PDA

View Full Version : Question for Mods - Redirect or Hack?



75Zag
02-24-2015, 06:20 PM
I tried to log in to the forum today at about 2 pm from my office, which I have done a million times. Instead of getting this site my office computer started flashing various red and white screens and a box came up which invited me to "click here to resolve the problem" - which I obviously did not do. I immediately shut down Internet Explorer using the "task manager" feature on my computer and contacted our IT people. They are currently inspecting my office computer and our firm system for potential viruses or malware.
Am I the only person that experienced this today? If so, I assume there was some sort of "redirect" problem with my own computer or our office IT system. If others had the same problem, I would like to tell our IT people.

Please PM me as this is obviously not a BB topic. If the Mods could leave this up for a few hours I would appreciate it.

Go Bulldogs!

gonzagafan62
02-24-2015, 06:51 PM
This is mostly just a bump so that other people an see this, but going to other basketball sites such as realtime rpi .com I have expireinced this problem. Sorry I couldn't help more.

jazzdelmar
02-24-2015, 06:51 PM
Got same message on my iPad. Just closed page.

JPW314159
02-24-2015, 07:32 PM
realtime rpi.com must have a bug. I've got the 75zag experience multiple times, always connected to that site.

NumberCruncher
02-24-2015, 07:40 PM
realtime rpi.com must have a bug. I've got the 75zag experience multiple times, always connected to that site.

Well, I'm glad I don't pay attention to RPI.

ZagaZags
02-24-2015, 07:44 PM
I go to Google to log in. 50% of the time it takes the to a bogus page and I shut it down quickly. Last week I tried logging on at work and got a a girl with zero clothes on. Needless to say I shut it down again. The bad part was, my Secretary was looking in my office when that happened.

75Zag
02-25-2015, 06:45 AM
Thanks for the comments. I will be careful to log in from my favorites list and not via the Google link in the future.

Go Bulldogs!

TheGonzagaFactor
02-25-2015, 06:50 AM
I have noticed that no matter where I am, if I google GU Boards and click on the "Men's Basketball" link, it takes me to some funny page. If I go to the main site and follow the links through GU Boards to Men's Basketball I've had no problems.

Once and Future Zag
02-25-2015, 06:53 AM
It's junk that's attached to ads.

https://adblockplus.org

Lurknomore
02-25-2015, 07:13 AM
This just happened to me at work too.

JPtheBeasta
02-25-2015, 07:17 AM
I just tried to get to the boards via a Google search and it re-directed to a malicious looking site, just as you folks mentioned. The work firewall or whatever junked the window very quickly. This would seem to be a Google issue. I usually come here via a bookmark and never have problems.

Zag_Dad
02-25-2015, 07:26 AM
I have noticed that no matter where I am, if I google GU Boards and click on the "Men's Basketball" link, it takes me to some funny page. If I go to the main site and follow the links through GU Boards to Men's Basketball I've had no problems.

I've had the same issue (when clicking on "men's basketball") which starting happening about a month ago. If I just go through the GU Boards forum, then select Men's Basketball I have no issues.

LongIslandZagFan
02-25-2015, 07:40 AM
Hmmm.... I was able to recreate this ONCE... I cannot make it repeat again. I have an email into the techs, but not sure if it is the board or if it is Google.

LongIslandZagFan
02-25-2015, 07:41 AM
It's junk that's attached to ads.

https://adblockplus.org

I have that turned on... it still happened to me.

TheZagPhish
02-25-2015, 08:01 AM
It's junk that's attached to ads.

https://adblockplus.org

+1

TheZagPhish
02-25-2015, 08:01 AM
I have that turned on... it still happened to me.

Script blocker? I'm seeing nothin' but GUB over here.

Zagcity
02-25-2015, 08:09 AM
Script blocker? I'm seeing nothin' but GUB over here.

Check your program manager to see if you recently down loaded a unwanted program and uninstall it. It's marketing gimmick

slickguser
02-25-2015, 08:24 AM
I started to track down this issue but I am no longer able to reproduce the problem. The steps and symptoms I saw:

1. Go to Google and search for "gu boards", click the Mens link
2. Eventually the browser loaded a site that was not GU Boards, but something like filedownload72.info (something like that), which was clearly a malware site.
3. I watched the network requests during this time and saw the request to the malware site had a referring header that was from guboards. This indicates that the link from the Google page is not the issue.
4. I did not see a network request that would directly redirect the request to the malware site, so it is likely coming from javascript (probably using window.location) on the page.
5. Searching the page and main assets from the page do not point out any direct problems.
6. The GU Boards site does load ads from Google Ads
7. While setting up a way to track exactly what was causing the redirect, the issue has stopped for me. I will check again later.

tldr: At this point, I would guess the issue was a bad ad being displayed on the page. If you get redirected to a site that is not GU Boards, do not click to download anything.

LongIslandZagFan
02-25-2015, 09:17 AM
Check your program manager to see if you recently down loaded a unwanted program and uninstall it. It's marketing gimmick

This happened to me on a Linux Box. Although I cannot recreate it

webspinnre
02-25-2015, 11:36 AM
Script blocker? I'm seeing nothin' but GUB over here.

Can't recommend this enough. Adblock plus and NoScript = amazing.

LongIslandZagFan
02-26-2015, 04:40 PM
Just an update... we are thinking but not 100% sure of what the cause of this was. I don't want to go into the nitty-gritty of it. The SR techs have done all they can to clean this up short of bringing the board down. IF you experience this again, PLEASE post on this thread so we can monitor it. Perhaps some downtime will be scheduled after the season is over to do a thorough cleansing and/or an upgrade.

75... thanks for bringing it up.

Just want to say thanks to the SR guys for working on this. I'm gonna have to buy them a beer next time I am in Spokane.