FlyerTalk Forums

FlyerTalk Forums (https://www.flyertalk.com/forum/index.php)
-   Technical Support and Feedback (https://www.flyertalk.com/forum/technical-support-feedback-386/)
-   -   FALSE Virus alert [there is NO malware on your computer] (https://www.flyertalk.com/forum/technical-support-feedback/1368367-false-virus-alert-there-no-malware-your-computer.html)

Prospero Jul 25, 2012 10:57 am

I'm moving this over to the Technical Issues forum.

Prospero
Moderator: BAEC forum

bcmatt Jul 25, 2012 10:57 am

See also discussion in Technical Issues: http://www.flyertalk.com/forum/techn...rus-alert.html

LiviLion Jul 25, 2012 10:59 am

I am getting this to.

Looks like one of your ad's is a bit dodgy. I've seen similar happen on other forums in the past as well.

You should really look at shutting down the offending provider as some less tech savvy people might install the rubbish that is offered.

GrahamClarke Jul 25, 2012 11:02 am


Originally Posted by Deckard (Post 18999634)
Are you sure your DNS isn't polluted? Never seen this.

I don't see this from other sites. I do not believe my DNS is polluted.

I suspect what is happening is that genuine adverts are shown for the majority of the time but occasionally (randomly) a "bad" one is shown, making it harder to track down who is serving these up.

Wilbur Jul 25, 2012 11:15 am

Any progress?
 
OK, so it has now been a week since this first started happening, and five days or so since it was reported to IBB.

Today, on the fifth or sixth computer (I am losing count) it happened again. Since most elite FF lounges use Windows and IE, this means that most anyone who is in a lounge and using the box provided by the lounge will likely encounter the virus.

Has there been any progress on fixing the FT site security and/or ridding FT of the culprit ads?

FSU Jul 25, 2012 11:32 am

Still happening to me. I would suggest that a statement about this problem be made on the main Flyertalk page and perhaps each of the forums. It took me awhile to find this forum and I would think all the members would need to know about this. I would also politely ask the administrators to let us know what is going on.

IBobi Jul 25, 2012 11:33 am

Merged a thread with the existing one on this issue to avoid messaging duplication.

We're working to determine which ad is causing this messaging to occur. This kind of advertising is *not* approved by FT, and will immediately be blocked when it is located. Meanwhile, be assured that despite the message it shows you, you do not have a virus (from this) and FT is not infected. This is an advertisement that appears to be exploiting a hole in Internet Explorer to show a false virus alert.

One way to avoid it is to switch browsers to Chrome or Firefox.

I'll update as soon as I have new information; thank you for hanging in there with us while we resolve this.

Paul

Doug_1970 Jul 25, 2012 11:57 am

I've had this too, on a number of different computers, at different locations.

If it's any help (and sorry if someone has already posted this), the internet address that it points to when I get the virus message is:

http://performancecaredetector.pl followed by a load of numbers.

I agree with the earlier poster who suggested it should be highlighted on each of the forums.

easterisland Jul 25, 2012 1:07 pm

I've been seeing the same problem, only when I visit FT.

Michilander Jul 25, 2012 3:14 pm


Originally Posted by SkeptiCallie (Post 18998283)
I've mostly switched to Chrome for FT as a result. I went back to IE a few minutes ago to test using "back" per earlier poster. For me it didn't work. In using IE, I got the virus screen about two seconds after navigating in FT, so I tried the "backspace" on the keyboard. That didn't close out the virus screen. So I tried the left arrow to navigate out, per post 78 (which I might not have understood), but that didn't work either. Tried the left arrow in combination with other keys, and that also didn't work. What did work for me was right-clicking on the bottom bar on the screen, then clicking on "Task Manager" (which I have now become aware of, thanks to this thread ;) ) and ending the task. That worked. But I still wondered about residual effects, so I just shut the computer down and started over with Chrome.

What I am wondering about is whether the virus screen will lead to any viruses or other malware being installed on our computers. When the technical people at IB find an answer to what is causing the screen appearing, I hope they will let us know what we should be aware of in terms of that possibility. Not everyone uses virus protection over and above that which is already provided by their OS, as for some people,a lot of it doesn't work well with their computers, and for those who do, not every virus protection program screens against all malware. So it would be good to know which virus protection program is effective against this thing, if indeed it is successful in installing itself on some computers.

Maybe I am concerned too soon. Hope so.

If you mean you hit the backspace and left arrow keys on your keyboard, that is not what knwl9 meant. S/he meant to click on the browser's back arrow (left pointing arrow in the upper left corner of the browser.)

Some of these links are just trying to sell you bogus AV software, some are trying to install a virus or trojan. It does appear to be a well known exploit, though, and as long as you have reputable, up-to-date AV software and you don't click on any of the buttons on the pop-up, you should be fine. If you are really concerned and use Norton, you can always run Power Eraser from the Norton site. Other vendors may have similar products. Norton has told me it blocked access every time I have gotten the pop-up.

SkeptiCallie Jul 25, 2012 4:12 pm


Originally Posted by Michilander (Post 19001489)
If you mean you hit the backspace and left arrow keys on your keyboard, that is not what knwl9 meant. S/he meant to click on the browser's back arrow (left pointing arrow in the upper left corner of the browser.)

I had already done that on several occasions, and it never worked. So I had assumed that knwl9 had meant something different, but those methods didn't work either. Thanks, however. I have just switched to using Chrome and am waiting to see if I need to check for a virus, but assume that this is just a rogue ad.

jfrey1 Jul 25, 2012 5:52 pm

Been getting the same fake warning on 3 different computers the last few days. Only happens when I am on Flyertalk

duluthDL Jul 25, 2012 7:21 pm

I had run the real MSE earlier today and found Rogue:JS/FakePAV; I thought this might be the problem. But I removed it and the FT problem came up again later in the day. I ran MSE again and there were no alerts, so according to MSE, there's no problem with the computer.

chucko Jul 25, 2012 7:41 pm

You really need to get a handle on this. I'm starting to avoid FT because it's becoming a hassle to always fire up Task Manager to nuke the browser, just to make that idiotic (whoever wrote it can't spell) message go away.

LiviLion Jul 26, 2012 2:15 am


Originally Posted by chucko (Post 19002726)
You really need to get a handle on this. I'm starting to avoid FT because it's becoming a hassle to always fire up Task Manager to nuke the browser, just to make that idiotic (whoever wrote it can't spell) message go away.

It is a bit crap this. I had another forum with this problem and the site admins shutdown the adfeeds one at at time to identify who was supplying the rogue advert.

Ideally, if the FT admins cannot work it out by the information being supplied then they need to leave each feed off for a couple of days and ask if the problem has stopped. Once the offending feed has been located then it's a case of working with the ad provider to locate the exact ad.

I'm going to configure an ad blocker to block all adverts from FT now to see if that makes the problem go away for me.


All times are GMT -6. The time now is 2:17 am.


This site is owned, operated, and maintained by MH Sub I, LLC dba Internet Brands. Copyright © 2026 MH Sub I, LLC dba Internet Brands. All rights reserved. Designated trademarks are the property of their respective owners.