Some additional information. We have found from some users that they were (they think) using certain pages of our website when the alerts from their antivirus went off or when the redirects and popups occured. But of course, we can never verify it and most users use the same pages without incident. (which yes points to the randomness of ads) However, at least with one user, once they were verifiably infected, it redirect them every time they went to certain pages on the site, but did not seem to do so when they went to other pages on other sites. Once Malwarebytes was run, the virus was removed and no more problem. But why did it pick on those certain pages/urls? Are certain keywords or url paths possible triggers for these types of viruses? How can we separate users who were infected elsewhere, but getting triggered popups/warnings while on our site, from a user possibly getting infected from something on our site. We want to solve this and help users, but the finger pointing and blaming doesn't help at all. We have also had many users take offense that their computer could have a virus and refuse to scan it and simply blame us! Thanks!