Problem/Bug [Unsolved]{Only my issue in special constellation?!} Malicius scam popping up [Chrome, Android 5.1]

Discussion in 'Forum Feedback' started by IlluminatiGaming, Nov 5, 2015.

Thread Status:
Not open for further replies.
  1. I opened the bukkit forums tab on my tablet in chrome, suddenly the website reloaded. The website changed to nbanantivirus.com, popping up with some stupid "There are 13 Viruses on your phone, click ok to remove blabla". It was in broken german, because i am german.
    I am not able to go to bukkit forums with chrome from my tablet, because this message pops up.
    As i refuse to touch anything from that website, i had to clear the cache nd data from chrome, and kill its process to get it back usable. (It was like freshly installed after that. So I HAD TO RESET CHROME TO REMOVE AN "AD" BY BUKKIT FORUMS. I know, you dont wanted this, but talk to your ad partners. I report it so you know about it.an Ad cannot throw me off bukkit forums (it loads in the same tab and trys to force me to install viruses that pretend to remove a virus)
    That isnt an ad, that is damaging bukkit forums.
    I did not change anything and i have the avira app on my tablet. I dont have any mp3 downloader or another shady app like that on my device.
    This doesnt pop up on other websites.
    I hope you can remove this. :)

    Here a scrrenshot: You can see it is the bukkit forums in the background, if you look close. [​IMG][/URL][/IMG] [​IMG]

    EDIT by Moderator: merged posts, please use the edit button instead of double posting.
     
    Last edited by a moderator: Nov 5, 2015
  2. Offline

    teej107

    You sure you didn't download a virus? (not from Bukkit)
     
  3. If I had a virus, the chrome app would open itself and show windows like that. And if i had clicked ok, I had a virus.
    But that was the first time ive seen this, it is a simple Javascript or somthing, this windows is troggered from the nbanantivirus website.
    Mainly, i use youtube on my tablet, and chrome rarely.
    I visited another webpage, nothing. I visited bukkit forums again, bam the scam thingy popped up again.
    This is the first time ive seen this on my tablet.
    So, no, i dont have a virus, as my avira app confirms, too.
     
  4. Offline

    teej107

    I also use Chrome on Android 5.1 and browse Bukkit from it occasionally. I never have had this problem.
     
  5. On my Phone, i dont have this problem too.
    I will Check later on my tablet if this still appears.
    It is strange, but it is not the fault of my tablet, because i nearly never use Chrome there, so it cannot be infected or something.
    I just wanted to Report that i have seen it and it seems like an shitty ad trying to get users to install a Virus.
    I even checked, on other Websites that didnt open.
    I did not even click an ad.
    Strange Problem.

    In the evening i can post a video of this.
    I logged in, visited this Thread, tapped to Post a reply, and Boom, right when i tapped the text input field, it popped up.
    Strange, just on my Nexus 7, only in chrome.
    I logged into another forum for testing, nothing happened.
    Really strange, please Bukkit staff, do something about it.
    I can reproduce it.
    Very strange...

    EDIT by Moderator: merged posts, please use the edit button instead of double posting.
     
    Last edited by a moderator: Nov 6, 2015
  6. Offline

    timtower Moderator Moderator

    @IlluminatiGaming Can you also reproduce it after resetting to factory settings or after reinstalling the browser?
     
  7. I can reproduce it when resetting my browser (Deleting its data, which on Android is the same as reinstalling)
    It just happens with Chrome.
     
  8. Offline

    timtower Moderator Moderator

    @IlluminatiGaming Are you able to reproduce it on other devices?
    If not: then I will keep with the fact that it is your device that is bugged, not the forums.
     
  9. https://drive.google.com/file/d/0BygyJ_5jAPjDTjNJaFY0aXI1cUk/view?usp=sharing
    This is the Video.
    Strangely, i had three tabs open and the only one doing this was the bukkit one.
    I now have rebootet my tablet in save mode.
    I will repost if it occurs there, but i will keep the fact that it are the ads, because my device is clean. Strange.
    I think i will not use chrome again xD
    http://www.giga.de/extra/sicherheit...s-was-tun-so-entfernt-ihr-sie-vom-smartphone/
    This is a german article about those notifications that are in fact triggered by the Browser.
    http://www.stayprotected.com/2014/01/warning-your-phone-has-13-virus-pop-up-ads/
    It is strange, i have the feeling that when i use swiftkey AS keyboard APP and login here, this thing Pops up. With Google Keyboard the issue Dienst appear. But i have über heard of swiftkey being doing this.
    Strange, strange....
    But i have only Seen it on this Website, that is really strange...
    Whatever, you should ask your ad provider if he has something to do with it.
     
    Last edited: Nov 6, 2015
  10. Offline

    oceantheskatr

    Maybe take a look at this browser: https://adblockplus.org/android-install It's an adblocking browser, so you may have better luck on the Bukkit Forums if it is indeed an ad that is causing the issue (which I doubt).
     
    timtower likes this.
  11. Offline

    timtower Moderator Moderator

    Not much to check when you are the only one with the issue and only on 1 device, makes it pretty clear to me.
     
    oceantheskatr likes this.
  12. I am german, so i see different ads then you. Why do you doubt an ad is causing the issue?
    I posted links to articles that confirm that this is caused by an ad. This popupwindow is created by a Website, not by a Virus ob my tablet.
    But the question is what triggers the Website change.
    As it seems to disappear when swift key is disabled, even if this is surprising me, because it is a legit App, it could be causing that.
    I will try installing swiftkey on my phone and see if that issue then reoccurs.
     
  13. Offline

    timtower Moderator Moderator

    @IlluminatiGaming Curse premium, no ads at all.
    And because you aren't able to reproduce it on other devices either. Nor has anybody else seen something like this.
     
  14. So, on my phone i get englisch ads...
    The Issue did not appear on my phone. So probably you're right, probably this ad simply does not appear on my phone, or something is wrong with my tablet, i think there is some conflict between my tablet, Chrome, swiftkey and this website.
    If i see my brother again i can test if his tablet has the issue too, We got the same model.
    The Issue did only appear on Bukkit Forums. A shady App indeed would openup Chrome from itself and directly show the link.
    I will Put this to solved and change the title to dont scare other users.
    The facts are: It seems to only appear in chrome on MY tablet when swiftkey is on, it only happens on this forum website (when i had multiple tabs open even then only the Bukkit one was affected, and on other Websites nothing happend, and it can be triggered by ads.

    As i will now just use another browser and removed swiftkey, this is not such a big issue.
    I just wanted to let you know.
    Dont Lock this thread, if it reappears somewhere i or an other Person can post here.

    :)

    EDIT: Issue came back. Not Swiftkey fault.
    But now i disabled Java Script and now nothing comes.
    Sorry, but that proves an ad triggers a Java Script and redirects me.
    Now you should do something, as it MUST be the Website.
    @timtower Reenabled JavaScript, relogged, gone to this thread, boom, sheeet just popped up again.
    You cant explain that ;) :D
     
    Last edited: Nov 8, 2015
  15. Offline

    Mrs. bwfctower

    Curse premium doesn't get rid of ads on the Bukkit forums.
     
  16. Offline

    timtower Moderator Moderator

    It did for me
     
  17. Offline

    Mrs. bwfctower

  18. Offline

    timtower Moderator Moderator

  19. Offline

    Mrs. bwfctower

    Weird, maybe it's because I have the 'complimentary' premium. Eh, I use adblock anyways xD
     
    timtower likes this.
  20. Offline

    bwfcwalshy Retired Staff

    We all have freemium :p

    I also have no ads with Curse premium on pc, phone and iPad.
     
  21. Offline

    Tecno_Wizard

    @bwfcwalshy, same. I have no ads on bukkit at all because of complementary curse premium for my plugin dev work.


    @IlluminatiGaming, I'd bet you your device is infected and then only way to remove it is probably flashing the ROM on your tablet. Very rarely is deleting chrome's data enough. The guys at Android.stackexchange.com should be able to help you.
     
  22. But my Antivirus App sasy nö infection, this only appears on Bukkit Forums and only if i have Java Script enabled. You can find various articles about ads like that.
     
  23. Offline

    teej107

    1. It only happens on your one device.
    2. AntiVirus software isn't perfect.
     
    oceantheskatr and timtower like this.
  24. Why does everyone ignore the fact that it is triggered by a Java Script on this website?
    Never appears on another website.
     
    ferrybig likes this.
  25. Offline

    timtower Moderator Moderator

    Because you are still failing to reproduce it on a different machine, or on a different browser.
    Maybe your phone has something that throws javascript on some web pages.
     
  26. Offline

    Tecno_Wizard

    @IlluminatiGaming, Android antivirus only detects malicious applications. It doesn't find other malicious software.
     
  27. And as Bukkit Forums is the main visited website on the Internet, any Virus would like to open up there.
    Currently i am installing an Adroid Update, i will see if that fixes the issue.
    Now it opens up as moiteymedia.com or something like that.
    2048
    com.uberspot.a2048
    Action 2: Pro
    com.chrislacy.actionlauncher.pro
    Aequum
    com.vent.aequum
    AGS
    com.bigbluecup.android.launcher
    Android Assistant
    com.advancedprocessmanager
    AndroidPIT
    de.androidpit.app
    Asphalt 8
    com.gameloft.android.ANMP.GloftA8HM
    Avira
    com.avira.android
    Axel (XML Viewer / Editor)
    fr.xgouchet.xmleditor
    BigScreenBrowserAlpha
    com.littleusefulapps.bigscreenbrowseralpha
    CHIP Online
    de.chip.ultimate
    COBRA
    net.watea.apps.cobra
    DashClock Battery Extension
    me.grantland.dashclock_battery
    DashClock Widget
    net.nurik.roman.dashclock
    Dungeon Hunter 4
    com.gameloft.android.ANMP.GloftD4HM
    F-Droid
    org.fdroid.fdroid
    Flow
    com.deeptrouble.yaarreddit
    Free Graphing Calculator
    com.jockusch.freegraphingcalculator
    Gel
    com.Fraom.Gel
    Geometry Dash
    com.robtopx.geometryjump
    Goat Simulator
    com.coffeestainstudios.goatsimulator
    Goggles
    com.google.android.apps.unveil
    Habit Browser
    jp.ddo.pigsty.HabitBrowser
    Hearthstone
    com.blizzard.wtcg.hearthstone
    HP Druckdienst-Plugin
    com.hp.android.printservice
    Intent Analyser
    com.apartapps.android.intentanalyser
    LEGO NXT Build Controller
    appinventor.ai_norfeldt.LEGO_NXT_Build_Controller
    Leo's Fortune
    com.leosfortune
    Like A Boss
    com.rewint.likeaboss
    List My Apps
    de.onyxbits.listmyapps
    Mail
    de.eue.mobile.android.mail
    Minecraft - Pocket Edition
    com.mojang.minecraftpe
    Minimalistic Text
    de.devmil.minimaltext
    Moonshine
    nexbit.icons.moonshine
    MX Player
    com.mxtech.videoplayer.ad
    Nexus Media Importer
    com.homeysoft.nexususb.importer
    Nightmare Defender
    com.djantelware.nightmaredefender
    Nova Launcher
    com.teslacoilsw.launcher
    Nova Launcher Prime
    com.teslacoilsw.launcher.prime
    One Tap
    com.mobile.onetap
    Pie
    jun.ace.piecontrol
    Pocket Dragons
    com.creativemobile.hegemons
    QuickPic
    com.alensw.PicFolder
    Rage Maker
    com.tmarki.comicmaker
    Raging Thunder 2 HD
    com.polarbit.rthunder2play
    Recursive Runner
    net.damsy.soupeaucaillou.recursiveRunner
    Rundroid
    com.kitogoru.rundroid
    Screen Off and Lock
    com.katecca.screenofflock
    SD Maid
    eu.thedarken.sdm
    Simple Explorer
    com.dnielfe.manager
    Skype
    com.skype.raider
    Swampy?
    com.disney.WMW
    Swipeup Utility
    com.AdrianCampos.swipeuputility
    Swordigo
    com.touchfoo.swordigo
    Telegram
    org.telegram.messenger
    That Level Again 2
    ru.iamtagir.thatlevelagain2.android
    Toast Notes
    at.toaster.notes
    Tux Rider
    com.drodin.tuxrider
    TV-Programm
    net.micene.minigroup.palimpsests.lite
    Twilight
    com.urbandroid.lux
    Vector Pinball
    com.dozingcatsoftware.bouncy
    Videoder
    com.rahul.videoder
    WPS Office
    cn.wps.moffice_eng
    Übersetzer
    com.google.android.apps.translate

    That are my installed Apps.
     
    Last edited: Nov 12, 2015
  28. Offline

    Lolmewn Retired Staff

    Tried reinstalling Chrome instead of just removing the cache? Something may have affected the APK or whatnot.
     
  29. Cant reinstall.
    Was preinstalled.
    Now i got this e mail talking aboutmalicious Java Script Stealing passwords...
    As it turned out this was a malicious Java Script, too.
    Because with disabled Java Script this didnt pop up so it has to be a Java Script.
    I dont think ITs a coincidence. If they inserted a pw Stellung Java Script they could have inserted this shit too.
    It only ever came up in bukkit Forums.
    Nobody believed me, but i think this is related to bukkit Forums and not to my device.
    Probably the ad jav Script didnt like me....
    I will test later if the issue disappeared.
    I only can repeat, this came up after LOGGING IN. When i gone into a thread.
    Only when logged in and now i hear the login JavaScript is compromised.
    Intresting. Probably its the skilluminati haxoring me becuz of ma fanxy Name.
    xD
     
    ferrybig likes this.
  30. Offline

    lol768 Retired Staff

Thread Status:
Not open for further replies.

Share This Page