Antivirus 2009 / "windows-defense.com" redirect & alert popup - resolved.

[Yaristock]

Sorry I didn't respond Friday, but I have not had one since the ads were turned off. As I'am typing this I'm going to other threads looking to see if I find a redirect or pop-up, and I find nothing.

[Yaristock]

Crap I spoke too soon. I let my guard down in the blog section and got pwned by the pop-up. I failed to pay attention to the ads.

[MetroMPG]

Thanks, Yaristock - I didn't shut off ads in the blog area (as you just found out). That may help narrow things down (particularly if only 2 of the 3 ad providers are in the blog - I'll have to check).

[ALS]

There is another one out there I got twice last week. Some kind of pop up advertising program. About every five minutes a pop up advertisement would appear. Neither of my spyware/virus software stopped it from coming in.
Did a scan with Trend Micro and it couldn't quarantine it. When I did a scan with Spy Sweeper it found it and killed it. The Trend Micro kept telling me it was there but the adware would redirect the problem by pointing to a infected dll. It would say the infection was somewhere else than where it really was hiding.

[ChrstphrR]

I'd like to make a suggestion to narrow down what the source is of the malware popups from your advertising sources:

Since you've narrowed down to 2 of 3 advertising sources, keep the one clean one on the blog and the forums...

Then for the other two:

Make two alternate pages on the site, that only use each of them, exclusively. Then, let us know what the pages are, and have us go at it, until we get one that matches ... or both, possibly.

To me, that's a wiser idea than continuing on with *known* infectious vectors on the site. If you can't determine wihch source brings the infectious content, then, you should seriously, immediately drop these two, not carry on and leave them to infect others.

[MetroMPG]

Just to clarify - there's nothing infectious about encountering the AV 2009 stuff we've been seeing. It's just a javascript redirect to their web site, and an alert popup.

The only risk of actually getting their malware on your computer is by agreeing to download & execute the program they're trying to get you to install.

---

I haven't yet planned with Ben about segregating the 2 remaining advertisers to different parts of the site (forum vs. blog), but that's a good idea.

[MetroMPG]

FYI, I've officially narrowed it down to 2 of the 3 ad providers. I'm reinstating Google ads on the forum, and will rely on feedback to see if they're the problem. I suspect they're not.

[ALS]

I found out where I picked up that nasty Adware program. Isohunt a torrent search engine. I have been trying to figure out where I got it. Well I went into the site and bang I get a warning pop up from my Trend Micro.
It is called Virtumonde and gets a maximum warning from Spy Sweeper on level of danger to your computer. I know which web site I will not be going to anymore.

[MetroMPG]

PING! Just checking in to see if anyone's noticed the redirect today - or not. Either in the forum or blog.

I believe we're narrowing in on one of the 2 remaining ad providers. A bit of evidence is stacking up anyway.

[Noel]

I was reading the blog a few hours ago, as soon as I hit page 2 BAM, it popped up again.