F2Andy Posted January 20 Share Posted January 20 I left an RMWeb page open. When I cam back a few hours later, there was a message supposedly from McAfee saying my anti-virus had expired and I had to take action. This was undoubtedly a scam, and taking the action they wanted would have resulted in an infected computer. The browser had redirected me to a new web pae that used the domain eu.securitypatch.life . I would guess this resulted from one of the adverts on the page. Users should beware, admins will hopefully investigate and stop said adverts. 1 1 Link to post Share on other sites More sharing options...
F2Andy Posted January 26 Author Share Posted January 26 Happened to me a second time. This is the page it takes me too. Link to post Share on other sites More sharing options...
Moderators AY Mod Posted January 26 Moderators Share Posted January 26 There have been no other reports and it cannot be replicated here. Please run Malwarebytes or similar on your system rather than sending me barbed comments via the Report facility. 1 Link to post Share on other sites More sharing options...
Dungrange Posted January 26 Share Posted January 26 1 hour ago, AY Mod said: There have been no other reports and it cannot be replicated here. I've had something similar with regards a McAfee subscription, but I couldn't replicate it. I was on an RMweb page and it was replaced by a message about an out of date McAfee subscription. Hitting the back arrow in the browser (I use Chrome) returned me to RMweb. I'm not sure of the reason and there didn't seem to be any issues afterwards. It's happened about three times over the last month, but that's only a tiny fraction of a percentage of the number of pages of RMweb that I view, so it's not common. However, I haven't had the same issue on any other website. Obviously you can't fix what you can't replicate, and I can't really help identify the cause. 1 1 Link to post Share on other sites More sharing options...
georgeds Posted January 26 Share Posted January 26 I have had a potentially related issue happening via my work laptop. The work firewall blocks RMweb and flags it as potentially fraudulent after leaving the page dormant for a few minutes, Link to post Share on other sites More sharing options...
paulj Posted January 26 Share Posted January 26 Just for info this also happened to me about the same time. I'm using Firefox. Closed the browser and ran a Malwarebyte scan. Nothing detected. On the McAfee knowledge center (Document ID: 000001899) It says 'These types of messages aren't 'pop-ups' in the traditional sense. These messages are web push notifications that are generated from websites that aren't associated with McAfee'. It gives info on how to turn off web push notifications depending on your browser. Paul Link to post Share on other sites More sharing options...
Moderators AY Mod Posted January 26 Moderators Share Posted January 26 37 minutes ago, Dungrange said: Hitting the back arrow in the browser (I use Chrome) returned me to RMweb If you let me know the URL of that page I can look further. However, if there's any resident malware on a system it could be time-based or randomised rather than anything within the page. The recommendation to run Malwarebytes applies here too. Link to post Share on other sites More sharing options...
RMweb Gold Trofimow Posted January 26 RMweb Gold Share Posted January 26 I've also had this happen. I use malware bytes and not McAfee. A scan came up clean. Link to post Share on other sites More sharing options...
Redkiterail Posted January 27 Share Posted January 27 http://trackmenow.life/visit.php?k=909cf9d654e1a0e04b51e70df8b97b09&c=154&bid_id=65b4dbd93ea1b0e47eb6d0e7&xrtb_id=ZvUnr2aN6viw&pub=rmweb.co.uk&exchange=evadav-cpm-rtb-vo&ip=2.221.160.0&browser=&os=&cc=GB&time=1z7e0s6q3j5d1e5y7t8e0p0l3&browserv=120.0.0.0&site_id=rmweb.co.uk_4ba4327589e8351cc86269c3c600d417&sec_id=cd2c72029ec2e7da8c966c02608fc290&ifm_ori=&x_fwd-fip=1&scid_bak=1c41d66b534abcb1ae4074295f71c147&scip_bak=e2dd65e280e9b67dbcde2c2f0c6a3362&tmid_flg=MKTackwaNxjiM010M7TU3OQO0O0OO0O0O&click_type=eval if that helps Link to post Share on other sites More sharing options...
Moderators AY Mod Posted January 27 Moderators Share Posted January 27 4 minutes ago, Redkiterail said: http://trackmenow.life/visit.php?k=909cf9d654e1a0e04b51e70df8b97b09&c=154&bid_id=65b4dbd93ea1b0e47eb6d0e7&xrtb_id=ZvUnr2aN6viw&pub=rmweb.co.uk&exchange=evadav-cpm-rtb-vo&ip=2.221.160.0&browser=&os=&cc=GB&time=1z7e0s6q3j5d1e5y7t8e0p0l3&browserv=120.0.0.0&site_id=rmweb.co.uk_4ba4327589e8351cc86269c3c600d417&sec_id=cd2c72029ec2e7da8c966c02608fc290&ifm_ori=&x_fwd-fip=1&scid_bak=1c41d66b534abcb1ae4074295f71c147&scip_bak=e2dd65e280e9b67dbcde2c2f0c6a3362&tmid_flg=MKTackwaNxjiM010M7TU3OQO0O0OO0O0O&click_type=eval if that helps I would need the RMweb page URL, not the page it goes too plus, ideally what ads were actually showing. Link to post Share on other sites More sharing options...
MartynJPearson Posted January 27 Share Posted January 27 (edited) @AY Mod I had the same last night (19:27 ish if it helps with log file reviewing!) when visiting Chrome browser running on Windows 10. Edited to add that it has literally just happened (16:30) while I left the Cavalex Class 56 thread open - Definitely coming from that page as once on the scam page, the back button takes me back to the RMWeb page. Rogue advert maybe? Run Malwarebytes and that is coming back completely clear. Edited January 27 by MartynJPearson More information 1 Link to post Share on other sites More sharing options...
georgeds Posted January 29 Share Posted January 29 This is only happening to me on Rmweb. Across two machines. No other websites. And only when the page is left open for a while. 1 Link to post Share on other sites More sharing options...
hayfield Posted January 29 Share Posted January 29 On 26/01/2024 at 15:55, AY Mod said: There have been no other reports and it cannot be replicated here. Please run Malwarebytes or similar on your system rather than sending me barbed comments via the Report facility. Either yesterday or Saturday I had the same thing on my computer after leaving my computer on with RMweb running, I do have McAfee software since buying a new laptop and brought an annual subscription earlier this month. Clearly it was a malware, whether it came from RMweb or was just a phishing exercise I have no idea, certainly was not picked up by my McAfee or produced by them 1 Link to post Share on other sites More sharing options...
georgeds Posted January 29 Share Posted January 29 Happened to me again today. Left Rmweb open in two tabs while at work, came home and Mcafee spam page loaded. The back history for the tab goes back to Rmweb in both cases. I left around 20 tabs open across two browser windows and the only ones affected are RMweb, so I am personally satisfied that it is an RMweb issue rather than malware installed on my machine (I have 15 years experience in IT so would like to think I am qualified to spot/resolve malware). 1 Link to post Share on other sites More sharing options...
Moderators AY Mod Posted January 29 Moderators Share Posted January 29 3 minutes ago, georgeds said: so would like to think I am qualified to spot/resolve malware So which page(s) had you left open? Link to post Share on other sites More sharing options...
Mol_PMB Posted January 29 Share Posted January 29 I’ve had the same issue on two different PCs with different virus/malware software installed. It’s happened several times. Always when RMweb has been left open in the background and I’m looking at something else. Hence it’s impossible to say which adverts etc were showing at the time. Mol Link to post Share on other sites More sharing options...
georgeds Posted January 29 Share Posted January 29 6 minutes ago, AY Mod said: So which page(s) had you left open? It actually just did it in front of my eyes while I was typing the original response to this. Earlier today I'd left open this thread, ironically, along with the thread "when the real thing looks like a photo". Other tabs left open were variety of model railway suppliers, social media, pistonheads forum, youtube etc. 1 Link to post Share on other sites More sharing options...
georgeds Posted January 29 Share Posted January 29 3 minutes ago, Mol_PMB said: I’ve had the same issue on two different PCs with different virus/malware software installed. It’s happened several times. Always when RMweb has been left open in the background and I’m looking at something else. Hence it’s impossible to say which adverts etc were showing at the time. Mol Same here. I'm on my home/gaming PC now but experienced exactly the same thing on my work laptop as well. Link to post Share on other sites More sharing options...
Moderators AY Mod Posted January 29 Moderators Share Posted January 29 Anyway; it's been referred on to the ad-techs for investigation. 1 1 1 Link to post Share on other sites More sharing options...
IWCR Posted January 30 Share Posted January 30 Had this this morning, looking at the Penryn Castle thread at about 10.05, suddenly just went into the McAfee page, clicking return put me back in the whats new index where I had been before the Penryn page. Pete Link to post Share on other sites More sharing options...
Moderators AY Mod Posted January 30 Moderators Share Posted January 30 20 hours ago, AY Mod said: Anyway; it's been referred on to the ad-techs for investigation. Quote I have been live monitoring this for two days and have yet to see any such ad crop up, so there is not much I can do. If the issue persists, please request the URL linking to the advert, and I will be able to do some deeper digging. So we'll need more/better information on any observations. Link to post Share on other sites More sharing options...
bbishop Posted January 31 Share Posted January 31 Andy, just now I had just left "The Night Mail" and was about to enter "Wright Writes". Went upstairs to get some information, came down and the screen was plastered with MacAfee warnings, Bill Link to post Share on other sites More sharing options...
Dungrange Posted February 3 Share Posted February 3 The above page popped up whilst I was browsing the thread below just a few minutes ago. I think this is the only time it's popped up whilst reading a thread - the other times were when I wasn't actively browsing. Link to post Share on other sites More sharing options...
daltonparva Posted February 3 Share Posted February 3 11 minutes ago, Dungrange said: The above page popped up whilst I was browsing the thread below just a few minutes ago. I think this is the only time it's popped up whilst reading a thread - the other times were when I wasn't actively browsing. i've had this twice in the last few days on my chromebook. Link to post Share on other sites More sharing options...
Moderators AY Mod Posted February 3 Moderators Share Posted February 3 The common behaviour seems to be if a page is left open. The critical thing would be to find what Google ads were displaying before the pop-up is spawned. I accept this is a difficult thing to pin down For anyone who has had these pop-ups; do you actually have McAfee on your system or not? Link to post Share on other sites More sharing options...
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now