SSMB Possibly causing Virus Warning Popups?

[Ryannumber1gamer]

So, since about 40 or 50 minutes ago, Either SSMB or Discord seems to be triggering Avast antivirus and causing threat warnings to pop up about it. After closing SSMB for about ten minutes, the warnings stopped and as soon as I opened up SSMB again, and was on it for a minute or two, the virus warning popped back up again, so I thought just in case, I should make a topic to make everyone aware of it. 

Edit: And after doing some testing, I think I can confirm it's SSMB. I shut down Discord and left only SSMB up and the warnings still popped up.

[Tara]

I could have sworn we had a virus alert thread with a snazzy Weird Al song and everything.  Oh well.

I'm unsure of what you're referring to actually.

Are you just referring to Avast's "Threat Blocked" message popping up?  If that's the case, that's most likely a false positive.  Does this happen on every page or just specific ones?

Or are you referring to those fake popup ads that look like antiviruses?  In which case, that's more serious.

[Agie]

Me and Ryan are buddies on Discord. He told me in a private message that he can't go on the SSMB due to worries that it'll mess up his devices one way or another.

But what he basically told me it that it was threat blocked messages, but when he did a virus scan, it said it had infected files in the threat.

It's also every page, and every five to ten minutes.

[Tara]

The virus files are almost certainly not coming from SSMB.  If Avast is showing them there, it's likely that he already has an infection from elsewhere or Avast is just being overprotective.

[Agie]

Ryan says he tested it on another laptop, and it's the same result despite being on a different device. Now, maybe it is simply Avast being overprotective, but could you at least check to be sure?

[Tara]

It's not happening on my version of Avast.  Can you give more details on what the message says?  Like, what specific file it mentions?

[Your Vest Friend]

I got a virus warning from here yesterday as well, so I don't think it's isolated. 

[Badnik Mechanic]

It'll be one of the following.

 

Someone is hotlinking to dodgy websites. Be an image in a signature or a post.

 

One of the adverts on the site is causing a false positive.

[Tara]

2 hours ago, Mayor D said:

It'll be one of the following.

 

Someone is hotlinking to dodgy websites. Be an image in a signature or a post.

 

One of the adverts on the site is causing a false positive.

SSMB shouldn't have adverts at all as far as I know, so the former is the more likely.

[Badnik Mechanic]

I know we used to only most ad blockers would stop them, since I'm rocking one I assumed we still did.

Gotta be someones signature or a recently linked to image.

[bmn]

SSMB has ads if you're not logged in - if you are, the code to enable them is removed in its entirety. This is the most likely cause of antivirus complaints if not logged in - by necessity we have to trust in the security measures employed by the ad networks we use, and at times they do let rogue ads slip through the net and onto the site.

There's also an affiliate linking feature, which takes effect (i.e. redirects by either adding an affiliate code to the URL, or goes through an external site called VigLink to do so) when you click a non-TSS link, but doesn't do anything before you make said click.

If logged in, it's possible that a linked image (e.g. signature, as @Mayor D mentioned) somewhere is coming from a domain name security databases consider untrustworthy. It would usually be the browser that flags this though, not antivirus.

 

Without more info I can't really say more than that. Avast should have a log including the page URL, the URL of the unsafe material, and which malware definition it triggered. We can come to a better conclusion if we have that.

 

[Nerfuffle]

Mystery solved?

Quote

Today i had 2 virus alerts from safe sites. One was xchat.cz and second on google.cz What happens? Cant belive this is real virus. Thanks

UPDATE: Not only those sites! Also if i run FULL SCAN, thousands of files are detected as virus! Can u imagine what happen if some user delete those files and no more boot up PC? This is unacceptable! Thank you avast. This is not first time i see that huge mistake in your products.

UPDATE 2: Thanks for fix, everything is ok now.

 

[Agie]

Has anyone been able to verify this? It'd be nice to know, at least.

[Ryannumber1gamer]

So, apologies for not being active to write the messages myself, so I thank @SurrealBrain for talking to you guys for me. 

On 2/22/2017 at 5:37 PM, Nerfuffle said:

Mystery solved?

 

I think this is the explanation. It makes sense, because even Discord was bringing up virus popups at least once, although it was SSMB doing it more frequently for me. I'll keep an eye out and let you guys know if I have any more troubles with it. Nevertheless, thanks for the help everyone, it's very much appreciated.