# Malware pop up!



## MikeAndrews

I got a pop-up message: "Are you sure you want to navigate away from this page and not chat with girls?" when I clicked on a thread.

This is with Chrome on Mac OS (with Ghostery blocking ads!)

I could come from another tab except it was a click here that triggered the pop up.

Methinks an ad server has some baddies on it.


----------



## hbtaylor

netringer said:


> I got a pop-up message: "Are you sure you want to navigate away from this page and not chat with girls?" when I clicked on a thread.
> 
> This is with Chrome on Mac OS (with Ghostery blocking ads!)
> 
> I could come from another tab except it was click here that triggered the pop up.
> 
> Methinks an ad server has some baddies on it.


I got the same thing. Went away after a refresh, but if it is a bad ad it might re-appear.


----------



## CatScratchFever

Check out the girls, you won't be sorry you did!

then let us know what you find!


----------



## JustAllie

I just saw the same pop-up.


----------



## supasta

I got it this morning.


----------



## dthmj

I got it this morning and this afternoon - I looked this morning for a thread here and there wasn't one - so I started one in HH to see if maybe it was just me...

I turned ads on and saw this ad on the right hand side - could this be it?


----------



## Mike Lang

Same as here...

http://www.tivocommunity.com/tivo-vb/showthread.php?t=498982


----------



## dthmj

Yeah - so much for the "family friendly" forum. Perhaps the site owners should remove that ad stream.


----------



## pianoman

Also just got the same popup. Not happy.


----------



## Unbeliever

I leave adblock plus off here, but use RemoveItPermanently on their subframes so that their frames/elements aren't displayed.

The ads still get fetched, but RIP keeps them from rendering on screen. Unfortunately, because the ads are still fetched, the JS in them still runs and I got the "You're trying to leave this page" JS popup a few times this morning.

Edit: If TCF doesn't screen their ads, I'll turn ABP back on.

--Carlos "Full width/height TCF" V.


----------



## justen_m

I haven't seen it either. Maybe because I've used ABP to remove a bunch of the subframes on this site that have advertising.

TCF gods, I DO have the ABP option of "Allow some non-intrusive advertising" enabled. Maybe you could just find some advertising that fits the bill? Like, TEXT ONLY and NO STUPID SEX ADS.


----------



## Gunnyman

I got it just Now on Safari with ad block enabled


----------



## Peter Redmer

Thanks everyone for the heads up--this is definitely not intended and we'll get rid of it ASAP, although I'm not sure exactly where (or from which server/company) it's coming from.

I'll pop back in once we stomp it out.


----------



## Peter Redmer

Also -- please PM me with any URL's that you see loading in your browser. I'm seeing a few in IE on the computer I'm on now (not at home or in office) but anything will be helpful, so we can add them to restriction lists on our ad serving companies and what not.


----------



## unitron

dthmj said:


> I got it this morning and this afternoon - I looked this morning for a thread here and there wasn't one - so I started one in HH to see if maybe it was just me...
> 
> I turned ads on and saw this ad on the right hand side - could this be it?


I'm pretty sure I've seen that ad on the right on this site (XP, Firefox, Flashblock on), but I haven't gotten the pop-up.


----------



## Peter Redmer

Ok, yesterday we blocked ads from the advertiser that appears to be running the offending ads. Is anyone still seeing them?

The pop up message is a separate issue which I have been investigating. Is anyone still seeing it with any consistency? I saw it today, but only once, and have not been able to reproduce it (Win8 and Chrome)

If you see it, please take a screengrab and let me know what you did right before it popped up, OS and browser version -- you can send via PM.

Thanks everyone for your help!


----------



## justen_m

Peter, have you tried what I said above about carlsjr.com? I know, it isn't about this site, but I am asking for you expertise about how to fix it.


----------



## RickStrobel

Just got this tonight.

Using Google Chrome Version 24.0.1312.56 m, Windows 7 Utlimate.

Note that I don't do much browsing on this computer. Any browsing was with FF or IE. Just trying out Chrome occasionally. Had been to a few sites prior to visiting, trying to learn about recording Minecraft games with FRAPS and posting to Youtube.

I visit TCF many times per day from many computers. This is the first time in a long time that I've had to log in - because I'm coming from a different browser that I've never visited with before. Glad someone had posted a thread in the Happy Hour or I would have thought my computer had a bug.


----------



## jcondon

Just got the same popup that RickStrobel's attachment shows. Win7 Pro 32bit this time. Win 8 Pro 64-bit home on Friday afternoon.

Chrome browser.


----------



## Peter Redmer

I found what might be the culprit. In doing some searches, it seems we aren't the only board to be "attacked" with this; it doesn't seem to have anything to do with the ad servers, but we're still looking into it.

Let me know if anyone sees it from here on out within 30 mins or so (to give the changes I made a chance to take.) In the interest of trying to narrow down where this is coming from, I'm not going to change anything else until I know if this fixes it


----------



## waynomo

I just got it for the first time. Call it 1:15 PM EST.

Don't know if this matters, but Chrome was restarted last night with TCF thread in one tab. And this was my first time doing anything on the forums since the restart. (I hit the "New Posts" tab.)


----------



## Peter Redmer

FYI for everyone -- we've added some filters with our ad providers that weren't previously available (or that were not enabled for some reason) to help prevent "sensitive" ads from appearing. That should help or eliminate the problems with the banner ads also mentioned in this thread, and may be connected to the popup.

If anyone sees the popup from here on out, please let me know via PM with the details of your browser/system.

@Waynomo - not sure if the state of the browser had anything to do with it; e.g., maybe it had an old cached page. I'm still not 100% certain of the origin of the popup though, so hard to say. Information from anyone who sees it, if it shows up again, will be helpful in sniffing it out.


----------



## timckelley

I cry shenanigans and false advertising. We were promised hot girls. Where are they?


----------



## MikeAndrews

If I ever see the pop-up again I'll try to view source on it.


----------

