# The SDMB is serving up malware again **URL:** \ **Category:** About This Message Board\ **Created:** [June 21, 2010, 2:40am UTC](https://boards.straightdope.com/t/the-sdmb-is-serving-up-malware-again/543949 "2010-06-21T02:40:32Z")\ **Posts on this page:** 20\ **Page:** 2
**Author:** ![Ed\_Zotti](https://avatars.discourse-cdn.com/v4/letter/e/fbc32d/32.png) [@Ed\_Zotti](https://boards.straightdope.com/u/Ed_Zotti)\ **Post date:** [June 23, 2010, 12:10am UTC](https://boards.straightdope.com/t/the-sdmb-is-serving-up-malware-again/543949/21 "2010-06-23T00:10:20Z")
> [@Terry\_Kennedy](#): > > This site seems to use other ad services besides Google. On this page, there are ads being served by: > > [pagead2.googlesyndication.com](http://pagead2.googlesyndication.com) (Google) > [ad.doubleclick.net](http://ad.doubleclick.net) (Google) > > [edge.quantserve.com](http://edge.quantserve.com) (Quantcast) > [www.quantcast.com](http://www.quantcast.com) (Quantcast) > [pixel.quantserve.com](http://pixel.quantserve.com) (one-pixel image to force a tracking cookie - nasty) (Quantcast) > [http.cdnlayer.com](http://http.cdnlayer.com) (SoftLayer) > [tumri.net](http://tumri.net) (Tumri) > [tap-cdn.rubiconproject.com](http://tap-cdn.rubiconproject.com) (Rubicon Project) > > The first 2 are Google. I don’t believe the others are. > > With all of these different ad brokers stuffing ads into the pages with Javascript, it is no wonder that people are seeing various problems with pages. It also makes it very difficult to discover which ad broker is serving up the malware. We use two ad services, Google and Rubicon. Quantcast is a well-known usage tracking outfit. It doesn’t track you personally, it tracks overall site usage, which it uses to publish reports available to potential advertisers at [quantcast.com](http://quantcast.com). Not sure what Tumri and SoftLayer are - I put in what the tech guys tell me to put in - but I’m confident they’re associated with one of the above. These are all well -known services with many clients; none of them is specific to us. Our message board software, vBulletin, is also in common use. So far as we’re aware, we’re not doing anything that lots of other boards aren’t doing. I don’t claim the problems you’re seeing are all in your head; however, our observation has been that global problems usually generate a raft of complaints, whereas isolated complaints generally mean some undesirable interaction between our site, an ad server, and some program local to you. As you can appreciate, these are difficult to track down, although we do our best. On the question of objectionable ads, our ad scheduler assures me we’re not supposed to be seeing ads with sound, malware, and the like. If you are, that suggests an advertiser has managed to sneak something past the broker’s filters. If you see or hear an objectionable ad, the simplest thing for PC users is to send us a screen shot (Alt-Print Screen) of the problematic SDMB page, if possible showing all three ads on the page. (Don’t hit the back button before doing this; you may get a different set of ads.) It’s much easier for us to follow up on objectionable ads if we can identify the advertiser. ---
**Author:** ![Rhodes](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/rhodes/32/273_2.png) [@Rhodes](https://boards.straightdope.com/u/Rhodes)\ **Post date:** [June 23, 2010, 12:40am UTC](https://boards.straightdope.com/t/the-sdmb-is-serving-up-malware-again/543949/22 "2010-06-23T00:40:17Z")
I haven’t had problems with my IE8 back-button, but a malware attempted to run when I clicked the “It’s mine!” thread in Threadspotting. 7:20ish PM central US time. My browser closed and was replaced by a dialog stating that I should run some phony anti-malware program. The dialog had only an OK button. I closed it using task manager. So far AVG and Malwarebytes haven’t found anything. ---
**Author:** ![Terry\_Kennedy](https://avatars.discourse-cdn.com/v4/letter/t/c57346/32.png) [@Terry\_Kennedy](https://boards.straightdope.com/u/Terry_Kennedy)\ **Post date:** [June 23, 2010, 5:58pm UTC](https://boards.straightdope.com/t/the-sdmb-is-serving-up-malware-again/543949/23 "2010-06-23T17:58:42Z")
> [@Ed\_Zotti](#): > > I don’t claim the problems you’re seeing are all in your head; however, our observation has been that global problems usually generate a raft of complaints, whereas isolated complaints generally mean some undesirable interaction between our site, an ad server, and some program local to you. As you can appreciate, these are difficult to track down, although we do our best. I’ve seen at least 5 other reports of the VSCAN7 one hitting people here recently, a bunch of complaints about the back button being broken, and at least 2 others about the noisemaking ads. This is the same as any real virus - if it infects and kills everyone, it can’t spread. So it evolves to only target some small percentage of the population. As I said in my original post, this is the **only** site out of 20 or so other vBulletin sites I use regularly where this happens. And it happens regardless of what computer I’m on. Trust me - “it’s not me, it’s you” 😃 > [@](#): > > On the question of objectionable ads, our ad scheduler assures me we’re not supposed to be seeing ads with sound, malware, and the like. If you are, that suggests an advertiser has managed to sneak something past the broker’s filters. If you see or hear an objectionable ad, the simplest thing for PC users is to send us a screen shot (Alt-Print Screen) of the problematic SDMB page, if possible showing all three ads on the page. (Don’t hit the back button before doing this; you may get a different set of ads.) It’s much easier for us to follow up on objectionable ads if we can identify the advertiser. As I was browsing the “Driving cross-country with a cat” thread in GQ, all browser windows closed and were replaced with the VSCAN7 popup: [image](http://www.tmk.com/transient/6-23-2010_1-37-11_PM.jpg) After nuking all IE processes and coming back to ATMB to report this, I saw a bump to a different post - “Anyone else getting fake anti-virus errors?” and was intending to post a link to this thread, when I got “Contratulations! You’re a winner!” blaring out of my speakers and a strobing ad box saying the same thing: [image](http://www.tmk.com/transient/6-23-2010_1-40-37_PM.jpg) Your ad brokers are either incompetent, lying to you, or both. ---
**Author:** ![Dallas\_Jones](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/dallas_jones/32/3277_2.png) [@Dallas\_Jones](https://boards.straightdope.com/u/Dallas_Jones)\ **Post date:** [June 23, 2010, 8:08pm UTC](https://boards.straightdope.com/t/the-sdmb-is-serving-up-malware-again/543949/24 "2010-06-23T20:08:09Z")
I got the fake anti-virus warning two days ago also. I didn’t bother reporting as it is the 3rd time in the last few months. My Norton always stops the threat and I am just begining to realize that the SDMB is simply one of those sites that you need to really use protection to visit. I’m sorry Ed, but whoever is in charge of your IT security sucks at it. That is the plainest way I can put it. ---
**Author:** ![Lare](https://avatars.discourse-cdn.com/v4/letter/l/53a042/32.png) [@Lare](https://boards.straightdope.com/u/Lare)\ **Post date:** [June 23, 2010, 8:20pm UTC](https://boards.straightdope.com/t/the-sdmb-is-serving-up-malware-again/543949/25 "2010-06-23T20:20:07Z")
> [@Ed\_Zotti](#): > > … > On the question of objectionable ads, our ad scheduler assures me we’re not supposed to be seeing ads with sound,… I just now clicked on the main page link (“Straight Dope Message Board\>Main”) link and the page had an ad for [eHarmony.com](http://eHarmony.com) at the bottom. Without meaning to, I moused over the ad. Sound started playing, a voice over about the eHarmony website. For the record, the ad DOES specifically say “Mouse over for sound.” I don’t know if this is therefore acceptable or not; and please understand that I am not complaining about the site so much as I am informing Those With The Power about the experience I had. ---
**Author:** ![ftg](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ftg/32/2801_2.png) [@ftg](https://boards.straightdope.com/u/ftg)\ **Post date:** [June 23, 2010, 9:37pm UTC](https://boards.straightdope.com/t/the-sdmb-is-serving-up-malware-again/543949/26 "2010-06-23T21:37:50Z")
It might also be helpful if people were to forward the output of a netstat command. With maybe 3 people reporting there might be enough info to locate the servers sending the bad ads and then figure out which irresponsible ad service is doing this. Note that malware ad distributors can make sure that the ads don’t get served to the region the host site is located so that the admins don’t see the ads. So the SDMB admins not seeing the malware means nothing. ---
**Author:** ![Cheshire\_Human](https://avatars.discourse-cdn.com/v4/letter/c/5f8ce5/32.png) [@Cheshire\_Human](https://boards.straightdope.com/u/Cheshire_Human)\ **Post date:** [June 24, 2010, 1:47am UTC](https://boards.straightdope.com/t/the-sdmb-is-serving-up-malware-again/543949/27 "2010-06-24T01:47:52Z")
For Everyone’s information, the VSCAN thing isn’t malware. It’s a crappy form of pop-under advertising that tries to _convince_ you that you have been infected with malware, so they can sell you their (almost certainly useless) anti-malware software. Complain about it as an ad, I would agree it sucks, but don’t call it malware. Incidently, the ad uses a “feature” of IE to do it’s shit. Firefox doesn’t ever show it. I can’t say about other browsers, because those are the only 2 I use. ---
**Author:** ![Terry\_Kennedy](https://avatars.discourse-cdn.com/v4/letter/t/c57346/32.png) [@Terry\_Kennedy](https://boards.straightdope.com/u/Terry_Kennedy)\ **Post date:** [June 24, 2010, 2:59am UTC](https://boards.straightdope.com/t/the-sdmb-is-serving-up-malware-again/543949/28 "2010-06-24T02:59:10Z")
> [@Cheshire\_Human](#): > > For Everyone’s information, the VSCAN thing isn’t malware. It’s a crappy form of pop-under advertising that tries to _convince_ you that you have been infected with malware, so they can sell you their (almost certainly useless) anti-malware software. Complain about it as an ad, I would agree it sucks, but don’t call it malware. Incidently, the ad uses a “feature” of IE to do it’s shit. Firefox doesn’t ever show it. I can’t say about other browsers, because those are the only 2 I use. I didn’t click Ok to see what this particular version does. In the past, there have been similar things that download a “free scanner” when you click Ok which then holds your system hostage until you buy your way out or find a way around it. Article about this [here](http://www.pcworld.com/businesscenter/article/173855/fake_antivirus_attacks_demands_ransom.html). Some particularly nasty variants encrypt your hard drive data. Article [here](http://www.thesecurityblog.com/2009/12/data-doctor-2010-will-make-you-sick/). ---
**Author:** ![Shark\_Sandwich](https://avatars.discourse-cdn.com/v4/letter/s/f04885/32.png) [@Shark\_Sandwich](https://boards.straightdope.com/u/Shark_Sandwich)\ **Post date:** [June 24, 2010, 2:52pm UTC](https://boards.straightdope.com/t/the-sdmb-is-serving-up-malware-again/543949/29 "2010-06-24T14:52:44Z")
I picked up the AV Security Suite “virus” here on Tuesday. Just like **Terry Kennedy** said, I was clicking back, the window popped up saying I was infected, and I Ctrl-Alt-Deleted out of my Explorer session, but it was too late. I didn’t report it because I’d seen it here before, but was lucky enough not to get infected. This time, not so much. And I _would_ call it malware, as it disables your browser by activating a proxy setting (IE, at least), disables .exe files from running, and will reinstall itself on start up if not completely scrubbed. I live in Chattangooa, TN, run IE8, and this is the only board I frequent. ---
**Author:** ![Basandre](https://avatars.discourse-cdn.com/v4/letter/b/bcef8e/32.png) [@Basandre](https://boards.straightdope.com/u/Basandre)\ **Post date:** [June 24, 2010, 3:41pm UTC](https://boards.straightdope.com/t/the-sdmb-is-serving-up-malware-again/543949/30 "2010-06-24T15:41:39Z")
I just got the VSCAN7 ad-download-me-now thing. I’m in central NM, using Vista and IE 8, and in case it matters, I think I was trying to load this thread: [Could I Be Convicted of Murder If I Encourage Someone To Commit Suicide? - Factual Questions - Straight Dope Message Board](http://boards.straightdope.com/sdmb/showthread.php?t=568337). ---
**Author:** ![Rhodes](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/rhodes/32/273_2.png) [@Rhodes](https://boards.straightdope.com/u/Rhodes)\ **Post date:** [June 24, 2010, 8:46pm UTC](https://boards.straightdope.com/t/the-sdmb-is-serving-up-malware-again/543949/31 "2010-06-24T20:46:44Z")
> [@Cheshire\_Human](#): > > For Everyone’s information, the VSCAN thing isn’t malware. It’s a crappy form of pop-under advertising that tries to _convince_ you that you have been infected with malware, so they can sell you their (almost certainly useless) anti-malware software. Complain about it as an ad, I would agree it sucks, but don’t call it malware. Incidently, the ad uses a “feature” of IE to do it’s shit. Firefox doesn’t ever show it. I can’t say about other browsers, because those are the only 2 I use. Absolutely false. A program that closes my browser and replaces it with a phony virus scanner IS malware. If I have to use the task manager to close the dialog, else it will hijack IE8 and redirect all URLs to the site where I am supposed to pay the ransom to get my browser back, it IS malware. An ad would be trying to sell me a service, not trying to destroy my computer so I can pay them to undo the damage. ---
**Author:** ![Rhodes](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/rhodes/32/273_2.png) [@Rhodes](https://boards.straightdope.com/u/Rhodes)\ **Post date:** [June 24, 2010, 9:23pm UTC](https://boards.straightdope.com/t/the-sdmb-is-serving-up-malware-again/543949/32 "2010-06-24T21:23:59Z")
Now I’m seeing the back-button issue that others have described. My IE7 back button history has been modified so that the most recent page is on [www.tumri.net/](http://www.tumri.net/)… When I click on it, nothing changes on my screen. ---
**Author:** ![Shark\_Sandwich](https://avatars.discourse-cdn.com/v4/letter/s/f04885/32.png) [@Shark\_Sandwich](https://boards.straightdope.com/u/Shark_Sandwich)\ **Post date:** [June 24, 2010, 10:04pm UTC](https://boards.straightdope.com/t/the-sdmb-is-serving-up-malware-again/543949/33 "2010-06-24T22:04:06Z")
Just got the AV Security Suite virus AGAIN at 5:48pm EST (ish) on my other laptop. Clicked the back button out of this thread, and noticed a Java splash screen launched. Before I get launch the task manager, AV Security Suite splash page popped up, and told me it’d detected a virus. I’m scrubbing that machine now, but I thought I’d let you know. ---
**Author:** ![Justin\_Bailey](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/justin_bailey/32/8792_2.png) [@Justin\_Bailey](https://boards.straightdope.com/u/Justin_Bailey)\ **Post date:** [June 24, 2010, 10:30pm UTC](https://boards.straightdope.com/t/the-sdmb-is-serving-up-malware-again/543949/34 "2010-06-24T22:30:33Z")
**NOTE TO SDMB ADMINS: Until this virus/malware thing is cleared up, I will no longer be visiting the SDMB. I can’t imagine I’m alone. Please realize this problem is costing you money.** Two minutes ago I got the AV Security Suite malware after clicking Reply on a thread. The following two ads were displayed on the page: [http://ad.doubleclick.net/click;h=v8/39c3/c/ad/\*/x;225450370;2-0;0;49220257;3454-728/90;36980763/36998641/1;;~sscs=%3Fhttp://r1.ace.advertising.com/click/site=0000759728/mnum=0000863869/cstr=45233279=\_4c23db9c,2120113841,759728^863869^1^0,1\_/xsxdata=$xsxdata/bnum=45233279/optn=64?trg=http%3A%2F%2Fwww.hotelindigo.com/h/d/in/1/en/c/1/content/dec/teaser/in/1/en/lp/mobile.html%3F\_PMID%3D99617394%26cm\_mmc%3Dcpms-\_-DFA-\_-AOL-\_-IN\_BOOKMOBILE-\_-EN%26dp%3Dtrue](http://ad.doubleclick.net/click;h=v8/39c3/c/ad/%2a/x;225450370;2-0;0;49220257;3454-728/90;36980763/36998641/1;;~sscs=%3fhttp://r1.ace.advertising.com/click/site=0000759728/mnum=0000863869/cstr=45233279=_4c23db9c,2120113841,759728%5E863869%5E1%5E0,1_/xsxdata=$xsxdata/bnum=45233279/optn=64?trg=http%3a%2f%2fwww.hotelindigo.com/h/d/in/1/en/c/1/content/dec/teaser/in/1/en/lp/mobile.html%3F_PMID%3D99617394%26cm_mmc%3Dcpms-_-DFA-_-AOL-_-IN_BOOKMOBILE-_-EN%26dp%3Dtrue) [http://ad.doubleclick.net/click;h=v8/39c3/14/1d5/\*/z;224777477;2-0;0;48568198;2321-160/600;37117759/37135637/1;;~sscs=%3Fhttp://ad.yieldmanager.com/clk?2,13%3B2d0f6457d766d68b%3B1296c11de9d,0%3B%3B%3B3440429785,NwQAAFdXDAB21UwAAAAAADEkFQAAAAAAAgAAAAoAAAAAAP8AAAAFE7YjGAAAAAAAFKkOAAAAAACrgxwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD6aAYAAAAAAAIAAwAAAAAAv90RbCkBAAAAAAAAADhkNjc2MmMyLTdmZGYtMTFkZi1iZDIzLTAwMzA0ODYxZTZhNgBUAAAAAAA=,,http%3A%2F%2Fad.doubleclick.net%2Fn622%2Fadi%2Fstraightdope.creativeloafing%2Fbboard%3Bpg%3Dbboard%3Bsz%3D160x600%3Btile%3D2%3Bord%3D9056%3F,http://www.ideeli.com/join\_today?mi=mm20100406dfa](http://ad.doubleclick.net/click;h=v8/39c3/14/1d5/%2a/z;224777477;2-0;0;48568198;2321-160/600;37117759/37135637/1;;~sscs=%3fhttp://ad.yieldmanager.com/clk?2,13%3B2d0f6457d766d68b%3B1296c11de9d,0%3B%3B%3B3440429785,NwQAAFdXDAB21UwAAAAAADEkFQAAAAAAAgAAAAoAAAAAAP8AAAAFE7YjGAAAAAAAFKkOAAAAAACrgxwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD6aAYAAAAAAAIAAwAAAAAAv90RbCkBAAAAAAAAADhkNjc2MmMyLTdmZGYtMTFkZi1iZDIzLTAwMzA0ODYxZTZhNgBUAAAAAAA=,,http%3A%2F%2Fad.doubleclick.net%2Fn622%2Fadi%2Fstraightdope.creativeloafing%2Fbboard%3Bpg%3Dbboard%3Bsz%3D160x600%3Btile%3D2%3Bord%3D9056%3F,http://www.ideeli.com/join_today?mi=mm20100406dfa) ---
**Author:** ![IAmNotSpartacus](https://avatars.discourse-cdn.com/v4/letter/i/cc9497/32.png) [@IAmNotSpartacus](https://boards.straightdope.com/u/IAmNotSpartacus)\ **Post date:** [June 24, 2010, 10:59pm UTC](https://boards.straightdope.com/t/the-sdmb-is-serving-up-malware-again/543949/35 "2010-06-24T22:59:44Z")
Oh, but it’s not the SDMB’s fault! Even if it is their message board, they’ve contracted out to a third party and the third party promises they’d _never_ serve malware or adware! The lack of accountability by management is incredible. Until someone owns up to the problem it isn’t going to get fixed. ---
**Author:** ![Tethered\_Kite](https://avatars.discourse-cdn.com/v4/letter/t/a5b964/32.png) [@Tethered\_Kite](https://boards.straightdope.com/u/Tethered_Kite)\ **Post date:** [June 24, 2010, 11:43pm UTC](https://boards.straightdope.com/t/the-sdmb-is-serving-up-malware-again/543949/36 "2010-06-24T23:43:32Z")
About one o’clock I bumped into Exploit Rogue Scanner type according to my AVG which blocked it. I tried to copy the info but then windows began opening up and I scooted. None of the addressess posted here looked like the one which was shown. Eekers. ---
**Author:** ![Joanie](https://avatars.discourse-cdn.com/v4/letter/j/e95f7d/32.png) [@Joanie](https://boards.straightdope.com/u/Joanie)\ **Post date:** [June 25, 2010, 3:34am UTC](https://boards.straightdope.com/t/the-sdmb-is-serving-up-malware-again/543949/37 "2010-06-25T03:34:19Z")
Oh my gosh! I am concerned that I may have gotten ahold of some malware this afternoon. For anyone interested, please check my post #18 in the ATMB forum in the thread, “Is it permitted to call the President a bunch of evil names?”. I placed a link at the end of this post. I made a spelling error wrt the name of the software in the post. The correct name is RegistryBooster.exe and it was offered to me to download after I received a warning that I was trying to open a “.php” file (that is a file used to create HTML files). [http://boards.straightdope.com/sdmb/showthread.php?t=568376&highlight=executable](http://boards.straightdope.com/sdmb/showthread.php?t=568376&highlight=executable) ---
**Author:** ![missred](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/missred/32/14096_2.png) [@missred](https://boards.straightdope.com/u/missred)\ **Post date:** [June 25, 2010, 4:58am UTC](https://boards.straightdope.com/t/the-sdmb-is-serving-up-malware-again/543949/38 "2010-06-25T04:58:25Z")
I’ve been having the back button issues for a week or more on my work computer, home computer, work laptop and personal notebook. I got the VSCAN7 message a bit after 3:00 am CST today. I’m in the Nashville area. ---
**Author:** ![Grrr](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/grrr/32/146_2.png) [@Grrr](https://boards.straightdope.com/u/Grrr)\ **Post date:** [June 25, 2010, 10:19am UTC](https://boards.straightdope.com/t/the-sdmb-is-serving-up-malware-again/543949/39 "2010-06-25T10:19:27Z")
Live in Dallas. Window Vista. IE, I don’t know how to tell which version I’m using. Probably the latest as I always update it when it tells me to. ---
**Author:** ![Joanie](https://avatars.discourse-cdn.com/v4/letter/j/e95f7d/32.png) [@Joanie](https://boards.straightdope.com/u/Joanie)\ **Post date:** [June 25, 2010, 12:39pm UTC](https://boards.straightdope.com/t/the-sdmb-is-serving-up-malware-again/543949/40 "2010-06-25T12:39:37Z")
One quick way is to click on Start - Programs - Accessories - Command Prompt. Then type in “VER” (which is the Version command) and it will display the version. [Previous page](https://boards.straightdope.com/t/the-sdmb-is-serving-up-malware-again/543949.md?page=1) [Next page](https://boards.straightdope.com/t/the-sdmb-is-serving-up-malware-again/543949.md?page=3)