Shop OBEX P1 Docs P2 Docs Learn Events
virus auto download attempt via forum postings ? — Parallax Forums

virus auto download attempt via forum postings ?

jmgjmg Posts: 15,173
in General Discussion
I get this popup when I go into one thread - seems to automatic launch download, and tries to save a suspect file to my hard drive ?
Mods may like to see which posting triggers that ?

Screen grab attached, shows forum and auto-download messages...
PropForumVirus.png
650 x 320 - 23K

Comments

  • Peter JakackiPeter Jakacki Posts: 10,193
    edited 2017-03-09 05:11
    The page source shows that your browser must be trying to download one of my youtube videos. 
    src="http://www.youtube.com/v/plmVhkIWkfk&rel=0"
    So I think it may be a browser "enhancement" issue :)

    Actually, FF on my Android phone always wants to download youtube attachements automatically as well.
  • jmgjmg Posts: 15,173
    Hmm, this is Google Chrome, Version 56.0.2924.87 (64-bit)
    Strange it automatically tries to do that ? - the message claims the forum is the one that wants to download the file ?
  • KeithEKeithE Posts: 957
    People have complained about this before, but I can't find the threads now. I think in the early days of youtube Shockwave Flash was used for all videos, but thought this was a thing of the past. No idea why the files get downloaded automatically, but at least they are small.

    I see this under Safari as well, so it's not just Chrome.
  • Peter JakackiPeter Jakacki Posts: 10,193
    I notice that youtube says that the YouTube Flash API was officially deprecated on January 27th, 2015. Perhaps the forum software needs to handle youtube links differently?
  • kwinnkwinn Posts: 8,697
    Ah, so I am not alone. Similar thing happens to me on the Tachyon V4 thread. Just posted a question for Peter about it.
  • GordonMcCombGordonMcComb Posts: 3,366
    SWF files from YouTube are not malicious -- it's the YouTube player code, or one of its components. It happens when someone tries to embed a video using the video tags, rather than just pasting in the share link. Depending on your browser and Flash settings, your browser will consider these files downloadable content rather than active page content.

    Just say fuggetaboutit to the download, and mark the thread for a moderator, who will hopefully fix the embed code (or ask the original poster to do it).
  • Peter JakackiPeter Jakacki Posts: 10,193
    Isn't this a forum software issue for Bump to look at? We have the YouTube icon between the image and url icon so we are only using the forum the way it was setup. But I mentioned before that these videos come up with a message saying "The YouTube Flash API was officially deprecated on January 27th, 2015" so perhaps there is a better way? It seems that applications need to migrate to the IFrameAPI.
  • Heater.Heater. Posts: 21,230
    Where are you guys seeing this issue?

    I'm cruising here all the time with Chrome on Windows or Linux and have yet to see it.

  • TorTor Posts: 2,010
    I see it all the time with Chromium on Linux. Lately also with the popup, but also still with the quiet youtube link files (those with '=' as part of the filename) in my Download directory.
  • Heater.Heater. Posts: 21,230
    Do you have a particular thread/post link that demonstrates this issue?
  • jmgjmg Posts: 15,173
    Heater. wrote: »
    Do you have a particular thread/post link that demonstrates this issue?

    See posts #1 and #2 above.
    It seems a fixable forum issue.
    Manually it can be fixed as Gordon suggests: "mark the thread for a moderator, who will hopefully fix the embed code (or ask the original poster to do it)."

    but it seems the forum should be able to either automate that, or prevent the occurrence.

  • xanaduxanadu Posts: 3,347
    Here's an example - http://forums.parallax.com/discussion/165599/rc-transmitter-trainer-port-joystick/p1

    That guy is always posting questionable stuff...
  • Heater.Heater. Posts: 21,230
    Post #1 has no link in it.

    Post #2 does.

    When I hit that link my Chrome warns against a swf download. Even if i accept it nothing happens.

    Except I have now have a .swf file in my downloads directory which this Win 10 machine does not know how to open.

    But what forum thread/post did that come from?



  • Phil Pilgrim (PhiPi)Phil Pilgrim (PhiPi) Posts: 23,514
    Nothing in xanadu's thread pops up for me. I'm using Chrome on OS/X.

    -Phil
  • Heater.Heater. Posts: 21,230
    There was no "pop up".

    Only the download thing that normally appears at the bottom left of the screen contained a warning and asked if I wanted to continue.

    Chrome on Win 10.
  • xanaduxanadu Posts: 3,347
    edited 2017-03-09 23:47
    I see what I did. I put the video ID in the video tags, I think the old forum worked like that, or another forum I am on -

    [you tube ]RjjW dMiIGcc [/ you tube]

    My Chrome on Win 10 tries to download a file called "RjjWd MiIGcc&rel= 0. swf"
  • xanaduxanadu Posts: 3,347
    If you're wondering about the spacing in my last post, without it the post disappears. It's definitely the youtube tag incompatibility which Vanilla should be able to patch.
  • GordonMcCombGordonMcComb Posts: 3,366
    Chrome (at least on Windows, and maybe others OSs) maintains its own Flash player. Mine is disabled, as is Flash in general. So I get the prompt. I don't think I do when I enable Flash under Chrome, but the last time I checked was at least a year ago.

    Except for some arcane video sites that still deliver only Flash content, or running some Flash-based software like MIT's Scratch (but not Blockly, which rightly doesn't use Flash), there is ZERO reason to keep Flash installed. Everyone who's smart provides their videos in MP4, OGG, or other format, delivered to you based on your system.

    You would never want to open an unknown SWF file. Depending on the version of Flash installed, you could open the Horrors of Hades upon yourself.
  • Duane DegnDuane Degn Posts: 10,588
    Don't use the YouTube tags to post YouTube links.

    Just paste the URL without any tags.

    This is supposed to be the better way so there are fewer files to download for people on mobile devices.

    I edit my old posts with videos to use this new method whenever I see them.

    FWIW, I see the SWF file warning frequently myself.
  • TorTor Posts: 2,010
    xanadu wrote: »
    Here's an example - http://forums.parallax.com/discussion/165599/rc-transmitter-trainer-port-joystick/p1
    If I click on the link, my Chromium automatically and immediately downloads a file "3OJNeLq2NlI&rel=" to my Downloads directory.

    I think I only get the pop-up if there are multiple such links in a thread.
    And I think I only get the auto-downloads after I have read that thread once before. Or at least there's some kind of correlation there.

  • VonSzarvasVonSzarvas Posts: 3,450
    edited 2017-03-10 10:09
    xanadu wrote: »
    I see what I did. I put the video ID in the video tags, I think the old forum worked like that, or another forum I am on -

    [you tube ]RjjW dMiIGcc [/ you tube]

    My Chrome on Win 10 tries to download a file called "RjjWd MiIGcc&rel= 0. swf"

    Hi Xanadu,

    To test out this situation I've edited your posts on that page containing the tubetags. Sure thing as Duane noted- by replacing them with url's (not in url tags, just plain-text urls), then the preview function works in the browser I'm using, and the enforced-download-error is gone.

    In this case the solution seems to be:
    1. Remove the tube button from the toolbar.
    2. If possible have [you tube ] tags auto convert to https://youtu.be/RjjWdMiIGcc format, OR else have the forum ignore tube tags.

    I'll report this back to Bump along with this thread, so he can check any other replies/ideas anyone might wish to add.

    caveat: As always, this task may not be so simple to implement and will join a queue of priorities which the mods are not aware of. If we notice and can edit new posts as an interim solution, then mods might do that to help- as time allows!
  • TorTor Posts: 2,010
    Yeah, that seemed to help - no auto-download when I click the thread again.
  • MikeDYurMikeDYur Posts: 2,176
    I'm for getting rid of the utube button, just seems like an extra step in the process that isn't needed, and doesn't work properly on all devices.
  • GordonMcCombGordonMcComb Posts: 3,366
    Tor wrote: »
    xanadu wrote: »
    Here's an example - http://forums.parallax.com/discussion/165599/rc-transmitter-trainer-port-joystick/p1
    If I click on the link, my Chromium automatically and immediately downloads a file "3OJNeLq2NlI&rel=" to my Downloads directory.

    Tell Chrome not to do that. You have the option to be prompted, which is a far, far better thing to do.

  • xanaduxanadu Posts: 3,347
    Thanks. Yes, definitely user error, but it would be nice if there was a failsafe, or warning if you do it wrong so people aren't prompted to d/l.

    I will fix that post.

  • TorTor Posts: 2,010
    Well, I didn't see anything in settings to stop the download. It's unusual in that it's enough to open a thread in a tab, not even opening the tab, and the file gets downloaded. There's nothing else out there that does that, only this forum. I seem to get a popup if there are multiple links in the thread.
    In any case, the modification that was done to the thread fixed the problem.
  • GordonMcCombGordonMcComb Posts: 3,366
    Settings->Show Advanced Settings->Ask where to save each file before downloading (checkbox).

    This setting gives you the option of not downloading content you don't want.
Sign In or Register to comment.