Slashdot Mirror
Malware Delivered By Yahoo, Fox, Google Ads
WrongSizeGlass writes "CNET is reporting that Avast has tracked over 2.6 million instances of malware that have been served up to unsuspecting web surfers since last December by ad services such as Yahoo's Yield Manager, Fox Audience Network's Fimserve.com and even some from Google's DoubleClick. Some high-profile sites include The New York Times, Drudge Report.com, TechCrunch and WhitePages.com. The practice has been dubbed 'malvertising.'
I usually suspect the users of 'careless web activity' when I delouse a PC, but now I'm going to have to give some the benefit of the doubt."
At my work, we allow unrestricted access to the net, but log everything. We had a recent spate of vundo variants come through, and when we went through the logs, almost all of them were via the NYTimes or Wa Post. Frustrating, when large companies like this make work for you. For the most part, the allow everything, log it and using IDPS on the front-end(s) has helped quite a bit.
Sent from your iPad.
Never ever click an ad!
Really, who is surprised by this? What's the cost of an ad and fake credentials compared to getting a chance to infect millions of computers?
The number one reason to avoid Flash is the advertisements. The numerous exploits means that it is just a matter of displaying the ad, and voila, you have most injected visitors.
JavaScript based ads are not much better, but they're at least not as easy to exploit as Flash based ads.
as far as I know the margins on selling infections aren't that fantastic.
I depends on who you're infecting though.
Good thing the combo of AdBlock, NoScript & FlashBlock will basically prevent these kinds of attacks.
There is a war going on for your mind.
Yet another reason to use ad blockers. I'm starting to think Firefox should come with it out of the box.
AccountKiller
1) Flash-based Banner Ad
2) JRE Exploit (CVE-2008-5353)
3) Adobe Reader Exploit
4) Profit?
I would like to support sites by viewing their ads but if it leaves you more open to viruses even on high-profile sites then it is not worth the risk.
Troll is not a replacement for I disagree.
Since the attact vector isn't Flash itself, but the implementation that 99.9999999% of people have installed.
The way I see it, no browser should be designed to require admin rights. All that it needs is a sandboxed environment for temporary files. When this mantra gets in the developers' heads, such exploits will no longer be possible. Of course, by that time, other type of exploits will be invented, but we'll cross that bridge when we reach it.
right...
And Ars Technica says I shouldn't block ads.
I repeatedly told their staff that I don't block Ars Technica, but I do block ad servers. If they want to send me ads let them server them from their own domain.
Sites resposible for ad-vectored infections should be hit with hundreds of small claims court lawsuits to recoup the costs to clean up the infections.
Maybe then they'll learn.
> I usually suspect the users of 'careless web activity' when I delouse a PC...
They are guilty of 'careless web activity': not blocking ads.
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
I recently loaded the website of a local paintball facility in Firefox 3.5.7 with NoScript and the site somehow added itself to the NoScript allowed sites and attempted to install one of the Antivirus XP 2010 type pieces of crapware. This was on Vista and the installation went nowhere; testing on an XP machine yielded full and complete installation with no user interaction beyond opening the original web site. Pretty scary.
Let's see here... an anti-malvertising/malware firm reporting lots and lots of malicious "bad things" being served up by those terrible pesky Internet ads... no agenda here. The report failed to follow-through and dig into the real problem with malicious payloads associated with online ads, the ad network daisy-chain. If network-A has no impression for you, you're handed off to network-B, which may have no impression and then gives you to network-C... and so on. As your impression traverses the daisy chain, the likelihood of hitting a low-tier ad network that allows any wanker with a (stolen) credit card to order millions of impressions increases... where the malware begins. We scan our ad tags daily, using two methods -- a dozens-of-times-an-hour service, and our own script on a minimally-protected PC. We've never seen malware from a advertising assets delivered by a top-tier ad network... when we see malware, it's ALWAYS from a provider down the daisy-chain.
Disable JavaScript and 3rd party cookies.
Obviously, don't use IE and configure it at the highest possible internet security options to stop accidental use by users or other programs hard coded to use it.
And not just malware, scam shops and all kinds of shady stuff. You want to know what's the best part? Google, Yahoo, and so on don't give a f*ck about it, I've reported such ads several times and I've never seen any action taken. As long as the criminals pay for the ads, nobody cares.
Seems like it should be easy to track and either immediately shut down the compromised accounts used or decapitate the morons responsible. If it's not easy then the payment systems need to be completely re-engineered such that it is. There's no excuse in this privacy-impaired online global society for not being able to track down where the money comes from. Heck, just ask the fraking RIAA for help if you can't figure out it's really a 70 year old grandmother without a computer who is placing these ads.
Then we should start blocking the ad networks from our networks.
If lots of people started doing that, I wonder how quick Google, Yahoo, et all would start screening advertisers for malware?
Corporatism != Free Market
I thought the text-only ads from Google will not allow an advertiser to embed Javascript. Not sure about their newer Flash ads which can embed ActionScript, but one would think Google will be more careful with that. Maybe it is possible that Google still unknowingly redirects you to a malware page after you click on an ad, but the pie chart in TFA does not show Google DoubleClick (probably an insignificant amount under Others). In addition, Google may use the automated method behind stopbadware.org to determine whether an ad is clean or not. I'd be surprised if they're not already doing that.
What is interesting is, although the chart does not show Google, the article still lumps Google Ads to their headline. Why? It's more catchy to sling mud on Google? What kind of irresponsible journalism is that?
I once had a signature.
Very good point, especially in light of Ars Technica's recent plea to users to stop blocking ads.
I, too, would be than more willing to disable the protective measures I've got in place, but as long as these sites rely on third party advertisers that are more concerned with eyeball collection than system security, we have a stalemate. If sites want me to see their ads, they have the burden of making sure the ads are safe (less annoying, would also be good). If I lower my guard out of "friendship" for a site, only to get a drive by download as a reward, I'm going to take it as a major breech of trust.
I'm not tense. I'm just terribly, terribly, alert.
They complain about advertising revenues while they are serving up ads that contain malware. To someone who hates ads to begin with, that's like saying "we know you don't enjoy crawling over broken glass, so how about crawling over glass mixed with AIDS-infected blood and barbed wire?"
how about badvertising?
That's why I am so pissed at site designers who go "lalala I can't hear you" whenever I request they make their site accessible without "active content" (i.e. Javascript, Flash, Java or even worse things).
It's nifty and all, but nowadays it's the main malware distribution mechanism. And you can't tell users "just switch off Javascript", because suddenly, half of the Web won't work (I do switch of Javascript: no, not NoScript. Just The Real Thing -- and for most, I'm even glad *this* half of the Web doesn't work -- but I can't tell a regular user to do the same). Heck, those $@#%! web designers even do regular links with javascript snippets for reasons inscrutable to me. Disgusting.
Advertisers? Do you hear me? I'll look at pngs, jpegs and gifs, even animated. I'll read text. but I won't even see your Javascript/Flash/whatever stuff.
There. Had to be said.
Watch an ad and you're f*cked automatically!
Nae king! Nae laird! Nae yurrupiean pressedent! We willna be fooled again!
Ad networks should not enable their clients to include Javascript, Flash, Java, or other active content in the first place. If they have a compelling business case for doing so, all code should be "whitelist" filtered before being distributed. The ad network's reputation is on the line every time they serve an impression.
It's a small price to pay for not using AdBlock. So remember: don't use it.
The simple act of browsing the web should never under any circumstances infect your computer. The web browser is simply a viewer. It should only have permission to save bookmarks, cookies, and maybe a few other things to disk. If your operating system allows the web browser to infect your computer or to modify itself without prompting you first, someone seriously dropped the ball when designing your OS. Relying on anti-virus protection or only visiting reputable web-sites is like piling sandbags in front of your house when you shouldn't have built in a flood-plane in the first place.
For the past 10+ years I've had no worries about clicking on any ad or link I see. Never picked up anything from doing so, despite being warned for the past decade that my days of worry-free browsing will soon come to an end. It's been over 10 years now and I'm still waiting. I run no A/V, never have, and my firewall is gathering dust. (I assume it works but I've never turned it on.) Mod this post into oblivion all you want, but I'm just here to tell ya, there really is a better way.
I don't need to tell you what OS I'm using. That should be obvious.
ONE small claims court victory for PC cleanup costs a month would pur a serious hurt an any site's revenue.
Serve the ads yourself and take responsibility for them, every other media format does.
> Doesn't really help in a business environment - few adblockers allow you to
> deploy and manage them centrally. Frankly, it would make more sense to block
> ads at the firewall.
Privoxy does exactly that.
Warning: this article may contain humor, sarcasm, parody, and perhaps even irony. Read at your own risk.
Once again, we cannot trust advertising that does not come directly from the web site being contacted. No surprise there. Further, there are times when we cannot trust advertising that DOES come from the site being contacted.
The only safe content, so far, is based on simple text and pictures.
Are you listening advertisers? TRUST the people you are advertising through to host and deliver your ads appropriately. RESPECT your audience enough to avoid using flash and other nonsense. Do this and people will not block your ads so much. People block not only because it is annoying, it is a risk to do otherwise.
i understand their position, but they're got to realize ours. hours wasted cleaning out malware/spyware does not make for a good browsing experience, period.
I have a running dialogue with a webmaster of a celebrity paps site (ok, sue me) about the various bits of malware that are being served up by her various advertisers. This began a few months ago, and it took a while before I figured out they could not be expected to know this was happening. She has tracked down the source of these adverts to an agency that offered her triple the usual rate. Now she knows, among other things, that if it's too good to be true, there is a reason why.
But, she and I have synched clocks so she can know to the few seconds what I got. She has to report back precise details to get her advertisers to figure out what happened, cause most of her direct advertisers are contracting out ads to other agencies, and they sell other ads, and the chain gets long and obscure in no time at all.
So far, she is helpful, but last week I sent her a screenshot of a nasty one installing that 2010 antivirus onto one of my virtual machines, and it turned out to be her oldest and most loyal sponsor, and an entirely legitimate ad that had gotten hijacked on the way to her server. Yup, her server is compromised, and some ads are being re-written on the fly from other sources. Makes sense to me, just another vector. This is not good - even honest webmasters are vulnerable, though she called in a team/favor to fix up her server, which is supposed to be monitored for this stuff. Oh well.
Is there any defense? I'm using VPC2007 to run browsers just to be able to look at the nasty stuff being inflicted on me (not the celebs, thank you) and I can't imagine the fun of doing this from my desktop. Ewww.
When the NYT is being used, we are past blaming the source.
Not to mention the waiting time I see for ad servers. I want the damned content I asked for, thank you, perhaps webmasters need to find a way to ditch slow ads and let us see what we wanted to in the first place, ok? Thanks!
deleting the extra space after periods so i can stay relevant, yeah.
I've been hit twice in two weeks with attempted installs of trojans/fake anti-spyware just from visiting pages linked to from Slahsdot stories. Not amusing.
Puzzle Daze is now my job
...that I never removed DoubleClick from the list of sites that aren't allowed to deliver content to my browser.
[b.belong('us') for b in bases if b.owner() == 'you']
I read a couple posts last week about how ad blockers are destroying ad revenue for sites and how ad blockers will destroy the sites you love...but if ads are serving that many viruses then how can you justify not using an ad blocker.
I install Firefox on every machine I set up and then add AdBlockPlus and Ghostery. It's amazing what these two block. Mind you, they are not perfect and sometimes you have to allow some code to get through with Ghostery or the site does not work. Lastly, of course, you should use Linux. That helps a lot...
*** Don't be dull.***
We do actually have that option in the content filter on our firewall. When I enabled it before I got complaints from one of the directors because they actually click on ads -.-
Wow... so these are the guys that actually pay for all of our free internet services? By all means do not ad-block them or the internet will collapse!
Advertising shitheads that want to run ad servers and serve up ads to hapless intarweb users should vet the content their customers are asking them to serve up. And not allow their customers to upload new content without being vetted. They should report any customers that misbehave. And they should be forced to do all this, on pain of literally having some guy named bubba come an break a finger for each offense.
the preceding comment is my own and in no way reflects the opinion of the Joint Chiefs of Staff
not. Wow, you can't even post useless crap correctly. You sure suck at life.
The other day someone posted a nice link to Google's facebook analysis, so I tried some of the pages mentioned above.
For example:
http://google.com/safebrowsing/diagnostic?site=drudgereport.com/
Seems that Google has a different opinion on this information.
Yup, I've seen it, too. I run a gaming web site that gets around 2 million page loads a month. A long time ago, I made a deliberate decision not to run ads. My rationale at the time was that I didn't mind paying the hosting cost because it's my hobby. Some people pay a lot on woodworking, some people pay a fortune on golf. My hobbyist indulgence is paying the monthly fee for a VPS to host the site.
A while back, when I needed more power for the site and the hosting costs went up, I made a deal to move the site (which was a MediaWiki-based wiki) to Wikia. They promised me that there would only be one ad on the site, that it would never be injected in the content, that it wouldn't be obtrusive, and other such things. After the site was moved, they proceeded to go back on these promises, and several more.
After less than a year, the other administrators and I decided to re-host the site ourselves, and ask for donations. Again, we don't run ads, and thanks to donations, I'm almost breaking even on the hosting costs.
Recently, someone pointed me back to Wikia's site. It is a tragedy. Aside from being woefully out of date, there were six or eight ads, including javascript and Flash ads that obscure parts of the screen and injected into the articles. Worst of all, some of the "malvertising" discussed in this article.
Here's what's kind of bad. Because Wikia uses SEO crappy games, their site still comes up on top of the search results in Google. (You should see the page titles, they're 10 or 15 words long.) I recently posted a message on the game's official forums warning people of the malevolent advertising, because I wanted to make sure people used the right URL for our wiki, and it was a good chance to reiterate how important it is to us to keep the site ad-free.
A week or so ago, one of the guys at Ars Technica ranted in an article about how people who use ad blocking are stealing content. It's the same argument I've seen higher profile people (Rubert Murdoch, I'm looking at you...) make the same claim. I said then, and I still maintain, that using ad blocking and Flash blocking is not just a matter of convenience, but a matter of maintaining the security of my system.
Fortunately, I like sites like Ars Technica, because they provide an alternate means of reading their content without "stealing" it, and I have a paid subscription to the site. However, as long as a site's only business model is advertising, I don't feel one iota of guilt in protecting my system. If they block content if ad blockers are being used, more power to them, I'll find another site to read.
But stories like this, stories I've actually felt first-hand, are why I support sites without advertising, I do what I can to opt out of advertising, and I don't force advertising on visitors to sites I run myself.
I work at a pinch hitter Tier 2 Pay to Play tech support company that is outsourced to by several major ISPs.
I see these damned things all the time. Usually they come with names like XP Antivirus 2010 or "Vista Security Center" or somesuch crap. They almost exclusively look the same, and there are new names that appear every so often -- XP Antivirus 2010 was "Internet Security 2010" not too long ago, for example. I suspect there is a kit that these companies are using to make their products.
They are almost exclusively coming in from banner ads. Specifically they use a Flash ad that, after a few minutes, or upon webpage close, or mouseover, opens an infected PDF file on a random infected server. Google Chrome occasionally catches these domain names, usually they are IP addresses or something similar.
Flashblock is NOT foolproof (although it does help), as occasionally they just have the ad banner on an infected server that auto-redirects you to a PDF file immediately.
They are occasionally Java files instead, but almost exclusively they are PDF files.
They're actually getting very creative in their infections. XP AV 2010, for example, sets itself up as the handler for EXE files -- in order to remove it, you have to install Malwarebytes and rename the mbam.exe file as 1.com or something similar. You can also dive into the registry to fix the EXE thing, except if the program is running it will just break it again immediately. Either windows does not have support for hijacking the .COM support in Windows XP/Vista/7, or these viruses just aren't thinking to try yet. Once they do, then our options drop to "OS Reinstall", as you can literally not run anything.
Some of these programs install themselves in such a way that if you attempt to load Safe Mode, your OS will intentionally BSOD. Or, in at least one infection, the screen filled with ASCII smiley faces and didn't continue.
Combofix will also remove most of these, and usually with "Security Center" or "XP AV 2010" we give up and run Combofix immediately.
The solution to prevent future infections isn't to move to Firefox or Chrome -- these infect those just as easily, although Chrome seems to just crash it's Flash plugin instead. In order to fix these, you have to update Adobe Flash, Adobe PDF, and Sun Java to the latest versions. PDF is the most important, but not the only one. Better browsers won't work. Antimalware programs won't work. The only way to fix it is to patch the holes.
Two weeks ago, someone asked me to reinstall Windows XP for them. Their disk was XP SP3.
I reinstall, and open IE to visit Windows Update
Instantly, I get a Vundo variant from a malicious ad attacking the out-of-date Flash Player that came with XP that installs without any user intervention whatsoever.
This only served to reinforce that I was right and not a webmaster/free content hating jerk when I block ads online.
There are some angry mods this am, I don't think correcting your own grammatical error is as offtopic as it is insightful...
1 is flat-out false.
2 is technically correct.
3 is true.
4, while true, is pointless. A far better (and simpler, easier) job of this can be done with a local caching DNS server.
5 is the same as 4.
6 is stupid and wrong. Text editors that can easily handle 30MB of text are rare under Windows, and nobody should ever do that anyways.
7 is completely stupid. There might be bugs in Window's HOSTS implementation. If there are, they will never be corrected. An AdBlock bug, or a DNS server bug, will be corrected within hours at the longest.
8 is vacuously true.
9 is completely false. Any malware that doesn't have admin access can get it trivially, under any Windows platform. It is impossible to lockdown the HOSTS file to the point that an admin-level malware cannot interfere with it.
10 is entirely wrong. See 6), and inspect any modern ad blocker. They've had 3-click-to-block for years now.
11 is flat-out wrong. See 9).
It takes you over an hour to process one million db entries? That's shameful. What are you doing that takes 4ms per entry? And why wouldn't "cat HOSTS | sed -e 's/[\t ]+/ /g' -e 's/[ ]+$//g' | sort -dfu" be faster and easier than processing text in assembler?
Just another "DOJ fascist authoritarian totalitarian bootlicker" -- Zeio
There's no such a thing. I don't buy the "web user stupidity" argument from all the paid M$ astroturfers that dodge the fundamental underlying issue.
Unless a user purposely download and install and enter the admin password, he's not being careless. The OS is. And that is an entirely different topic.
How on earth is it possible that by simply surfing the Web from your browser your PC can become part of a botnet?
The answer is simple: sloppy security, from the browser up to the OS.
A carefully conceived OS doesn't "get rooted" by surfing the Web. A carefully conceived browser does NOT leave anything escape its sandbox.
Truth is: most browsers are abysmal piece of ***t developed by security-clueless programmers and regarding Windows, my views are not printable, not even as an AC.
Yep. You don't have to click on anything to get infected. We've had a couple of our systems infected over the past couple of months. What scares me is:
1. We were running the latest version of Firefox
2. Acrobat Reader was fully patched (version 8, not 9. But, we have to leave the JS enabled)
3. Adobe Flash was up-to-date
4. Windows was fully patched
5. We have web filters
6. They got past 2 layers of IDS/IPS and 3 layers of antivirus scanners (different engines)
7. Users are NOT admins!!!
Since then, we have switched to a few new products and attempted to tighten things up even more, but these things have gotten incredibly complex. In one case, it was a triple attack. The Flash ad (0-day exploit) loaded an exploited PDF (0-day exploit) that took advantage of a 0-day IE exploit (keep in mind we use Firefox), which compromised the system. We have a nuke-from-orbit policy on any system we suspect has been infected, but what a waste of time!
It was hosted from a site in India. The user was on Yahoo's website (we've had 4 infections through Yahoo's ads). They did NOT click on anything!
Be very afraid!
I usually suspect the users of 'careless web activity' when I delouse a PC, but now I'm going to have to give some the benefit of the doubt."
I too have found myself in this situation and it is really difficult for me to not immediately jump to conclusions. To this day the only malware detected on my computers were put there by software I should have known better than to install. When I stopped installing that software I stopped having problems. But I know a lot of people who get viruses regularly and never use any warez and claim to be very careful about what they open from emails and where they browse on the web and which browsers they use.
No sig for you. YOU GET NO SIG!
Anybody that's been dealing with this stuff already knew that it was being served up by ad servers. The people running the ad servers evidently do not check scripts for malware before they are put into rotation, and they'll sell ad rotation to anybody that has the money with no questions asked.
This is not new news, I am not shocked by this, nobody should be.
Steve's Computer Service, Hobbs, NM
Things have indeed changed: posting with the attitude that sloppy practices are the only vector for attacks is dated.
I recently had my laptop (OEM fresh, everything updated, running chrome) owned by something nasty. MalwareBytes, WebRoot, etc etc - all turn up blank.
How it got on remains a mystery - and the only fix seems to be the mentioned nuke-from-orbit.
I fix PC's for a living and I have been seeing this too. Some people all the do is Facebook and they are getting "XP Antivirus" or it's variants, and I know there is no way they are doing anything. They all use Firefox, etc. The last 2 weeks I have been putting on Ad Block Plus and explaining to them what it does because I was having people get infected again in a manner of weeks after I clean it up the first time. I know that kinda sucks for website revenue, but what else is there to do. One guy got infected from Photobucket, and it was repeatable.
Why use Adobe Reader in the first place? There are alternatives out there which are less embarrassingly insecure. You should be telling your customers to switch from Adobe Reader, if possible.
FYI: If you can kill the malware process and then delete it, you can manually re-associate EXEs to run as applications in the File Types menu. Just did this for a machine on my network last week. Of course I also ran Malware Bytes...
I just dealt with a truly nasty version yesterday though that not only sets itself up as the handler for EXE files, but also closes the task manager immediately when you try to open it. In order to remove it I had to boot the machine using a Linux live CD, and then remove the offending files.
So whats going to be done about it? I see allot of use ad block and such,but thats not going to put the criminals who are stealing resources to spread there malware. If they get caught it should be high profile news and the punishment every painful as in length of prison time,not insert blunt obj in rectum kinda pain lol. Anyways i always see allot of talk but not any action against the criminals,this anti virus scam has been going on for years. Don't ya think its time to stop them?
Jack of all trades,master of none
the biggest change this has for me is that it has moved installing adblocking software from just 'something i do for my personal computers' to 'something i do on any computer i touch, even professionally'.
it was the ad server's responsibility to regulate what they distribute. instead, they have just become an avenue for zero-day attacks that can spread across the web in no time at all. since they did NOT act responsibly in preventing this type of attack (really, is there NO review process at all on what they serve out to millions of people?), it falls on us, the users, to protect ourselves. when companies complain about lost revenue due to adblocking software, this is your justification.
frog blast the vent core
I second this. I see exactly this with PDF files routinely. I have simply uninstalled acrobat (aka adobe reader) on all on the Windows machines at this point and use SumatraPDF instead. It is only a matter of time until they start using zero-day exploits.
Notepad can easily handle 30meg text files or even 2gig text files. When your list is that long it makes sense to go the server route, but in my experience you only need a couple megs to block the majority of sites and performance is not noticeably impacted then.
Try Ghostery - the ad script killing plugin for Firefox - nukes everything - awesome
---- "Logoff! That cookie shit makes me nervous!" - A. Soprano
I had to clean up a vundo and Antivirus 2009 on a few of my relatives computers. The best thing I've found is the Ultimate Boot CD for windows (UBCD for windows). You need a legitimate copy of a Windows OS disc and then it creates a boot CD of a clean fresh new OS with a whole host of tools.
It's a great way to attack the virus from a fresh OS install running off a RAM disk.
Same experience except: my sneaky trick is to install mbam on the infected computer, then run the same version of it off a flash drive. Surprisingly, it works.
Also, do you think using Foxit instead of Adobe might help? For that matter, setting PDFs to not auto-open?
This new form of attach makes me sad as I recently chewed out my kid for infecting two differtent computers at home. But, last night I got hit by a side panel ad that set off my AV alert. I have also seen some unusual firewall alerts so there is still something there under the hood. The last time I got hit I accendently clicked on a questionable ad while attempting to scroll down the page. But at least I knew that I had clicked. What to do about this? Do I run web browing and email sandboxie? Do I setup VMplayer copies of Windows to browse and email? Are there other (better) solutions? Tea-Timer and the rest seem to drive my wife and Teen age daughter nuts with prompts (and they are never sure what is okay anyway.)
Google does fine with their text-ads, most ad-blockers leave it alone as well.
Why is it somehow un-ethical to block ads again?
Perhaps it's a good idea for big sites with a reputation to maintain to borrow just a bit from the old model where they sell ad space with an approval process directly to advertisers and serve the images from their own servers.
A big class action against DoubleClick, etc. would be appropriate. They "exceeded authorized access", as defined in the Computer Crime and Abuse Act. That they got the attack from someone else isn't an absolute defense. The ad network obtained "something of value" for the attack. If they sent out one attack after they'd been informed, they were doing so "knowingly".
The ad network has the right to find and sue the source of the ad, but that's their problem, not the end user's problem. This is well-established law. In general, you can sue the party you dealt with, and they can sue the next party up the chain.
No, just run Combofix. Then MBAM. It'll fix it. It's a rootkit, which is blocking MBAM and Webroot from seeing it.
That's the most terrifying thing about these things -- they literally install as rootkits, without admin privileges, even on a fully up to date WinVista or Win7 box. UAC, Security Policies, etc do nothing.
It's no wonder Google got hacked by China.
No need for an OS reinstall yet. Actually, it isn't too bad...
.REG file. Reboot the infected machine into safe mode, import the .REG file, and then use a program such as System Explorer or Security Task Manager to help clean up any bad processes.
I used a clean machine to export the registry keys for the EXE file association to a
Next, locate the exact filename of the virus (av.exe as one example). Rename/Remove the virus EVE file. Then create a DIRECTORY with same name in the same path (so a directory named "av.exe") - While the virus creators have been finding craftier and craftier ways to get it to execute itself on systems, this is an absolute stupid simple way to prevent it from even being writable (until they change the filename or path for where it saves itself).
Oh, and there is always PeerBlock with a daily updated list, which is great at blocking 3rd party malware servers entirely (this has worked much MUCH better at being up-to-date with Malware lists than any AV application as of recent) - http://www.peerblock.com/
Your brother is likely working somewhere where they don't want to provide internet access bureaucratically. FD's are notorious for micromanagement, and internet access is so easy and tasty a target when it comes to exerting control over your minions.
As for the critical systems part, at least in our installation, there were no critical life safety systems running on our internal network, just our incident report database system, the personnel scheduling system, exchange and SMB. Last time I checked the rig rolled out the door regardless of the internet. Dispatching is handled over the airwaves, no internet required. In fact, I'd be hard pressed to trust any life safety item that REQUIRES the internet, seems like an oxymoron to me...just like the fact that the ultrasound machine (GE) I use at work runs XP, but then again, it's not life safety.
Remember, it's all about control when you're in IT (or in management at a FD). You can either be a dick or a doormat, but the best people fall somewhere in between, albeit a modicum of paranoia helps to one keep the generosity in check.
Ocean is land, covered with water.
Are all these comments regarding being infected coming from windows users? Or are some of these infections on Linux Machines too... say for instance via Flash/Firefox. This is an honest question.
I really would like to know, because from what I read, there is no easy way to tell if a Linux machine is infected, besides digging through network traffic, guessing that some processes might be a bad one, etc. There is no antivirus signature checking and REMOVAL software for Linux right?
I always thought when reading about Linux security that it's great that it is so secure compared to other OS's but when people post to message boards that they think that they are infected, the responders post back that there is no way to really know for sure and no way to remove Trojans from an infected Linux machine with any sense of certainty. Not to prop up windows, but as I read it, with windows antivirus software, one can remove viruses from an infected machine with some realm of certainty that it is gone, without the need to reinstall the whole OS.
Thanks, Please comment.
In Alberta - it's illegal to have a billboard on a Highway. Based solely on the idea that it causes more accidents because billboards are distracting. This isn't a direct attack on the speed limit, a major factor, or Alchohol, another major factor. Because attempting to control those other 2 factors would cause a huge upset.
Everyone once in a while people post things that are 100% incorrect.
Alberta highways are full of billboards. No such law exists. From advertising the local ski resorts (of which we have many), to "keep Ottawa out of Alberta" (ie: Alberta separatists), we have plenty of billboards.
And those are only 2 examples out of the hundreds I saw last time I went on the road.
There are rules to limit them, but they are most certainly not illegal. If they are, it's certainly a law that's not being enforced very well.
There are guidelines, but no ban..
Endless arguments over trivial contradictions in books written by ignorant savages to explain thunder in the dark.
1 is only semi-false. Using a HOSTS file doesn't use significant CPU that you aren't already using because your request is already going to hit your HOSTS file anyways. I suppose technically having a very large HOSTS file would consume more parsing it than a small one, but in comparison to alternatives, it's CPU light at the least.
See subject. All he had in reply was modding down the initial poster as well. Poor showing on technical issues and yet he was modded up? Please. What has this place come to?
How about not running any plug-ins at all?
I got this nice checkbox "aktivate plugins" in Opera. It is always unchecked unless I need to see a video.
I'm sorry, are you trying to claim somebody posted and moderated in the same discussion? Get the fuck out of here, you illiterate halfwit.
1) Tell me: Does performing a lookup into a one-million-entry list require more or less CPU than performing a lookup into an empty list? The page will be parsed no matter what you do.
4) Dan Kaminsky's work is important. But the flaw he found is non-trivial to exploit, has never been discovered in the wild, and on a private DNS server is trivial to protect against. (Like, oh, say, using Source Port Randomization)
6) Okay, my mistake. Let's try that, open notepad, open some 30MB file. Oh, look at that. It's locked up. Two minutes later, it's loaded the file. That's certainly easier than the three clicks required to block an entire adserver with AdBlock.
7) What profanity? Is WebSense blocking me? Untwist your panties, grandpa. And again, Dan Kaminsky. One flaw renders the entirety of DNS unusable? I suppose you throw your car away when it runs out of gas, too.
As for your PS, I don't care what you call it. A file containing a series of organized entires in a regular structure is a database. The fact that it's not SQL matters not in the slightest. The fact that it takes you an hour to process this "not a database" with only a million entries is shameful, and the shell script I provided you would likely perform the same task in under a minute. Why so defensive?
Just another "DOJ fascist authoritarian totalitarian bootlicker" -- Zeio
SumatraPDF ftw.
Yes, using Foxit does seem to help, but unfortunately it doesn't seem to be 100% compatible with all pdf files. Anyone know any more about that? SB
It's old. The more humans I meet, the more I like my cats. At least they are honest.
I, too, clean many malware infested machines. I've never had a problem with .exe handling being rewritten, because I do all my cleaning from a boot CD. Why you'd ever try to clean a machine from an infected install is beyond me. OS reinstall is pretty much never necessary, though it can be cheaper (when the time needed to backup data, install OS, install apps, & restore data is smaller than the time needed to clean the infection.)
Not a sentence!
Combofix will also remove most of these, and usually with "Security Center" or "XP AV 2010" we give up and run Combofix immediately.
I hadn't heard of combofix before, so I googled it.
From combofix.net:
Known issues
* ComboFix is made to only run on 32-bit versions of Microsoft Windows 2000, Windows XP and Windows Vista.
* Some antivirus software may detect ComboFix as malicious; for example it uses NirCmd, which is considered as a backdoor by many antivirus software.
* ComboFix may disrupt internet connectivity.The majority of times only a simple fix is required.
* ComboFix may attempt deletion all files from the system drive on systems infected with a rootkit.
That last one might give me pause....
Because the "bad stuff" didn't come from the domain you're testing.
I've had users hit with these things several times over the last few months. Some of them do prevent you from doing ANYTHING to the running system. The one thing they can't stop though, is the 'hook the drive up as a secondary in another pc to clean it' method. I've even seen a couple of them installing stuff in the boot sectors.
That last one might give me pause....
The guy who writes it has English as a second language. Basically it's asking for permission to do delete rootkits it finds, and warning you that Rootkit removal is an art, not a science, and some OS Loss may occur.
Besides, this is the real Combofix site, not that one:
http://www.bleepingcomputer.com/combofix/how-to-use-combofix
Right. but if you put in facebook.com, you see that they are an intermediary for an infection. Is what Google describes for facebook.com different than what you describe? And is it different what the summary claims ( yeah i did not rtfa this time either)?
You don't know if you'd want to reduce their income??? So because a lot of people make money with advertising online, then we should all just ignore the fact that seemingly every major ad purveryor is also purveying malware with their ads? Sorry pal, but fuck advertising, fuck you, and fuck your concern for advertiser's revenue streams.
For the first time in years (i.e. since I was a teenager pirating computer games from 3.5 inch floppy disks), I got malware on my PC last week. PC Total Defender 2010, I think it called itself.
I couldn't figure out how I got caught. I have the standard firewall and antivirus installed, plus SpyBot's TeaTimer tool. And I tend to browse safe sites, anything questionable is done in a virtual machine.
Anyway, it turns out that my Adobe Reader was somewhat out of date, and I had half a dozen versions of JVM installed. I suspected one of these was at fault.
Crazy. How am I supposed to blame my users now?
"6) Okay, my mistake. Let's try that, open notepad, open some 30MB file. Oh, look at that. It's locked up. Two minutes later, it's loaded the file. That's certainly easier than the three clicks required to block an entire adserver with AdBlock." - by geekboy642 (799087) on Tuesday March 23, @04:15PM (#31588660)
You did make a mistake, pretty big one too... & hosts reads? They occur @ the IP Stack level, FAR FASTER in RPL0/Ring 0 driver code than it takes place in user mode. E.G.-> Ever create a program in GUI, & then redo it in tty/console mode/DOS prompt/character mode code?? You get a 10 fold increase in speed usually (less message passing & other overheads)... now, think it "slows down more" when you step down to a higher privelege level like drivers & the kernel run in??? Guess again.
----
"1) Tell me: Does performing a lookup into a one-million-entry list require more or less CPU than performing a lookup into an empty list? The page will be parsed no matter what you do." - by geekboy642 (799087) on Tuesday March 23, @04:15PM (#31588660)
You're doing ADDITIONAL PARSING using browser addons, for each page. That doesn't occur using a HOSTS file (it merely filters out the ability to load data from various sites, albeit, @ the IP Stack level).
----
"4) Dan Kaminsky's work is important. But the flaw he found is non-trivial to exploit, has never been discovered in the wild, and on a private DNS server is trivial to protect against. (Like, oh, say, using Source Port Randomization)" - by geekboy642 (799087) on Tuesday March 23, @04:15PM (#31588660)
He still illustrates flaws, & THEY ARE EASILY EXPLOITED too - how so? Ok - say I know you are about to query your DNS, & that you are querying a site (a particular one, say GOOGLE) - IF the DNS server doesn't KNOW the answer, it begins calling out to other DNS servers, & guess what?? If I flood your DNS server with incorrect responses, BEFORE others legit DNS servers can get a legit answer?? Guess what - I have just misdirected you to a (probably) BOGUS site (to exploit your system). Get it??
D.K. has successfully done this, literally, in SECONDS FLAT no less... it is NOT that tough to do actually, & because of how DNS servers work (especially those set into recursive mode).
----
"7) What profanity? Is WebSense blocking me? Untwist your panties, grandpa. And again, Dan Kaminsky. One flaw renders the entirety of DNS unusable? I suppose you throw your car away when it runs out of gas, too." - by geekboy642 (799087) on Tuesday March 23, @04:15PM (#31588660)
Listen "LITTLE BOY" - it's not that it's unusable: It's just quite easily exploitable by its OWN NATURE is all & design... get it?? On the "grandpa" thing, too??? Hey - the day you have done all this (which I did whilst you were in diapers in this life no doubt)???
"My Name is Ozymandias: King of Kings - Look upon my works, ye mighty, & DESPAIR..."
----
Windows NT Magazine (now Windows IT Pro) April 1997 "BACK OFFICE PERFORMANCE" issue, page 61
(&, for work done for EEC Systems/SuperSpeed.com on PAID CONTRACT (writing portions of their SuperCache program increasing its performance by up to 40% via my work) albeit, for their SuperDisk & HOW TO APPLY IT, took them to a finalist position @ MS Tech Ed, two years in a row 2000-2002, in its HARDEST CATEGORY: SQLServer Performance Enhancement).
WINDOWS MAGAZINE, 1997, "Top Freeware & Shareware of the Year" issue page 210, #1/first entry in fact (my work is there)
PC-WELT FEB 1998 - page 84, again, my work is featured there
WINDOWS MAGAZINE, WINTER 1998 - page 92, insert section, MUST HAVE WARES, my work is again, there
PC-WELT FEB 1999 - page 83, again, my work is featured there
CHIP Magazine 7/99 - page 100, my work is there
See the subject line.
....or simply set Firefox to "Save AS" any PDF file, and view off-line, if you really want to see what's in it.
"You would do well to avoid aggrandizing yourself with that particular reference. Unless you mean to imply you are a washed-up and useless wreck." - by geekboy642 (799087) on Wednesday March 24, @03:14PM (#31601942)
Sure, sure, & you're a NOBODY/NOTHING who has never accomplished squat... or is your lack of the same types of things I did while you were in diapers not indicative of that? Typical b.s. from a never will be are replies like that... it's fairly obvious.
----
"If this is correct, then I can write, and have written, a piece of shellscript that accomplishes all these tasks which runs in under a minute" - by geekboy642 (799087) on Wednesday March 24, @03:14PM (#31601942)
Oh, no no senor: WRITE IT YOURSELF, in a programming language like C, C++, Delphi, VB, etc. (not having a shell script engine do the work for you by calling prewritten commands)...
Kknow what they call people, like you? SCRIPT KIDDIES, lol!
YOU ARE NOTHING BUT A "SCRIPT KIDDIE", PERIOD... & your inability to create such engines ON YOUR OWN from scratch only evidences this for me.
----
"Go lookup "database" in any mainstream dictionary. No, wait. I'll do it for you. Here's what Princeton's wordnet thinks a database is:" - by geekboy642 (799087) on Wednesday March 24, @03:14PM (#31601942)
Are websters dictionary or any other, database programmers? No. Their "definitions" are VERY "loose".
APK
Mr. Alexander Peter Kowalski
903 East Division Street
Syracuse, N.Y. 13208
We are watching you, AlecStaar.
Oh, now you're being boring. Nothing but banal insults? So jejune. Farewell, grandpa.
Just another "DOJ fascist authoritarian totalitarian bootlicker" -- Zeio
See subject-line, & realize you're nothing but that, & a wannabe/never-will-be... lol! You shot your mouth off, but the fact remains you have NEVER done anything noted well by others in publication in this art & science... & YOU KNOW IT (now, so do we all reading).
"Oh, now you're being boring. Nothing but banal insults? So jejune. Farewell, grandpa." - by geekboy642 (799087) on Wednesday March 24, @03:54PM (#31602554)
Sure, sure... uhm, didn't you start with the 'grandpa' stuff, & first, "script kiddie" (lmao): Sure you did... what's the matter BOY? You can dish it out, but you can't take it...?? Apparently so.
APK
P.S.=> Want to know WHY I wrote it, & by hand in Delphi (an actual REAL programming language, not script kiddie usage of already built commands & engines)?
Because not everyone has *NIX level string processing commands @ hand, for one thing!
(E.G.-> Windows for the longest time, really didn't @ the DOS command prompt level, @ least NOT AS GOOD (sure, you've got batches with FOR % tools & NOWADAYS @ least) OR recently, Powershell - but you have to have SOMEKIND of skills in those areas to use them both!)
I.E.-> Batch commands & how to use them in looping OR VB type skills @ least!
AND, not everyone has Access for instance (which iirc, lacks a VARCHAR field, which would cut off trailing blanks if I did, say, a SELECT DISTINCT command to trim out duplicates of an imported HOSTS file - & then, I'd have to run a script in Access via its VBScript built in to pull off that TRIM)...
Since that is the case for most folks? I wrote it up, myself, so if they need a tool like it, they can have one that works is all!
I can rip thru processing removal of duplicated entries in less than a second over a million records from an imported HOSTS file in Access, OR any other SQL compliant DB engine really, & because of its JET ENGINE/RUSHMORE QUERY ENGINE & indexing... but again, not everyone has those tools! apk
Why use Adobe Reader in the first place? There are alternatives out there which are less embarrassingly insecure. You should be telling your customers to switch from Adobe Reader, if possible.
Oh, there certainly are alternatives.
But my average user is not "technically savvy". To the point that getting them to type in the URL of our website, then find the icon for our service, is very difficult.
It doesn't help that the company I pinch hit for (the stupidity of which inspired the Dilbert comic) has decided to give our service any of 4 different names depending on which website, state, etc you are in, and decided to hide our icon literally off the screen.
No, literally, you have to scroll down and to the right to find it.
My typical call entails taking 10-20 minutes to get a customer to type in a simple URL (domain.com/servicename), explaining that the My Web Search bar is not the address bar, explaining that again, explaining that you can't put a space in our URL, explaining that I wanted them to spell out the word minus instead of typing in -, etc etc.
Oh, and a VERY large number of these people are running IE6. Or are running machines with 128/256 megs of ram and can't run anything else. Or have tried installing IE8 (it thinks it can run on 64 megs of ram and will auto-install) on a WinXP machine with 128 megs of ram and are upset the machine is slow...
Er, sorry, lost myself for a second. I guess what I'm saying is that these people can't even SPELL "PDF", yet alone uninstall Reader and install a different program. And since my metrics -- i.e., the thing keeping me from being fired -- is based on getting customers off the phone as fast as possible...
(Oh, and our parent phone company does NOT want us giving tech advice or suggesting alternatives to programs like Reader, cause "they're not in the toolkit"...)
Now after he outright ran, geekboy has to have everyone look at his frontpage highly rated post being blown to smithereens here http://tech.slashdot.org/comments.pl?sid=1592276&cid=31585690 and here http://tech.slashdot.org/comments.pl?sid=1592276&cid=31599184 by an AC no less as well as others here who caught him in mistakes also here http://tech.slashdot.org/comments.pl?sid=1592276&cid=31585518 and here http://tech.slashdot.org/comments.pl?sid=1592276&cid=31587184. Like I said the funniest part of all this is his mod up +4 because it only makes me think that geekboy tried to be clever and use an alternate account he has mod points on to mod his post up with, because his technical mistakes and clear lack of technical prowess demonstrates anything but a posting that deserved an upward mod.
http://tech.slashdot.org/comments.pl?sid=1592276&cid=31604444
I'd like to know which company you work for...
"If it ain't broke, it doesn't have enough features yet"
Bit of clarification for you, my man (& thanks for bolstering my points too):
"1 is only semi-false. Using a HOSTS file doesn't use significant CPU that you aren't already using because your request is already going to hit your HOSTS file anyways. I suppose technically having a very large HOSTS file would consume more parsing it than a small one, but in comparison to alternatives, it's CPU light at the least." - by Schadrach (1042952) on Tuesday March 23, @02:24PM (#31587184)
A relatively "smallish" HOSTS file resides in the native DNS Clientside caching service on Windows (so it is constantly in memory, inside of what C/C++ folks call a "structure" (either standalone, or part of an object), or what PASCAL "fiends" like myself, call a record (or again, object) since PASCAL RECORD = C/C++ STRUCTURE).
Also - this avoids being "diskbound slow"... now, if you use a relatively "LARGISH" hosts file? You have to disable your DNS Clientside cache service - or, it "breaks down" & you lag, rather horribly (I have pointed this out to Microsoft on their blogs (S. Sinofsky's, head of Windows development iirc) & Foredecker (a senior mgt. figure @ MS too, who posts here no less)... so, what makes up for that? See subject-line... answer = YOUR DISKCACHE!
HOSTS files, after all, are JUST ANOTHER FILE... & what caches repeatedly used files? Caches do!
("&, there ya are")
APK
P.S.=> Loads & POSSIBLY reloads (if you stop your connection, OR, change entries in your HOSTS file) of a HOSTS eat FAR LESS CPU than ADBLOCK'S constant parsing of each webbrowser page you load in FireFox (the ONLY browser family that ADBLOCK COVERS, mind you, not all others as HOSTS files do, as well as email programs & really ANY WEBBOUND PROGRAM YOU HAVE)... period!
The "right idea" here though? Layered security - use BOTH methods of protection! I expound on that in this security guide for Windows 2000/XP/Server 2003/Windows VISTA/Windows 7/Windows Server 2008, here -> http://www.tcmagazine.com/forums/index.php?s=705f48ab441c8cafce3f0657e1309b87&showtopic=2662 & it works! Nearly 300,000 views strong, with testimonials like this are its results:
Proofs to its efficacy?
Ok, some quoted testimonials:
----
http://www.xtremepccentral.com/forums/showthread.php?s=672ebdf47af75a0c5b0d9e7278be305f&t=28430&page=2
"I recently, months ago when you finally got this guide done, had authorization to try this on simple work station for kids. My client, who paid me an ungodly amount of money to do this, has been PROBLEM FREE FOR MONTHS! I haven't even had a follow up call which is unusual." - THRONKA, user of my guide @ XTremePcCentral
AND
"APK, thanks for such a great guide. This would, and should, be an inspiration to such security measures. Also, the pc that has "tweaks": IS STILL GOING! NO PROBLEMS!" - THRONKA, user of my guide @ XTremePcCentral
AND
http://www.xtremepccentral.com/forums/showthread.php?s=672ebdf47af75a0c5b0d9e7278be305f&t=28430&page=3
"Its 2009 - still trouble free! I was told last week by a co worker who does active directory administration, and he said I was doing overkill. I told him yes, but I just eliminated the half life in windows that you usually get. He said good point. So from 2008 till 2009. No speed decreases, its been to a lan party, moved around in a move, and it still NEVER has had the OS reinstalled besides the fact I imaged the drive over in 2008. Great stuff! My client STILL Hasn't called me back in regards to that one machine to get it locked down for the kid. I am glad it wor
See subject-line, and realize 1 thing: Anyone here can "mod themselves up", @ any time, by doing what's in my subject-line in fact...
"I'm sorry, are you trying to claim somebody posted and moderated in the same discussion? Get the fuck out of here, you illiterate halfwit." - by Anonymous Coward on Tuesday March 23, @04:02PM (#31588520)
My my, such profanity: geekboy, this is doubtless you, because I know that reg'd users can elect to post as AC here, for 1 thing. Now, onto my subject-line's statement... What's in my subject's a PART of why I refuse to "join the 'in crowd'" almighty elitist "registered user" crowd here really (I don't want anyone accusing ME of that much).
I also don't like how 'trackable for trolling' a reg'd user is here either.
Of course, I also really don't have the desire for "karma points" b.s. either, that's like welfare man! Freebies for nada, instead of merit, and I don't like how some of the low-digit long-timers here often think they're like "GODS" or something, lol... it's hilarious @ times.
I am really just here to learn & grow, more than anything (@ least hopefully - there are some "smart cookies" here, & that's NOT sarcasm (especially in the programmer's or network engineering and sciences topics is why, & these are areas I take interest in).
APK
P.S.=> Me? I'd rather be part of the "MIB" around here because of the above reasons... & this quotes suits that much:
"From now on you'll have no identifying marks of any kind. You'll not stand out in any way. Your entire image is crafted to leave no lasting memory with anyone you encounter. You're a rumor, recognizable only as deja vu and dismissed just as quickly. You don't exist; you were never even born. Anonymity is your name. Silence your native tongue. You're no longer part of the System. You're above the System. Over it. Beyond it. We're "them." We're "they." We are the Men in Black..."
I like the "You're above the System. Over it. Beyond it." part, because I know how to beat the "10 posts per 24 hour" limit on AC's, & I'd suppose that "qualifies" me on that in quotes remark, lol... apk