Networks

Ask something
Discussion Locked

Popup ad on TR

0 helpful
39 replies

by jck

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

Twice now in the past week, I have had a popup dialog come up on my computer telling me that I could have something on my computer.

Given, I know it's not true. We have a comprehensive security suite on each PC, as well as our servers, and security measures at our firewalls, routers and what not.

It seems that one of TR's ad servers is now pushing popup ads with windows that go to looking similar to Windows Explorer and what not. I would think this is the same kind of *ware that websites use to try and get you to load some control or app of theirs.

Has anyone else hit this issue?

Is anyone else annoyed that you can't paruse TR in peace now without some ad spinning up once a week and taking over your browser?

(Sorry if this is a re-hash, but I had to bring it up.)

39 replies

by hal 9000

Maybe you have an Infection. :D

[i]Given, I know it's not true.[/i]

If you use Windows in any form how do you know this?

Some argue that Windows itself is nothing more than a Virus but I have to disagree with that sediment. After all what other Virus/Malware do you actually pay for before you start using it and which ones come after you for Piracy?

But on a more serious note just because your Security Suite of Apps says that things are clean doesn't mean that they are just that the Apps that are supposed to secure things can not identify the Infection that you have. ;)

No I have yet to see anything like what you are seeing and I'm using XP with IE7. ;)

Col 0:-)

by locolobo

I haven't had that issue until I clicked on your post. Then I was redirected to some ad somewhere. I was going to mention surveys though. They keep popping up on this site.

by jck

Yeah, I get those too. You can click the close and they go away though.

This one is one of those that pops up a window. When you click the X in the top right, it opens another window that looks similar to Windows Explorer. Just reminds me of all those popups you get on less respectable sites.

Just kinda scared me that TR might have an ad company spinning that thing once in a blue moon to a user and someone (who doesn't know better) might load an ActiveX control or something (trusting that TR would not hurt them) and end up with some spyware or malware or adware on their PC.

by locolobo

rather than a popup. Techrepublic dissapeared as if I clicked a link, which I didn't.

by netman1958

Yesterday I was browsing the "Questions" listings and had something tried to open Adobe Reader and my Nod32 blocked it. I took a screen shot of all the popups and the Nod32 message, but forgot to save it to a file. If it happens again, I'll save the screen shot and try to get it to the appropriate person at TR.

by jck

I'll try to do that too when it happens again.

If there's an advertisers spinning ads with bad content, I wouldn't want TR hang out there and get hurt by it.

Thanks

by gsg

Sorry, but I think you do have a virus. I thought I was protected as well, but I got a similar pop-up and discovered several viruses that 2 AV apps couldn't find.

by jck

But, we have a pretty tight setup. I'll scan with other tools and see what happens.

by forum surfer

I know for a fact it gets a few that slip through Symantec and other corporate av solutions. There are a few pop up related infections that many av solutions miss, mbam seems to take care of these. Enough so that I keep the installer on my keychain drive, which is usually reserved for music, photos and a portable version of open office.

by jck

it wasn't a popup. guess that's the wrong technical term for it. the initial thing that came up was a dialog window. then when i tried to close it, it went to that Windows Explorer-like thing. I hit Esc there and it closed the window and TR's window wasn't there anymore.

That may have been what happened to me as well...it redirected me. I'll back up through my windows and see if I can get the ad to repeat from cache here in a minute. I'm running mbam right now, and so far it's clean.

by jck

Nothing came up. Also ran the enterprise security suite we use, and nothing as well.

by charliespencer

McAfee VirusScan Enterprise 8.7, .DAT version 5728 of Sept. 2nd. Browser is FF 3.5.2. It's given me a warning five consecutive times when I open the original article or the second comment.

"Script executed by firefox.exe. JS/Exploit-Packed.c.gen. Trojan."

McAfee is successfully blocking the script. I've notified Tammy.

Do ---NOT--- copy and paste this link unless you're positive your anti-malware apps are up to date, but I would like to know if anyone else gets a similar response.

http:// blogs. techrepublic .com.com/ datacenter/ ?p=1436

by charliespencer

I tried the link, but McAfee complained I didn't have cookies enabled. (Incidentally, it included enabling instructions only for IE 4, 5, or 6!) I'll gladly take Doug's word that it was a false alarm; I'm not motivated enough about the details to enable and disable cookies.

by shellbot

However, the other night when I clicked on the Contacts tab, it got blocked by Symantec as a phishing page.

I took a screenshot..meant to mail it in..keep forgetting.

Its not happened since..but kinda freaked me out

by karydavis

I was reading the posts about the woman who was fired for using all caps in an email, and suddenly McAfee warned me that a trojan was deleted as it tried to infect my machine.

I did not have any other IE8 windows open...

Just an fyi

by karydavis

The virus popped up again while I was reading another article on TR...how do I get a pic of that on here or to the TR Powers that Be?

by charliespencer

I sent a message to Tammy for you, as a follow-up to the one I sent her about seeing something similar on another discussion earlier today. She's looking into the problem, but it's starting to look like there's definitely something going on here.

You don't happen to have any details from the warning, do you? Type of malware, name, that sort of thing?

by charliespencer

Opening the "10 buzzwords at work" article. Identical warning to the one I posted above, but at home this time instead of at work.

Love y'all, but I'm out of here. I'll try again at work tomorrow, where the defenses are stronger and my recovery tools are better.

by ic-it

I fired up my Browser, opened Outlook, and TrackIt. Left for a 4 minute smoke and came back into the office in time to see McAfee alert on three files.

I then spent a better part of the day tracking down and deleting the RootKit tied in with Uacd.sys.

Nasty little bugger. Thanks TR. :-(

by charliespencer

I'm not saying it didn't originate here. I'm just wondering how you nailed this joint down as the source.

by ic-it

site visited and a check of our connected LAN servers showed clean there was no traffic/audits to my system. I think it piggy backed in on an ad. (my fault also for using a system with IE6 and less protection than my normal system).

Edited to add; Here is the mcAfee log;
C:\Documents and Settings\xx\Local Settings\Temporary Internet Files\Content.IE5\69MTQ5OB\newvers[1].exe\newvers[1]
9/1/2009 8:49:33 AM Deleted x C:\DOCUME~1\xx\LOCALS~1\Temp\~.exe C:\WINDOWS\system32\braviax.exe FakeAlert-HD (Trojan)
9/1/2009 8:49:33 AM Deleted x C:\DOCUME~1\xx\LOCALS~1\Temp\~.exe C:\WINDOWS\system32\dllcache\figaro.sys FakeAlert-C.dr (Trojan)
9/1/2009 8:50:06 AM Not scanned (scan timed out) x C:\DOCUME~1\xx\LOCALS~1\Temp\~.exe C:\Documents and Settings\xx\Local Settings\Temporary Internet Files\Content.IE5\87ONIFWB\Install[1].exe
9/1/2009 8:50:06 AM Deleted (Clean failed) xx C:\DOCUME~1\xx\LOCALS~1\Temp\~.exe C:\Documents and Settings\xx\Local Settings\Temporary Internet Files\Content.IE5\87ONIFWB\Install[1].exe FakeAlert-XPSecCenter (Trojan)

by Tammy.Cavadias

for IE 7 and above, seems to do the trick.

The ad in question for both TR/ZD is still being investigated as to which ad, and what exactly is causing the false postive within it.

-Tammy [_]3

by Tammy.Cavadias

it's related to how McAfee is detectioning certain javascript files.

It's been happening in both TR and over in ZDNet.

So for now, not much else we can do, but let folks know it is a false postive.

I use AVG, so I haven't received this alert, but all those who have are all using McAfee.

-Tammy [_]3

by jck

I was on this page in TR:

https://www.techrepublic.com.com/5221-6230-0.html

All the sudden, the browser went to this URL, then forwarded to a IP address URL that came up with this message:

Sorry this link is no longer available

I think this is what was redirecting me to that stuff I was seeing earlier this week.

Tammy, I'll send you the URLs that we redirecting me from TR so that whomever checks that stuff can do it.

it happened at 9:55am ET btw.

by jck

also noticed that after the page had done loading, in some cases something would trigger a call to "a367.yahoofs.com"

dunno if that's a key to this either. just figured i'd put it out there.

by shasca

It just happened to me too. I was scrolling the questions section, then the system went wild and next thing I know I was redirected to "Yahoo Hot jobs". I have never even visited that site before, so it was definitely a hijacking.

by seanferd

I was wondering why I couldn't find a reason for this in page source. I didn't experience the notification, either, so I was a bit baffled.

by hal 9000

But why not finish the intended sentence. Instead of reading

[i]No, I wouldn't worry [/i]

It should read

[b]No, I wouldn't worry when you go straight to Panic it saves so much time and gets things done considerably faster. Worrying is just a waste of Time & Effort. [/b] :^0

Col 0:-)

This discussion is closed to new replies.