35 replies to this topic

[MikeVeitch]

I haven't seen it with Mac and Firefox...

[JimSwims]

Just had it happen 2nd time to me.

Image address-



Not sure if that' s the data you need to track down but HTH. I've now blocked from that address.

Cheers,
Jim.

[Steve Williams]

It only seems to happen when I come into Wetpixel from using a Google search. Got it again;

Content on this website has been reported as unsafe

tscxtpr.portrelay.com
Hosted by: wetpixel.com

[JimSwims]

It only seems to happen when I come into Wetpixel from using a Google search. Got it again;

Content on this website has been reported as unsafe

tscxtpr.portrelay.com
Hosted by: wetpixel.com

SNAP!

Yes I should have mentioned that was how my last pop-up occurred. Think my other event was just via bookmark.

Cheers,
Jim.

[Storker]

It only seems to happen when I come into Wetpixel from using a Google search

Me, too, i.e. not when I enter wetpixel directly through my bookmarks. Also it's only happening the first time I get in through Google. Dismissing the popup downloads a PDF which my antivirus program flags as infected. If I hit the "back" button and enter again through Google, I don't get the popup.

Opera 12.10, Windows XPSP3 (IIRC, also on my Win7SP1 computer, still Opera 12.10)

Edited by Storker, 29 January 2013 - 08:26 AM.

[cor]

To me this is starting to look more and more like a search hijacking on your own system. Thats a very common attack vector. They intercept your DNS requests, then send you someplace else, inject ads, and proxy you back to wetpixel. Anyone here with the poker ads able to check their DNS records and see if they're actually pointing to your service provider?

Also, anyone NOT on windows see these ads?

[Storker]

OK, I don't know enough to argue your point. But since this is only happening with wetpixel.com webpages - at least on my system - and it seems as if wetpixel.com and the poker website are the common denominators for people literally all over the world, it seems natural to assume that the problem somehow lies on the server side rather than on the client side.

[cor]

It's extremely difficult to locate. Whatever it is, it is well hidden, and I cant reproduce it. But we've at least found something on the server, so we'll see if that can be tracked to this issue.

[diver dave1]

I could not get a URL for poker, but today when using Firefox a second window came up after the poker one. It wanted me to update firefox and it provided a 'helpful' button for me to press.
Here was the site name on that page. Needless to say, I did not select that button.

http://allrabiz.com/update.html

[KirkD]

I got my first one today. I just shut down my browser immediatly and reopened it.
Kirk

[DANYGRAIG]

I get the pop up on PC at home and at work - using Google and IE.

[echeng]

Hello, all. If you are seeing this, you are on our new server. We identified and removed the threat on the old server on February 14. It was a pop-up, and occasionally targeted users running Internet Explorer on Windows. One user was infected with a virus when closing the pop-up window. We apologize for being the target of hacking; our server was many years old, and we are confident that the new server, with its new infrastructure, will be much more resilient to attacks.
 
In general, we (and all security experts) universally recommend that you do NOT run Internet Explorer for any reason. If you must use IE for work, do not use it for any personal web browsing. We recommend Chrome, Firefox, and Safari.

[Steve Williams]

Which of those 3 (Chrome, Firefox or Safari) would you recommend?

 

Steve

[echeng]

I like Safari and Chrome. Firefox feels a little bloated, these days, but is still great because of the plug-in ecosystem.

[Chadd]

I run a forum on another topic and have recently found out that we are having the same problem. Could you please share the info you found with me? Fortunately, I'm also a diver that is looking to get into underwater photography, so something good has come from this experience for me.

[echeng]

Chadd, can you PM me with more information about who you are? I'll share what I've found, after you do so.