Spyware report

180OUT · #1 (**permalink**) 03-09-2009, 07:40 PM

This evening when tried to access my pvt. messages dozens and dozens of popups attempted to load and were blocked by my software. This went on for so long I had to crash out of the site but not before my anti-spyware warned me that it had blocked a site called "dr.areaconnect.com" that was identified as spyware. This is the second time in a month or so that something like this has happened.

Simon, I know the ad revenue helps support the site's overhead and I think that's a good thing, but it's disturbing when something like this happens. How do sites like "dr.areaconnect.com" get associated with the alfabb?

**smestas** · #2 (**permalink**) 03-09-2009, 09:30 PM

Jim,

Thanks for reporting this but I haven't had any other emails, PMs of anything similar regarding the site or our advertisers.

Anyone else??

180OUT · #3 (**permalink**) 03-09-2009, 10:09 PM

Simon, just so you'll know, this is the second time in about a month this has happened. The first time was on my computer at work (which doesn't connect with my home computer) and the symptoms were identical. At the time, I logged back in and did experience any further problems so I just figured it was a one time thing. I have active x set to request. If it were turned on I wouldn't have know the d/loads were happening. Usually, I'll get a half dozen requests when I log on. These went on for several minutes. Interestingly, I was able to initally log in without a problem. It was only when I selected the pvt. messages that the trouble appeared. The first time the trouble appeared as soon as I had logged in.

**smestas** · #4 (**permalink**) 03-09-2009, 10:23 PM

Very strange indeed. I'll keep an eye out.

I do know that sometimes a rouge advertiser gets onto one of the ad networks we subscribe to but they are usually quickly removed from the system.

180OUT · #5 (**permalink**) 03-16-2009, 08:51 PM

Simon, I had another cookie attack. I was in pvt. mail trying to move back to the forums when suddenly I was hit by unending requests for active x d/loads. I have IE set to ask for active x and I must have hit no for 10 or 15 minutes. The requests came so fast I couldn't x out of the BB.

This time I paid more attention to what was causing this. One site that tried to load repeatedly had "zedo" in it name. Another persistent site was "ad.iconadviser" and another had a name like "yieldmanager" or something. This only appears to happen when exiting mail, I've never had it happen in the forums.

**AlfaVeloce** · #6 (**permalink**) 03-16-2009, 11:16 PM

Hi Jim
I am wondering if you run any kind of anti-virus or anti-spyware? If so, what? I run AVG but not the free one, it is the network edition. I also run Ad-aware but it is the free version and I am not so sure it is the best, but it does seem to catch stuff.
Seems to me you have a classic case of spyware attack.

I'd have sent you this on PM but PM seems to be where you say you have the most trouble.

180OUT · #7 (**permalink**) 03-17-2009, 09:55 PM

I thought about that, too, Larry. I'm pretty well protected with good firewall, anti-virus, and anti-spyware software which is up to date and in regular use. It's still possible that I've picked something up the software isn't catching but this is the only site where it's happened. I'm pretty careful about what gets d/loaded. If I had active X turned on or turned completely off, I would never have noticed anything. However, I had it set to prompt before loading something and that's when I could see the problem.

**AR4me** · #8 (**permalink**) 03-19-2009, 08:39 AM

I have seen a gazillion pop-ups as well - on at least 3 occassions while using AlfaBB and no other brower windows open.
Jes

**dscottj** · #9 (**permalink**) 03-19-2009, 06:06 PM

There's a really nasty bit of spyware's that's gotten loose, say about two weeks ago. At least some of the sites which spread it have wormed their way into the ad cycle of many BB-style sites, I'm afraid this one included. It got me, and this is the only one of those places I check regularly. That was day-before-yesterday (Tuesday).

Simon: If there's some way to report this to whomever runs the ad service, it might be time to raise a caution. Unfortunately I can't be specific as to which site it is.

It's definitely not just here. I'm the network admin for a medium sized non-profit, and I can now tell who visits hobby sites because they're all getting nailed.

**AlfaVeloce** · #10 (**permalink**) 03-19-2009, 07:27 PM

Quote:

Originally Posted by 180OUT

I thought about that, too, Larry. I'm pretty well protected with good firewall, anti-virus, and anti-spyware software which is up to date and in regular use. It's still possible that I've picked something up the software isn't catching but this is the only site where it's happened. I'm pretty careful about what gets d/loaded. If I had active X turned on or turned completely off, I would never have noticed anything. However, I had it set to prompt before loading something and that's when I could see the problem.

180OUT · #11 (**permalink**) 03-20-2009, 07:05 PM

Simon, about 6Pm central time tonight detected two virus attempts when I was exiting this site. My anti-virus software (AVAST) stopped both of them, fortunately. They occurred as I was logging out and about to "x" out of the site. I just ran a full scan and my computer is clean.

Also, I had another multiple cookie attack this morning when I was on the site from my networked office computer. I wasn't logged in but a huge amount of stuff came down. I think it was stopped by our network protection.

**smestas** · #12 (**permalink**) 03-20-2009, 07:18 PM

Jim,

I'm not really sure why you are experiencing what you seeing on your end. Perhaps your security software is flagging some of our site cookies as spam which they are not. We also haven't heard from a bunch of other members experiencing the same thing which leads me to believe that this is perhaps an isolated case. I’m pretty much on the site 24/7 and haven’t been able to re-create or see any of the things listed above.

Can you provide any other information on exactly what is getting flagged (cookie names) or URL’s?

**smestas** · #13 (**permalink**) 03-20-2009, 07:22 PM

Quote:

Originally Posted by AR4me

I have seen a gazillion pop-ups as well - on at least 3 occassions while using AlfaBB and no other brower windows open.
Jes

**smestas** · #14 (**permalink**) 03-20-2009, 07:27 PM

Quote:

Originally Posted by 180OUT

Another persistent site was "ad.iconadviser" and another had a name like "yieldmanager" or something. This only appears to happen when exiting mail, I've never had it happen in the forums.

**aldo** · #15 (**permalink**) 03-23-2009, 06:56 AM

The last two days while viewing the bb I've been redirected to a different site, (some sort of IQ test) its not a pop up, its a completly different site.

When I hit the BACK ARROW I'm returned to the bb.

This is the only site where it happens.