DMusic.com | for indie musicians and fans | Free MP3 music downloads

Forums > Help: Complaints

Malware ad

TameasDust	Date: February 26, 2008 @ 11:57 AM Its still here and its still annoying Couldn't open the other forum any more so I started a new one. Hate websites that try to install on your pute without permission.
Mojosnake	Date: February 26, 2008 @ 11:58 AM yeah what he said it's all just there iv'e said my i mean
Distilled1	Date: February 26, 2008 @ 12:03 PM its in the ad on the front page. Tames download bit defender FREE (its odd to find on their page but its there) it will get it and kill it... also keep it running for what ever reason Macafee and norton both are not finding or catching it ...its new and its a big problome for google MOM find that link and post it again would you?
ShadowMom	Date: February 26, 2008 @ 12:08 PM New Google Trojan Software Swaps Google Ads for Malware
Distilled1	Date: February 26, 2008 @ 12:28 PM oh and I don't get it actually with norton... just on my test lap top cause I am not auto logged on here on that one seems to be effecting only if if I'm not a subscriber .. (logged off) I haven't tested with my sons account yet I will maybe tonight and see if it gets it again
Distilled1	Date: February 27, 2008 @ 3:58 AM If you are getting this or any pop ups from Dmusic.com: Please be advised that even though it may at this point only happen here and only once a 24 hour period, there is a Trojan on your machine. This is Trojan that got into Google Ad servers. if you do not rid it eventually it will start on other pages and then become so prominent that you can not surf the web at all. What I have found: 1. MacaFee is not stoping it finding it or blocking it (I have a paid for fully updated version on the test computer. 2. on my main computer I could not get it (symantic internet security 200 (its super slow and a memory hog ) 3. Jack removed the Google ads from Dmusic until it is resolved. (If you don't have it or haven't had any maleware/winfixer type pop ups and re directs to other sites, you shouldn't get it) 4. IF YOU DO HAVE IT, YOU NEED TO CLEAN IT FROM THE COMPUTER TO CHECK AND SEE IF YOU HAVE IT EVEN IF YOU HAVEN'T SEEN A POP UP :**** a) click the run box on windows start up menu b)copy and paste the following= ping -t pagead2.googlesyndication.com click run c)The response should look similar to this: Pinging pagead.l.google.com [6x.xxx.xxx.xxx] with 32 bytes of data: where the x's represent digits. If you are not infected, the first digit will be a 6 (as in the example). If you are infected, the first digit will be a 9 or a 209 or any thing but a 6. you can just close the dos window.(this won't harm a thing, just showing what url its pointing to) d) if you are getting anything but a 6 as the first # in the IP address you need to clean http://www.bitdefender.com/VIRUS-1000239-en--Trojan.Qhost.WU.html if your spyware/virus detection is not finding anything, I suggest running the free on line or free down load of bit defender. as well there are others Bill Rynes suggest http://www.simplysup.com/ In any case do remove this I had 2 friends computers that took me days to get rid of win fixer as they let it go for ever (it keeps reinstalling itself and creates itself in the windows restore secction as well. I hope this helps anyone with this issue, if you have any questions or need any help let me know.
Woof	Date: February 27, 2008 @ 9:46 AM If... and I'd like to really stress the "If" part, this problem is indeed the result of some lack of attention to detail on Google's part, it seems to me that we have good grounds for starting a class action lawsuit against them for loss of revenue. From users deciding against subscribing, deciding not to renew subscriptions, and also visitors being prevented from exploring DM's advertisements due to interference, and ultimately not accessing the site for extended periods of time while dealing with removal of the problem. Of course, we'd have to have proof that Google was 100% responsible for this... and for it to be class action, we'd have to find other commercial sites that have suffered similar losses. Could work...
zedsalt	Date: February 28, 2008 @ 3:32 AM I'm all for spanking a megacorp like Google when they've been bad, but how in the world could you figure a dollar amount that's anywhere near fair and accurate, especially considering all the nonGoogley problems?
Woof	Date: February 29, 2008 @ 8:06 PM Well here's a small update. Hope it's useful. After a week or so of peace and quiet since the last reformat/reinstall, I landed on another website tonight that served up a similar ad to the one I got the last time. It was a different ad... something about optimizing Windows XP... but the format was identical to the screenshots that I posted the first time I got hit with this. And no, I wasn't surfing anywhere weird. I was looking for interactive learning programs for the XBox 360. At any rate, I don't plan to visit that site ever again, I've cleaned my cookies, cache, and form data, and now we'll just sit back and see what happens. I don't expect the popup to recur unless I revisit that site. If it does, that would prove that there is something resident on my PC. If it doesn't, I'm taking it as a sign that it resided in my cache only, and clearing it has solved the problem. That would indicate to me that the site served the ad, and the problem was easily eliminated my not going back there to give them a chance to deliver it again. I'll keep you posted.
Woof	Date: February 29, 2008 @ 8:19 PM PS. I should also mention that, for the last week, I have not been served this popup while visiting DMusic. Could be we're clean over here, at least.
kyodylee	Date: March 1, 2008 @ 2:53 PM I use Peerguardian2 and it is not allowing me to open some DMusic pages because it is blocking a link to this website from loading on the DMusic page. spyware.speedylearning.com IP 66.98.192.92 I've never had this problem before at DMusic, but Peerguardian2 definitely is not letting this pages load because of this link.
ShadowMom	Date: March 1, 2008 @ 3:02 PM You know, I spend hours here every day, logged in and not logged in when I need to do work. And I've not seen a pop-up in years. Yes, my main account is a sub, but I have a non-sub account, too. I also use two pcs, a laptop and a desktop, with Firefox and IE6 and IE7... and I've had nothing. And all I have is Norton on both, and on my laptop something called California Security Center. Not that I would TRY to get this for love or money, but there must be a common factor. Maybe isp? I also do a fair amount of surfing, but I don't really go to sites like MySpace, SoundClick or Facebook-- I visit mostly blogs and news sources. But why you all would be getting it and I don't-- I don't understand.
Israfel	Date: March 1, 2008 @ 5:02 PM I got it earlier today. Wasn't logged in at the time. Sheesh!
Cryxan	Date: March 1, 2008 @ 5:14 PM I ran a Vista box today. I got it on the first DM link I clicked.
ChillinBuzz	Date: March 2, 2008 @ 2:00 AM Why the heck are the ads still running if this is still happening? Hello! Powers That Be! PULL THE AD SYSTEM OUT ENTIRELY. As if I need to say it anyway...
Rodrica	Date: March 2, 2008 @ 2:09 AM
shadowself	Date: March 2, 2008 @ 6:50 AM On 2nd Mar 2008, ChillinBuzz said: Why the heck are the ads still running if this is still happening? Hello! Powers That Be! PULL THE AD SYSTEM OUT ENTIRELY. As if I need to say it anyway... Time for Firefox + Adblock.
Woof	Date: March 2, 2008 @ 7:34 AM You know, I used Peerguardian for years, and forgot what a useful program it is. Thanks, Kyody! Sadly, there's no version that's compatible with Vista yet... but if you use XP, this little baby blocks all kinds of intrusion attempts. You use it along with your firewall. http://phoenixlabs.org/pg2/ The first thing you'll notice after installation, is that pages with banner ads load a little slower... because PG blocks the banner ads. When the page does load, you'll see broken image icons where the ad banners would normally be. Of course, this also means that you won't be able to monitor adware activity, which will make it more difficult to report whether there's still a problem here. But at least your PC will be safer. Don't forget to download the latest lists and definitions once you install the program, though. It's important to get those once a week or so.
Woof	Date: March 2, 2008 @ 7:39 AM PS. Also important to note: PG can cause some legit sites to not work properly... like shopping online, etc.. If you're on a site you know and trust, and find yourself unable to conduct transactions, you can turn PG off until you're finished doing business, and then turn it back on.
ChillinBuzz	Date: March 2, 2008 @ 7:50 AM I'm running Firefox and Adblock. And a chunky HOSTS file too. Definitely worth it. PG2 is great, although sometimes as Woof says it does too good a job. I run it with uTorrent although it's too much of a nuisance with HTTP blocked too, so most of the time it's off... However, I've been observing a few torrents/trackers using port 80 lately. You can right click a blocked IP and "allow permanently" if you know and trust that IP address, like certain websites. That would certainly help to block unruly popups and those f*cking PartyPoker pop-unders, I bet.
Distilled1	Date: March 2, 2008 @ 1:57 PM they were supposed to be pulled and i got them from the new ons biz something... posted to jack and the powers to be ... so much for helping use that above i posted ... and ya norton blocksit fine! visit me at 61... no one listens no one answers and the buddylist looks like the ebd of theworld
trombone11	Date: March 2, 2008 @ 2:01 PM looks like the biz rate one is gone! so someones listening to us.. maybe!
leedsquietman	Date: March 2, 2008 @ 4:32 PM Firefox and Adblock helps but it doesn't always do the job these days as Firefox has now gotten to be worth writing malicious code for seeing as it is getting around 18% market share for browsers. There are in fact many recent trojans that exploit firefox only, although Mozilla are much better at keeping up with the holes than MS.
leedsquietman	Date: March 2, 2008 @ 4:34 PM Even as is stands, firefox is still way safer than IE. No active X and better control of pop up blocking and JS commands, but it is getting more attention now from trojan and virus writers as it has become so popular.
ChillinBuzz	Date: March 3, 2008 @ 12:51 AM Indeed, lqm. Firefox is getting a lot of attention now and it appears at times more than IE, however you can bet Mozilla are on the ball when an exploit is discovered and an updated version comes out quite often, unlike IE where sometimes you wait for months... As for ActiveX - Pffft. Totally unnecessary, if it were then Firefox wouldn't have the market share it does as IE would be seen as a more "complete" browser. Still, FF does share some flaws that IE suffers from but that's mainly down to the way the internet and the HTTP protocol works, I guess.
Woof	Date: March 3, 2008 @ 8:54 AM Well, I promised a follow-up to my last post in this thread, so here goes: As mentioned, on Feb. 27 I landed on a site that served up an ad similar to the one that I got here at DM. I cleared my cache, cookies, and form data (I'm using IE7 on Vista), and swore never to revisit that site again. Today's March 3, and the popup has not reappeared. I've been all over the web, too... YouTube, various MySpace pages, visiting sites as the result of Google searches... Nothing. Not even here at DM. What's weird, though, is that people are reporting different kinds of popup ads here at DM over the last four or five days, and I haven't had those happen to me at all. The only time I experienced those, was when I installed some trial version of some adware remover to get rid of the original problem. It got rid of the original popup, but generated several different varieties of popup ads whenever I'd visit DM, and only DM. Well... that program's no longer on my PC, and other than this one incident on the 27th, it's just been the odd popunder ad for free smilies and such, delivered by sites that I know dish out that kind of thing as a rule.
Woof	Date: March 3, 2008 @ 9:02 AM PS. I really should also mention that the trial version of the adware removal program didn't really remove the original popup. It only suppressed it. When I uninstalled the program, the new popups were no longer a problem, but the original popup returned.
Distilled1	Date: March 3, 2008 @ 11:57 AM woof be sure and clean that from the registry search whatever it is and follow the directions ...even though its not active it maybe hidden somewhere waiting thats the way these ass holes work
Woof	Date: March 3, 2008 @ 12:52 PM Thanks, Distilled... Which entry or entries should I be looking for on Vista? And should they be modified, or deleted?
Distilled1	Date: March 3, 2008 @ 5:37 PM search the name of the pop up... and one of the sites should have how to step by step.. again i found bit defender to me most up to date on all this but any "trusted" spy/ad-ware/virus site should have the steps for you.. I'm not touching vista but should be similar to XP. I have been using bit defender free to kill and clean after each time I have been able to get it here ..and at another music site! yep another one with google ads!
ChillinBuzz	Date: March 4, 2008 @ 7:41 AM It makes you wonder how many have a rogue application on their system that they may not have noticed before, or malware that's been lying dormant or hidden... Pulling the ads down by that point would've made no difference since an infected machine would have its malware triggered by a website address and not the content of it... So for those still seeing malware popups, the problem can't be the site but the computer it's being viewed on - If the offending ads are gone.
Distilled1	Date: March 4, 2008 @ 4:16 PM ^ And yes I can not get it now at all so its not here anymore.. and Rodrica aren't you on a MAC? it shouldn't affect you and this trojan really was low risk and dose not destroy anything just a bothersome re direct to their site to buy BAD crap stuff. just and FYI. I guess it could re direct with Fire Fox though on a mac hu but still its just run security and it will catch it (again Macafee is still not finding it with the latest updates!) NOrton is as well as MANY FREE spyware removal progs...
Opossum	Date: March 4, 2008 @ 4:21 PM I only had a weird link come up instead of the DMusic page twice last month, but it was just a blank page.
ChillinBuzz	Date: March 5, 2008 @ 12:36 AM I think Rich has either a) been taken over by an alien, b) been drinking pure alcohol, or c) developed dyslexia overnight. There's something seriously wrong around here lately... Rich's writing, Bo's artwork, Moam's chickens... Time to call in some specialists.
zedsalt	Date: March 5, 2008 @ 3:42 AM It's hard to tell given the way I cropped it, but in my avvy, I'm wearing both a policeman's hat and a pair of 3D glasses. A specialist, however, I'm not...
Distilled1	Date: March 5, 2008 @ 3:48 AM Opossum do this if you got to a weird page and make sure you don't have it. a) click the run box on windows start up menu b)copy and paste the following= ping -t pagead2.googlesyndication.com click run c)The response should look similar to this: Pinging pagead.l.google.com [6x.xxx.xxx.xxx] with 32 bytes of data: where the x's represent digits. If you are not infected, the first digit will be a 6 (as in the example). If you are infected, the first digit will be a 9 or a 209 or any thing but a 6. you can just close the dos window.(this won't harm a thing, just showing what url its pointing to) d) if you are getting anything but a 6 as the first # in the IP address you need to clean http://www.bitdefender.com/VIRUS-1000239-en--Trojan.Qhost.WU.html *if your spyware/virus detection is not finding anything, I suggest running the free on line or free down load of bit defender. as well there are others Bill suggest http://www.simplysup.com/ Zed aren't you a specialist in analog music ...yeah ya are! so damn your 3 of them things now!
Opossum	Date: March 5, 2008 @ 3:55 AM Okay, but all I got was my own machine (127.0.0.1), thanks to my massive hosts file, which blocks about every ad server that exists. Thanks for that, though.
jack	Date: March 5, 2008 @ 3:58 AM We tracked it down, it was a flash ad, this should be resolved now. Sorry for the troubles!
Distilled1	Date: March 5, 2008 @ 4:04 AM Good deal Jack yes I have tried over the past 3-4 days to get it and cant so I figured you got it. still again if anyone had been receiving the pop up or a re direct run that to see if it "YOUR" computer is clean of it.
dsindel	Date: March 5, 2008 @ 7:11 PM ping -t pagead2.googlesyndication.com I get 74.125.19.167 I did an immediate sys restore last week when I was redirected to a phony virus site I did not like what I saw!
Distilled1	Date: March 6, 2008 @ 5:33 AM Dan you have a Trojan, and its from the original ad. see sys restore only puts it somewhere else you should ping a 66.xx.xxx.xxx http://www.bitdefender.com/VIRUS-1000239-en--Trojan.Qhost.WU.html I sugest using bit defender free and cleaning it out. it may not show here or anywhere for months but its there and is going toshow itself somewhere again if you don't /
dsindel	Date: March 6, 2008 @ 4:47 PM Run): ping -t pagead2.googlesyndication.com The response should look similar to this: Pinging pagead.l.google.com [6x.xxx.xxx.xxx] with 32 bytes of data: where the x's represent digits. If you are not infected, the first digit will be a 6 (as in the example). If you are infected, the first digit will be a 9. TECHNICAL DESCRIPTION: Google Adsense is a service offered by Google which places advertisements in web pages. The advertisements are targeted (meaning that they are in concordance with the topic of the webpage), making them more effective. The revenue from every click on the advertisements is shared between Google and the webpage owner. The embedding of the advertisements is done by including a small piece of HTML / JavaScript (provided by Google) in the webpages which should present the advertisements by the webmaster. This code contacts the Google Adsense servers which delivers the targeted advertisements. This malware uses the "hosts" file (located in the "%WINDIR%\System32\drivers\etc" directory) to redirect the initial query to the Google Adsense servers to a malicious host. This file is used as a first step in the name / IP translation process and if an entry is located in this file, the domain name server is not queried. The malware creates an entry redirecting pagead2.googlesyndication.com to a rogue server. This server, rather than displaying advertisements from Google, display advertisements from a third party services. This damages both users (because the advertisements and/or the linked sites may contain malicious code - a very likely situation, given that they are promoted using malware in the first place) and webmasters (because they take away viewers and thus possible money sources from their websites). Removal instructions: Please let BitDefender delete the infected files. To restore the "hosts" file, remove the line from it containing "pagead2.googlesyndication.com" ANALYZED BY: Attila Balazs, virus researcher
Woof	Date: March 7, 2008 @ 7:34 PM Haven't seen the ad for quite a while... over a week, at least. I ran the test that BitDefender recommended, and I'm clean, too! Norton prevented the ad from downloading something whenever the ad would appear anyway. I'd get a notification that an attempt was blocked. At any rate, this HAD to be a bear to deal with... THANK YOU, JACK!