Is it just me or is Itstics popping up for everyone?

[mos]

Glad it's not just me

I did a full malware scan the other day and nothing was picked up then so methinks something is afoot either with my ISP (Virgin Media have had DNS & routing issues recently I've read) or at CUK towers as it's only happening with CUK ... I haven't tried it browsing the site on chrome yet.

Im vm too.

[mudskipper]

Im vm too.

I'm VirginMedia - have disabled adblock, still not seeing the problem.

[adubya]

All OK for me. VM customer, Chrome browser. I'm using Adblock Plus though so ads don't appear.

Edit: As per muddy above, I disabled Adblock and still no issue.

[bless 'em all]

When you say "Every time I try to get into the forums" do you mean when you visit the site, or when you log in?

I'm logged in all the time - just seen my new malware blocker stopped the divert.

IP-BLOCK 208.91.197.101 (Type: outgoing, Port: 49182, Process: chrome.exe)

The scan didn't return any results and the issue does not affect any other sites.

[administrator]

Cheers all. Still scratching my head on this one.

root@tyrant:/var/www/vhosts/forums.contractoruk.com/webroot# find . -mtime -30
.
./hmrc-ebt-enquiries
./.htaccess
./newsinclude
./newsinclude/news.xml

No files been tampered with on the site, just a couple of changes I made to the ebt thread to put a redirect in and the news include that is pulled from the main site.

Had another scan through the ad server, same there in terms of no files edited for the last 30 days that arouse suspicion and also nothing in the DB that has been the route for usual hacks with that system.

For those of you getting the redirect, could you do something like install liveheaders on Firefox, or install NF's favourite toy, Charles, and see where the redirect is happening. Is it happening before the headers for the forum are called or is the redirect coming when you have made the connection to the server?
https://addons.mozilla.org/en-US/fir...-http-headers/
Charles Web Debugging Proxy • HTTP Monitor / HTTP Proxy / HTTPS & SSL Proxy / Reverse Proxy

If you can post any output from these progs when you get a redirect it will really help us to track this problem down.

Congrats on the 1,000th post bless 'em all - sorry your post was for this, will knock a couple off for you if you like

[NickFitz]

Fired up one of my sacrificial XP VMs, with an HTTP proxy running on the Mac side to intercept everything going in and out, but couldn't get it to happen with IE8, Firefox latest or Chrome latest. I even installed the Java plugin and enabled it everywhere, as that's the dodgiest thing at the moment, but couldn't get any action. Couldn't see anything out of the ordinary in the HTTP logs either

On the bright side, it turns out there were unused icons on my desktop, so I was able to get that sorted out

[administrator]

Fired up one of my sacrificial XP VMs, with an HTTP proxy running on the Mac side to intercept everything going in and out, but couldn't get it to happen with IE8, Firefox latest or Chrome latest. I even installed the Java plugin and enabled it everywhere, as that's the dodgiest thing at the moment, but couldn't get any action. Couldn't see anything out of the ordinary in the HTTP logs either

On the bright side, it turns out there were unused icons on my desktop, so I was able to get that sorted out

Cheers for checking Nick, much appreciated. I have done the same with IE6-9 all on Win, tried on Linux VMs too but can't find anything suspicious. But seems to be too many people for there not to be something somewhere causing it. Anyone here NOT on Virgin Media getting it?

[ctdctd]

Also VirginMedia here - have disabled adblock, no problems.

Also tried IE with the popup blocker switched off, no problems.

W7 with FF 19 (FFS!) and IE9

[NickFitz]

Should have mentioned, I'm on Virgin Media: to be precise, cable broadband (as opposed to their ADSL service) in the part of their network that used to be NTL.

Just tried turning off wifi on the iPad and browsing the site via O2 - nothing interesting happened

[fullyautomatix]

Not happening for me. Firefox here with no adblock but have flashblock installed.

I am guessing this is a PC being infected issue.