# The SDMB is serving up malware again **URL:** \ **Category:** About This Message Board\ **Created:** [June 21, 2010, 2:40am UTC](https://boards.straightdope.com/t/the-sdmb-is-serving-up-malware-again/543949 "2010-06-21T02:40:32Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Terry\_Kennedy](https://avatars.discourse-cdn.com/v4/letter/t/c57346/32.png) [@Terry\_Kennedy](https://boards.straightdope.com/u/Terry_Kennedy)\ **Post date:** [June 21, 2010, 2:40am UTC](https://boards.straightdope.com/t/the-sdmb-is-serving-up-malware-again/543949/1 "2010-06-21T02:40:32Z")
I’ve been tolerating the broken ad-serving code that prevents the browser “back” from working some of the time, but this is a **much** more serious problem. On clicking “back” a second time (IE 8), the browser closed except for a single small menu box which said my computer was infected, and that I should run VSCAN7, with only an “Ok” button. Task Manager reported 2 instances of IE running and I killed them both. The particular malware link that was being served was [http://f2f183769.anti](http://f2f183769.anti)\*-\*[Elementor Hosting | This site is private](http://spysoftware.com/stream1/cacnpr/ffnhcqdnhn/fcllaqhnrf.html) (link broken to protect the obtunded). If this is like the last few times, that is an ephemeral link that will vanish in a few hours. Why does this problem keep happening here (and only here)? I am a frequent user and/or contributor to at least another 20 vBulletin-based boards, and have **never** had that problem anywhere but here. “Advice” of the form “so, don’t do that”, like “purchase a subscription” or “switch to some-browser-nobody-ever-heard-of” isn’t going to be listened to, so please save the electrons.\* By the way, when I tried to reproduce the “back doesn’t work” problem to tell you what that URL is, I wasn’t able to duplicate it, but I did get some annoying audio ads. They just go “Ap!” or something like that and cut off, presumably because I navigated off the page they were infesting while they were still loading. If the answer is “don’t let the door hit ya on the way out”, that’s fine - but The Management should be clear about that, and not do the “you’re the only one that ever reported that”, or “we had a problem but we fixed it”, or “provide some impossible information and we’ll look into it”. This is a _big_ site, and while you get ad dollars from the ad-serving companies, they are getting _more_ from the companies that are paying them. So a threat to switch to a different ad-serving company should induce them to look at it from their end. - For those that have access to post stats, you’ll see that I answer questions, not ask them. I doubt as a casual individual user I’m worth much to keep around, but I could go to one of the sites that pays people for their answers. For everyone who makes a stink about this problem, there are probably many more who don’t complain. Edit: I just managed to get the “broken back button” problem to trigger. It is [http://www.tumri](http://www.tumri)\*.\*net/ads/mti/5658?ATL\_C… ---
**Author:** ![TubaDiva](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/tubadiva/32/507_2.png) [@TubaDiva](https://boards.straightdope.com/u/TubaDiva)\ **Post date:** [June 21, 2010, 2:19pm UTC](https://boards.straightdope.com/t/the-sdmb-is-serving-up-malware-again/543949/2 "2010-06-21T14:19:04Z")
Noted and reported. ---
**Author:** ![zweisamkeit](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/zweisamkeit/32/4360_2.png) [@zweisamkeit](https://boards.straightdope.com/u/zweisamkeit)\ **Post date:** [June 21, 2010, 4:44pm UTC](https://boards.straightdope.com/t/the-sdmb-is-serving-up-malware-again/543949/3 "2010-06-21T16:44:49Z")
There’s also some issue with ads maybe timing out. I get it on almost every damn page. I click on a topic to open in a new tab and it near locks up while trying to serve up the ads. And don’t you dare click again or it’ll lock up my entire browser. I’m getting rather pissed. ---
**Author:** ![In\_Winnipeg](https://avatars.discourse-cdn.com/v4/letter/i/a8b319/32.png) [@In\_Winnipeg](https://boards.straightdope.com/u/In_Winnipeg)\ **Post date:** [June 21, 2010, 5:11pm UTC](https://boards.straightdope.com/t/the-sdmb-is-serving-up-malware-again/543949/4 "2010-06-21T17:11:53Z")
Ah, so it is this site, and not my computer. Whew! ---
**Author:** ![RaftPeople](https://avatars.discourse-cdn.com/v4/letter/r/6f9a4e/32.png) [@RaftPeople](https://boards.straightdope.com/u/RaftPeople)\ **Post date:** [June 21, 2010, 8:53pm UTC](https://boards.straightdope.com/t/the-sdmb-is-serving-up-malware-again/543949/5 "2010-06-21T20:53:54Z")
I just hit the back button and everything was fine, so it must be a problem on your end. What kind of electricity are you using? ---
**Author:** ![Skywatcher](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/skywatcher/32/254_2.png) [@Skywatcher](https://boards.straightdope.com/u/Skywatcher)\ **Post date:** [June 21, 2010, 8:56pm UTC](https://boards.straightdope.com/t/the-sdmb-is-serving-up-malware-again/543949/6 "2010-06-21T20:56:49Z")
I’ve seen the “your computer is infected” “warning” but don’t know what caused it. It’s possible the SDMB didn’t have me logged in at the time. ---
**Author:** ![Skammer](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/skammer/32/143_2.png) [@Skammer](https://boards.straightdope.com/u/Skammer)\ **Post date:** [June 21, 2010, 9:22pm UTC](https://boards.straightdope.com/t/the-sdmb-is-serving-up-malware-again/543949/7 "2010-06-21T21:22:31Z")
> [@zweisamkeit](#): > > There’s also some issue with ads maybe timing out. I get it on almost every damn page. I click on a topic to open in a new tab and it near locks up while trying to serve up the ads. And don’t you dare click again or it’ll lock up my entire browser. I’m getting rather pissed. I have this problem in almost every thread, but I’m a member and shouldn’t be getting ads anyway. I’ve complained in this forum already without any helpful response. ---
**Author:** ![MikeG](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/mikeg/32/4329_2.png) [@MikeG](https://boards.straightdope.com/u/MikeG)\ **Post date:** [June 21, 2010, 10:06pm UTC](https://boards.straightdope.com/t/the-sdmb-is-serving-up-malware-again/543949/8 "2010-06-21T22:06:38Z")
I’ve never had so much as a whisper of a problem from this site other than lag. ---
**Author:** ![Ed\_Zotti](https://avatars.discourse-cdn.com/v4/letter/e/fbc32d/32.png) [@Ed\_Zotti](https://boards.straightdope.com/u/Ed_Zotti)\ **Post date:** [June 21, 2010, 10:38pm UTC](https://boards.straightdope.com/t/the-sdmb-is-serving-up-malware-again/543949/9 "2010-06-21T22:38:01Z")
We’re trying to figure out where these ads are coming from. We’re not supposed to be getting this kind of stuff and haven’t been able to replicate it. Please indicate your location (city), perhaps this will give us some idea. We’d also appreciate hearing from others who are having this problem. Please provide as much info as you can - ad(s) seen, browser used, etc. Thanks. ---
**Author:** ![Zoe](https://avatars.discourse-cdn.com/v4/letter/z/a4c791/32.png) [@Zoe](https://boards.straightdope.com/u/Zoe)\ **Post date:** [June 22, 2010, 12:23am UTC](https://boards.straightdope.com/t/the-sdmb-is-serving-up-malware-again/543949/10 "2010-06-22T00:23:30Z")
If I have tracked someone here to a hacker group, should I let you know who that is, or does everyone belong to a hacker group and I’m just naive? Zoe, P.I. ---
**Author:** ![BigT](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/bigt/32/12044_2.png) [@BigT](https://boards.straightdope.com/u/BigT)\ **Post date:** [June 22, 2010, 12:51am UTC](https://boards.straightdope.com/t/the-sdmb-is-serving-up-malware-again/543949/11 "2010-06-22T00:51:03Z")
> [@Zoe](#): > > If I have tracked someone here to a hacker group, should I let you know who that is, or does everyone belong to a hacker group and I’m just naive? > > Zoe, P.I. I believe policy is that what you do offsite is not of interest here. Just because someone is a hacker does not mean they have hacked the Dope. It also has been revealed to be against policy to give out identification information. Come to think of it, though, we have had a large amount of Malware, and I wonder if it is being targeted directly at us. Surely Google’s adservice actually checks the source code before approving an ad. ---
**Author:** ![Lare](https://avatars.discourse-cdn.com/v4/letter/l/53a042/32.png) [@Lare](https://boards.straightdope.com/u/Lare)\ **Post date:** [June 22, 2010, 4:52am UTC](https://boards.straightdope.com/t/the-sdmb-is-serving-up-malware-again/543949/12 "2010-06-22T04:52:25Z")
> [@Ed\_Zotti](#): > > We’re trying to figure out where these ads are coming from. We’re not supposed to be getting this kind of stuff and haven’t been able to replicate it. Please indicate your location (city), perhaps this will give us some idea. We’d also appreciate hearing from others who are having this problem. Please provide as much info as you can - ad(s) seen, browser used, etc. Thanks. Happened to me today right after reading this thread. I’m in the metro-Phoenix area, using Windows 7 and IE8. Didn’t notice the actual ads seen as there was just a sudden notice that I should run VSCAN7. I believe I said “Accckkk!” and hit ctrl-alt-del to shut down IE. Unfortunately it insisted on restoring itself so I went to shutdown. ---
**Author:** ![Terry\_Kennedy](https://avatars.discourse-cdn.com/v4/letter/t/c57346/32.png) [@Terry\_Kennedy](https://boards.straightdope.com/u/Terry_Kennedy)\ **Post date:** [June 22, 2010, 5:04am UTC](https://boards.straightdope.com/t/the-sdmb-is-serving-up-malware-again/543949/13 "2010-06-22T05:04:35Z")
> [@Ed\_Zotti](#): > > Please indicate your location (city), perhaps this will give us some idea. I’m in New York City, but some software thinks I’m in Colorado (the netblock I’m in is delegated from there). > [@](#): > > We’re trying to figure out where these ads are coming from. May I suggest that the problem is the ad broker you’re using? This comes around rather frequently, and apparently they apologize and say “we’ll never do that again”, but it comes back after a couple of months. ---
**Author:** ![Terry\_Kennedy](https://avatars.discourse-cdn.com/v4/letter/t/c57346/32.png) [@Terry\_Kennedy](https://boards.straightdope.com/u/Terry_Kennedy)\ **Post date:** [June 22, 2010, 5:30am UTC](https://boards.straightdope.com/t/the-sdmb-is-serving-up-malware-again/543949/14 "2010-06-22T05:30:48Z")
> [@BigT](#): > > Surely Google’s adservice actually checks the source code before approving an ad. This site seems to use other ad services besides Google. On this page, there are ads being served by: [pagead2.googlesyndication.com](http://pagead2.googlesyndication.com) (Google) [ad.doubleclick.net](http://ad.doubleclick.net) (Google) [edge.quantserve.com](http://edge.quantserve.com) (Quantcast) [www.quantcast.com](http://www.quantcast.com) (Quantcast) [pixel.quantserve.com](http://pixel.quantserve.com) (one-pixel image to force a tracking cookie - nasty) (Quantcast) [http.cdnlayer.com](http://http.cdnlayer.com) (SoftLayer) [tumri.net](http://tumri.net) (Tumri) [tap-cdn.rubiconproject.com](http://tap-cdn.rubiconproject.com) (Rubicon Project) The first 2 are Google. I don’t believe the others are. With all of these different ad brokers stuffing ads into the pages with Javascript, it is no wonder that people are seeing various problems with pages. It also makes it very difficult to discover which ad broker is serving up the malware. ---
**Author:** ![wellanuff](https://avatars.discourse-cdn.com/v4/letter/w/57b2e6/32.png) [@wellanuff](https://boards.straightdope.com/u/wellanuff)\ **Post date:** [June 22, 2010, 5:56am UTC](https://boards.straightdope.com/t/the-sdmb-is-serving-up-malware-again/543949/15 "2010-06-22T05:56:20Z")
Having my back button disabled has happened to me on this site (only) for the last two weeks or so. I would say it happens about once out of five to ten page views. When it happens, I check the “Recent Pages” list next to the back button (because I can use that list to skip back past the offending entry), and without fail the most recent entry is “[tumri.net](http://tumri.net)”-related. Chicago area, XP, IE8 ---
**Author:** ![jayjay](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/jayjay/32/6765_2.png) [@jayjay](https://boards.straightdope.com/u/jayjay)\ **Post date:** [June 22, 2010, 11:30am UTC](https://boards.straightdope.com/t/the-sdmb-is-serving-up-malware-again/543949/16 "2010-06-22T11:30:42Z")
I had actually started my own thread in ATMB about this (thanks, **Terry Kennedy** , for pointing me here). On my work comp, on which I’m forced to use IE6, I’m getting the no-back and when I check the recent pages list, there’s always (and I mean ALWAYS) for this site, at least 2 and usually 3 or 4 ad urls (mostly google.doubleclick) right at the top of the list, forcing me to constantly go “back” by bringing up the recent pages and clicking on the first real SD page. Lancaster, PA here. Work computer just got upgraded to XP, IE6 (don’t let them convince you that state gov gets all the good toys!). ---
**Author:** ![zweisamkeit](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/zweisamkeit/32/4360_2.png) [@zweisamkeit](https://boards.straightdope.com/u/zweisamkeit)\ **Post date:** [June 22, 2010, 1:25pm UTC](https://boards.straightdope.com/t/the-sdmb-is-serving-up-malware-again/543949/17 "2010-06-22T13:25:54Z")
I’ve seen issues so far with specific click, [content.yieldmanager.edgesuite.net](http://content.yieldmanager.edgesuite.net), [googleads.g.doubleclick.net](http://googleads.g.doubleclick.net) and [ad.doubleclick.net](http://ad.doubleclick.net). I don’t get any malware pop ups but I’m getting damn tired of my internet windows locking up on me. :mad: ---
**Author:** ![Postariti](https://avatars.discourse-cdn.com/v4/letter/p/b4bc9f/32.png) [@Postariti](https://boards.straightdope.com/u/Postariti)\ **Post date:** [June 22, 2010, 5:17pm UTC](https://boards.straightdope.com/t/the-sdmb-is-serving-up-malware-again/543949/18 "2010-06-22T17:17:13Z")
I just got the VSCAN7 message. I did not hit back, I right clicked and opened a couple of threads. Either VSCAN7 took over one of those tabs, or opened it’s own tab. When I checked that tab, there was a pop up box. I closed it, and it said it was scanning my computer. I shut the tab, and don’t see anything unusual running in my task manager. I’m in Hot Springs, Arkansas. However, because of my searches, ad servers often think I’m in Dallas, Texas. I’m using IE7 and Vista. ---
**Author:** ![An\_Arky](https://avatars.discourse-cdn.com/v4/letter/a/87869e/32.png) [@An\_Arky](https://boards.straightdope.com/u/An_Arky)\ **Post date:** [June 22, 2010, 6:41pm UTC](https://boards.straightdope.com/t/the-sdmb-is-serving-up-malware-again/543949/19 "2010-06-22T18:41:51Z")
I’m getting slowed way down by [tap-cdn.rubiconproject.com](http://tap-cdn.rubiconproject.com) . I’m not supposed to be seeing ads; why should my performance be affected by things I’m not supposed to be loading in the first place? ---
**Author:** ![zweisamkeit](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/zweisamkeit/32/4360_2.png) [@zweisamkeit](https://boards.straightdope.com/u/zweisamkeit)\ **Post date:** [June 22, 2010, 7:14pm UTC](https://boards.straightdope.com/t/the-sdmb-is-serving-up-malware-again/543949/20 "2010-06-22T19:14:38Z")
I just got the VSCAN hijack at 3:12 eastern time. I’m in Southfield, MI though it may show me as being in Tampa, FL because of my work. [Next page](https://boards.straightdope.com/t/the-sdmb-is-serving-up-malware-again/543949.md?page=2)