Malware/Adware?

[R.I.C.O.]

Hi there, don't want to sound alarmist but the last 2 or 3 times I've visited the new Villatalk site I've been viewing topics and then all of a sudden I get taken to a completely random site, usually trying to coerce me to into doing a survey, buying a mobile app or gambling, which then crashes my internet browser.

May I just say this only happens when I visit this site and no others. Is this a feature of the new advertising arrangement as I notice the adverts are now embedded in the post you view.

Not entirely sure its a problem from my end, and yes this happens in both IE and Firefox.

[limpid]

Hi there, don't want to sound alarmist but the last 2 or 3 times I've visited the new Villatalk site I've been viewing topics and then all of a sudden I get taken to a completely random site, usually trying to coerce me to into doing a survey, buying a mobile app or gambling, which then crashes my internet browser.

May I just say this only happens when I visit this site and no others. Is this a feature of the new advertising arrangement as I notice the adverts are now embedded in the post you view.

Not entirely sure its a problem from my end, and yes this happens in both IE and Firefox.

None of our advertising partners do anything like this. Does it happen for other computers on your internet connection? Also does it happen when you are connected elsewhere?

For reference, the advertising is the same as before the site was changed.

[Jimzk5]

it doesnt happen whilst on villatalk but when i google something when i click on the link i want it always redirects me to survey sites, i have to open the link 3 times before it takes me there, i thought i had a virus but a scan has found nothing

[limpid]

it doesnt happen whilst on villatalk but when i google something when i click on the link i want it always redirects me to survey sites, i have to open the link 3 times before it takes me there, i thought i had a virus but a scan has found nothing

There are many possibilities, but check the nameserver (DNS) settings on your computer are what the ISP told you to use (or set to your router). Also check the DNS settings on your router are what the ISP told you to use. There have been a few trojans which alter DNS settings (dnschanger being the biggest) where they hijack the adverts on sites you visit to point to other sites. They are usually quite good at doing this seamlessly so that you don't notice though.

[R.I.C.O.]

These are the sites I keep getting redirected to when browing THIS site:

localgiftspanel.com/uk/survey/indext3b1.php

uk.709tube.com

testables.net/d/juicy.ru

I think its probably a russian trojan virus that has embedded itself in my laptop, but cant be sure as it only happens on this site, no others. That survey site is bitch to escape from as well.

[R.I.C.O.]

Did some research after getting it again...

this issue is reported all across the web, it is pretty well accepted to be a 3rd part advertisement issue associated with Google Ads. People are getting redirected on all OS's including Linux so Malware seems highly unlikely. Also, it seems to be most common with forums (but that's likely due to common Google ads use).

Search "testables.net" in Google to see all the complaints and discussion.

The juicy.ru website that pops up often appears alongside a link to a tracking cookie/image with a url starting with:

http://t.mookie1.com/t//imp?migAgencyId

This is a tracking cookie from an agency called MIG - Abine

Bunch of rocket polishers.

[limpid]

Did some research after getting it again...

this issue is reported all across the web, it is pretty well accepted to be a 3rd part advertisement issue associated with Google Ads. People are getting redirected on all OS's including Linux so Malware seems highly unlikely. Also, it seems to be most common with forums (but that's likely due to common Google ads use).

Search "testables.net" in Google to see all the complaints and discussion.

The juicy.ru website that pops up often appears alongside a link to a tracking cookie/image with a url starting with:

http://t.mookie1.com/t//imp?migAgencyId

This is a tracking cookie from an agency called MIG - Abine

Bunch of rocket polishers.

and yet it seems to only affect a tiny number of readers. Very strange.

[R.I.C.O.]

I'm going to have a right old clear out of all these cookies to try to get rid of it then.

[brummybloke]

only happens on this site.

randomly when you click on a thread it takes you to spam central and i cant just click 'back' i have to close villa talk and reopen it again

happens every day at the moment, it just did it on the joe bennet thread when i went to have a read, was doing it on the darren bent thread yesterday.

[limpid]

only happens on this site.

randomly when you click on a thread it takes you to spam central and i cant just click 'back' i have to close villa talk and reopen it again

happens every day at the moment, it just did it on the joe bennet thread when i went to have a read, was doing it on the darren bent thread yesterday.

Please read R.I.C.O.'s post above.

Does it happen with another browser? Does it happen with other computers on the same connection? Does it happen when you are on a completely different connection?

[brummybloke]

happened on firefox and ie

this is the link which just came up when i popped on 1 minute ago loggin on through internet explorer

http://surveyorster.net/d/juicyru.com

i have only logged in via my desk top pc in the last couple weeks so dont know about my laptop.

i have also done some reading up and it seems to be a script introduced to a good few british web based sites since the start of november which have adverts on them.

digital spy a large website has been plagued by it.

[limpid]

Sounds to me like something is hijacking your dns settings to steal advertising slots. I'm pretty confident it's not this site causing the problem, it is conceivable that one of our advertising partners might be having their ads targeted by the malware affecting your computer or router. This is exactly how the DNS-Changer trojan worked.

[R.I.C.O.]

Another one got me today just now, took me to a site called "bagram.net" I couldnt get out of (it was trying to sell me shoes)

Is there anything you can recommend that will stop this from happening? Its starting to put me off coming here to be honest.

[limpid]

It's not coming from this site. The fact that it's not yet affecting you when you visit other sites is not relevant. Please could you answer the questions I asked brummybloke above?

[ED]

Every time I come onto VT it opens up utorrent. Concerning

[limpid]

Every time I come onto VT it opens up utorrent. Concerning

On one browser or many? On one computer or many? Have you cleared your cookies and cache? Have you checked the file associations you've set up in your browser to see what file types open utorrent?

[ED]

Just my android mobile device. Cleared everything.File associations seem normal, very puzzling.

[limpid]

Just my android mobile device. Cleared everything.File associations seem normal, very puzzling.

I guess it's time for a backup and reset to factory settings.

Out of curiosity, what does it try to torrent?