could something be wrong?..

[eskimo]

Firstly I didnty know where to post this so my apologies and to get attention quick I posted it here

First noticed thursday morning that when attempting to access this site from the google links I get redirected to elsewhere by "filestore72" a search has shown that vBulletin sites and of course ones pc could be infected.

I can access PM and exploreoz (a non vBulletin site) using the google links okay without drama. But not this
ebay and a couple several other vBulletin forums are okay.

Following a link in a reply that WWF sends out is okay...its only the links that pop up in google

It was only happening (yesterday) with woodwork forum link...not the metalworking link....but today its happening with all the google links for this site.

Anyone else having problems...it has me beat!?...i dont know if its me or WWF server?

Kaspersky and Malwarebytes and a couple of others dont show anything......and no a restore to 15th Jan didnt help

[Master Splinter]

Sounds like you have the 'Filestore72" browser hijacker.

http://blog.mitechmate.com/remove-filestore72-info-malware/

[Big Shed]

eskimo, I have reported this to Admin.

I have also tried to duplicate what you reported and yes, if I click on the Google link to Woodwork Forums I got the same redirect. If I clik on any of the links under that link, I go straight to that sub-forum, ie Metalwork Forum.

Interesting thing is that when I tried this a second time clicking on the Google link to Woodwork Forums took me straight to WWF.

Another moderator had the same experience.

Master Splinter, thanks for that link, but the instructions given for Firefox seem to be out of date as pressing Alt H and then selecting Troubleshooting Information does not give me a Rest Firefox option.

[TheNutter]

This is happening to me on my IPAD.

[Cliff Rogers]

Yup, happened the first time I tried it & then it didn't happen again.
Mind you, when it happened, it took me to the filestore72 site but the site reported an error.

[Jekyll and Hyde]

Its likely nothing to do with your computer. I spent 4 hours looking on mine to find this thing (not a trace anywhere), as I do a lot of browsing through multiple forums and had it happen often. Used MalwareBytes and a bunch of others, even tried some old system restore points....

Finally jumped on the missus' computer, and did the same testing I'd been doing - google search, and start opening any results from forums in a new tab. Straight away, Avast! antivirus started blocking redirects.

This filestore72 redirect has been a problem for any vBulletin based forums for some time, but in a different form. It seems they've now come up with a new version thats managed to upload itself to most of the vBulletin boards on the net sometime in the last couple of weeks, and redirects at (I assume) a server level. Installation of Avast! antivirus (free) seems to block the redirects on mine without issue (with a friendly little message to tell me its done so), so I'd suggest checking that your antivirus software is up to date, and turned on.



I must say though, writing this reply has reminded me I need to investigate an unrelated issue with this site and my new computer. Typing into the reply box results in about 25% of the keystrokes not being recorded, and I can't scroll down from what I'm writing to see the previous posts, as the page keeps jumping back up to where I'm typing. Seems like its auto-refreshing constantly. I'm actually typing in Notepad, then copy pasting. Even then, I have to right click to paste, as Ctrl-V doesn't work... Pretty sure its related to IE11.

[camoz]

Good to know it is not just me then:D.

Here is a screenshot just in case it helps (happening on Windows 7 machine, using firefox (it seems to load a random page as well)

http://i1365.photobucket.com/albums/r754/woodworkforum/413b10dc-64e6-480d-af5e-9a09863b5b75_zpsoxtfdyxs.jpg (http://s1365.photobucket.com/user/woodworkforum/media/413b10dc-64e6-480d-af5e-9a09863b5b75_zpsoxtfdyxs.jpg.html)

[eskimo]

Master Splinter, thanks for that link, but the instructions given for Firefox seem to be out of date as pressing Alt H and then selecting Troubleshooting Information does not give me a Rest Firefox option.

it took me ages to figure that one out...the time I have wasted trying to get rid of invisible bit of malware !!!!
loading this and that and doing scans, so called manual removal tyhat showed up nothing.
cost me $40.00 bucks for Spyhunter that freezes during its scan....now I am in for another fight to get my money back for a useless bit of so called anti-malware software.....:((

Any way I am sort of glad it wasnt my computer

[morrisman]

Yep.. me too . At the library computer .

[eskimo]

One thing i have noticed
My pc does it every time from google links
(Not from links one get from emails from wwf forum replies)
My firefox is set to delete history at end of session.
today at the club i tried to access wwf on mobile phone and it did first time only...okay snd accessed on successive s it did also this time....but mobile us set to auto log in....unlike pc which requires password etc?
Mmmm?

Edit...nah cleared cache from phone and still worked okay
Will test pc in morning

[grantoboy]

Been getting this issue from my android phone using chrome. Looks like it is one of the new web page redirects that have popped up but no one knows how to fix it. Read about this problem in the news about a week ago.

[eskimo]

google links works okay this morning

[eskimo]

broken again

any news yet Big Shed on what the problem is?

[Big Shed]

Admin is still working on it.

This is not confined to just this forum, quite a few forums and blogs are affected by it too.

Have you thought about putting an icon on your desktop/toolbar for the WWF?

I have one on my toolbar and never have a problem.

[Cliff Rogers]

Yup, make a shortcut. :2tsup:

[eskimo]

Have you thought about putting an icon on your desktop/toolbar for the WWF?


Yes, but I will have to delete another to make room for it

[ubeaut]

Steven has been working on this problem. First detected it Tuesday 20th, last week.

Done exhaustive scans of all files and fixed the problem ones Saturday more scans showed us to be free of the problem.

But it's back again and scans will start again. :C

In the mean time

Make sure your computer, tablet, mobile etc has good virus protection.
DO NOT enter any malicious site that comes up. GET OUT OF THE SITE IMMEDIATELY!
Report any malicious site warnings and how you got to the site here.
Do not use a search engine to access these forums.
Bookmark the home page or remember woodworkforums.com and type it in.


Woodwork Forums is not the only one that has been affected by this so be a little wary with all searches. I have tried a number of search engines and all will bring up the same thing so switching from Google to Bing or Yahoo, etc, etc, won't help neither will changing browsers Firefox, Chrome, Opera, IE will all give the same result.

Safest method is to log out which will clear all cookies, log back in by typing in www.woodworkforums.com then when you have finished simply leave the site DO NOT log out. This will preserve site cookies and you shouldn't have to log in again when you return unless you have set your browser or computer to clear cookies at the end of each session.

Hope this is of some help.

Cheers - Neil :U

[eskimo]

DO NOT enter any malicious site that comes up. GET OUT OF THE SITE IMMEDIATELY!


So naked lady sites are definitely off limits.....Bugga!

[rob streeper]

Sounds like you have the 'Filestore72" browser hijacker.

http://blog.mitechmate.com/remove-filestore72-info-malware/

Did it, all better now. Been seeing this problem for a week or so. Kaspersky has been having a fit and killing the browser.

[Sawdust Maker]

good old kaspersky

[ubeaut]

Just out of interest the scan of the site takes a little over 12 hrs to run last scan showed us uninfected but in the 12 hrs it took to run the mongrels somehow infected us again.

There will be a lot of hours and work thrown at the problem again over the next 24 hrs and this time we hopefully will be free of it.

Cheers - Neil :U

[eskimo]

Just out of interest the scan of the site takes a little over 12 hrs to run last scan showed us uninfected but in the 12 hrs it took to run the mongrels somehow infected us again.

There will be a lot of hours and work thrown at the problem again over the next 24 hrs and this time we hopefully will be free of it.

Cheers - Neil :U


It took me ages to realise it wasnt even me that was infected....after doing numerous scans in normal mode and safe mode by kaspersky, malwarebytes, avg, spyhunter etc etc and then doing registry scans for junk etc in norm and safe mode still had me scratching my head...then I thought I wonder ( remembering that I had read somewhere on the net that it can affect Vbulletin site's and their coding) if its WWF and hence my initial post

Any way I hope you get rid of it soon

[Big Shed]

Yes, but I will have to delete another to make room for it

I use Firefox as my browser and on the Firefox toolbar you can actually add more icons than fit on the screen, any icons that don't fit on the screen sit in a dropdown box at the end of the toolbar.

The other thing that helps to put more icons on is to make the description as short as possible, eg WWF for Woodwork Forums, or no description at all.

After my first brush with this pesky re-direction thing it hasn't happened for me again, even when I go from a Google link, which I don't normally do, I just click on the toolbar icon.

I don't log out either as per Neil's suggestion.

[eskimo]

I use Firefox as my browser and on the Firefox toolbar you can actually add more icons than fit on the screen, any icons that don't fit on the screen sit in a dropdown box at the end of the toolbar.

The other thing that helps to put more icons on is to make the description as short as possible, eg WWF for Woodwork Forums, or no description at all.

After my first brush with this pesky re-direction thing it hasn't happened for me again, even when I go from a Google link, which I don't normally do, I just click on the toolbar icon.

I don't log out either as per Neil's suggestion.

I dont log out either

However I have firefox set to NOT remember history or anything so I wonder if its that as to why it always redirects from the google links

If I am in WWF and then also go to wwf via a google links, all is ok.

[ubeaut]

So far today so good. Quick check shows us to be clear but there is still a lot of work in the back room to be done before we can say we are free from this blight. There are a thousand fixes out there and so far most of them are pretty much useless for our purposes.

The bloody thing hides in stealth mode among all sorts of files and in the cache which is easily fixed by deleting cache, but then it comes back again re-installed from another of it's stealthy little hidey-holes. There seem to be a heap of mutations and most scans can't find them. So...........

We just keep our fingers crossed and hope Steven can find every single instance of the bloody thing.

Neil :~

[eskimo]

Every thing on both pc and mobile is going okay
Looks like you guys got on top of it

[ubeaut]

Pretty sure Steven has been able to fix it fully..... At least for now.

With luck we won't ever see it again, but the malicious bastards are so cunning that anything is possible.

Thank you Steven for the great job and for the long hours spent on what was a pretty difficult and very complex, seek and destroy mission. :2tsup:

A job very well done.

Cheers - Neil :woot:

[eskimo]

Pretty sure Steven has been able to fix it fully..... At least for now.

With luck we won't ever see it again, but the malicious bastards are so cunning that anything is possible.

Thank you Steven for the great job and for the long hours spent on what was a pretty difficult and very complex, seek and destroy mission. :2tsup:

A job very well done.

Cheers - Neil :woot:

:welldone:

[eskimo]

I was wrong...its back again

how do I know...I keep forgetting that I now have a shortcut on my desktop and keep typing into google "Woodwork Forums"

looks like you'll be working overtime this weekend stephen.....just make sure you get paid for it....:D

[Cliff Rogers]

Yup, it just tried to take me here but it failed to load.
It took me to WWF by hitting back & clicking the link again.

http://cxtcbqld2ddtovpsa4ztpfj.e-grafiker.com/index.php?s=eHpza3JzPWxmc2t3ZyZ0aW1lPTE1MDEzMDA0NTYyODE1MTA3NTMxJnNyYz03NiZzdXJsPWZpbGVzdG9yZTcyLmluZm8mc3BvcnQ9ODAma2V5PTFFRjMwQTZDJnN1cmk9L2Rvd25sb2FkLnBocCUzZmlkPWIxNjkzZTcy

[steven]

You're right, thanks for the heads up.

[eskimo]

that was quick Steven....:2tsup:

are you counting down til it re-occurs or do you think you've got it all?

[steven]

that was quick Steven....:2tsup:

are you counting down til it re-occurs or do you think you've got it all?

I'm hoping we're good his time. But as usual, if you notice anything suss, please let us know ASAP, it really is a big help.

[rob streeper]

I can no longer see the buttons in the page that opens for formatting posts and uploading pictures. Is it me?

[steven]

I can no longer see the buttons in the page that opens for formatting posts and uploading pictures. Is it me?


Do a refresh and that screen should be right.

[Cliff Rogers]

I just got this when I did a google seach & Firefox popup blocker killed it.
http://myfilestore.com/download.php?id=b1693e72
It says Ads by Infinity.com

[ubeaut]

Steven's been working overtime on these problems. Final fix went on yesterday morning and all things being equal that should hopefully be the end of it.

Has mucked up a few other minor things though and they also seem to be on the mend, especially the Tapatalk stuff.

:U

[eskimo]

Steven's been working overtime on these problems.

Hope he got paid

Yes...all seems to be working ok last few days, and how do I know...cause i cant find the ruddy short cut I put on the desktop....:2tsup:

Incidently, with what did you guys scan with?...a commercial anti-malware software or do you just look for wrong/faulty code?