New SiteAdvisor blocking message (screenshot)

[Hayton]

A while ago I was Googling for occurrences of mchlp32.exe, and one of the results pointed to "https://forums.mcafeehelp.com", which appears to be a mirror of ths site. I clicked on a link in one of the panels on the right-hand side, to go to a current thread. What happened next was unexpected - a new blocking message from SiteAdvisor which I hadn't seen before. The message comes up if I click on any of the links on that page. Has anyone else seen this?

[Peacekeeper]

This Connection is Untrusted
          You have asked Firefox to connect
securely to forums.mcafeehelp.com, but we can't confirm that your connection is secure.
          Normally, when you try to connect securely,
sites will present trusted identification to prove that you are
going to the right place. However, this site's identity can't be verified.
          What Should I Do?
            If you usually connect to
this site without problems, this error could mean that someone is
trying to impersonate the site, and you shouldn't continue.

FF 4.01 says this

[Hayton]

I got that too (in Chrome). If you click on "Go to Site" you land on the site; if you repeat the search and click on the same link a second time you don't get that warning again, you just go straight in. So there must be a cookie setting somewhere to prevent the warning coming up again if you've decided to ignore it.

[Peacekeeper]

Ask on Monday call Wonder how many these copies around and how safe they are.

[exbrit]

All hyperlinks posted anywhere in these forums are automatically given an sa-live 'security clearance' hence that may popup occasionally.

For instance if you want to give someone a link from say THIS document you can't simply right click a link and select  'copy link location'.    Take the one for Windows Defender on that page for instance.....

It gives you something like this:  https://sa-live.com/l?v=0&ui=0&p=000c00000000000000000000400000000000&spid=mcafee-forums&url=-+78787...

- you have to actually open the link and copy the URL from the address line.   It's a royal pain in the butt as far as I'm concerned.

Now if you give someone that sa-live URL to click on instead of the actual URL they will get exactly the same windows you posted above.

They then have to click 'Visit Anyway' or do the other thing.

If that other button is leading to the wrong page then make it a subject for our call I guess.

Edit:  Naturally clicking the example I gave doesn't do that....I give up.

Message was edited by: Ex_Brit on 08/07/11 7:39:17 EDT AM

[exbrit]

OK here's an example.  I copied and pasted the Hijackthis links from my crib sheet here on these forums over to a post on Neosmart Forums here: http://neosmart.net/forums/showthread.php?t=8640&p=66616#post66616

and if you click on them it gives that self-same window, so I had to add an edit to the post to click the 'Visit Anyway' button.   (Stooooooopid Jive and it's so-called security.)

Clicking the other button however takes me to the correct product pages: http://home.mcafee.com/Store/PackageDetail.aspx?pkgid=275&cid=86000

.

Message was edited by: Ex_Brit on 08/07/11 8:59:59 EDT AM

[exbrit]

By the way that message has been around for a while, it just rarely pops up that's all.

[Hayton]

Now, that's interesting. The SiteAdvisor message may not be new, but I've certainly not come across it before.

As for the page you go to if you click on "Get Protection Everywhere" : that is not the page I landed on yesterday when I first encountered this. Possibly someone read the post I made elsewhere and made a quick alteration to the link. Yesterday it was going to a different page with out of date information.

And (since there are two topics in this thread now, and they're getting tangled up) the original post I made referred to "forums.mcafeehelp.com". I believe April was on the look-out for this sort of thing coming up in search results, so I'll let her know I found one of the indirect links to the site.

The message Tony posted in #2, that was displayed by Firefox, appears like this in Chrome :

So, yes, it's an SSL issue. These are not the droids you're looking for 🙂

[exbrit]

..and who says Jive and/or McAfee never act strangely.......... yes who?

[Hayton]

When you click on that link you gave - http://home.mcafee.com/Store/PackageDetail.aspx?pkgid=275&cid=86000 - what country and currency do you see? For me, it comes up as the UK site, with prices in pounds sterling. The address bar shows the same link you gave, so it looks as if behind the scenes it's worked out where I am and made the appropriate connection. Now, that's clever.