Adware Issue With Chrome and Firefox.......

**BEGIN PUBLIC SERVICE ANNOUNCEMENT**

Please don't rely on Anti-Virus software to keep you safe from these types of problems. AV software is not effective at preventing things like this. You've probably heard about the NYT getting hacked a couple weeks ago by the Chinese. The NYT had up-to-date anti-virus on every endpoint that was compromised. The AV software missed 44 of the 45 malicious payloads used by the attackers. Greg Davis is more effective at 3rd down conversions than AV is at picking up new viruses. It's great at finding last year's viruses, but they're always behind the times and should never be your first line of defense.

Disable the extensions you don't need in your browser, or at least force Chrome to prompt you before launching them: java, flash, shockwave, etc. These are common infection vectors, and you probably don't need them for daily browsing. And when you do need them, you can enable them on an as-needed basis in Chrome.

If anybody wants help setting up their browser to prompt them, I can post instructions here or you can PM me.

Stay safe out there.

**END PUBLIC SERVICE ANNOUNCEMENT**

EDIT: I'm not saying you shouldn't run AV, I'm just saying don't rely on it as your only line of defense.
 
I have submitted a request to google for them to crawl the site again now that we have removed what I believe was the offending ad network.
 
Oddly, chrome on my android tablet never picked up the threat. Only on desktop was hn blocked.
 
Scorpio79 said:
Oddly, chrome on my android tablet never picked up the threat. Only on desktop was hn blocked.
Click to expand...

I would wager this is what happened:

Late last night, one specific ad network was injected....and then it began to deliver ads that were possibly tainted depending on exploit opportunities on individual computers. It also could have been overly aggressive cookie searching which makes a computer think its under an attack, which is called a false positive....and it gets tagged as malware.
 
JonDMiller said:
I would wager this is what happened:

Late last night, one specific ad network was injected....and then it began to deliver ads that were possibly tainted depending on exploit opportunities on individual computers. It also could have been overly aggressive cookie searching which makes a computer think its under an attack, which is called a false positive....and it gets tagged as malware.
Click to expand...

Think clearing the browser cache in individual computers would make any difference?
 
I don't know anything about this sort of stuff, but that ^ sounds reasonable.
 
[h=2]Safe Browsing[/h][h=3]Diagnostic page for hawkeyenation.com/forum[/h]
What is the current listing status for hawkeyenation.com/forum?
Site is listed as suspicious - visiting this web site may harm your computer.
Part of this site was listed for suspicious activity 5 time(s) over the past 90 days.
​
What happened when Google visited this site?
Of the 195 pages we tested on the site over the past 90 days, 14 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2013-02-03, and the last time suspicious content was found on this site was on 2013-02-03.Malicious software is hosted on 1 domain(s), including ads.zitaholdings.com/.
2 domain(s) appear to be functioning as intermediaries for distributing malware to visitors of this site, including yieldmanager.com/, metanetwork.com/.
This site was hosted on 1 network(s) including AS32748 (STEADFAST).
​
Has this site acted as an intermediary resulting in further distribution of malware?
Over the past 90 days, hawkeyenation.com/forum did not appear to function as an intermediary for the infection of any sites.
​
Has this site hosted malware?
No, this site has not hosted malicious software over the past 90 days.
​
How did this happen?
In some cases, third parties can add malicious code to legitimate sites, which would cause us to show the warning message.
​
Next steps:

 
kmajhawk said:
Think clearing the browser cache in individual computers would make any difference?
Click to expand...

Right now, the alert is going to keep showing until google scans the site again and doesn't turn up any problems. Being that there are hundreds of millions of sites in the world and its a monday, I am guessing we're somewhere on the list of thousands looking to do same thing this AM
 
JonDMiller said:
Right now, the alert is going to keep showing until google scans the site again and doesn't turn up any problems. Being that there are hundreds of millions of sites in the world and its a monday, I am guessing we're somewhere on the list of thousands looking to do same thing this AM
Click to expand...

OK. Well, good luck with it. This could certainly cut down on traffic and page views if it goes on long...
 
Here is what I got from one of my vendors:

Hello,

There was an incident of malicious ads detected within the (Vendor) Market during the EST evening last night.
The malicious creatives were caught by monitoring & removed from the system.

This issue would cause a Google alert concerning the malicious domain: ads.zitaholdings.com

For Google / Chrome safe browsing warnings, it will be best to have the publisher login to their Google Webmaster account and request a re-scan of the website in order to have the warnings removed.
Click to expand...

As far as the latter is concerned, I have initiated that.
 
JonDMiller said:
I would wager this is what happened:

Late last night, one specific ad network was injected....and then it began to deliver ads that were possibly tainted depending on exploit opportunities on individual computers. It also could have been overly aggressive cookie searching which makes a computer think its under an attack, which is called a false positive....and it gets tagged as malware.
Click to expand...

Nothing worse than a false positive......
 
You must log in or register to reply here.

Latest posts

Share this page

Top