experiencing "redirect" when accessing HF - Last couple days

**dimjim** · 01-22-2015, 10:11

Hey all,

On 3 separate occasions over the last 2 days I experienced some problems accesesing hammockforums. Here's what happened: I was googling certain search terms such as "lineloc 3 shock cord hammockforums" - this brings up several search results leading to hammockforums.

Once I clicked on a couple of them, I was redirected NOT to hammockforums, but to "myfilestore.com" - which instantly starts downloading a "setup.exe" file (thankfully it can't open by itself!) and when attempting to close the tab/window containing the myfilestore.com site it pops up several dialog boxes basically asking if I really want to exit the page, or stay on it... This is a pretty typical pseudo-mal-ware dialog box and website, as it appears.

FYI I'm using the latest version of Google Chrome, and after scans with 2 different anti-virus and anti-malware programs I appear to be clean.

So I googled "redirected to myfilestore" - to see what was possibly going on... Lo and behold there are appears to be an "exploit" regarding vBulletin which exhibits this exact behavior (redirecting users to myfilestore, at least some of the time - sometimes just the first time they click from google to the vBulletin forum).

As I said, this just started 2 days ago, so it may newly affecting HF (or me, if I'm dead wrong!) - Here are a couple threads regarding the vBulletin exploit: Link #1 Link #2

If you have also been redirected, please post here so we know.

**gmcttr** · 01-22-2015, 10:25

I just tried a google HF site specific search and got the same redirect. Thanks for reporting it. I run a variety of blockers, so no auto download or pop-ups.

**JCinPA** · 01-22-2015, 10:32

I've gotten the exact same thing clicking on links in emails from Hammock Forum with my thread subscription notifications. I figured you must be aware of it, but I probably should have not assumed that and reported it.

The email from this site that says to view the new posts, click here --- the here gets hijacked to the myfilestore link.

-John

**tlfillingim** · 01-22-2015, 10:39

I get the same result from the Google search, but only the first time I click on the link from Google. I'm using Chrome. Once I closed the myfilestore tab and clicked on another link from the google results, it takes me straight to HF. I was already logged in to HF when trying this. Hope it helps.

**mudsocks** · 01-22-2015, 12:08

Thanks for bringing this to our attention. In the future please don't hesitate to contact an admin directly. While we monitor this subforum a PM will get our attention much faster.

The problem appears to be an older version of the YUI (Yahoo User Interface). I've added a bit of code to mitigate the problem while I research the exact vector used.

That's tech-speak for you shouldn't see the redirect anymore.

**Paul-Stefi** · 01-22-2015, 15:41

I get something like that every once in a while from a different site it pops up a second window for "Clean My Mac.com" when I try to close it pops up a dialog box that says are you sure you want to leave this page (Yes or NO) I wish I could block this pop up somehow. Any suggestions for Macs?

I am running safari and operating on Maverick

**SilvrSurfr** · 01-22-2015, 15:49

Originally Posted by Paul-Stefi

I get something like that every once in a while from a different site it pops up a second window for "Clean My Mac.com" when I try to close it pops up a dialog box that says are you sure you want to leave this page (Yes or NO) I wish I could block this pop up somehow. Any suggestions for Macs?

I am running safari and operating on Maverick

I am running Google Chrome on Windows and also get redirected to some kind of bogus anti-viral site - can't close the window or anything. I had to reboot.

**inspectorguy** · 01-22-2015, 16:54

I got it on a tablet a couple of times just yesterday. Thought it was just me. No ctrl-alt-delete on a tablet....

**L.D. Cakes** · 01-22-2015, 20:50

It's happening with firefox too. But no exe. file popping up since I have protection for that. Also redirects on my Droid. That's what clued me in that it was HF & not my computer. I reported it but admin said they were already working on it.