Hi,

I noticed on my iPad (first Gen.) that since some days here on every click on a thread a new window open with SPAM, PUP, SCAM, etc. sites open. The same on my android tablets. For the iPAd there is no Add-Blocker, so I can't stop it. For the Tablets the is an possibility with a special web-browser.

The question is, why you do this? Give this so much money or is this a form of hijacking?

Kind regards

Manfred

It seems something might be wrong with your browser. Use the AdwCleaner from Malwarebytes and see if this helps.

No, not possible on an iPad.

I echo the suggestion about "running a check of your platform". I also get this stuff whenever I browse without ad-blocker(s) enabled, but on my end those annoying windows open just on the first click.

Also, as a webmaster+community manager myself, I'd like to say that more often than not the administrators do not literally handpick what kinds of ads get displayed on the website. It's done by the companies "we" rely on; can't tell you how many times I had to contact those guys to get rid of porn ads which would sneak in every once in a while.

I just disabled my Adblocker and clicked on a few threads, which opened without any spam, PUP, or scam windows.

You are right, i forget to tell that this happens only when I am nog logged in.

I'm using the iPad when sitting in the kitchen and then often I forget to log in.

I also noticed the recent pop-ups that have started to appear on this site. I am using a laptop with Avast free anti-virus. It just started happening a few days ago. Never happened once before. Very weird!!!

These popups are because you've gotten some kind of malware. Reset your iPad to factory defaults.

Kaspersky is filling up with this every time I visit the site today.



18.11.2017 17.13.29;Download blocked;http://forums.ffshrine.org/clientscript/yui/yuiloader-dom-event/yuiloader-dom-event.js?v=423;HEUR:Trojan.Script.Generic;http://forums.ffshrine.org/clientscript/yui/yuiloader-dom-event/yuiloader-dom-event.js?v=423;Firefox;Trojan program;11/18/2017 17:13:29

My free Avast ant-virus and Malwarebytes programs are saying the domain of this site (coinhive) is malicious. I don't know what is going on but it just started happening a few days ago!

SSL?
What do you think...

UBlock Origins also registers Coinhive as malicious and blocks it. I can get on this site from my PC with no issues but when I try to access from my android web browser I'm continually bombarded with pop-ups or hijackers. And no my phone is not infected with malware. I have both Malwarebytes with real-time protection and Avast installed and neither detect any threats present. The only site where this occurs is here.

I'm getting it now too, on PC, iPad, and Android.

Hi, I would like to add to the list of things popping up.

For me, it`s something called Brocoiner, Windows Defender pops up with it every time I open FFShrine and the process for the tab that is FFShrine hogs the CPU to 90% - 100%.

Aaaaalso, I`ll add that I`m using Mozilla`s Firefox Quantum (not that I wanted the update, but oh well, it IS faster, I had no complaints until Win Defender started popping up). I can`t say if it`s connected (some security leakage on Firefox`s part), but this Brocoiner thing popped up after the update to Quantum, and is popping up as soon another tab with FFShrine is opened.

YIKES. I never noticed the CPU but it's definitely happening. This website is maxing out a Core i7-4960x on all cores any time it's being viewed.

The moment you leave the website, it drops back to idle. You come back, you're at 100% instantly.

Brocoiner is a cryptocurrency miner. Somebody is using us to mine Monero coins.

It seems the only way to mitigate the CPU maxing out thing is with real-time web protection software, which blocks the intruding "software" immediately. I installed Malwarebytes`s Trial version, that helped ( :scratching-head: to be honest, I don`t know how I forgot to install Malwarebytes after the last fresh OS install).

It also reported coinhive.com as a Domain from which are these intrusions originating.

I'm on Windows 7, adbocker on my browser, Microsoft Essentials for real time protection. It keeps reporting and quarantining this when I visit the shrine:
Trojan:HTML/Brocoiner!rfn

Yes, I confirm too. Some streaming webs are mining coins using this new method, and this forum too it seems. My firewall block the intrusion everytime.

The log say:
https://coinhive.com/lib/coinhive.min.js
JS/CoinMiner.F

^ this link is the source of the mining listed in my antivirus, blocked by default by Adblock or uBlock.

I use uBlock Origin. All fine and dandy.

Nice bitcoin miner you've been trying to load on this site.

uMatrix add-on lists a script called "coinhive.com" on FFShrine. Lul. Admins better get rid of that crap quick.

I actually have no real issue with allowing them to use my cpu when im on the site as a way to help the site. I can't let them use 100% though. That's ridiculous along with the fact that it doesn't tell you it's happening. It's a cool idea to help a site pay the bills just by using a some of your cpu. It needs to be a choice though.

1. Tell users that this is going to happen.
2. Give them the opportunity to opt out.

I access FFshrine from a laptop most of the time. This 100% CPU usage utterly murders the battery, and on top of that regularly running a CPU at full load will eventually shorten its lifespan. I've got work to do, which is now being done slower. (I tend to browse the site while waiting for encoding tasks to be done. Now I can't do this.)

I really hope this is a hack and not a deliberate policy.

Ads are annoying but understandable. This is a step too far.

Get in touch with Sarah and tell her about this, folks, I think that's the best thing you can do.

looks like malware was injected somehow, investigating so i can clean it up now. scans may take a bit but they're started

this is definitely not something we'd ever put on the site intentionally fyi.

I'm not getting Kasperky notifs any more so it must have been fixed.

Looks like its resolved here!

Well, removing the malware is the first step. The next is figuring out how it was injected in the first place - otherwise it will just happen again.

The most likely suspect would be any out-of-date software that the website is using.

Firefox CPU usage now at 0.2%.

A million thanks. :)

Hooray, I can now browse the site without those spoopy viruses! Thanks!

The pop-ups issue seems to be thankfully resolved!!! Much appreciated!!!

Can finally access from my phone without pop-ups and forced redirects. Glad to see the issue has been resolved, hopefully permanently.

Right, can browse without any pop-ups and redirects. Thanks for the fix!

At last the pop-ups are gone. Much appreciated!

Looks like the pop-ups are back. I'm not getting the miner at the moment, but I am getting endless fake Microsoft error pages and various other crap. :(

Use adblocker, people. It's only a click away and it does wonders.

still getting them on Edge which is not a surprise
Chrome seems fine.

Yep, the pop ups are back!!! This is not good!

Okay, I'm starting to think this all your fault for not using adblocker.

It's really not that hard.

i was going to point the complain. Suddenly every link i click in the forum goes to spam websites and such

i'll continue investigating what might be causing this & how they're injecting code. will post updates as they come

They're back.

hxxp://mfio.cf & hxxp://besti.ga this time.
this definitely looks like malware &/or a back-door worm/rootkit (leaning more towards local-side rootkit; Avast is not warning me about anything malicious.)

Okay, I'm starting to think this all your fault for not using adblocker.

It's really not that hard.

Adblocker is great, of course, but don't you think it's worth solving the underlying problem - someone hacking malware into a website which is then distributed to the website's users - rather than blaming people for not having software that (hopefully) stops the bad stuff at the door?

Adblocker is great, of course, but don't you think it's worth solving the underlying problem - someone hacking malware into a website which is then distributed to the website's users - rather than blaming people for not having software that (hopefully) stops the bad stuff at the door?

Of course, I'm not saying to not solve the problem - I'm just saying if people had an adblocker it'd never have happened to them in the first place. I have one and I never noticed anything.

At first I wasn't sure it is this site but I got on my laptop but I got some browser-ransomware-thing popup. Now on my PC I got some pop-ups too and also this antivirus message:

Confirmed, the miner is back.

Of course, I'm not saying to not solve the problem - I'm just saying if people had an adblocker it'd never have happened to them in the first place. I have one and I never noticed anything.

I have one too (Adblock Plus) and it didn't stop Kaspersky spitting out the "Threat Blocked" message until a couple of days back, so I'm assuming some sort of forced redirect was embedded into the site's code itself.

I have one too (Adblock Plus) and it didn't stop Kaspersky spitting out the "Threat Blocked" message until a couple of days back, so I'm assuming some sort of forced redirect was embedded into the site's code itself.

I use uBlock Origin and never had any issue.

I use uBlock Origin and never had any issue.
Which doesn't work on mobile without root. Oddly, I wasn't get any issues on mobile until today, where every "click" tries to redirect or gives a popup.

Of course, I'm not saying to not solve the problem - I'm just saying if people had an adblocker it'd never have happened to them in the first place. I have one and I never noticed anything.

adblocker is not going to prevent trojans, viruses, etc. which is what I was getting here afew days ago. Are you sure you arent getting infected?

adblocker is not going to prevent trojans, viruses, etc. which is what I was getting here afew days ago. Are you sure you arent getting infected?

Yes, because the shit comes from ads that display in the Shrine, and thanks to my adblocker I'm not getting any. :)

I have Adblocker too, and it wasnt preventing infections. Microsoft Essentials was processing infections when I visited here. Not getting indications of anything today.

Initially, viewing site in Safari running Ublock Origin 1.14.14 I experienced constant page redirects and a sudden CPU spike necessitating closing the tab. However, I added the following domains to Ublock's filter list…

coinhive.com
besti.ga
mfio.cf
oei1.gq

…and the redirects and CPU spike no longer seem to be an issue.

I've experienced no issues whatsoever viewing site with Chrome (for Mac) running Ublock Origin 1.14.18.

Something has been clearly hacked on the website. For years I never needed adblocker or any crap like that.....
Anything I do on this forum is opening spam over and over again-. and no, Its my problem, on my end. this is only happening in here.

I've experienced no issues whatsoever viewing site with Chrome (for Mac) running Ublock Origin 1.14.18.

Same, except on PC. I'm using Chrome + uBlock Origin (which is an addon just like Adblock but apparently less of a resource hog), and I've had no problems with ads, CPU explosions, redirects, anything; the site runs normally. This combination hopefully will work for others!

Well, now any link click triggers a pop-up which sends Firefox into a resource-hogging freeze. Disabling Javascript entirely stops it. However, this forum and/or its server is INFECTED with the AdWare causing these link pop-ups.

Hi everyone,

Everytime i click, it opens a new window :

(https://www.hostingpics.net/viewer.php?id=841055popup.jpg)

Can i authorize this "deloton.com" ?

Thanks.

--------------------

I found this : https://malwaretips.com/blogs/remove-deloton-com/

but it seems very complicated :(

---------- Post added at 05:25 AM ---------- Previous post was at 04:41 AM ----------

I have installed Malwarebytes and i have "WITHOUT INTERRUPTION" this messages :
(https://www.hostingpics.net/viewer.php?id=626938mal1.jpg) (https://www.hostingpics.net/viewer.php?id=297527mal2.jpg)

There's 2 malwares on the site :
deloton.com
go.pushnative.com

Hi everyone,

Everytime i click, it opens a new window :

(https://www.hostingpics.net/viewer.php?id=841055popup.jpg)

Can i authorize this "deloton.com" ?

Thanks.

--------------------

I found this : https://malwaretips.com/blogs/remove-deloton-com/

but it seems very complicated :(

---------- Post added at 05:25 AM ---------- Previous post was at 04:41 AM ----------

I have installed Malwarebytes and i have "WITHOUT INTERRUPTION" this messages :
(https://www.hostingpics.net/viewer.php?id=626938mal1.jpg) (https://www.hostingpics.net/viewer.php?id=297527mal2.jpg)

There's 2 malwares on the site :
deloton.com
go.pushnative.com

Um no

Yup, it's back, Kaspersky is blocking malicious links and code on this site.

Yh, Its a Joke... if these sort of things keep happening... whats the point.

Shut your Mouth when you don't have anything constructive to add to the Thread ? kthxbye.

Can confirm it's back

Can confirm Avast is working perfectly to block infections on the go, BTW, but yeah, pop-ups on every link and page

Noticed today the chrome extension No Coin is showing a coin miner again detected on the website with uBlock showing coinhive.com on the list.

Until I saw this thread I thought it was just me
I hope they fix it soon, I like to come here sometimes...

The forum administrator was able to fix it somehow but then it started up again after 2 or 3 days. If you have some type of anti-virus or malware/ ad-blocker on your computer, you should be protected but there will still be constant pop-ups informing you that malicious programs have been blocked.

No matter if you get pop-ups, similar or nothing at all. If you are not sure if your system is clean, it is never wrong to run a scan with the program Malwarebytes.

https://www.malwarebytes.com/

I don't think I have to mention that you should always have your browser updated to the latest version regarding security updates.
A reasonable AdBlocker and correctly adjusted NoScript have already been mentioned enough.

Of course, this doesn't make the problems disappear directly from the website, but you don't want to risk getting them on your own system., right?

Is it 100% confirmed that the spam websites infecting this website are trojans?

Luckily I have AdBlocker and MalwareBytes---MB was able to inform me about the coinhive website that kept gettig blocked every time I visited this website, but even when I was visiting other normal websites, MB still kept informing me that the coinhive website was getting blovked...should i be concerned??

^

Why is Malwarebytes blocking CoinHive? (https://blog.malwarebytes.com/security-world/2017/10/why-is-malwarebytes-blocking-coinhive/)

Stealth web crypto-cash miner Coin Hive back to the drawing board as blockers move in (https://www.theregister.co.uk/2017/10/19/malwarebytes_blocking_coin_hive_browser_cryptocurr ency_miner_after_user_revolt/)�

Yeah, it must have been this coinhive, a JavaScript which "monetizes your business with your users' CPU power," which triggered FireFox to hog over 90% of my CPU. Script and ad blockers are good, but just disabling JavScript altogether kills everything which exploits scripts.

If you use FireFox, enter "about:config" in the URL bar, then type in "javascript" into that search bar, scroll down and toggle, "javascript.enebled" to "false" before entering the forum. Then toggle it back to "true" after you leave. It's a bit of a fiddle-around, but it does kill EVERYTHING exploiting scripts.

So i guess i have nothing to worry about when it comes to coinhive, but it doesn't seem like anybody answered my first question:

all these other spam websites/ads infecting the site...are they trojans??

A Trojan is a viral program which disguises itself as something else...like, "Your Flash plugin is outdated, download it here"...so, unless you download something these random AdWare pop-ups, it shouldn't be an issue.

Thanks for the work around way, daypass. Worked perfectly :)

This morning the Pop ups and redirects are back on my iPad first generation. But now also when I am logged in! Thanks daypass! I disabled Javascript in the Safari settings and it seems to be helping. I don't now what happen here on the site, but this is really bad!

My AdBlocker in Chrome has been catching that a coin miner is trying to run when I load pages here the last few days, but I have the option of ignoring the script.

Happening to me too. My %CPU is at 400% when on this site.

EDIT: Installed NoCoin and no more throttled CPU. No Coin says that there was an attempt to run a coin miner.

I had to install noscript for firefox to stop this from happening

I'm now getting notifs telling me that downloads are getting blocked from the following domains:

mfio.cf
oei1.gp

It seems that something is trying to bypass my ad blocker.

I had to install noscript for firefox to stop this from happening

explain to me how you did it and where to get it?
is it really safe? you are not shitting me right?
so please, help me with that.

explain to me how you did it and where to get it?
is it really safe? you are not shitting me right?
so please, help me with that.

NoScript is legit. I use it myself alongside uBlock Origin. Hell, I didn't know there was an issue until I saw these threads popping up.

Just so you know, if you do install it, you'll have to allow every site you visit because NoScript blocks everything by default. It's simple.

Example: I've only allowed ffshrine.org
If you want to remove that notification that pops up, just go to options and uncheck "Show message about blocked scripts":

Just be smart about what you allow.

Edit: Removed direct links. You'll have to Google it yourself, it's on Firefox's Add-ons. Check version history for older versions if you haven't upgraded Firefox.

uBlock Origin: Firefox (https://addons.mozilla.org/en-US/firefox/addon/ublock-origin/), Chrome (https://chrome.google.com/webstore/detail/ublock-origin/cjpalhdlnbpafiamejdnhcphjbkeiagm?hl=en), Safari (https://github.com/el1t/uBlock-Safari/releases)*.

* add the domains coinhive.com, besti.ga, mfio.cf and oei1.gq to Safari's uBlock filter list.

I had to install noscript for firefox to stop this from happening


NoScript is legit. I use it myself alongside uBlock Origin. Hell, I didn't know there was an issue until I saw these threads popping up.

Just so you know, if you do install it, you'll have to allow every site you visit because NoScript blocks everything by default. It's simple.

Example: I've only allowed ffshrine.org
If you want to remove that notification that pops up, just go to options and uncheck "Show message about blocked scripts":

Just be smart about what you allow.

Edit: Removed direct links. You'll have to Google it yourself, it's on Firefox's Add-ons. Check version history for older versions if you haven't upgraded Firefox.

you both were right. thanks for your solution to it. :)

This is starting to get ridiculous. Now whatever is going on with this site is trying to force it's way past my adblocker. Someone really needs to do something about this.

---------- Post added at 01:20 AM ---------- Previous post was at 01:18 AM ----------


I'm now getting notifs telling me that downloads are getting blocked from the following domains:

mfio.cf
oei1.gp

It seems that something is trying to bypass my ad blocker. My Ublock's logger lists those as well. Along with Coinhive and another unknown domain address

Still getting it, and now apparently there's bitcoin-mining malware on the site.

Here's the specific link being blocked by Kaspersky: forums.ffshrine.org/clientscript/vbulletin-core.js?v=424

The site is clearly infected, guys.

Using noscript or so is definitely not the right way to get rid of this issue. If ffshrine server is indeed hacked by someone and got these ads and malware implanted, then the security of the username/password database is questionable. I highly suggest one to at least use unique random password to avoid potential data breach, so that even the account in this forum is stolen, other accounts will remain unaffected.

Also, miner script filtering plugin is purely blacklist-based, using antivirus software is better because they do better pattern matching job.

So after days of trying to figure out what's up with my PC (100% CPU utilization), countless scans with AV and Malwarebytes, I land here. This one was tough to narrow down (for me) because I always have a dozen tabs open in my browser and never thought it would be website specific (but thought something infected Chrome). I eventually noticed that it was happening when I would resume a session instead of using a new one. I double-checked this by using other browsers (Chrome, Firefox, IE, Edge, etc.) and it's clear that it's specific to ffshrine forums.

I can confirm what others are saying, the site is definitely infected by something which is trying to use PC resources to mine something. So far, it keeps trying to connect to;
-deloton.com
-coinhive.com
-go.pushnative.com

Hopefully the admins can fix this but it seems to be an outstanding issue for over two weeks now. Whatever was done to remedy the situation before didn't seem to take (maybe someone is purposefully sabotaging the site?). The only thing I can say to others is to avoid giving the solution of "use blockers" as that doesn't get to the root of the problem. If you have spoiled food in a restaurant, the solution isn't to tell diners to make sure they have all their vaccinations up to date (despite it being a good idea). You find out what's spoiled and throw it out.

Good luck to the admins, I'm a big fan of the site and I really hope they can find the cause. It may be prudent to setup a PSA on all pages to alert users until the problem can be eliminated.

I'd suggest using coin miner blockers. There are many, even on Firefox (old one that I use now, haven't changed into Quantum) and Chrome.

Browse some using addon option (Firefox, my suggestions: NoMiner, AntiMiner, or Block Coin Miner) or Extensions (Chrome, my suggestions: Anti Miner, MinerBlock).

Well, my suggestions are on the basis of ratings alone. Please choose whichever suits you best :D

Oh I forgot, keep on using adblocker. uBlock Origin does the job well in detecting coinhive scripts and some scripts mentioned here.

Well, always keep your antivirus on :D

The forum is definitely infected. I barely log onto google (my home page) and malwarebytes blocks off a certain IP like 94.130.129.235 (there's a couple 4 or 5 more that get detected) and it comes from Germany with coinhive or something. If someone knows a good fix to completely remove these, i'd appreciate it.

Sooooooooooooooo... is this going to be fixed soon? Seriously. What's going in?

Sooooooooooooooo... is this going to be fixed soon? Seriously. What's going in?
Sarah says she was out of town. This will be fixed soon. (hopefully for good this time?)

Seriously everytime I come on here the site lags and windows keep popping up.its really pissing me off, that is one of the reasons I don't come on here anymore

I'm getting the high CPU usage still. There is a Chrome extension called No Coin which you can use to block the mining, but I believe it only blocks coinhive.com at least for now.
So is the mining definitely not added by the admins of the forum? If it was I'd suggest that you should be able to reduce the amount of CPU power it uses (I found an article all about the issues with CoinHive on Pirate Bay), though from what you guys are posting I assume it's not from the admins.

Disable JavaScript (scripts) in whatever browser you are using before entering the forum. Turn JavaScript (scripts) back on after you leave.

https://productforums.google.com/forum/#!msg/chrome/BYOQskiuGU0/5PRO2P-1WWwJ

What's is the website owner's response to this? Are they unaware there are bitcoin mining scripts running or is this an alternate to advertising revenue?

What's is the website owner's response to this? Are they unaware there are bitcoin mining scripts running or is this an alternate to advertising revenue?
Thread 220616

It would be nice if you guys could read the thread, or at least the page before going "Oy Vey, what do I do?"

As has been stated several times: uBlock Origin, No Script, No Coin.

Block these (do not click the links you troglodyte):

inline-script & frame http://horoskopishqip.org/blog/haxored4.php
inline-script http://horoskopishqip.org/blog/haxored.php
script http://www.google-analytics.com/ga.js
xhr http://gjol8ib0.website/1082464/
script https://coinhive.com/lib/coinhive.min.js
xhr http://1wzfew7a.site/1082464/
xhr http://cd8iw9mh.cricket/1082464/
script http://besti.ga/
xhr http://mlvc4zzw.space/1082464/
script https://go.mobtrks.com/notice.php?p=...interstitial=1
script http://go.onclasrv.com/apu.php?zoneid=1423030
script http://go.onclasrv.com/apu.php?zoneid=1423030
script http://mfio.cf/
script http://oei1.gq/

Lol, no official announcement by owner or staff or moderators.

Initially, viewing site in Safari running Ublock Origin 1.14.14 I experienced constant page redirects and a sudden CPU spike necessitating closing the tab. However, I added the following domains to Ublock's filter list�

coinhive.com
besti.ga
mfio.cf
oei1.gq

�and the redirects and CPU spike no longer seem to be an issue.

I've experienced no issues whatsoever viewing site with Chrome (for Mac) running Ublock Origin 1.14.18.

This definitely stops the runaway CPU usage, but Norton is still detecting and deleting a trojan on just about very page

Lol, no official announcement by owner or staff or moderators.
It's pointless to do such thing, you are the living proof of it. Idiots like yourself don't even bother to read the whole thread before posting, otherwise, you would have known that the webmaster of ffshrine is aware of the issue still… "Persisting". Moderators can't do shit about it and personally (let me stress that again, personally, I'd rather not have any interaction with the Big Boss of the Shrine, so don't bank on me to get in touch).

@Jediknight12:
Woah! Why don't you put a "4K" .gif in your signature, while you're at it? Last I heard, there were certain guidelines to follow for the signature. Jesus, can't believe you've yet to be reprimanded for the size of your animated image… Or maybe you've got reprimanded and just didn't care, that would be even worse.

Several people have mentioned it already, just install the uBlock addin. No, it won't solve the underlying problem, but it will solve it locally. I've checked my uBlock logging, and it's actively blocking the coinhive redirect. Other than that, I have zero issues. Laptop is purring like a kitten... No lag (except when JediKnight12's signature appears.. I feel your pain Leon Scott...), no freezing, no CPU peaks, nothing of the sort.

I'm running Sophos for Mac and Malwarebytes locally, and the HTTPS Everywhere, Privacy Badger and UBlock Origin plugins for Chrome. Yes, that's a lot, but that's probably what keeps me clear from these issues ;)

This definitely stops the runaway CPU usage, but Norton is still detecting and deleting a trojan on just about very page

lrn2read

Oh, alright, so then nobody should bother following up or try to get updates on the situation. You're totally right, just make sure we're all wearing condoms but pay no attention to who (or what) you're having sex with. Sounds legit.

If a lot of people aren't aware of the site owner's position on something, chances are, it's because it wasn't communicated well. There's radio silence for the last 2 weeks, no timelines, details, etc. other than it's being looked at. Imagine walking in to a store and asking a question and getting a response of "Hey, our CEO already commented on that during the last quarterly call, can you people not read/listen". Yeah, I know, free website and all, not the same thing. The point is approach and effectiveness isn't improved by defensive attitudes towards feedback. Would an official post/banner/etc. help get the word out and keep others informed? The answer is simple. Would people still ask questions? Yes. Would you still be better off? Yes.

The irony of the whole situation is that people trying to help are suggesting answers that reduce revenue for ffshrine (by blocking ads and everything else with it). At the end of the day, you want to encourage traffic and ease of use, it's just something that can't be done right now until the site is cleaned up.

I keep getting f_000107 is not safe and has been removed every time I go anywhere on this site, this does not happen on the internet when browsing only on here

according to norton - PUAJScoinminer

See Thread 220616

I’m getting coinhive has been blocked.

sorry for the delay. still working on sorting out how it got in there & removing it. it's been injected in multiple places.

@Sarah: I've searched through this thread and haven't seen anything about the group pages' current inaccessibility. Do you expect that they'll come back?

EDIT: All links under "Settings" are also kaput.

Same here. AVG Anti Virus detects a coin miner.

Same here. AVG Anti Virus detects a coin miner.

See Thread 220616

addressed it in the other thread, it should be resolved now.

continuing to work on the miner issue, they injected the code in a bunch of places and it's been a pain to find them all.

Seems to be gone now? Hopefully that's the last we'll hear of it. Thanks for all the effort, I'm sure it's not easy.

Thanks for the fix dood, really.

Stay on the lookout, Sarah in case they come back like last time.

Your hard work keeping this forum operating is greatly appreciated!!!! Thanks so much and take care!

Thank you for annihilating the lil' devils!

First time in a while I haven't gotten a coin miner warning... is it gone now? I hope so.

^_^ great news. Our Home has been Cleaned-
I doubt I am the only feeling this place as second home.

Yes, the pop-ups are gone, and I don't see any coin miner processor hogging, either. Many thanks, Sarah!!

It's back, folks.

It's back, folks.
Not seeing anything on my end.

I cant even see my end. But I'm not seeing the popups, maybe because of addblocker.

Yeah, I have uBlock Origin and have never had problems with ads or bitcoin mining.

I'm going to try one of these ad-block programs because the pop-ups on the forum are a real pain and my free version of Avast isn't doing anything to prevent them!!!! Is uBlock Origin compatible with Windows 7/ Mozilla Firefox? Thanks for your help!!

Actually my Adblocker was disabled. Had something called Webmail Ad Blocker running, so I turned that off to see if that was preventing popups here. Havent gotten any popups, so something else must be preventing them, or something in your system is allowing them.

Been having them for quite some time also. :(

I haven't been on the website for a little while now. Looks like the bitcoin issue is gone but now I'm getting ads of straight up porn. This is ridiculous...
Is anyone else getting these ads? They open in a new tab.

I'm also getting popups now while navigating the site. This was not the case last month. I can't say anything has changed on my end.

It's back again huh, I thought something was wrong when I found this forum down yesterday. Now each time I click somethin it opens tabs to fake junk.

any updates??

Fix it now

Yes, please stop this - it's REALLY annoying!

Whenever I enter ffshrine KIS warns me about a 'download blocked'. Please fix it. <3

Use uBlock Origin. This site works like a charm with it.

Use uBlock Origin. This site works like a charm with it.

I use uBlock Origin. Avast still goes off every time I visit this site, and often refuses to load pages here after that initial alert.

Oh, and if I decide to check on this forum from my mobile, every click results in a new page loading an ad. It's really beyond annoying now.

I am unable to visit this site on my iPhone anymore. For a while, I was used to the usual double pop-up (where you have to tap the X twice to close out of it) after 10 seconds on it, and tapping on a thread results in opening a new window for ads. But yesterday, a pop-up came up that basically hijacked my browser. Behind the pop-up was some web page going on about how my phone had been hacked or whatever. Here are the things I tried to free my phone from being held hostage that didn't work:

1. Closing out of the pop-up, which would just freeze Safari and sometimes crash it.
2. Closing out of the Safari app entirely, which resulted in the page just reloading and the pop-up coming back.
3. Shutting down my phone with the "hold both buttons" method, which resulted the same as #2.

I beginning to think I'd need to find a way to close out of my Safari tabs remotely somehow outside of the app. It was honestly starting to worry me, because I thought Apple products were virus-proof and I was going to lose my phone--or at least the Safari app--to a stupid "virus" from visiting one of my only favorite sites.

The final solution: close out of the Safari app, open it up again, IMMEDIATELY switch to the view that shows all the currently open tabs, and start swiping left as fast as humanly possible. I finally closed out of the hijack page before it had a chance to load.

This has been going on for months. Like others have said, it's a problem on my computer too, but I am using uBlock Origin. Every time I return to the homepage I get an "Error: Connection has been reset" message or something along those lines. If I wait 5-10 minutes, I can come back to the homepage again. This is getting ridiculous. Why hasn't a solution been figured out yet?

Yeah I haven't used the website on my phone so I can't say what that's like. It seems like there's less porn ads but they're just replaced with other just as annoying ads unfortunately. I've decided to install Adblock, which I'm pretty sure is secure and it works well.

Also, a tip for closing the tabs that open: try turning off your Wi-fi/mobile data after closing Safari, so when you reopen Safari the websites aren't able to reload. Just a simple workaround but I guess it's better than having to swipe like crazy to close the tabs haha.

this has been occurring for almost a month now, how has this not been fixed yet??

still not fixed yet...

Why aren't you fixing this

Can ANYONE please fix this issue? Maddening that it has taken this long!

Can ANYONE please fix this issue? Maddening that it has taken this long!

What I still don't get is that people keep casually posting on other threads as if nothing unusual is happening...

What I still don't get is that people keep casually posting on other threads as if nothing unusual is happening...
Those users probably have installed add-ons such as uBlock Origin and the likes (the forums "looks" and "behaves" absolutely fine with it, at least on my end. Nothing. Zero. Nada)� Or they simply don't care, as long as they download what they want, haha.

At any rate, I remember stating this elsewhere, but notify Sarah about this (still) occurring issue, most likely the only person who can do something about it.

Those users probably have installed add-ons such as uBlock Origin and the likes (the forums "looks" and "behaves" absolutely fine with it, at least on my end. Nothing. Zero. Nada)� Or they simply don't care, as long as they download what they want, haha.

At any rate, I remember stating this elsewhere, but notify Sarah about this (still) occurring issue, most likely the only person who can do something about it.

I could be wrong, but I think I recall seeing some users post that they still got warnings from their anti-virus programs from this site even with uBlock Origin...I'll have to check again.

I was going to message Sarah but she hasn't been active here for a month or so, apparently.

I could be wrong, but I think I recall seeing some users post that they still got warnings from their anti-virus programs from this site even with uBlock Origin...I'll have to check again.

I was going to message Sarah but she hasn't been active here for a month or so, apparently.
You're not wrong, there have been users who said so, but I think they've been already… "Infected" probably isn't the most correct word, but nothing better comes to mind right now. I'm going to share what I use:

- Windows Vista (Home Basic Edition)
- Mozilla Firefox ESR (Extended Support Release) v52.7.3
- Disconnect (https://disconnect.me/) v5.18.21
- uBlock Origin (https://addons.mozilla.org/firefox/addon/ublock-origin/) v1.16.2

Never had annoying pop-ups from this place, nor spikes in CPU usage. Let's hope it's not another malware injection.

As for Sarah, I don't know where else to contact the boss; you might still want to give a try to private messaging, maybe e-mail notifications are enabled.

Obviously the ffshrine authorities know about this, so the fact it still happens means it's being done with their consent. It's probably a way to monetize the site.

This site has become a joke now.

Now I'm getting a bloody Mackeeper auto-download every fricking time I click on anything here. I have to close the spam windows just as they're opening, with some very quick key strokes. Luckily my fingers are nimble, but this is beyond ridiculous now :(

Can you folks install/use ad-blockers on whatever device you currently use to browse the forums?

I'm not getting nasty pop-ups, etcetera, but I browse from a PC with ad-blockers installed. Once again, Sarah is seemingly the only one who can try to fix this issue, should still have a Twitter handle, too.

This site has become a joke now.

and you noticed that after 7 posts?
Solution: Don't visit here anymore....

I would never use the internet without an ad-blocker....other sites have these things too, you know
so where's the problem?

I know I am getting tired of coming to these forums and first click of any type results in a popup. I am using Malwarebytes premium on a brand new system... I don't surf porn sites, I don't download .exe if its not safe.. Getting really boring when all I'm trying to do is share my FTP



http://www.yourfilelink.com/get.php?fid=1512830

Adblockers haven't been doing shit for a while now. This stuff is insidious.

People, just use NoScript on firefox. There's a site called horoskopishqip(dot)org that needs to be blocked entirely. Use that in addition to adblockers and you should be good.

Adblockers haven't been doing shit for a while now. This stuff is insidious.

..use a better one...I encountered NEVER any popups or other unwanted stuff on this forum...

Can you folks install/use ad-blockers on whatever device you currently use to browse the forums?

I'm not getting nasty pop-ups, etcetera, but I browse from a PC with ad-blockers installed. Once again, Sarah is seemingly the only one who can try to fix this issue, should still have a Twitter handle, too.

This stuff BYPASSES that. Bypasses Firefox's catchers (using version 59.0.3 (64-bit), btw), too.

This stuff BYPASSES that. Bypasses Firefox's catchers (using version 59.0.3 (64-bit), btw), too.
Then explain this to me: how could have I been using Firefox+ad-blockers for years, without getting ANY of this nasty pop-ups/shit while browsing the Shrine? EDIT: I'm on 52.7.4 (32 bit).


Those are the only add-ons I have installed.

this stuff pypasses nothing...
I am using firefox latest version and no-script and get NOTHING...not here or on any other internet site...

So is nothing going to be done about all the annoying pop ups and other junk going on around here? I can't even access the site from my phone anymore. This has been going on for months now. It's getting ridiculous.

So is nothing going to be done about all the annoying pop ups and other junk going on around here? I can't even access the site from my phone anymore. This has been going on for months now. It's getting ridiculous.
Who knows. I shared what I know… That Sarah is presumably the only Staff member who can attempt to fix what's going on with the site. I honestly don't know if work is getting done "behind the scenes", or if she's aware of the ongoing issue, even.

In the meantime, protect your device(s) as best as you can and don't attempt to browse the forum from a phone. Yeah, the issue is annoying, but it's not like there aren't workarounds…

For what it's worth:

Like Leon, I'm too using UblockOrigin, but still got a strange behaviour starting today.
Whenever it happens (randomly), after a page finishes loading up, bang: redirected automatically towards "http: // iyfnzgb . com/?pid=9PO1H9V71&dn=horoskopishqip . org"
I updated Ublock just in case, but that still happens from time to time, and only on these forums.

I've been getting the same thing since today. For those with uBlockOrigin,

Go into My Filters->copy+paste the following rules/addresses, save changes and see if you still get redirected:

iyfnzgb.com
horoskopishqip.org
d1lxhc4jvstzrp.cloudfront.net

On my end the redirects seem to have stopped, for the time being, at least.

@Leon Scott Kennedy

Yeah, I did exactly that after posting, in fact.
Also seems to have calm down for now.
I'll add the last one you're proposing though, didn't have any of it yet, so gotta take the lead on this one =]

What is even happening with the forum, a few weeks ago I couldn't even load the main forum without it being overloaded with spam and hijackers, did the admin staff actually give up on the forum or what?

What is even happening with the forum, a few weeks ago I couldn't even load the main forum without it being overloaded with spam and hijackers, did the admin staff actually give up on the forum or what?
I don't think the seemingly sole administrator who remained active can technically do something about the issues plaguing the community.
It appears there's also a domain hosting a complete carbon-copy of the forum:


http://slayingwave.com/

wow ublock origin fix did the trick!�thanks LSK

I don't think the seemingly sole administrator who remained active can technically do something about the issues plaguing the community.
It appears there's also a domain hosting a complete carbon-copy of the forum:


http://slayingwave.com/
Wait, so does that mean the current dev has no permission to actually fix it? Or is it that they don't know how to fix it? Either way shouldn't it be time to recruit more people to the head staff who actually know how to manage the forum? Because if left as it is the forum is a good as dead.

Also those copy sites always target sites with heavy traffic, 4chan has two or three sites dedicated to make carbon copies of whatever is being posted to scam people

working on this now

working on this now

Really appreciate it Sarah. Hopefully the popups stop and we don't need to use our ad blockers here.

Seems to be back normal to me. :D Thank you!

About time, it was starting to really tick me off.

Sorry to bump this, but Kaspersky is giving me "Malicious Link Blocked" every time I move about on this site.

Just encountered this while browsing a thread here: http://www.myantispyware.com/2019/02/27/how-to-remove-firefox-update-center-pop-up-virus-removal-guide/

"Firefox Update Center." Anyone else seeing this? I actually had ABP (Adblock Plus) active on Firefox, so it took me by surprise.

Just encountered this while browsing a thread here: http://www.myantispyware.com/2019/02/27/how-to-remove-firefox-update-center-pop-up-virus-removal-guide/

"Firefox Update Center." Anyone else seeing this? I actually had ABP (Adblock Plus) active on Firefox, so it took me by surprise.

I don't see it but I do get told the links were blocked.

ABP has become rather bad, TBH, since ads are figuring ways around it. I recommend uBlock origin.

Sorry to add to the necroposts, but I've been getting a "trojan blocked" warning from Malwarebytes regarding the domain "jquery(dot)su" when browsing this site on my PC. I assume this is a new ad service that was recently added? I use Chrome with uBlock Origin, and I see no ads, but I get this notification from MB every time I move to another page.

Sorry to add to the necroposts, but I've been getting a "trojan blocked" warning from Malwarebytes regarding the domain "jquery(dot)su" when browsing this site on my PC. I assume this is a new ad service that was recently added? I use Chrome with uBlock Origin, and I see no ads, but I get this notification from MB every time I move to another page.

That's the site Kaspersky is blocking too.

Just encountered this while browsing a thread here: http://www.myantispyware.com/2019/02/27/how-to-remove-firefox-update-center-pop-up-virus-removal-guide/

"Firefox Update Center." Anyone else seeing this? I actually had ABP (Adblock Plus) active on Firefox, so it took me by surprise.
Also getting this over the past couple of days. Thankfully I'm on a mac at the moment as I fear if I'd been on Windows it might've been worse. Either way it was certainly a shock and very disconcerting to be met with aggressive pop-up/screen covering spamware that somehow 'shakes' the forum!

...using this forum for years and NEVER got anything (with adblocker and no script add-ons...)

Just did a refresh of the movie soundtracks page 1, and all the characters turned to "?", and then some popup came up about how my computer was infected, then the window went full-screen.

Anyway, the site seems ok now, but that was the first thing I've seen since the blockchain scripts ran here a couple of years ago.

EDIT: I'm using Chrome on a Mac with ABP, NoCoin, and uBlock.

I don't see it but I do get told the links were blocked.

ABP has become rather bad, TBH, since ads are figuring ways around it. I recommend uBlock origin.

Thanks for the recommendation. Will definitely try that out. Just added NoScript back to Firefox after forgetting about it for a while.


Also getting this over the past couple of days. Thankfully I'm on a mac at the moment as I fear if I'd been on Windows it might've been worse. Either way it was certainly a shock and very disconcerting to be met with aggressive pop-up/screen covering spamware that somehow 'shakes' the forum!

Yeah, actually got a Mac for that very reason. Not that Macs are free of such woes, but they don't seem quite as open to attack as my PCs in the past due to the closed system.

Still getting the same issue the first time I come to the site per browser session. :(

Logged in yesterday first time since last week and it seems to have gone now thankfully :)

It came back with a vengeance for me yesterday. This morning I disabled Javascript on my Mac, and that seems to have fixed it.

For about 2 weeks Safari has indicated the forum is "Not Secure"; i.e. it's using the http protocol instead of the https protocol.

re: the hijacking

I played with my filter list and didn't seem to be getting anywhere. But after removing the Shrine from my whitelist … voila … I got back in.

Stupid oversight.

There is a nasty virus firing off when the forum came back up today, I keep getting Web Attack:Formjacking.... yall might want to check and see if you have been injected in the root system of the boards, something is definitely off

Just got an attack for a fake firefox update that tried to install a virus on my computer. These forums have been compromised.

@Sarah @LeonScottKennedy forums are compromised again. getting tons of blocks on anti-virus and firefox

Oh I thought I was the only one.
I had this error on Chrome-Mac, googling a bit about it it is a phishing. It seems to be fixed now

Using Firefox on W10 here with uBlock origin, sometimes the pop up manages to trespass it and give me a message about using an old Firefox version (same symptoms full of question marks). So definitely it can traspass it.

Had the same problem with the fake Firefox update for the past two days.
Since I always stay logged in, I tried logging out then in again and so far it has bypassed (eliminated?) the problem.
_______________________________________

Just tried again 9 hours later and the same fake Firefox update nonsense. Tried Chrome and same thing but with a fake Chrome update.

Tried LSK's suggestion below (post #188) and that does work, so far. Thanks, Leon!

Using Firefox on W10 here with uBlock origin, sometimes the pop up manages to trespass it and give me a message about using an old Firefox version (same symptoms full of question marks). So definitely it can traspass it.
Try accessing uBlockOrigin's dashboard->"My filters"->Manually add jquery.su.

Thanks Leon Scott, still try that as still getting this spam pop up.

Try accessing uBlockOrigin's dashboard->"My filters"->Manually add jquery.su.

Thanks for the heads up! I've added it and reloaded a page 5 times to see if it still happened. So far so good, I'll report back if it happens again :)

I got that fucking spam too

Fun fact: Chrome 75 was actually released and i never updated it yet lol. But yeah i got that same crap afterwards.

Unfortunately still getting spam pop up despite ublock origin amendment. Any idea about the source of this?

Unfortunately still getting spam pop up despite ublock origin amendment. Any idea about the source of this?

A few smart coders have been able to answer just that question here (Thread 233849).

A few smart coders have been able to answer just that question here (Thread 233849).

OK... so what can WE do, as the end users?

use NoScript and be done with it...

Is it gone? It hasn't popped up today. I just came on a few min ago.

use NoScript and be done with it...

Been using it ever since I found this issue. Works like a charm.