Scammy Pop-Up Ad Claiming to Award Apple Products

Aislinn · Sep 29, 2013

Sorry if this is in wrong place or I'm missing something but....

I just PM'd a member about reading the first two chapters of their MS, and when I'd sent the PM a pop-up appeared that looked just like AW's new message pop-up, except that it said I was today's winner of an apple product (instant spam alert) and when I closed it I got sent to one of those links with lots of tempting looking apple products asking me to enter my details etc.

Has this happened to anyone else? Sorry, but I wasn't sure where else to alert AW...

Ramshackle · Sep 29, 2013

It's not happened to me.

It sounds like adware or maybe malware, both forms of spyware. This means it may very well be coming from your computer rather than AW. While the Mods check it out, it would be best to run a virus scan with reputable antivirus software to see if anything crops up your end.

Some forms of spyware will quite commonly create 'Win an Apple product' or 'Your computer may have a virus - click here to download and run scan' (don't click - likely false antivirus) popups... and even survey popups that appear to relate to the site you're on. It's generally more of a nuisance than dangerous, but it's best to get rid of it. I'd also probably say, after a scan and clean up, you might want to change passwords for any online accounts you use (this is just to be the safe side).

Have similar things happened whilst surfing other sites yet?

alleycat · Sep 29, 2013

I've made sure the administrators are aware of this, but Ramshackle is probably right--first check for malware on your end, Aislinn.

Aislinn · Sep 29, 2013

Okay, thanks, I'm running a scan now. I was concerned it might have been related to the user whose request I responded to - a new-ish user - and I PM'd my email address (yep, I guess probably not such a good move with someone I don't know well, but I didn't think I could handle reading 2 chapters within a PM.)

Is it possible to withdraw that PM on the off-chance it hasn't been opened? Or is it just likely not related to that person at all?

Ramshackle · Sep 29, 2013

Aislinn said:
Okay, thanks, I'm running a scan now. I was concerned it might have been related to the user whose request I responded to - a new-ish user - and I PM'd my email address (yep, I guess probably not such a good move with someone I don't know well, but I didn't think I could handle reading 2 chapters within a PM.)

Is it possible to withdraw that PM on the off-chance it hasn't been opened? Or is it just likely not related to that person at all?

I don't think you can withdraw PMs, but one of the Mods or a more long-term user than myself will probably be able to clue you in for certain.

It's highly unlikely to be related to that user (the only real possibility it could be is if they sent you a link offsite and you clicked it... and even then, chance is slim).

If you're a bit nervous about sharing a main email address with somebody new, it might be worth setting up a second web-based account, such as gmail, specifically for this type of thing in the future.

Aislinn · Sep 29, 2013

And now I have a 'remove malware' advertisement on one of the banners... I am feeling watched.

Thanks for the feedback, Ramshackle. Your advice is all good.

AW Admin · Sep 29, 2013

Aislinn said:
And now I have a 'remove malware' advertisement on one of the banners... I am feeling watched.

Thanks for the feedback, Ramshackle. Your advice is all good.

I suspect you picked up something elsewhere that was simply waiting for a popup window to execute.

In addition to scanning for malware, be sure to empty your browser cache and clear cookies (be sure you know your logins first) since several kinds of malware essentially use JavaScript and cookies to plant time bombs.

Aislinn · Sep 29, 2013

AW Admin said:
I suspect you picked up something elsewhere that was simply waiting for a popup window to execute.

In addition to scanning for malware, be sure to empty your browser cache and clear cookies (be sure you know your logins first) since several kinds of malware essentially use JavaScript and cookies to plant time bombs.

OK, thanks for your help. It hasn't happened again.

Caitlin Black · Sep 30, 2013

So I got the same message earlier today, found this thread, and cleared out my cache. When I logged back in, I tried coming into this thread to mention it - and got the same message again.

So I've done a complete system scan on my computer, and found nothing bad. 0 infected files.

WTF?

It hasn't happened again since logging back in *now* after the scan... But I'm mightily confused!

Deleted member 42 · Oct 1, 2013

Cliff Face said:
It hasn't happened again since logging back in *now* after the scan... But I'm mightily confused!

It's not enough to clean your cache; nuke cookies, and, if you're on any flavor of Windows, close all Browser windows, and Quit the browser.

Essentially, this is "Time bomb" malware; JavaScript and a cookie wait until a specified series of conditions; these typically include a delay from infection (hence the cookie) and an execution dependent on an iframe.

The cookie can essentially "fetch" the JavaScript, so you need to clear cookies (at least clear any from sites you don't know and choose to visit), empty your cache, and Quit the browser, completely.

Also, it never hurts to offer the gods of the net a bottle of wine and a goat.

gingerwoman · Oct 1, 2013

I think you mean "phished" not simply "spammed".

Caitlin Black · Oct 1, 2013

Medievalist said:
It's not enough to clean your cache; nuke cookies, and, if you're on any flavor of Windows, close all Browser windows, and Quit the browser.

Well, I think the cookies went away with the clear-out (I'm pretty sure that box was checked...). But how do I clear everything out without having a browser open? Or do I just quit the browser after nuking everything?

I haven't had any problems since turning the laptop off and restarting, and I've been in Firefox for probably an hour or so since then...

Might just quickly nuke everything one more time, make sure cookies have been marked for deletion, and do so with *only* my home page open, instead of this thread open as well...

Caitlin Black · Oct 1, 2013

OMG, why does life hate me? *headdesk*

I did what I said I would, went to the Firefox home page, cleared everything, closed the browser, logged back in - and got that damn message.

I really don't know what else I can do right now.

ETA: And I know better than to click "OK" on the popup message, but there's no red X to close it or a Cancel button or anything, so I've been pressing Alt-F4 - which closes Firefox entirely, not just the popup. If this keeps happening, it's going to make browsing the internet more trouble than it's worth.

Lineykins · Oct 1, 2013

You can add me to the apple-pop-up list.
Only happened when on AW - and like the others, it kicked me off the site completely.

Seems to be clear on this visit though.

robjvargas · Oct 1, 2013

I'm not allowed Mozilla at work. As I recall, there's an option to delete all browsing files and history. I'll see if I can't look this up at home tonight.

NOTE: If I'm remembering correctly, this is going to erase all sites that you have remembering you, so make sure you have all your Web site passwords. You'll need to login again.

Maryn · Oct 1, 2013

Cliff, that's clearly a virus. They tend to park themselves at far less accessible locations than your cache or your cookies, where it's so very easy to delete them.

Update your antivirus software, whatever it is, then run a scan. For me, this slows down computer performance so much on everything but word processing that the smart thing to do is go away and let it do its thing.

Reboot when it's done, and see if you still get the pop-up. If you do, then you may need to take extra steps, like the Security Tango, which consists of free programs you run in a specific order to clean out all the crap lurking in your computer.

If you're the sole user of the computer, it's wise to set up an administrator account but to go about your business on a user account. Then if you pick up something nasty, it's isolated and the admin account can better deal with it.

Maryn, hoping for a cure for you

kborsden · Oct 1, 2013

Cliff (and OP),

Malicious Javascript isn't powerful enough to execute the same level of activity that you would expect from a true virus, at least on its own it isn't. JS will exploit holes in your browser as it is isolated in the browser sandbox unlike java which can be implemented to interface (attack or mess) with your system directly. These holes (think rogue widgets and pop-up windows pretending to be scanners, adverts that redirect etc etc) I'm talking about are usually browser specific and webkit browsers are the most secure against them -- trident and gecko type browsers (i.e. IE, Mozilla, core Maxthon, SlimBrowser) usually show less resiliance to automation and delayed response scripts stored in temp or cache. If the problem returns, try using a different browser such as chrome or opera, or Hybrid Browser like Maxthon which can switch between trident and webkit and see if it happens still.

If it is a JS+cookie combo, clear cache and temporary files. There's still no need to panic as JS is not as powerful as any true COM based scripting language that would have unremmed access to your systems core files and functions. So, if you can't rid yourself of it and you've already cleared your cookies and cache, close all browser windows, disconnect your internet, hold the windows key and press 'R' -- in the dialogue box type %TEMP% and delete the contents of the folder that opens.

Reboot your PC and surf happily again

ETA: just read the whole thread and see this post is redundant... too late to the party to be of use, again!

Caitlin Black · Oct 1, 2013

Maryn, my antivirus updates itself automatically every day, and I did run the scan - and found nothing.

I'll have to look into that Tango thing at some point when I have more free time.

But I can say that I have had 0 problems so far this morning, after being online for about an hour or so. That was the same as when I first cleared the cache, actually - I got the message straight away when I logged back in, and then had 0 problems for several hours till I cleared the cache again, and got the message again right after.

So... I'm cautiously optimistic, but will still do that Tango thing when I have more free time and less bloody homework. :tongue

LA*78 · Oct 1, 2013

Lineykins said:
You can add me to the apple-pop-up list.
Only happened when on AW - and like the others, it kicked me off the site completely.

Seems to be clear on this visit though.

Ditto - I've had it for the last two days, though so far only on the first visit each day. Ad-Aware and virus-check haven't found anything... yet.

AW Admin · Oct 1, 2013

Seriously, this isn't a virus. Thanks to the assertion that it is a virus, I'm dealing with panicked users proclaiming that AW has a virus.

This Isn't A Virus. It's Not On or From AW.

It's not from AW. It's a scam, or rather one of two scams, one that sells you a credit card that's less than afforable and one that also appears to sell your data. So Don't Click.

It is in fact exactly what I've said. It's an injection exploit that takes advantage of a pop up window or iFrame ad. You picked up the JavaScript and a cookie somewhere else, possibly some weeks ago; it appears to be tied to the calendar.

Two of the Admin lists I belong to have had reports of this specific adware from Admins on numerous servers.

Here's what to do:

Clean your cache.
Delete cookies (make sure you know your logins)
And completely shut down your browser; close all windows, and Quit.
You'll need to log back in to AW.
If you aren't asked to log back in, you've omitted at least one step.

Be aware that you can pick up the adware again.

This FAQ describes the procedure and includes a link telling you how to delete cookies on various browsers.

Fenika · Oct 1, 2013

So glad I've gone Mac. But I am sorry you folks are dealing with this frustration. People need to stop writing Malware and crap.

Aislinn · Oct 2, 2013

I don't allow pop-ups on many sites which probably explains why it happened here.

bellabar · Oct 2, 2013

I just got the same message, using chrome on a mac. Went immediately to force quit chrome and all seems ok again.

Deleted member 42 · Oct 2, 2013

bellabar said:
I just got the same message, using chrome on a mac. Went immediately to force quit chrome and all seems ok again.

You need to clean your cookies and cache nonetheless.

Deleted member 42 · Oct 2, 2013

Fenika said:
So glad I've gone Mac. But I am sorry you folks are dealing with this frustration. People need to stop writing Malware and crap.

This kind of ad exploit is OS independent; it can happen to anyone, using any browser.

Scammy Pop-Up Ad Claiming to Award Apple Products

Head down

*scribbles*

Still around

Head down

*scribbles*

Head down

Head down

Wild one

Deleted member 42

Wild one

Wild one

I Tried

Has a few recurring issues

Wild one

Head down

figuring it all out

Deleted member 42

Deleted member 42

scribbles

scribbles