Checkwinonline? Possible malware while browsing ATS

Originally posted by NOTurTypical
I never clicked an AD, it happened to me when I was scrolling down on a thread with the center wheel on my mouse.

There has been documented malware that targets such action. Typically it's received via an email payload.

reply to post by SkepticOverlord


I first thought the same thing, knowing that such a high percantage of attacks do come via an email payload.
I checked my email after I ran my scans and found no unusual messages, and the spam folder was completely empty.
The percentages still lie with it coming that way, although no one that sent me an email message has reported any such problem.
I just wanted to raise everyone's attention to this situation, and if it were a forum related problem that it get noticed asap. So far so good though, has not re-occured.

Yeah.. ATS Staff, please get this under control. My security program just popped up with a checksomethingorother.exe trying to run on my computer. I really love visiting this site, but I don't want to have to ruin a computer to do it.

Originally posted by Advantage
I use linux, so Im reasonably okay.. but I went to page 2 of a thread day before yesterday and I got my warning page concerning it being a threat.. asked if I wanted to ignore. It was weird as Ive never had that happen every before anywhere else.

Same here, using linux/ubuntu almost exclusively and have not encountered this, plus it's a lot safer to browse with anyways. Do you remember the threads name? I'd like to check it out.

Springer and S.O.

I'm running a Mac computer, so those problems don't really pertain to me. This is the first time that I've gotten the Google Warning on this site. As you guys know, there are malwares out there that will affect your computer by just surfing the page (rogue installers and the like). Look at what happened with that Anti-virus 2010 thing. It just installs without your consent. I've worked on numerous Windows systems that have gotten that virus. I understand that your hands are tied as far as isolating this ad, but the only thing that popped up was checkwinonline when the Google page warning popped up. S.O., I U2U'd you the information a few days ago when it first happened.

There was no time to check the ad that popped up as Google circumvented it and went straight to their warning page. It sucks that we can't figure this out, and I understand the frustration.

I hope you guys have some luck pinning this down.


Peace be with you.

-truthseeker

I didnt mean this thread to become a blame ATS for all of our computer problems here

I hope its not related to the forum, I just wanted to raise awareness in case it was.
I revistited the thread where i had the problem and even clicked on a few ads and thus far no more problems, if it was a forum or ad related issue, it seems to be islolated.

Thanks guys, but that even has only happened to me the one time on the site, or any other site. It had a red screen for a backdrop. And I haven't been in my email account for a couple weeks now, I just rebooted a half hour or so ago and noticed there were several hundred unopened emails awaiting me! :|


But, I saw this thread on the homepage and wanted to relay my similar experience. I feel better reading all the precautions you guys take here at ATS.

TY and carry on Sirs.

Ron

I just got redirected to checkwinonline.com when I clicked on the recent post tab. I have not had any unfamiliar emails. I just ran Malwarebytes got nothing, so whats up?

Originally posted by Optix
I got some WIN Defrag Virus last night while browsing only this site, all of a sudden it popped up and shut my computer down, spent most of the night getting rid of it.

Hello Optix,

Could you please tell me how did you get rid of Win Defarg virus? I just got this virus too Apparently it's a new one. I've looked around and found removal instructions, but they say I need to download some sort of removal program like spy doctor, can't remember the other one, to remove the virus. I don't want to download anything. I don't even if I can trust them. Last time I used malware bytes, but it doesn't detect Win Defrag virus. So, I don't know what to do now. I also followed the manual removal steps on deletemalware.blogspot.com... but I can't find any process similar to 1938417.exe.

Sorry if this is not the right forum, but I desperately need help with this virus.

Thank you!

Google safe browsing reports no problems for ATS:
www.google.com...

Yesterday I added a specific test for the malicious domain in filters for Media Trust, our ad scanning vendor, and after 1,820 scans since then, no ads were found to contain actions that either redirected to that domain (or any redirects), or contained assets (images, code, etc.) from that domain.

I'm running another manual test, tracking HTTP headers of each ad, of all ads.

Also, these past three days have seen exceptionally high traffic on ATS. In the past few times when there has been a confirmed bad ad, we've always received additional complaints through our contact form -- we have none.

Additionally, all the networks we use employ their own tests and filtering to ensure these types of ads don't run. We're doing our best, but simply can't find it.

reply to post by SkepticOverlord


Thank you so much for your diligence in this matter.
As stated before, I didnt believe that it was a forum related matter, but wanted to raise awareness in the case that it may have been, and simply to err on the side of caution.

Once again thank you very much.
It definetly eases my mind to know that this site provides such protection to its users!

I've tested over 1,200 distinct ads though our own automated test, and so far no results.

However, it happened to me once on a Breaking Alternative News thread, and while I didn't get the specific ad, I did identify the ad network tag that caused the redirect. I alerted the network and disabled their tag until it's repaired. They may have a compromised server somewhere on their network, especially if not specific ads can be found that are causing the problem.

just my 2cents.

i have been having problems with malware issues over the last few days. Only 2nd time in the last ten years. Anytime I start looking at some of the wiki leaks material my laptop starts going screwy. This includes some of the newspaper sites.

I have found now that the best place to look at it now seems to be their own cablegate site(when its up)

Its my own opinion that there is a massive campaign to gently stop people looking at this material or their PC is gonna be messed up.

Sorry but I don't think you can trust Google to investigate itself.

This isn't the only time. The last time (around July I think) something came onto my computers, via this site and it was related to Google. I attempted to notify ATS but the post got trashed as a complaint.

Now, after reading the stuff I have today on this thread, I will say that maybe Google isn't the cause but they most likely are the vehicle. IMO.

If I may suggest, Microsoft Updates has a thing called Mircosoft Security Essesntial (I think). It is there own anti-virus. I just started using it recently and haven't had a problem since. I recommend it highly. Also, I started using Firefox more. It at least has tools on there that one can better use to stop and/or identify issues/threats.

I did a thread about it about two weeks ago. Try it out.
www.abovetopsecret.com...

Originally posted by SkepticOverlord
I've tested over 1,200 distinct ads though our own automated test, and so far no results.

However, it happened to me once on a Breaking Alternative News thread, and while I didn't get the specific ad, I did identify the ad network tag that caused the redirect. I alerted the network and disabled their tag until it's repaired. They may have a compromised server somewhere on their network, especially if not specific ads can be found that are causing the problem.

S.O., now that you remind me of it, that was when I got the Google Warning hit. I don't remember which thread it was in particular, but I believe it was related to the TSA stuff. Thank you for your diligence in all of this. I know what it is like trying to find a needle in a haystack, so your effort is so very much appreciated. It hasn't happened to me personally since, so I think that perhaps the problem has been fixed, or at least has gone away.

Thanks again.


Peace be with you.

-truthseeker

Twice this week when I clicked on a thread in the recent posts I've been directed to a reported attack page--.checkwinonline.com...=jy7lno3o I didn't click on any ads, only the thread. It just happened about 2 minutes ago.

reply to post by virraszto


It only happened to me that once, but it seems like it has happened to others as well.

Hadnt heard anything about it in a few days, I surmised the problem had been isolated and corrected, apparently not in your case. I'm sorry that it has happened to you too. It doesnt seem to be very malicious, just annoying.

Just happened to me here is a screen shot of the warning page that replaces the ATS page when it happens:
[atsimg]http://files.abovetopsecret.com/images/member/59c0d33565da.png[/atsimg]

Don't know if it helps but if staff needs the full screenshot showing the page info and what not pm me.