Malware/adware distribution via this forum

[chambers]

When you do a google search for cast boolits there is a " this site is hacked", it is not my computer but something with the site. You do get redirected when you click on cast boolits.

[MaryB]

If you use firefox I strongly suggest installing ad block plus and ghostery to kill ads. It traps out 99.99% of the malware that pops up too. It can cause headaches with some types of videos/twitter feeds but those can be added to allow.

[dragon813gt]

I had a redirect on my work iPhone today. This was using Safari and from a Google search. Something still seems to be wrong. I've never attempted to visit the site from that phone before. I hit the back button, clicked the same link and this site loaded properly.

[popper]

ad block plus and ghostery Even Hodgdon has google trackers. One of my banks has several trackers also. Yando.com appears to be a google knockoff in russia, appears to be a 'safe' site. Wife tried to go to Fandango and couldn't even see the movie selection screen for all the ads. Ipad gets all the junk too. I just note the ads and don't do business with them. They get $ each time your screen shows the ad, whether you click on it or not. Internet is getting 'sucky' now. Like having a steady stream of door-to door sales people at your door.

[retread]

Which post/photo? Sometimes pic hosting sites such as photobucket have popup ads which are frustrating but harmless, while some may host adware that can be harmful such as those that warn your computer may be infected etc.

I was on Reloading bench pics. Sundoggy

[The_Hammer]

I've been having the same issue using multiple browsers.

[10x]

Clear your browser history. Clear all cookies. Set you browser to block pop up ads.
Still persists run Malware bytes and Hitman pro.

Sometimes the the pop up malware downloads piggy backed as bundled software.

I have yet to have a pop up add or a redirect on Cast Boolits.

[DanishM1Garand]

I get the same redirect from different devices. iPhone iPad and iMac.

[rototerrier]

The problem is with the castboolits server side code. There something crept in.

It's quite simple, I can duplicate this every time. Simply clear out your cookies and temp internet files in either Chrome or IE and then do a google search for something that will pull up castboolits.

In my scenario, I searched for "Accurate Mold 9mm"

It then redirects me to myfilestore.com

But, I ran a fiddler session to ensure I did first hit castboolits, here are the results. You'll see I clicked the link from google, which then takes me to castboolits which then, after loading a bunch of scripts it hits line 24 and redirects to myfilestore.com

[rototerrier]

One other thing to note, this is the header received from castboolits for the redirect:

GET http://myfilestore.com/download.php?id=2b5c7c20 HTTP/1.1
Accept: text/html, application/xhtml+xml, image/jxr, */*
Referer: http://castboolits.gunloads.com/show...Accurate-Molds
Accept-Language: en-US,en;q=0.5
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko
Accept-Encoding: gzip, deflate
DNT: 1
Host: myfilestore.com
Connection: Keep-Alive

You'll notice the referrer is castboolits. This is being initiated from the server side.

So, for anyone concerned that it's something local, don't be. This is purely and definitively coming from the server side.

I've pulled down and searched thru the script files being downloaded and I've not found anything that would cause the redirect locally. I was thinking it could have been a javascript issue, but that would have most likely triggered a cross sight scripting error. So that helped lead me to determine it's a redirect issued from the server and to track it down as such.

[rototerrier]

Looks like a known issue:
https://www.vbulletin.com/forum/foru...yfilestore-com

Wish I could help more. I'm a .NET/SQL guy so my knowledge is limited in this area.

[Andy]

I keep getting the myfilestore thing too, only happens with this site. Happens about 5-10% of the time I follow a google link to a post on this site and has only been happening the last 3 weeks or so.

[popper]

Page first goes to google java lib, then continues to CB. About 1 in 3 pages I get a delay from google before page loads. Other sites that use vbulletin SW don't have this problem.

[white eagle]

I still get this redirect and have seen a different page before opening C.B