Malware/Virus Warning

[RonBoyd]

Periodically, I would get a popup warning of a Virus (and a very loud screeching noise) when going to early-retirement.org. The Browser becomes locked. I would have to close the open tab and re-open the site and it would behave as expected.

Today, however, I cannot get the site to open without activating the virus warning no matter what I do. This happens with Microsoft Edge (the new version) but doesn't seem to be a problem with Chrome (which is what I am using to post this). Nor does it happen with any other web site when using Edge... or any other program, for that matter.

See attached image.

Early-Retirement.org.JPG

[braumeister]

That appears to be a malware popup.

You should clear your browser cache and cookies, reboot your machine, and run Malwarebytes or the equivalent to find and delete the offending stuff.

[Aerides]

...(comes into thread getting ready to move it to the new Covid section)...

Oh THAT kinda virus! But yeah that looks like your machine.

[RonBoyd]

Quote:

Originally Posted by braumeister That appears to be a malware popup. You should clear your browser cache and cookies, reboot your machine, and run Malwarebytes or the equivalent to find and delete the offending stuff.

I cleared "Cookies and other site data" and "Cached images and files." That seems to have fixed the problem.

I did not have to reboot. Malwarebytes scans the System every day at 3AM. SpyBot is continuously monitoring.

I am happy that fixed it but whatever it was had to have come from your Server.

[RonBoyd]

Quote:

Originally Posted by Aerides ...(comes into thread getting ready to move it to the new Covid section)... Oh THAT kinda virus! But yeah that looks like your machine.

<Chuckle> Yes, I should have been more descriptive in the Subject line. I apologize.

[target2019]

https://www.bleepingcomputer.com/vir...s-damaged-scam

That link describes your problem specifically. I'm posting it because the article explains the delivery mechanism.

[scrabbler1]

I had written about this problem back in January. I get the scam hijack from other websites, too, but mostly from this one. I ran adwcleaner (one of the items mentioned in target2019's link), which found some things. Let's see if that helps.

[audreyh1]

I thought Malwarebytes itself was bad actor software?

[braumeister]

Quote:

Originally Posted by audreyh1 I thought Malwarebytes itself was bad actor software?

Not sure where you got that idea. It's safe and effective.

BUT there are some fake versions of it that are not safe. Go directly to the source to download it.

[Sunny]

Quote:

Originally Posted by RonBoyd I am happy that fixed it but whatever it was had to have come from your Server.

Even legitimate ads (on the side of websites) can trigger malware if that is what the malware authors have decided to use for a trigger. Websites utilize ad networks for the displaying of ads, so it isn't as if ER's servers are infected and directing malware at your computer.

Your computer is infected and innocuous ads in websites may be being used as the trigger mechanism.

I think somebody posted a link above that likely also indicates this as well, just wanted to reiterate it'd be very odd if ER's or any other typical web server was the cause of the infection.

Quote:

Originally Posted by audreyh1 I thought Malwarebytes itself was bad actor software?

Malwarebytes, the offiical one from https://www.malwarebytes.com/ and affectionately called MBAM, has been one of the best anti-malware software apps for at least a decade. Every computer should have it installed in my opinion. You don't need to pay for the active scan if youa are careful and OK with updting / running manual scans when you need to since that portion is free.

[audreyh1]

Quote:

Originally Posted by braumeister Not sure where you got that idea. It's safe and effective. BUT there are some fake versions of it that are not safe. Go directly to the source to download it.

Well, I thought the undismissable pop-up I would occasionally get was from them.

[RonBoyd]

Quote:

Originally Posted by Sunny Your computer is infected and innocuous ads in websites may be being used as the trigger mechanism.

You may be correct. However, it only affects the Early-Retirement.org website (on this one machine).

It is even more suspicious in that Malwarebytes, SpyBot, SpywareBlaster, Reg Organizer, WinOptimizer 17 -- which run continuously -- and a couple more that are run periodically (weekly?) have failed to detect anything unusual.

In any event, we are still good. I was merely whinning.

[target2019]

Quote:

Originally Posted by RonBoyd You may be correct. However, it only affects the Early-Retirement.org website (on this one machine). It is even more suspicious in that Malwarebytes, SpyBot, SpywareBlaster, Reg Organizer, WinOptimizer 17 -- which run continuously -- and a couple more that are run periodically (weekly?) have failed to detect anything unusual. In any event, we are still good. I was merely whinning.

Just a WAG, but how do you know those programs are all safe?

[RonBoyd]

Quote:

Originally Posted by target2019 Just a WAG, but how do you know those programs are all safe?

Is anyone safe, anymore? Not wanting to "knock on wood," I'll just leave it at that.

[target2019]

Quote:

Originally Posted by RonBoyd Is anyone safe, anymore? Not wanting to "knock on wood," I'll just leave it at that.

1) What I meant was how did you receive the installers for the programs? E.G. I have Malwarebytes, and it came from the official site. It is possible though to download it through other sites, and it could be re-packaged.

2) I'm trying to understand how this particular pop-up comes to find its victims. Some say they never see it, and I am thinking this can be true if ads are blocked and javascript is off. However, others say it is because you are infected by malware.

As you say, is anyone safe anymore?

[The Cosmic Avenger]

Quote:

Originally Posted by Sunny Even legitimate ads (on the side of websites) can trigger malware if that is what the malware authors have decided to use for a trigger. Websites utilize ad networks for the displaying of ads, so it isn't as if ER's servers are infected and directing malware at your computer. Your computer is infected and innocuous ads in websites may be being used as the trigger mechanism.

That's not quite right. Malware already installed doesn't really need triggers; malware authors can be brilliant programmers, but there is no need for them to make things more complicated than necessary. Generally your computer is either infected or it is not. That screenshot looks to me like an attempt to infect the computer with malware by getting the user to click "update", which probably installs the malware. Once the target computer is already infected, malware will generally try to stay invisible to the local user, otherwise it risks detection and removal.

(Not INFOSEC/cybersecurity certified, but I work closely with certified professionals on such issues.)

[RonBoyd]

Quote:

Originally Posted by target2019 1) What I meant was how did you receive the installers for the programs? E.G. I have Malwarebytes, and it came from the official site. It is possible though to download it through other sites, and it could be re-packaged.

Each of those programs were installed at some time over 10 years ago -- across all five computers. Since that time, the only thing new was routine updates/upgrades from the official sites.

Quote:

Originally Posted by target2019 2) I'm trying to understand how this particular pop-up comes to find its victims. Some say they never see it, and I am thinking this can be true if ads are blocked and javascript is off. However, others say it is because you are infected by malware.

I, too, am quite curious how this could happen.

[RonBoyd]

Quote:

Originally Posted by The Cosmic Avenger That's not quite right. Malware already installed doesn't really need triggers; malware authors can be brilliant programmers, but there is no need for them to make things more complicated than necessary. Generally your computer is either infected or it is not. That screenshot looks to me like an attempt to infect the computer with malware by getting the user to click "update", which probably installs the malware. Once the target computer is already infected, malware will generally try to stay invisible to the local user, otherwise it risks detection and removal. (Not INFOSEC/cybersecurity certified, but I work closely with certified professionals on such issues.)

Yeah, I don't believe my machine is/was infected by this "popup." I have been around long enough to know not to anything foolish -- like giving such a thing credence. I quickly closed the page without any other action. It is a valid point (and, indeed, quite perceptive) that no malware (or virus, for that matter) worth its salt is going to continually announce its presence.

On the other hand, it is curious that only one machine (out of five) on the same LAN is affected. Similarly, why doesn't the same thing occur with Chrome or Internet Explorer? Or different URLs?

[Janet H]

There are two possibilities:

1. Unwanted adware on your machine or some actual malware. Scans and removal will manage these (once again recommending malwarebytes for adware).

2. Occasionally a bad ad is served that hijacks or redirects. These are especially tough to find because we each see different ad content. If it's the later AND we can get a url from the ad it can be blocked.

The site and server have been checked and rechecked and we are confident that there's no virus or malware being served.

[Sunny]

Quote:

Originally Posted by RonBoyd You may be correct. However, it only affects the Early-Retirement.org website (on this one machine). ... In any event, we are still good. I was merely whinning.

Flip side though is if it were the ER servers more of us would be having the issue.

And I didn't think you were whining.

Quote:

Originally Posted by The Cosmic Avenger Once the target computer is already infected, malware will generally try to stay invisible to the local user, otherwise it risks detection and removal.

Which is the reason some, not all, malware may try to use triggerss to trick the user in allowing for further infestation of more unwanted programs.

But yes, most adware / malicious stuff using ad networks wouldn't be this sophisticated.