Admin: Malicious Ad...
 

[Closed] Admin: Malicious Advert

Posts: 0
Free Member
 

Gonna try a different browser...

I'll see if Opera is pron resistant 😀


 
Posted : 17/12/2013 12:36 am
Posts: 0
Free Member
 

Getting the same popup: in France, WiFi only, Android and Dolphin mini browser.

Only way out seems to be to force close the browser. AVG free seems to stop it happening (there's a message about an invalid security certificate) but the installation is a bit big for my old phone!


 
Posted : 17/12/2013 10:46 am
 Mark
Posts: 4391
 

Hi Guys,

Could I ask the guys in France and Germany if the banner text of the popup was in English? French or German?

Cheers
Mark


 
Posted : 17/12/2013 11:04 am
Posts: 0
Free Member
 

I got it in Belgium too (Nexus7 on wifi)

It was written in English...


 
Posted : 17/12/2013 11:33 am
 Mark
Posts: 4391
 

This does seem to be a wider issue than just our site. There are many reports of an Android based issue on the web. I'm not distancing ourselves from the problem as it's something we and other sites need to try and track down. As soon as we can track the ad down we will be able to stop it.

Thanks for all the info you've sent to us so far.


 
Posted : 17/12/2013 2:11 pm
Posts: 357
Free Member
 

[i]Hi Guys,

Could I ask the guys in France and Germany if the banner text of the popup was in English? French or German?

Cheers
Mark[/i]

For me in Germany the banner was also in English


 
Posted : 17/12/2013 2:18 pm
Posts: 4892
Free Member
 

This does seem to be a wider issue than just our site. There are many reports of an Android based issue on the web.

Concur, looks like an advert that contains JS has been hacked and is being served by one of the networks.

Not a STW isolated issue


 
Posted : 17/12/2013 4:37 pm
 Mark
Posts: 4391
 

If we catch the actual ad itself when it occurs we will be able to block it and so we will keep hunting for it.


 
Posted : 17/12/2013 5:33 pm
Posts: 0
Free Member
Topic starter
 

Mark,
What information exactly do you need?


 
Posted : 17/12/2013 5:54 pm
 Mark
Posts: 4391
 

We need the html code from within the page that will contain the source of the ad including which ad network it is coming from. For example, right clicking it and selecting 'inspect element' in Chrome.


 
Posted : 17/12/2013 6:18 pm
Posts: 0
Free Member
 

In Germany and the text is in English.


 
Posted : 17/12/2013 6:40 pm
Posts: 0
Free Member
 

I am getting a virus software for android pop up...


 
Posted : 17/12/2013 6:46 pm
Posts: 0
Free Member
 

I just got the lovelinks pop up. (S3)
Am I safe? 😯


 
Posted : 19/12/2013 6:48 pm
Posts: 0
Free Member
 

2 days using Opera & no pop ups yet.

Fingers crossed.....


 
Posted : 19/12/2013 7:12 pm
Posts: 34
Free Member
 

The only way I managed to stop it is by disabling java script in the content settings of chrome.


 
Posted : 19/12/2013 7:21 pm
Posts: 0
Free Member
 

Hi Guys, any fix on this yet , i cant access STW on my phone anymore as every thread I try and open I get the lovelinks popup . My phone is a galaxy S3 . Strangely on my android tablet all seems ok . I am in NZ if that helps .


 
Posted : 20/12/2013 8:10 am
 iolo
Posts: 194
Free Member
 

I'm in Viennna on an S4 roaming network (o2 uk). Same message.
Nothing on my iphone 4 (bob network)


 
Posted : 20/12/2013 8:17 am
Posts: 0
Free Member
 

Just happened on DarkRoastedBlend - told me I need to check my Android for a virus.

Which is interesting, since I'm using iOS 7!

I can screenshot it (if I can get it again) and send it to someone if it helps. Oddly, it happened way down a page, not when I first got to the page.

Also got several pop ups from something like ib.adnxs.com telling me that JellySplash is the best selling game or something


 
Posted : 20/12/2013 8:26 am
Posts: 0
Free Member
 

Me too in Australia since installing IOS 7.0.4 last night, particularly the Jellybean one.


 
Posted : 20/12/2013 9:58 am
Posts: 39669
Free Member
 

[img] [/img]


 
Posted : 20/12/2013 10:46 am
 Mark
Posts: 4391
 

Thanks for that. I have added more filters just now. lets see if I've got it. Keep reporting if you see this or anything like it. I'm not always on the forum so email me direct mark@singletrackworld.com and I'll be able to work from mobile when I'm out of the office too.

It's an industry wide issue that is causing havoc just now. Just to reassure that it's not an exclusive STW issue. There's a lot of people searching for the rogue ad networks that are pumping this crap out.


 
Posted : 20/12/2013 10:54 am
Posts: 0
Free Member
 

Chinny reckon

OT sorry...but that took me back 25 years. Thank you.


 
Posted : 20/12/2013 11:04 am
Posts: 9106
Full Member
 

Had the original problem on my Motorola Xoom2 (Andoid ICS running chrome and chrome beta). AVG free reports nothing bad happening, but it's annoying as hell and making me question using the tablet until I can factory rest it/wipe it.


 
Posted : 20/12/2013 11:09 am
Posts: 0
Free Member
 

Getting popups on my iPhone, only on STW...


 
Posted : 20/12/2013 1:03 pm
Posts: 2134
Full Member
 

This is making STW virtually unuseable on my mobile. Nexus4 on giffgaff. Android 4.4.2. Only happens on STW

[IMG] [/IMG]


 
Posted : 20/12/2013 3:56 pm
Posts: 2134
Full Member
 

Should add, virtually no apps on my devise and those that are are from large respected suppliers like TomTom, BBC, garmin etc. No kids stuff like ringtone editors or prawn....


 
Posted : 20/12/2013 3:58 pm
Posts: 251
Full Member
 

I think from what Mark's said is that one of the ad servers that STW use has 'acquired' some infected ads.

Each time they're displayed the javascript kicks in and that's when the problem occurs.

Issue seems to be identifying which ad server it is and which ads to block.


 
Posted : 20/12/2013 4:02 pm
Posts: 0
Free Member
 

[img] [/img]
/p>

Same as trail rat, I've been getting this popping up all day on here.

Not getting it at all on any other sites.

O2 3G/4G connection on iphone.


 
Posted : 20/12/2013 4:05 pm
 Mark
Posts: 4391
 

Those ad networks are not ones we use but I've added them to all the filters we have anyway. I've even disabled a host of ad networks other than the ads we contract directly with bike companies (which are all either flash, gif or jpeg) and Google ads, which are about as safe as it's possible to be, from appearing on android devices at all.

This morning I turned off each network in turn and we still saw reports of this popup. I'm going to keep looking and I'm in contact with our network ad managers at the various ad companies - they are all scratching their heads too and they are receiving reports of the same from lots of other sites too.

I'll keep looking and please keep letting me know if it occurs on your device. Over Christmas it's best to email me directly mark@singletrackworld.com


 
Posted : 20/12/2013 4:09 pm
Posts: 4097
Free Member
 

Possibly slight devil's advocate, but isn't there a case for STW pulling ALL their ads until this is resolved?

The situation seems to be that there are popups being served to users that link to malware? I know that STW aren't the ones causing it, but they are knowingly continuing to carry the ads, in the knowledge that some of them are "bad" - is that not slightly irresponsible?

Or have I misunderstood the malevolence of these? (I've not had any yet myself)


 
Posted : 20/12/2013 4:12 pm
 Tom
Posts: 0
Free Member
 

If you experience this problem, please post or email me with:
OS with version
Browser with version
List of enabled plugins (usually at about:plugins)

Please also try clearing your cookies:
http://singletrackworld.com/clearcookies.php


 
Posted : 20/12/2013 4:27 pm
Posts: 0
Free Member
 

I just got the lovelinks pop up again.


 
Posted : 21/12/2013 2:14 am
 Mark
Posts: 4391
 

Could you provide the info that Tom asks for above?


 
Posted : 21/12/2013 10:33 am
 Mark
Posts: 4391
 

Oh if you could also indicate which country you are in as part if the info that will also help.

Cheers


 
Posted : 21/12/2013 10:37 am
Posts: 0
Free Member
 

Now keep being taken to the iOS App Store periodically, but quit it before it takes me anywhere. iOS 7, iPhone 4S, Australia. Only noticed it on wifi so far...


 
Posted : 27/12/2013 11:33 am
 Mark
Posts: 4391
 

Thanks for the report. We are still searching for the culprit but this does seem like a much wider internet problem that a great many sites are battling with. The ad networks are all looking into this with some urgency too.


 
Posted : 27/12/2013 11:41 am
 tomd
Posts: 0
Free Member
 

I had this last week on my Android device running 4.2.2. Never had it on any other site. I kept getting the dialogue box about a virus with only the "OK" option. I wasn't logged in at the time, but when I logged in (ads disabled) the problem went away.


 
Posted : 27/12/2013 11:53 am
Posts: 0
Free Member
 

There's a bit of misinformation in this thread in regards to Android and their relationship to virus's from drive-by style banners.

In short, unless you are installing APK's from non-Playstore sources, you have nothing to worry about. You don't need AVG or Malware bites.

If you're installing APK's from non-Playstore sources that aren't trusted then you may be at risk.

If you don't know what an APK is, you won't have a virus as you have to allow you phone to accept non-appstore APK's in the first place.

The worry stems from a few years ago when Google we're not vetting their Playstore. People would add apps to the store with malicious content under tempting names such as "The REAL 50 Shades of Grey - what your wife DOESN'T want you to read!" or whatever - a lowe and behold people with less "computer savvy" minds would download some spyware that would take photos of their nostrils on the front mounted cam. Whatever.

However Google went on a massive cleanup a few years ago after they were being embarrassed by Apple's appstore with their "tighter-than-a-nuns-(use your imagination)" style of app approval and the security for end users that came with it.

In it's current state the Google Playstore is the safest it's been. As always - read the comments first. Apply some common sense. But if it's from the Playstore - you're golden.

TL;DR: An Android phone cant install anything NOT from the Playstore by default. Unless you've told it to do so in the past, you're 99% not infected with a virus or malware.


 
Posted : 27/12/2013 1:22 pm
Posts: 2
Free Member
 

I'll add that I used to get the lovelinks one quite a lot but clearing my cache resolved the issue. Not seen it for a while. Wasn't worried about security, as plyphon says, unless you tell it to install, it won't.


 
Posted : 27/12/2013 1:25 pm
Posts: 13252
Free Member
 

i, too, am having this problem....

Sony with Android.... other sites are fine. when opening a thread a little window pops up saying:

"The page at lovelink.us says:
1 Virus found
Dwnload, Install & Run a
Complete Threat Scan Now.
--------OK-------------"

me being a complete luddite (and there being no option for "no") pressed ok.

now have some app, 360 Mobile Security, on my phone.

even with this app the window still pops up.

what is going on and how do i sort my phone out? will restoring fatory settings remove any bugs?


 
Posted : 27/12/2013 1:43 pm
Posts: 251
Full Member
 

[i]Wasn't worried about security, as plyphon says, unless you tell it to install, it won't. [/i]

followed by:

[i]
me being a complete luddite (and there being no option for "no") pressed ok.

now have some app, 360 Mobile Security, on my phone.[/i]

makes me wonder how many people now might be having everything they do on their phone being sent to some server in Russia/etc?


 
Posted : 27/12/2013 1:47 pm
Posts: 0
Free Member
 

Well, that's interesting... Seeing as I am on an iPhone, and therefore (I assume) pretty invulnerable to any malicious software, I let the App Store load all the way to wherever I was being hijacked to.

The answer: Candycrush bloody saga. What's all that about then????


 
Posted : 27/12/2013 2:15 pm
Posts: 0
Free Member
 

I just got the lovelinks pop up, again.
Still in West Yorkshire, still on a Galaxy S3.


 
Posted : 27/12/2013 3:50 pm
Posts: 2
Free Member
 

[i]now have some app, 360 Mobile Security, on my phone.

even with this app the window still pops up.

what is going on and how do i sort my phone out? will restoring fatory settings remove any bugs? [/i]

Go to settings->apps and delete that for a start.


 
Posted : 27/12/2013 3:52 pm
Posts: 0
Free Member
 

That 360 App appears to be a "legitimate"* app - it's in the app store which is how it worked it's way on to your phone.

Which means it's likely a safe app and isn't harvesting your limbs for Russia.

[url= https://play.google.com/store/apps/details?id=com.qihoo.security&hl=en_GB ]360 Link to Playstore[/url]

However, that doesn't stop the company using deceptive tactics to get you to install it in the first place, which is what is happening here I think.

* Whilst the app itself might be legit and not harbor any malicious code to skim credit cards, it may be legitimately sending data or something else about your usage or whatever for the owners to sell on or worse. I personally wouldn't install it under any circumstances.


 
Posted : 27/12/2013 4:13 pm
Posts: 251
Full Member
 

I run Lookout virus protection on my phone.

It just blocked a pop up from
Stw and have the option not to display the message again.

For those getting the problem it might be a solution.


 
Posted : 27/12/2013 6:36 pm
 iolo
Posts: 194
Free Member
 

I have both an iphone and s4 .
I have no issue with the iphone but lovelinks.us warning on chrome and android internet (whatever that is).
I know I shpuld have stayed with IOS as I never had a problem with it.
This S4 is bloody awful phone.


 
Posted : 27/12/2013 6:45 pm
 iolo
Posts: 194
Free Member
 

Is there a fix for this yet?


 
Posted : 29/12/2013 10:25 pm
Posts: 251
Full Member
 

have you tried Lookout - works for me?


 
Posted : 30/12/2013 10:12 am
Posts: 0
Free Member
 

LG g2, Android 4.2.2

Htc one,

Still keep getting the lovelink crap!

I have noticed an add that looks dodgy, it appears at the top of the page and looks like a Facebook bar but with no writing, just a flashing message icon, when I clicked on it it tells me I've won a free app, obviously I've not gone any further but could this have anything to do with the problem?


 
Posted : 30/12/2013 10:23 am
Posts: 0
Free Member
 

Still happening. Nexus4, kit kat.
[IMG] [/IMG]


 
Posted : 30/12/2013 10:23 pm
Posts: 621
Free Member
 

iolo - Member

I have both an iphone and s4 .
I have no issue with the iphone but lovelinks.us warning on chrome and android internet (whatever that is).
I know I shpuld have stayed with IOS as I never had a problem with it.
This S4 is bloody awful phone.

Sorry to spoil your moan but [url= http://singletrackworld.com/forum/topic/ios-add-pop-up-anyone-else-jelly-splash ]people are having the same issues on iOS[/url]. The problem is with the advert providers and is absolutely nothing whatsoever to do with the OS or browser which is simply displaying that data it is served.


 
Posted : 30/12/2013 10:59 pm
Posts: 173
Free Member
 

Might as well add here - I'm getting an annoying "You've won an iPad!" pop-up (and automatic redirect).

Only happens on STW and only some of the time, so assuming it's ad-related.

I'm in France and the message is in French.

Windows 7, Firefox.


 
Posted : 30/12/2013 11:09 pm
Posts: 13807
Full Member
 

I dont get anything at all... on notebook, ipad or S3 phone.


 
Posted : 30/12/2013 11:15 pm
Posts: 33886
Full Member
 

Just read this all the way through, and so far I've not seen any of these pop-ups, either on my pad or phone.
However, I usually only go on here in the evening, and that's via wifi at home. Since this issue popped up, (s****), I've not had an opportunity to grab sneaky looks at STW while at work, so no idea about over phone networks.


 
Posted : 31/12/2013 12:42 am
Posts: 2
Free Member
 

back for me now. Wifi and O2.


 
Posted : 31/12/2013 12:44 am
Posts: 33886
Full Member
 

Just out of interest, how long do you have to be using STW before this pop-up appears? I've turned off wifi on the pad, and I've been using it for about thirty-forty minutes, and nothing has appeared yet. That's on O2. I can't try on 3, the signal in this part of town is almost non-existent.


 
Posted : 31/12/2013 1:48 am
Posts: 12334
Full Member
 

Mark

Are these of interest? Ones that try to install an app onto your phone?

[IMG] [/IMG]


 
Posted : 03/01/2014 9:51 am
Posts: 28712
Full Member
 

Ah, this thread explains a few things i've seen on my Nexus.

However, overall the site is completely unuseable on my Nexus anyway, "Chrome is not responding.." "wait, close, " etc.

So so so often on Android it's not even funny.


 
Posted : 03/01/2014 10:05 am
 tn25
Posts: 0
Free Member
 

Hi,

perhaps this was the cause of the problem? http://www.theregister.co.uk/2014/01/06/yahoo_tainted_ads_malware/


 
Posted : 07/01/2014 10:33 am
Posts: 251
Full Member
 

I just saw that on bitterwallet and was looking for this thread.

I'm not sure it's the same as that one was targeted at PC users as well?


 
Posted : 07/01/2014 10:35 am
 cp
Posts: 8962
Full Member
 

Just had a pop up blocked on my new phone. Moto g running android 4.3 with chrome.

Logged in as premier member with ads off. Still only ever have the problem on stw, never on other sites.

I didn't follow it to investigate.


 
Posted : 10/01/2014 10:58 am
Posts: 2134
Full Member
 

This has been fine for a couple of weeks for me but its started going mental again today [IMG] [/IMG]
/p>

Phone settings
[IMG] [/IMG]


 
Posted : 10/01/2014 1:51 pm
Posts: 16381
Free Member
 

Had it a lot recently. In Singapore on hotel WiFi. Android 4.3, Google nexus 4. These and the yahoo one:

http://seth.avazutracking.net/tracking/redirect/redirect.php?id=91169377&czid=YXZhenU5MTE2OTM3NzE=&usrid=NTkxNGF2Y&rgid=Xp1OTIx&kw=vob7bn9ts7cx&vurl=1792_1490

http://lovelinks.us/gray/mobo/360.php


 
Posted : 12/01/2014 11:31 am
Posts: 3225
Free Member
 

Got this also.. Being served up ONLY from stw


 
Posted : 12/01/2014 7:17 pm
Posts: 216
Full Member
 

Ditto... 🙁


 
Posted : 12/01/2014 9:36 pm
Posts: 173
Free Member
 

Had a bogus "Java update required" page served-up to me today.

Still getting the "you've won an ipad" scam pages as well.

ONLY from STW.


 
Posted : 13/01/2014 1:12 am
Posts: 0
Free Member
 

Had my first experience of this today on my new phone. Get a warning message flash up for a split second then the screen goes blank and the phone shuts down completely then powers up. Only happens on STW as the ads load up. Can stay on other sites for ages without a problem.

Sony Xperia SP, Android 4.1.2 using Chrome browser on O2. Doesn't happen on the built-in browser.


 
Posted : 13/01/2014 8:16 pm
Posts: 34456
Full Member
 

Just had this on my nexus 4 never seen anything like it on any other web page using chrome btw


 
Posted : 27/01/2014 9:58 pm
Posts: 2134
Full Member
 

Its back again. Same as last time (screenshot above) forum unuseable on mobile now.
Any update from admin?


 
Posted : 04/02/2014 5:52 pm
Posts: 0
Free Member
 

HTC Desire S, ancient android 2.3.5, and for the first time getting the lovelink.us "you're app store needs updating" popup. On open free hotel WiFi and never had it on home network, but only getting on STW site.


 
Posted : 04/02/2014 7:42 pm
Posts: 4747
Free Member
 

Im getting a virus frightener, only on my phone and only on here.


 
Posted : 04/02/2014 11:40 pm
Posts: 0
Free Member
 

I don't get the redirects to the App Store - couldn't Apple just ban them for their antics?


 
Posted : 05/02/2014 8:52 am
 Drac
Posts: 50560
 

It's not the App store or the App that cause the problem.


 
Posted : 05/02/2014 9:08 am
Posts: 18587
Free Member
 

I fell for the bogus Java update. Lots of programme deleting, remove Firefox including all personal settings, OS back to a recovery point, reinstall Firefox, all OK now. Except Chrome which is still screwed but only serves as a back-up browser. Apart from the games everyone else gets I get some specific French things saying I've won an i-pad. AVG sends me a warning from time to time and Malwarbytes considers the stuff automatically downloaded when I use STW to be nasty. There were about 80 STW related things to be deleted the last time I ran a scan. Watching the adresses flashing up bottom left when I open an STW page is amusing but not reassuring.


 
Posted : 05/02/2014 6:23 pm
Posts: 18587
Free Member
 

I suggest admin put a sticky up warning users not to click anywhere on any window that opens automatically while using STW.


 
Posted : 05/02/2014 6:30 pm
Posts: 495
Full Member
 

Bump as this is getting massively annoying now.


 
Posted : 05/02/2014 7:12 pm
Posts: 0
Free Member
 

It's not the App store or the App that cause the problem.

But surely it's only the app that would propagate an exploit to drive users to download it? Qui bono? Or have I misunderstood?


 
Posted : 06/02/2014 1:47 am
Posts: 0
Free Member
 

But surely it's only the app that would propagate an exploit to drive users to download it? Qui bono? Or have I misunderstood?

Or it could be the app developers have an affiliate program that someone is taking advantage of. There's lots of poorly run affiliate programs out there where they don't worry about fraud as long as the sales come in.


 
Posted : 06/02/2014 7:34 am
Posts: 0
Free Member
 

if it helps: I only get it visiting the classifieds section...

(previously I got it on all of the STW Forums)


 
Posted : 06/02/2014 8:01 am
Page 2 / 3