# Kaspersky (security software) report when browsing site. **URL:** \ **Category:** About This Message Board\ **Created:** [December 24, 2011, 3:25pm UTC](https://boards.straightdope.com/t/kaspersky-security-software-report-when-browsing-site/607283 "2011-12-24T15:25:38Z")\ **Posts on this page:** 15\ **Page:** 2
**Author:** ![Dallas\_Jones](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/dallas_jones/32/3277_2.png) [@Dallas\_Jones](https://boards.straightdope.com/u/Dallas_Jones)\ **Post date:** [January 6, 2012, 6:19pm UTC](https://boards.straightdope.com/t/kaspersky-security-software-report-when-browsing-site/607283/21 "2012-01-06T18:19:48Z")
> [@Ed\_Zotti](#): > > Since you seem to be getting a lot of these things, you’re in a good position to help us get to the bottom of this. Do us a favor and report all malware indications you receive. Also, if you’ll forgive my asking a possibly stupid question, what is your location? Are you in Dallas? I am in a small town in NW Oregon, Dallas is the name of my cat. I will report all notifications Norton shows me while viewing the SDMB and post what the notifications say. I hope I can help. I haven’t received any new warnings since this thread died out a few days after Christmas so perhaps the ad providers took some action. ---
**Author:** ![Ed\_Zotti](https://avatars.discourse-cdn.com/v4/letter/e/fbc32d/32.png) [@Ed\_Zotti](https://boards.straightdope.com/u/Ed_Zotti)\ **Post date:** [January 6, 2012, 6:39pm UTC](https://boards.straightdope.com/t/kaspersky-security-software-report-when-browsing-site/607283/22 "2012-01-06T18:39:59Z")
> [@Dallas\_Jones](#): > > I am in a small town in NW Oregon, Dallas is the name of my cat. I will report all notifications Norton shows me while viewing the SDMB and post what the notifications say. I hope I can help. > > I haven’t received any new warnings since this thread died out a few days after Christmas so perhaps the ad providers took some action. Thanks. Checking all the URLs given above with McAfee SiteAdvisor, I get a green light for all the named sites, but a security warning for two of the three IP numbers, so you may be right that someone is spoofing legitimate sites. ---
**Author:** ![Normal\_Phase](https://avatars.discourse-cdn.com/v4/letter/n/5f9b8f/32.png) [@Normal\_Phase](https://boards.straightdope.com/u/Normal_Phase)\ **Post date:** [January 7, 2012, 11:22am UTC](https://boards.straightdope.com/t/kaspersky-security-software-report-when-browsing-site/607283/23 "2012-01-07T11:22:09Z")
I just got one last night. I was on SDMB (and nothing else), don’t remember what page, picked up by Kaspersky. The report says: HEUR.Trojan.Script.Generic Object: [http://www.eleganor.com/](http://www.eleganor.com/) gertrudame/86453892495682907 It’s identified as a virus. I got it last night at 10:19:45 pm eastern; I’m in the New York area. Using Firefox 9.0.1, hadn’t put AdBlock on yet. It freaked me the fuck out, I wasn’t expecting something like that from a well-known site like this. ---
**Author:** ![Ed\_Zotti](https://avatars.discourse-cdn.com/v4/letter/e/fbc32d/32.png) [@Ed\_Zotti](https://boards.straightdope.com/u/Ed_Zotti)\ **Post date:** [January 7, 2012, 1:54pm UTC](https://boards.straightdope.com/t/kaspersky-security-software-report-when-browsing-site/607283/24 "2012-01-07T13:54:21Z")
Have reported this. Will advise of any developments. ---
**Author:** ![Ed\_Zotti](https://avatars.discourse-cdn.com/v4/letter/e/fbc32d/32.png) [@Ed\_Zotti](https://boards.straightdope.com/u/Ed_Zotti)\ **Post date:** [January 11, 2012, 10:37pm UTC](https://boards.straightdope.com/t/kaspersky-security-software-report-when-browsing-site/607283/25 "2012-01-11T22:37:49Z")
> [@AnalogSignal](#): > > Yes, this is the same pattern I saw when I captured a Fiddler trace of a malware attack on Dec 17. In that particular attack, Doubleclick (owned by Google) served an ad from a smaller ad platform [zedo.com](http://zedo.com) which rotates ads. Zedo choose an ad from a malicious site ([spheredintparted.com](http://spheredintparted.com)) which in turn redirected to [ashaph.com/news](http://ashaph.com/news) (in Moldova) which served the Java malware. These attacks are tricky to prevent because they are changing servers and using nested ad networks to hide their malware. I’m happy to report that one of our ad providers, Rubicon, has succeeded in tracing the rogue ad above with the help of the Fiddler log provided by **AnalogSignal**. There were six hops all told, several of which happened off stage and so did not show up in the log, although **AnalogSignal** got the gist. The campaign has been halted and the party that let it through (a seemingly reputable digital media agency one hop down from Rubicon) has been notified. Our thanks to **AnalogSignal** for his assistance. We are continuing to pursue reports of other attacks and will advise of developments. ---
**Author:** ![RaftPeople](https://avatars.discourse-cdn.com/v4/letter/r/6f9a4e/32.png) [@RaftPeople](https://boards.straightdope.com/u/RaftPeople)\ **Post date:** [January 12, 2012, 12:11am UTC](https://boards.straightdope.com/t/kaspersky-security-software-report-when-browsing-site/607283/26 "2012-01-12T00:11:44Z")
Mildly interesting thing I noticed: I was just googling around for something and [rubiconproject.com](http://rubiconproject.com) came up in the search result, the site is marked red (bad) for WOT (Web Of Trust). This is the description of that rating: “Very poor reputation. This site is dangerous. We recommend using a website with a better reputation.” ---
**Author:** ![samclem](https://avatars.discourse-cdn.com/v4/letter/s/a9a28c/32.png) [@samclem](https://boards.straightdope.com/u/samclem)\ **Post date:** [January 12, 2012, 12:12am UTC](https://boards.straightdope.com/t/kaspersky-security-software-report-when-browsing-site/607283/27 "2012-01-12T00:12:37Z")
> [@Ed\_Zotti](#): > > I’m happy to report that one of our ad providers, Rubicon, has succeeded in tracing the rogue ad above with the help of the Fiddler log provided by **AnalogSignal**. There were six hops all told, several of which happened off stage and so did not show up in the log, although **AnalogSignal** got the gist. The campaign has been halted and the party that let it through (a seemingly reputable digital media agency one hop down from Rubicon) has been notified. Our thanks to **AnalogSignal** for his assistance. We are continuing to pursue reports of other attacks and will advise of developments. Methinks we need to show some appreciation to **AnalogSignal** somehow. Maybe comp him a membership? ---
**Author:** ![Ed\_Zotti](https://avatars.discourse-cdn.com/v4/letter/e/fbc32d/32.png) [@Ed\_Zotti](https://boards.straightdope.com/u/Ed_Zotti)\ **Post date:** [January 12, 2012, 12:37am UTC](https://boards.straightdope.com/t/kaspersky-security-software-report-when-browsing-site/607283/28 "2012-01-12T00:37:06Z")
> [@RaftPeople](#): > > Mildly interesting thing I noticed: > I was just googling around for something and [rubiconproject.com](http://rubiconproject.com) came up in the search result, the site is marked red (bad) for WOT (Web Of Trust). > > This is the description of that rating: “Very poor reputation. This site is dangerous. We recommend using a website with a better reputation.” What’s telling you this? It’s coming up green in both McAfee and Norton for me, as one would expect, since this is the company’s main corporate website. ---
**Author:** ![Ed\_Zotti](https://avatars.discourse-cdn.com/v4/letter/e/fbc32d/32.png) [@Ed\_Zotti](https://boards.straightdope.com/u/Ed_Zotti)\ **Post date:** [January 12, 2012, 12:39am UTC](https://boards.straightdope.com/t/kaspersky-security-software-report-when-browsing-site/607283/29 "2012-01-12T00:39:58Z")
> [@samclem](#): > > Methinks we need to show some appreciation to **AnalogSignal** somehow. Maybe comp him a membership? Absolutely. In fact I thought we did that when we helped us a year ago. Be that as it may, I think we’ll award him a custom title, too. ---
**Author:** ![RaftPeople](https://avatars.discourse-cdn.com/v4/letter/r/6f9a4e/32.png) [@RaftPeople](https://boards.straightdope.com/u/RaftPeople)\ **Post date:** [January 12, 2012, 1:18am UTC](https://boards.straightdope.com/t/kaspersky-security-software-report-when-browsing-site/607283/30 "2012-01-12T01:18:11Z")
> [@Ed\_Zotti](#): > > What’s telling you this? It’s coming up green in both McAfee and Norton for me, as one would expect, since this is the company’s main corporate website. I use firefox and WOT, when I google and [rubiconproject.com](http://rubiconproject.com) appears in the list, the main site and all sub-pages have WOT’s red circle next to them. This is a link to their scorecard, but it’s not exactly the same as what appears in google. In a google list you just get the red circle, don’t know how their algorithm arrives at red if all categories aren’t red [http://www.mywot.com/en/scorecard/rubiconproject.com](http://www.mywot.com/en/scorecard/rubiconproject.com) Note: see comments section for things people have run into on that site ---
**Author:** ![samclem](https://avatars.discourse-cdn.com/v4/letter/s/a9a28c/32.png) [@samclem](https://boards.straightdope.com/u/samclem)\ **Post date:** [January 12, 2012, 2:13am UTC](https://boards.straightdope.com/t/kaspersky-security-software-report-when-browsing-site/607283/31 "2012-01-12T02:13:30Z")
> [@Ed\_Zotti](#): > > Absolutely. In fact I thought we did that when we helped us a year ago. Be that as it may, I think we’ll award him a custom title, too. Let him choose it, or make it a contest? I vote for _badass MoFo ad killer_. YMMV. ---
**Author:** ![Ed\_Zotti](https://avatars.discourse-cdn.com/v4/letter/e/fbc32d/32.png) [@Ed\_Zotti](https://boards.straightdope.com/u/Ed_Zotti)\ **Post date:** [January 12, 2012, 2:39am UTC](https://boards.straightdope.com/t/kaspersky-security-software-report-when-browsing-site/607283/32 "2012-01-12T02:39:05Z")
> [@RaftPeople](#): > > I use firefox and WOT, when I google and [rubiconproject.com](http://rubiconproject.com) appears in the list, the main site and all sub-pages have WOT’s red circle next to them. MyWOT is crowd sourced, a controversial method of site evaluation. As I say, [rubiconproject.com](http://rubiconproject.com) comes up green on Norton and McAfee. ---
**Author:** ![Ed\_Zotti](https://avatars.discourse-cdn.com/v4/letter/e/fbc32d/32.png) [@Ed\_Zotti](https://boards.straightdope.com/u/Ed_Zotti)\ **Post date:** [January 12, 2012, 2:43am UTC](https://boards.straightdope.com/t/kaspersky-security-software-report-when-browsing-site/607283/33 "2012-01-12T02:43:52Z")
> [@samclem](#): > > Let him choose it, or make it a contest? > > I vote for _badass MoFo ad killer_. YMMV. Well, we have the SDSAB, so I was thinking of SDDOD, for Straight Dope Dept. of Defense. But we’ll leave it to him. We comped him on basic membership last time. I think next time I’ll have to send him a mug. ---
**Author:** ![AnalogSignal](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/analogsignal/32/1085_2.png) [@AnalogSignal](https://boards.straightdope.com/u/AnalogSignal)\ **Post date:** [January 12, 2012, 4:56am UTC](https://boards.straightdope.com/t/kaspersky-security-software-report-when-browsing-site/607283/34 "2012-01-12T04:56:36Z")
I went with the title “Ne’er-do-well.” I may change it if I come up with a better idea. ---
**Author:** ![RaftPeople](https://avatars.discourse-cdn.com/v4/letter/r/6f9a4e/32.png) [@RaftPeople](https://boards.straightdope.com/u/RaftPeople)\ **Post date:** [January 12, 2012, 5:30am UTC](https://boards.straightdope.com/t/kaspersky-security-software-report-when-browsing-site/607283/35 "2012-01-12T05:30:42Z")
> [@AnalogSignal](#): > > I went with the title “Ne’er-do-well.” I may change it if I come up with a better idea. “Ne’er-do-well, most of the time” [Previous page](https://boards.straightdope.com/t/kaspersky-security-software-report-when-browsing-site/607283.md?page=1)