Welcome to the MacNN Forums.

If this is your first visit, be sure to check out the FAQ by clicking the link above. You may have to register before you can post: click the register link above to proceed. To start viewing messages, select the forum that you want to visit from the selection below.

You are here: MacNN Forums > Community > Feedback > Page forwarding to malware site?

Page forwarding to malware site?
Thread Tools
andi*pandi
Moderator
Join Date: Jun 2000
Location: inside 128, north of 90
Status: Offline
Reply With Quote
Nov 29, 2007, 11:11 AM
 
when I clicked on this link,

http://forums.macnn.com/89/macnn-lou...yone-tried-it/

I got sent to a site that luckily my work blocked, saying it was a malware site. I believe it was traveltray.com.

I can't reproduce the problem, so maybe I mistakenly clicked on one of the ads on the page.
     
MacosNerd
Professional Poster
Join Date: Jun 2007
Status: Offline
Reply With Quote
Nov 29, 2007, 11:19 AM
 
I got it too. I thought it was weird and when I went back to the thread it did not reoccur.
     
macdude
Junior Member
Join Date: Oct 2006
Location: Location:
Status: Offline
Reply With Quote
Nov 29, 2007, 12:04 PM
 
I just clicked it for the first time and nothing happened.

Might be because I'm on a Mac, but I imagine most here are. I'm using Safari 2.0.4.
     
xi_hyperon
Addicted to MacNN
Join Date: Jul 2001
Location: Behind the dryer, looking for a matching sock
Status: Offline
Reply With Quote
Nov 29, 2007, 12:20 PM
 
I'm on a Mac and I got sent to the site too.
     
MacosNerd
Professional Poster
Join Date: Jun 2007
Status: Offline
Reply With Quote
Nov 29, 2007, 12:36 PM
 
I was on a peecee (at work) and running firefox.
     
Chuckit
Clinically Insane
Join Date: Oct 2001
Location: San Diego, CA, USA
Status: Offline
Reply With Quote
Nov 29, 2007, 02:16 PM
 
It would be the ad on the page doing it, I think.
Chuck
___
"Instead of either 'multi-talented' or 'multitalented' use 'bisexual'."
     
CharlesS
Posting Junkie
Join Date: Dec 2000
Status: Offline
Reply With Quote
Nov 29, 2007, 02:41 PM
 
That happened to me last night on a Mac with Safari 3.0.4. I don't remember which thread did it, though, although it was most likely a banner ad on the page rather than the page itself.

Ticking sound coming from a .pkg package? Don't let the .bom go off! Inspect it first with Pacifist. Macworld - five mice!
     
residentEvil
Professional Poster
Join Date: Jan 2000
Location: Detroit
Status: Offline
Reply With Quote
Nov 29, 2007, 05:54 PM
 
i got it just going to the main forum site this morning; firefox 2.0.0.10/windows xp. i didn't return again.

now, back home...haven't had it happen.
     
Peter
Addicted to MacNN
Join Date: Oct 2002
Location: England | San Francisco
Status: Offline
Reply With Quote
Nov 29, 2007, 05:56 PM
 
no redirection here ... weird
we don't have time to stop for gas
     
Sourbook
Mac Enthusiast
Join Date: May 2005
Location: Philadelphia
Status: Offline
Reply With Quote
Nov 29, 2007, 08:32 PM
 
No redirection here either. Mac/Firefox.
     
CharlesS
Posting Junkie
Join Date: Dec 2000
Status: Offline
Reply With Quote
Nov 29, 2007, 08:48 PM
 
It's only done it to me once, and I haven't been able to get it to do that again, so I'd figure it's one of the banner ads that comes up in infrequent rotation.

Ticking sound coming from a .pkg package? Don't let the .bom go off! Inspect it first with Pacifist. Macworld - five mice!
     
Laminar
Posting Junkie
Join Date: Apr 2007
Location: Iowa, how long can this be? Does it really ruin the left column spacing?
Status: Offline
Reply With Quote
Nov 30, 2007, 02:22 AM
 
I was just forwarded from the main lounge page to this:
     
Buckaroo
Professional Poster
Join Date: Mar 2002
Status: Offline
Reply With Quote
Nov 30, 2007, 02:23 AM
 
This happened to me too. I took screen shots of all the screens and you can find it in your history.

It's an ad that is in the banner. I'm not sure, but it either comes up when you close a window or move your mouse over the banner towards something above the banner. It happened so fast I couldn't tell.

If macnn would like to have all the screen shots, let me know and I'll email them too you.

You have a asshole advertiser causing this. It only came up once and never came up again. I'll try another machine later.
     
C.A.T.S. CEO
Professional Poster
Join Date: Nov 2004
Location: eating kernel
Status: Offline
Reply With Quote
Nov 30, 2007, 02:51 AM
 
Originally Posted by Laminar View Post
I was just forwarded from the main lounge page to this:
That page f*cks with Safari too.
Signature depreciated.
     
C.A.T.S. CEO
Professional Poster
Join Date: Nov 2004
Location: eating kernel
Status: Offline
Reply With Quote
Nov 30, 2007, 02:51 AM
 
Originally Posted by Buckaroo View Post
This happened to me too. I took screen shots of all the screens and you can find it in your history.

It's an ad that is in the banner. I'm not sure, but it either comes up when you close a window or move your mouse over the banner towards something above the banner. It happened so fast I couldn't tell.

If macnn would like to have all the screen shots, let me know and I'll email them too you.

You have a asshole advertiser causing this. It only came up once and never came up again. I'll try another machine later.
Can you post them here?
Signature depreciated.
     
brassplayersrock²
Addicted to MacNN
Join Date: Mar 2006
Location: California
Status: Offline
Reply With Quote
Nov 30, 2007, 03:31 AM
 
just had this happen when I opened up the "amazing find" thread
     
Buckaroo
Professional Poster
Join Date: Mar 2002
Status: Offline
Reply With Quote
Nov 30, 2007, 03:51 AM
 
Originally Posted by C.A.T.S. CEO View Post
Can you post them here?
I'll have to find a server to upload them onto. I'll try to do it tomorrow night.
     
Buckaroo
Professional Poster
Join Date: Mar 2002
Status: Offline
Reply With Quote
Nov 30, 2007, 03:52 AM
 
Just click on the error link above or go to your history and you can click on it again.
     
Brien
Professional Poster
Join Date: Jun 2002
Location: Southern California
Status: Offline
Reply With Quote
Nov 30, 2007, 04:18 AM
 
Originally Posted by Laminar View Post
I was just forwarded from the main lounge page to this:
I just got the same one and it practically hijacked Safari... I believe I got this ad once before, a few months back.
     
Oisín
Moderator Emeritus
Join Date: Mar 2004
Location: Copenhagen
Status: Offline
Reply With Quote
Nov 30, 2007, 04:54 AM
 
I got it too, just now.

I think it’s the same one as previously when this problem occurred: it redirects you three or four times, makes your browser window a tiny little blob in the upper left corner while giving you one of those annoying, “Your computer is infected with viruses, do you want to run this completely virus-free software from an unknown Internet site that just hijacked your browser in order to fix it? [ Ok | Yes ]” alerts. Once clicked (or rather: once escape has been pressed), it takes you to the actual ad site in a humongously blown up Safari window*.

Clickthrough address was the same as the one Laminar posted.



(*When the hell are they going to add that rather important ‘Prevent web sites from moving or resizing your browser window’ option to Safari?!?)
     
ebuddy
Posting Junkie
Join Date: Aug 2003
Location: midwest
Status: Offline
Reply With Quote
Nov 30, 2007, 07:39 AM
 
I just had it happen too. It happened yesterday and now again today. It's this "traveltray" site with the "error detected" nonsense telling me my PC is not protected. It gives you the option of OK or CANCEL and both options take you to their site.

using Safari
ebuddy
     
MacinTommy
Mac Elite
Join Date: Aug 2006
Location: Denver, CO
Status: Offline
Reply With Quote
Nov 30, 2007, 09:10 AM
 
This just happend to me too.. it actually scared the sh*t out of me for a second... then I saw this post.
     
Kevin
Baninated
Join Date: Oct 2002
Location: In yer threads
Status: Offline
Reply With Quote
Nov 30, 2007, 09:47 AM
 
Originally Posted by ebuddy View Post
I just had it happen too. It happened yesterday and now again today. It's this "traveltray" site with the "error detected" nonsense telling me my PC is not protected. It gives you the option of OK or CANCEL and both options take you to their site.

using Safari
Yeah My Windows had the virus!121 OH NOS! I actually laughed when I saw it. But was surprised to see it here.
     
Big Mac
Clinically Insane
Join Date: Oct 2000
Location: Los Angeles
Status: Offline
Reply With Quote
Nov 30, 2007, 11:08 AM
 
Yup. Happened once to me so far. What ad company would let javascript dialogs in their banner ads?

"The natural progress of things is for liberty to yield and government to gain ground." TJ
     
Person Man
Professional Poster
Join Date: Jun 2001
Location: Northwest Ohio
Status: Offline
Reply With Quote
Nov 30, 2007, 11:10 AM
 
Originally Posted by Kevin View Post
Yeah My Windows had the virus!121 OH NOS! I actually laughed when I saw it. But was surprised to see it here.
It just happened to me too. I took detailed notes on the behavior, with screenshots. I'll post them here at lunch, but whichever ad company is serving this ad needs to be dropped entirely. This makes ALL of their ads untrustworthy.

To the admins, mods, whoever: DROP THIS AD COMPANY! Don't just ask that the malware ad be removed from the rotation.
     
Person Man
Professional Poster
Join Date: Jun 2001
Location: Northwest Ohio
Status: Offline
Reply With Quote
Nov 30, 2007, 12:44 PM
 
Ok. Exact behavior of this ad.

1. Surf to a page. Ad server serves this ad, which on loading runs a JavaScript that redirects you away from the originating page (making it very hard to identify which company served the ad or which ad it was).

2. The new page resizes the browser windows to a small square and displays a popup box:



3. Clicking on either "Cancel" or "OK" causes the browser window to expand to the full dimensions of your screen resolution, and an animation runs which shows a "scan" being done. At the end of the "scan," this pops up on screen:



4. Clicking on either "Remove all" or "Ignore" causes the computer to download an ".exe" file:



If this were a windows machine and the person executed the file, it would install the software. Fortunately we're on a Mac and it doesn't affect us, but still. If I can find the ad server that served this, I think it would be best if MacNN didn't do business with that company ever again.
     
Person Man
Professional Poster
Join Date: Jun 2001
Location: Northwest Ohio
Status: Offline
Reply With Quote
Nov 30, 2007, 01:06 PM
 
Ok. I found the URL of the ad that's being served.

DO NOT CLICK ON THIS URL UNLESS YOU WANT TO GO THROUGH THE ABOVE PROCESS!

Error Detected

More info on this ad: Spyware Sucks

And a few more sites: Alluc.org forum / Malware Scan Advertisement

Exploit Prevention Labs: Banner ads from major sites

DoubleClick caught supplying malware-tainted ads | The Register

Damn you AdTraff. Did MacNN sign up for ads from AdTraff? They need to be dropped permanently if they are.
( Last edited by Person Man; Nov 30, 2007 at 01:22 PM. )
     
Jens Peter
Senior User
Join Date: Apr 2002
Location: Aarhus, Denmark
Status: Offline
Reply With Quote
Nov 30, 2007, 01:08 PM
 
Yep, Iit happened to me too.. Got the exe-file sitting on my desktop, and just glad I'm not on a Windows machine.

But MacNN, you need to talk to the people in charge of your banners! This is spyware!
     
BlueSky
Mac Elite
Join Date: Aug 2004
Location: ------>
Status: Offline
Reply With Quote
Nov 30, 2007, 01:12 PM
 
Me too. As this thread opened I was forwarded automatically to traveltray.com -> blessdads.com -> scanner2.malware-scan.com. ****wads.
     
Person Man
Professional Poster
Join Date: Jun 2001
Location: Northwest Ohio
Status: Offline
Reply With Quote
Nov 30, 2007, 01:28 PM
 
....
     
MacosNerd
Professional Poster
Join Date: Jun 2007
Status: Offline
Reply With Quote
Nov 30, 2007, 02:10 PM
 
Happened again when viewing this thread link

Again a peecee running firefox.
     
MacosNerd
Professional Poster
Join Date: Jun 2007
Status: Offline
Reply With Quote
Nov 30, 2007, 02:11 PM
 
Why aren't the mod/admins chiming in on this thread?
     
Demonhood
Administrator
Join Date: Mar 2000
Location: Land of the Easily Amused
Status: Offline
Reply With Quote
Nov 30, 2007, 02:24 PM
 
forwarding the issue to the powers that be.
     
mkbhatia
Administrator
Join Date: Dec 1998
Status: Offline
Reply With Quote
Nov 30, 2007, 02:28 PM
 
I believe I've disabled the network that caused this ridiculous ad. Let me know if you still see it after this date/time of this post.
     
CharlesS
Posting Junkie
Join Date: Dec 2000
Status: Offline
Reply With Quote
Nov 30, 2007, 09:07 PM
 
Unfortunately, I just got it a few minutes ago.

Ticking sound coming from a .pkg package? Don't let the .bom go off! Inspect it first with Pacifist. Macworld - five mice!
     
Person Man
Professional Poster
Join Date: Jun 2001
Location: Northwest Ohio
Status: Offline
Reply With Quote
Nov 30, 2007, 09:09 PM
 
Originally Posted by CharlesS View Post
Unfortunately, I just got it a few minutes ago.
I just got it too. This time it redirected me to performanceoptimizer.com instead of Malware Scan.
     
CharlesS
Posting Junkie
Join Date: Dec 2000
Status: Offline
Reply With Quote
Nov 30, 2007, 09:12 PM
 
If it helps at all, this URL showed up right before the blessedads.com/?cmpid=threw6ar one in my browser history, although browsing to it again doesn't seem to do anything:

http://traveltray.com/statsg.php?cam...96469087057.62

Ticking sound coming from a .pkg package? Don't let the .bom go off! Inspect it first with Pacifist. Macworld - five mice!
     
Cold Warrior
Moderator
Join Date: Jan 2001
Location: Polwaristan
Status: Offline
Reply With Quote
Nov 30, 2007, 09:13 PM
 
beyond the immediate topic: do you think this is an ad company just taking money from anyone, with no interest in what's going on, or have their servers been hijacked?
     
MacosNerd
Professional Poster
Join Date: Jun 2007
Status: Offline
Reply With Quote
Nov 30, 2007, 11:05 PM
 
They're back again, I just got some sort of performance website when I attempted to enter a thread. I had to force quit safari.
     
64stang06
Mac Elite
Join Date: Aug 2007
Status: Offline
Reply With Quote
Nov 30, 2007, 11:15 PM
 
Just got it also when trying to view the Lounge.
     
besson3c
Clinically Insane
Join Date: Mar 2001
Location: yes
Status: Offline
Reply With Quote
Nov 30, 2007, 11:36 PM
 
This MacNN ad really freaked me out:

http://www.netdisaster.com/goff.php?...al-war-lounge/
     
Jawbone54
Posting Junkie
Join Date: Mar 2005
Location: Louisiana
Status: Offline
Reply With Quote
Dec 1, 2007, 01:09 AM
 
Just happened to me for the third time. Running Mac/Safari.
     
legacyb4
Mac Elite
Join Date: May 2001
Location: Vancouver
Status: Offline
Reply With Quote
Dec 1, 2007, 03:10 AM
 
Yup, just happened to me. I think I might have accidentally clicked on a banner. Traveltray is the first URL that I got directed to.
Macbook (Black) C2D/250GB/3GB | G5/1.6 250GBx2/2.0GB
Free Mobile Ringtone & Games Uploader | Flickr | Twitter
     
ColdFire
Fresh-Faced Recruit
Join Date: Nov 2007
Status: Offline
Reply With Quote
Dec 1, 2007, 04:20 AM
 
Just had it happen a couple of times. The ad redirected me to: scanner2.malware-scan.com
     
starman
Clinically Insane
Join Date: Jun 2000
Location: Union County, NJ
Status: Offline
Reply With Quote
Dec 1, 2007, 04:36 AM
 
Just got it

Home - Twitter - Sig Wall-Retired - Flickr
     
Rorzabal
Fresh-Faced Recruit
Join Date: Jul 2007
Status: Offline
Reply With Quote
Dec 1, 2007, 05:10 AM
 
Just happened to me as well. I haven't seen anything so obnoxious since I ditched my Windows machine last January.
     
Mekman
Fresh-Faced Recruit
Join Date: Sep 2007
Status: Offline
Reply With Quote
Dec 1, 2007, 10:50 AM
 
Just happened to me. I killed safari via the process manager, just so I don't actually download it by accident.
Question:
1) This download doesnt affect macs right?
2) I've only got ClamAv and the firewall that came with the mac, is the going to be sufficient (ok and enough sense to not provide the Admin/PW to an app I didn't download on purpose).
3) Do I have to worry (I've just migrated from the PC World in August...when the new iMacs came out)?....For some reason that popup really freaks me out

Thanks
     
Atheist
Mac Elite
Join Date: Sep 2006
Location: Back in the Good Ole US of A
Status: Offline
Reply With Quote
Dec 1, 2007, 11:08 AM
 
Just got it as well.
     
cybergoober
Mac Elite
Join Date: Jun 2003
Location: Newport News, VA USA
Status: Offline
Reply With Quote
Dec 1, 2007, 12:07 PM
 
Just happened to me when trying to load the main forums page.

Ugh.
     
analogika
Posting Junkie
Join Date: Feb 2005
Location: 888500128
Status: Offline
Reply With Quote
Dec 1, 2007, 12:16 PM
 
Originally Posted by Mekman View Post
Just happened to me. I killed safari via the process manager, just so I don't actually download it by accident.
Question:
1) This download doesnt affect macs right?
2) I've only got ClamAv and the firewall that came with the mac, is the going to be sufficient (ok and enough sense to not provide the Admin/PW to an app I didn't download on purpose).
3) Do I have to worry (I've just migrated from the PC World in August...when the new iMacs came out)?....For some reason that popup really freaks me out
1) Nope.
2) Yes.
3) The ****ing arseholes who do this kind of thing will burn in hell, eventually - unless the cops get to them first. Don't worry.
     
 
Thread Tools
 
Forum Links
Forum Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts
BB code is On
Smilies are On
[IMG] code is On
HTML code is Off
Top
Privacy Policy
All times are GMT -4. The time now is 04:00 PM.
All contents of these forums © 1995-2017 MacNN. All rights reserved.
Branding + Design: www.gesamtbild.com
vBulletin v.3.8.8 © 2000-2017, Jelsoft Enterprises Ltd.,