# Yet more malware/hijacker on SD **URL:** \ **Category:** About This Message Board\ **Created:** [February 12, 2014, 4:29pm UTC](https://boards.straightdope.com/t/yet-more-malware-hijacker-on-sd/681158 "2014-02-12T16:29:58Z")\ **Posts on this page:** 13\ **Page:** 2
**Author:** ![Crazyhorse](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/crazyhorse/32/31_2.png) [@Crazyhorse](https://boards.straightdope.com/u/Crazyhorse)\ **Post date:** [February 13, 2014, 10:07pm UTC](https://boards.straightdope.com/t/yet-more-malware-hijacker-on-sd/681158/21 "2014-02-13T22:07:30Z")
For this specific problem with ads redirecting the user to another website, the information requested won’t make any difference. The problem is with Flash-based ads in general and they will affect any browser/version/OS if Flash is installed on the system. The location of the poster might be relevant in tracking down which ads are doing it at the moment, and of course a screenshot of what specific ads were displayed when the redirect happened would help. But again that would only help identify that one particular ad. As long as Flash based ads are being displayed others will come along to replace any that we manage to get removed. For what it’s worth some more discussion including screen shots can be found in [this recent thread](http://boards.straightdope.com/sdmb/showthread.php?t=713805). Searching google for something like “Flash based ads redirect malware” will lead to hundreds of pages describing the problem. The only solution from the user’s side is to block ads or remove Flash. The only solution from the SDMB Admin’s side is to refuse to serve Flash-based ads. A simple image - a jpg or gif - with the advertisers pitch and a link to their site should be sufficient for any honest advertiser. Allowing advertisers to use a programming language that can control the user’s browser is unwise. ---
**Author:** ![Saint\_Cad](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/saint_cad/32/18907_2.png) [@Saint\_Cad](https://boards.straightdope.com/u/Saint_Cad)\ **Post date:** [February 13, 2014, 11:42pm UTC](https://boards.straightdope.com/t/yet-more-malware-hijacker-on-sd/681158/22 "2014-02-13T23:42:20Z")
> [@Suburban\_Plankton](#): > > It would show which browser you’re using, for one thing. > > It would also help if you would tell us what \*version \*of said browser you are using . > > And if you are using any addons, plugins, toolbars, etc. > > And what anti-virus you are running, and whether or not it’s up to date. > > Nothing you have told us so far is in any way helpful to TPTB to solve the problem, if it is indeed theirs to solve. Your demeanor here suggests that you aren’t actually interested in fixing anything; you just want to complain. > > I’ve been on this board for over 10 years. I almost always have a tab open to the Dope whenever I’m online, which is many hours every day. And I have \*\*\*never \*\*\*had a problem with malware coming from this board (or any other, for that matter). Because I practice ‘safe computing’. If you would do the same, you wouldn’t have problems either. It really is that simple. I don’t need a lecture from you. At home I use Firefox with adblocker. At work we are not allowed to put on add-ons. And how dare you imply I’m not trying to help out SDMB. I fucking tracked down a malicious cookie problem from atlassolutions that I warned them about 2 months prior. In fact, it was so new that it wasn’t even known on the internet when I told SD about it. I told SD about this new one and even pulled up the whois to get some background on the domain which was 5 days old. So your condescension needs to stop. Based on the history SD has had, I know it’s the ads, you know it’s the ads , TubaDiva and everyone working at SD knows it’s the ads. All the users on SD knows it’s the ads and to be honest your holier-than-thou malware apologist stance sucks. How dare you blame me for being hit with malware and hold SD blameless despite their history. You want me to give information to help SD out? How 'bout this: ATTENTION TUBADIVA! STOP HAVING ADSERVERS THAT DELIVER MALWARE!. Happy I did my part in this investigation? ---
**Author:** ![Ed\_Zotti](https://avatars.discourse-cdn.com/v4/letter/e/fbc32d/32.png) [@Ed\_Zotti](https://boards.straightdope.com/u/Ed_Zotti)\ **Post date:** [February 13, 2014, 11:56pm UTC](https://boards.straightdope.com/t/yet-more-malware-hijacker-on-sd/681158/23 "2014-02-13T23:56:37Z")
The “browser update” screen popped up for me and I was able to capture screen shots of it and the ads that were visible in the thread at the time. I forwarded these to our digital ad guy, who has forwarded them to our ad provider with instructions to figure out what this is and get rid of it. There’s definitely something funky going on. To repeat what I’ve said before, screen shots are extremely useful to us in tracking down bad actors. The online ad delivery ecosystem is complex and highly automated; although safeguards are in place, it’s possible for bad guys with technical knowledge to evade the filters and sneak rogue ads into the rotation. Even more helpful than screen shots is tracking software such as Firebug, which records the ad calls and makes it possible to isolate where the bad ad came from. Tracking software requires some computer savvy to use, but (a) if you’re in that category, (b) get hit by malware from time to time, and © are willing to help us out, your assistance would be appreciated. Our apologies for the inconvenience; we hope to get to the bottom of this soon. ---
**Author:** ![Saint\_Cad](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/saint_cad/32/18907_2.png) [@Saint\_Cad](https://boards.straightdope.com/u/Saint_Cad)\ **Post date:** [February 14, 2014, 1:59am UTC](https://boards.straightdope.com/t/yet-more-malware-hijacker-on-sd/681158/24 "2014-02-14T01:59:47Z")
> [@Ed\_Zotti](#): > > The “browser update” screen popped up for me and I was able to capture screen shots of it and the ads that were visible in the thread at the time. I forwarded these to our digital ad guy, who has forwarded them to our ad provider with instructions to figure out what this is and get rid of it. There’s definitely something funky going on. Thank you. ---
**Author:** ![Ed\_Zotti](https://avatars.discourse-cdn.com/v4/letter/e/fbc32d/32.png) [@Ed\_Zotti](https://boards.straightdope.com/u/Ed_Zotti)\ **Post date:** [February 14, 2014, 9:15pm UTC](https://boards.straightdope.com/t/yet-more-malware-hijacker-on-sd/681158/25 "2014-02-14T21:15:08Z")
Our ad provider advises that they have blocked feeds to us from the channels believed to be the source of the offending ads. If you see any more such ads, please let us know as soon as possible. Again, please provide screen shots of (a) any popup screens you see, and (b) any and all ads on the SDMB page (both top and bottom of the thread) at the time the popup appears. Thanks. ---
**Author:** ![running\_coach](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/running_coach/32/15836_2.png) [@running\_coach](https://boards.straightdope.com/u/running_coach)\ **Post date:** [February 14, 2014, 9:36pm UTC](https://boards.straightdope.com/t/yet-more-malware-hijacker-on-sd/681158/26 "2014-02-14T21:36:37Z")
> [@Ed\_Zotti](#): > > Our ad provider advises that they have blocked feeds to us from the channels \*\*believed to be \*\*the source of the offending ads. If you see any more such ads, please let us know as soon as possible. Again, please provide screen shots of (a) any popup screens you see, and (b) any and all ads on the SDMB page (both top and bottom of the thread) at the time the popup appears. Thanks. So a company that’s in the business of serving ads to websites can’t even tell if the ads are infected before they go out? What a bunch of fucking incompetents. ---
**Author:** ![Measure\_for\_Measure](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/measure_for_measure/32/557_2.png) [@Measure\_for\_Measure](https://boards.straightdope.com/u/Measure_for_Measure)\ **Post date:** [February 14, 2014, 10:47pm UTC](https://boards.straightdope.com/t/yet-more-malware-hijacker-on-sd/681158/27 "2014-02-14T22:47:49Z")
> [@running\_coach](#): > > So a company that’s in the business of serving ads to websites can’t even tell if the ads are infected before they go out? > What a bunch of fucking incompetents. Doubtful. I have a guess about what’s going on. Scammers bid up the price of the ads, crowding out legitimate businesses. Scammers make money by selling you Arcea, collecting your credit card number, then billing you monthly. [Article on one cyber-millionaire](http://www.theatlantic.com/magazine/archive/2014/01/the-dark-lord-of-the-internet/355726/): …Willms defrauded consumers of some $467 million by enticing them to sign up for “risk free” product trials and then billing their cards recurring fees for a litany of automatically enrolled services they hadn’t noticed in the fine print. In just a few months, Willms’s companies could charge a consumer hundreds of dollars like this, and making the flurry of debits stop was such a convoluted process for those ensnared by one of his schemes that some customers just canceled their credit cards and opened new ones. In fact, canceling the credit card was really the most practical way of addressing the problem. Advertisements are purchased by competing affiliates who direct traffic to eg Willms. Willms typically paid affiliates a higher fee than that of the actual sale - which makes sense because the entrepreneur was after credit card numbers, not customers. The affiliates in turn (which might consist of thousands of one man shops) are willing to pay hefty fees to ad brokers. Ad brokers don’t want to get too tough with their main customers, or so I speculate. For years I used flash block, but not ad blocker. Then I adopted an ad-blocker, set to low. Now I have it on a standard setting. I’d be willing to whitelist a provider that promised to only deliver non-obnoxious .jpgs, with no moving gifs or flash ads. Admittedly I’m rare in that way. ---
**Author:** ![Measure\_for\_Measure](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/measure_for_measure/32/557_2.png) [@Measure\_for\_Measure](https://boards.straightdope.com/u/Measure_for_Measure)\ **Post date:** [February 14, 2014, 11:08pm UTC](https://boards.straightdope.com/t/yet-more-malware-hijacker-on-sd/681158/28 "2014-02-14T23:08:41Z")
> [@Dallas\_Jones](#): > > **Saint Cad**. > > If you are using Windows IE there is a free web de-bugging tool you can down load, called Fiddler, that will show you all of the traffic going through your computer. There is another one for Mac I think. > > [Telerik - Wikipedia](http://en.wikipedia.org/wiki/Fiddler_(software)) > > You can find a download link from a site you prefer. It is free. Ed Zotti told me about it a few years ago when I had similar complaints and I monitored traffic for a while in the hope of helping to identifying some of the problems. Then I got bored because I wasn’t finding anything and we went through a period of no problems. Thanks. For my reference, could somebody point me to a good piece of sandbox software and a guide to the same? I might want to fool around with this stuff someday on a spare PC. ---
**Author:** ![MsWhatsit](https://avatars.discourse-cdn.com/v4/letter/m/eb8c5e/32.png) [@MsWhatsit](https://boards.straightdope.com/u/MsWhatsit)\ **Post date:** [February 14, 2014, 11:15pm UTC](https://boards.straightdope.com/t/yet-more-malware-hijacker-on-sd/681158/29 "2014-02-14T23:15:10Z")
> [@Measure\_for\_Measure](#): > > For years I used flash block, but not ad blocker. Then I adopted an ad-blocker, set to low. Now I have it on a standard setting. I’d be willing to whitelist a provider that promised to only deliver non-obnoxious .jpgs, with no moving gifs or flash ads. Admittedly I’m rare in that way. I have a lot of individual sites whitelisted in my adblocker. Basically, any site that 1) provides me with good entertainment value on a regular basis, and 2) doesn’t feature ads that move, play videos or music, or install malware. The SDMB meets the first criterion, but not the second. ---
**Author:** ![Guinastasia](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/guinastasia/32/5751_2.png) [@Guinastasia](https://boards.straightdope.com/u/Guinastasia)\ **Post date:** [February 14, 2014, 11:50pm UTC](https://boards.straightdope.com/t/yet-more-malware-hijacker-on-sd/681158/30 "2014-02-14T23:50:44Z")
> [@Saint\_Cad](#): > > I don’t need a lecture from you. > At home I use Firefox with adblocker. At work we are not allowed to put on add-ons. And how dare you imply I’m not trying to help out SDMB. I fucking tracked down a malicious cookie problem from atlassolutions that I warned them about 2 months prior. In fact, it was so new that it wasn’t even known on the internet when I told SD about it. I told SD about this new one and even pulled up the whois to get some background on the domain which was 5 days old. > > So your condescension needs to stop. Based on the history SD has had, I know it’s the ads, you know it’s the ads , TubaDiva and everyone working at SD knows it’s the ads. All the users on SD knows it’s the ads and to be honest your holier-than-thou malware apologist stance sucks. How dare you blame me for being hit with malware and hold SD blameless despite their history. > > You want me to give information to help SD out? How 'bout this: ATTENTION TUBADIVA! STOP HAVING ADSERVERS THAT DELIVER MALWARE!. Happy I did my part in this investigation? While I totally agree with you that the board should be more vigilant about the ads, you probably shouldn’t visit here from work for the time being. I know exactly how you feel, since my last computer was completely fucked up by some nasty spyware. BUT, it’s probably just a good idea right now. People are simply trying to offer you advice, so there’s no need to freak out on them. Okay? People can’t help you if you don’t give them info first. (I am NOT defending the Dope. I’m saying stop stop yelling at people who are simply asking for details). Okay? Chillax. ---
**Author:** ![Saint\_Cad](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/saint_cad/32/18907_2.png) [@Saint\_Cad](https://boards.straightdope.com/u/Saint_Cad)\ **Post date:** [February 26, 2014, 8:23pm UTC](https://boards.straightdope.com/t/yet-more-malware-hijacker-on-sd/681158/31 "2014-02-26T20:23:47Z")
> [@Guinastasia](#): > > While I totally agree with you that the board should be more vigilant about the ads, you probably shouldn’t visit here from work for the time being. I know exactly how you feel, since my last computer was completely fucked up by some nasty spyware. BUT, it’s probably just a good idea right now. People are simply trying to offer you advice, so there’s no need to freak out on them. Okay? > > People can’t help you if you don’t give them info first. (I am NOT defending the Dope. I’m saying stop stop yelling at people who are simply asking for details). Okay? Chillax. For the record, my comments to Suburban Plankton was in regards to > [@](#): > > Nothing you have told us so far is in any way helpful to TPTB to solve the problem, if it is indeed theirs to solve. Your demeanor here suggests that you aren’t actually interested in fixing anything; you just want to complain. > > I’ve been on this board for over 10 years. I almost always have a tab open to the Dope whenever I’m online, which is many hours every day. And I have never had a problem with malware coming from this board (or any other, for that matter). Because I practice ‘safe computing’. If you would do the same, you wouldn’t have problems either. It really is that simple. Helping people out and asking for information is one thing but the condescension and holier-than-thou attitude in that section of his post was uncalled for and I called him out on it. ---
**Author:** ![RaftPeople](https://avatars.discourse-cdn.com/v4/letter/r/6f9a4e/32.png) [@RaftPeople](https://boards.straightdope.com/u/RaftPeople)\ **Post date:** [February 26, 2014, 9:58pm UTC](https://boards.straightdope.com/t/yet-more-malware-hijacker-on-sd/681158/32 "2014-02-26T21:58:21Z")
I agree with you **Saint Cad**. Not only is this statement annoying, it’s completely wrong and based on a very naive/ignorant understanding of computers and malware. > [@Suburban Plankton](#): > > …And I have never had a problem with malware coming from this board (or any other, for that matter). Because I practice ‘safe computing’. If you would do the same, you wouldn’t have problems either. It really is that simple. ---
**Author:** ![TubaDiva](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/tubadiva/32/507_2.png) [@TubaDiva](https://boards.straightdope.com/u/TubaDiva)\ **Post date:** [February 27, 2014, 3:49pm UTC](https://boards.straightdope.com/t/yet-more-malware-hijacker-on-sd/681158/33 "2014-02-27T15:49:34Z")
If you have a beef with another poster About This Message Board is not the place to work it out. If you want to slap at one another, the Pit is the place to do it. Not here. [Previous page](https://boards.straightdope.com/t/yet-more-malware-hijacker-on-sd/681158.md?page=1)