Possible Hack

[cessna152towser]

I was in the middle of reading a thread on RMWeb a short time ago when I was interrupted by a new screen which said "You have visited an insecure site which has been affected by a virus.  Your personal information and banking details are at risk".   This was followed by a "McAfee" pop up saying five viruses had been detected and asking me to click to remove the viruses.  When I did so it said "Your McAfee anti-virus protection expired on 22nd July 2022.  Click here to renew subscription".  I knew this was untrue as I renewed it recently.   This box refused to click away and my computer froze.   I eventually clicked the renew button and just as a new page was opening I immediately shut down my computer, as I suspect this would have been the page which would have loaded malware.   I re-started and ran my McAfee which confirmed I have no viruses and my subscriptions are up to date.   Just sharing this as a warning in case any other RMWebbers receive the same.   

 

Edited October 8, 2022 by cessna152towser
typo

[AY Mod]

I haven't had any other reports to date.

 

Have you run Malwarebytes? It's better than McAfee at this sort of thing.

[woodenhead]

@cessna152towser Did you share the page link with @AY Mod so he can check what's in that page in case someone has shared/linked something that perhaps links through to somewhere decidedly more dodgy that an RMWeb Wheeltappers Politics attempt on a Saturday evening.

[cessna152towser]

Sorry I didn't share the page as I did not immediately return to RMWeb on re-starting my PC.

If I recall correctly it was in Prototype Questions, on the thread "Naming a Locomotive.....is this a British Thing?".   During my reading of the thread I clicked on several links and was just in the process of reading the final post when the thread was replaced by the annoying message.

[woodenhead]

There's only one set of links that I could see there to a Swiss site for loco classes, Norton didn't flag any problems, however, I did have all the scripting on the site isolated.

[cessna152towser]

I have just had the same thing again this morning - while I was reading the most recent post in the Accurascale FNA-D thread.    This is a thread which I had also visited yesterday before I visited the Naming of Locomotives thread.   Will pm Andy.