2A-%2A-%2A"

Perhaps you can tune your software to cull out any ads that load that URL.

Before I had a chance to take a screen-shot of the window itself, I lost the window, and when I went back and attempted to reload it, the window showed as blank and was titled "about:blank". The ad appears to check to see if the computer is a Mac and stops, while for a Windows machine it would go ahead (as it did on my registrant's Windows machine yesterday) once someone clicked on the right button in the ad.

When I went back to the site from which I believe I got this pop-up, and went through the same actions that triggered the pop-up the first time, nothing happened. I believe that ad did not load onto the page that second time.

The first time I was at that site, when I clicked to go off the site to another site, the pop-up flickered in front and then went immediately into the background, but this time I knew enough to go looking for it right away, and there it was behind my other browser windows. That is when I was able to harvest the URL I gave you above.

Is there any way that I can turn off or get you to turn off the ad areas on the login page and registration pages, as I have paid to do within my forum?

Meanwhile, I will see if my registrant can give us any other information.

Thank you again, SLGray. I do appreciate the help on this.

Steve

It would be best if you post your information in that other topic. Forumotion uses third-party ad providers.

OK, I will move my two posts there. I would point out, though, that this whole problem would be ended for my forum if you folks would simply remove the ad service on the login and registration pages. I have paid to remove ads from my site. Other founders may or may not be paying to remove ads on their sites, a choice that is entirely up to them. If a founder wishes to leave his or her site with ads inside the site, that is their choice. I have chosen not to have ads on my site and am perfectly content to pay the entirely reasonable price Forumotion asks in order to remove those internal ads. However, I still have the ads on the login and registration pages despite my payment, and my users are still subjected to risks I have paid to eliminate. I think you can see how that might disturb me, and as far as I know, I can't add an announcement to the main login page to let people know about this problem and help keep them safe. So please consider my recommendation that you folks allow ads only inside forums that do not pay to remove ads and keep ads off your login and registration pages. Now I will move my two posts to the other topic. Thank you for your help, SLGray. I do appreciate it.

Actually, SLGray, having read that topic through, I have decided to drop my pursuit of this problem. I know it's a general problem on the internet, and I can handle this in my registration invitation, though of course I don't want to have to do that. I will also make sure that I maintain my subscription fee to turn off ads inside my forum.

However, I will briefly reiterate my suggestion in the post I published immediately above, that you folks should limit this problem to people who do not pay to turn off ads on their Forumotion sites, and that means you would need to turn off ad placement on Forumotion's login and registration pages. I doubt that would cost you much revenue, and it would save everyone like me a lot of potential trouble. However, I understand that Forumotion is your site and not mine, and you can serve ads on those pages if you wish. I just think it's a bad idea. Thanks for your help today, and I hope you and your colleagues will seriously consider my recommendation.

Hello,

May we close this topic then?

The reason our head office wont turn off ads anywhere on any site is 2 reasons, 1. Is obviously the potential loss of revenue and 2. We need the ads to be on in order to find the problem ads and get them taken down by our ad partners.

-Brandon

Brandon_g, I find your reasons a little weird. Yes, I understand that there would be a loss of revenue. I would be delighted to pay to remove ads from the login and registration pages in front of my site. I've already paid to turn off ads within my forum and found that fee reasonable, and turning off ads on these two pages at the front end of my forum would *hugely* reduce my hassle and worry about my members getting whacked with a virus if they click on the wrong place. Many of them are not very literate in terms of tech. I don't want them frequently harassed by these malicious pop-ups. I myself have been hit by them about 5% of my logins over the past 10 days or so. That's an enormously high rate. Far higher than any other site I visit on the web. It's so high that I am seeking a different forum site as we e-speak here. I don't want to go elsewhere. Forumotion has all the features I need at entirely reasonable prices, but at least half of my test registrants have seen this "Upgrade Flash Player" virus ad. *Half*! The rate of malicious ads on your registration page appears to be even higher than on your login page. One woman couldn't get on at all to register, because her antivirus software or browser software completely blocked her access to the registration page, labeling Forumotion a malicious site. I'm quite concerned that I might get my whole member set registered (with difficulty, as you can imagine), only to find some of their AV protection simply blacklisting your site completely. And then where am I, with a bunch of my members unable to get on at all?

I realize you folks need to make money to support your many laudable and appreciated efforts. However, I will bet that if you were to remove the ad service just on your registration page, that you would have more business and more members and lower support costs. I've just started my forum here, so if I'm going to move at all, I need to move now. I've got 100-200 members to bring on board, not a lot by your standards but a lot by mine, particularly if I have to handle dozens to possibly hundreds of emails from scared members or potential members who panic when they see a virus-carrying pop-up or worse yet, click on it and have to spend days getting their PC cleaned at substantial cost. It's a nightmare for them and a nightmare for me. All because you folks won't let me pay you to remove the ads from the registration page and login page that serve my specific forum.

If I were running Forumotion, security for my forum founders and their forum members would be absolutely top priority. From what I have seen in looking through the various ad-related threads, security lies below new features in priority. This is just seriously short-sighted on the part of your management. Make the absolute suppression of malicious ads a new feature, then, and sell your forum services to more people because you have a deep commitment to security first. It's a big selling point for me now, given the poor experience my members and I have had since starting up just 10 days ago.

Thus my dilemma. Your services cover all my needs. Your forums are easy to use both at my level and for the members I have. I don't want to move. Yet I must, because you folks need to serve ads on my login and registration pages to earn a little bit of money from me and don't care enough to get a capable ad-serving company which will screen this malicious stuff out before it even gets to your site or my forum. All I can say is that (1) you folks really need to rethink your priorities, and (2) I hope I can find a site like yours that does care enough about security that I can actually do my work without endangering my members.

I would appreciate it if you would keep this thread open for a few more days. I will watch it for any further comments you may post here to let me know if you folks have decided to make something good happen for my forum. Meanwhile, I will see if I can find another forum hosting company that has your features and also cares about security at a high enough priority to assure my members won't risk getting hacked every other time they try to register. Be assured that I am not angry at you folks, but I am sad such a potentially excellent site has such a terrible flaw.

Hello I see you have just posted that you have just made your forum with us the popup ad would have gone away after you have posted some and you have more members posting.
The popup ad's was only made to work for a set time until your forum was used more.

I understand this popup is a pain in the BUTT and I would also like to see it removed also.
I think what Brandon was saying is that we have to use ad's to pay for our free hosting service not that we have to use bad popup's to do it.


Now as for the problem popup that comes in on registration well that is not our system and we work hard with you the members to find that URL and codes used so we can block them and tell our ad's providers of them.

Now not all forums get the same thing as I know I have 3 forums hosted with forumotion and I have never seen this ad on my site but I have seen it on other sites not even hosted with forumotion.

Posting in the other thread will help out tech team and head office get this fixed as long as we have all the data asked of by the team.

APE, thank you for your generous comment to my frustrated one. :-)

I have 9 people including me signed up and 15 messages posted. However, I still see an ad being served on my forum's login and registration pages. Fortunately, today, I repeatedly loaded the Accept page and found only normal ads displaying as a banner on the page, no Media-Clic shark fin.

Are you saying that only banner ads will be served from now on and no possibility of a malicious ad that triggers a pop-up hack window? Or are you saying that once we have a certain number of people and messages, the banner ad on my forum's login and registration pages will vanish completely? I would greatly appreciate it if you could give me exact data on how many people and messages I need on my forum and what will happen to these ads once I reach that point. Do they change somehow or do they disappear from these pages, never to return?

If I see that malicious ad again I will try to get a screenshot of the window. I have already put into a message above the 'testpconly' URL for that window, but I have no clue how to get a code or some way to figure out which ad it really was that spawned that pop-up window. Yes, I have seen this malicious ad elsewhere, but only once or twice, never as frequently as here.

I'm *totally* fine with you folks using ads to make money. I am totally *not* fine with serving pop-up ads with malicious virus injectors in them! :-D If I pay to remove ads from my forum, that fee should be enough to cover the removal of the ads on my forum's login and registration pages, too, especially given management's pain-in-the-BUTT(!) policy on this.

So my final question is, has my site gotten busy enough to remove the pop-up issue from our login and registration pages, or do I need to put in more members and more messages so that hurdle can be jumped over and left behind?

And thank you again for your help, APE. I do appreciate it, especially because it seems that I may be able to stay with this forum after all, based on what you've said. So: have I jumped the hurdle already?

When your forum becomes more active, the ads will disappear. When the activity decreases, the ads will re-appear. Your forum needs to have activity (posting) everyday.

SLGray, thank you! Finally, at long last, I understand. Truly, I wish this were made clear up front. We all could have saved a huge amount of time and for me, angst. Perhaps you folks could add an explanation of this in the section in ACP > Misc where people like me pay credits to suppress ads in the forum. I thought it meant *all* ads would be suppressed, so I was disappointed when the login page and registration pages still had ads. OK. All right. I get it now.

Two things:

First, I want to pay a fee to turn off ads on the login and registration pages for my forum just as I already do for inside my forum. Can you folks please work out a way for me to do that?

Second, is the protocol for determining when ads on these pages are turned on or off a secret? Or can you tell me how you guys measure activity and determine when activity is sufficient each day to make the ads disappear? I would really like to know when the ads *should* turn off, to make sure they actually do turn off as required by the protocol and as activity in my forum rises due to more members and activity.

Thank you, guys. I appreciate all the help.

There is not a topic or list that explain what is determined to be enough forum activity. Forum activity is used in many different ways by Forumotion. Some examples: Forumotion offers a free domain name for a year, forum ranking in the directory, etc.

There is not an option to turn off these types of ads.

SLGray, I sort of expected that the protocol was complex. As for turning off ads on the front pages of my forum, I didn't say there was a way to turn the ads off on these pages. I said I *wish* there were and that I would happily pay the fee for that. :-)

As far as I'm concerned, I'm done with this thread. If you want to archive it, feel free. Thanks again for the help.

Have a good day stvbaker and sorry about the confusion.

Good luck with your forum as well.

-Brandon

Topic marked solved & archived ~ brandon_g Please read our forum rules: ESF General Rules