Trojan on thottbot, wowhead, and Allakhazam

vee · 03-10-2008, 09:30 PM

Here is the link: http://boards.worldofraids.com/topic-11536-1.html

Cut from post:

The matter is currently under investigation and will hopefully be resolved soon, however i suggest you take the obvious precautions to protect yourself.
Firefox or a modified hosts file is your best bet at protecting yourself for now.

Firefox : http://www.getfirefox.com/
Noscript : http://noscript.net/getit

Source:
* http://rrvs.blogspot.com/2008/...ular-sites.html
* http://rrvs.blogspot.com/2008/02/trojans-again.html
* http://rrvs.blogspot.com/2008/03/trojans-oh-boy.html

Quote:

Malgayne said...

This is Malgayne from Wowhead. I know this is totally inexcusable. If I had my way we'd have shut down all ads on the site already, but unfortunately I don't handle the advertising directly.

I can tell you with assurance that this has nothing to do with Affinity Media. Our Director of Ad Ops has been staying up until all hours of the night desperately trying to find which of our ad networks is causing the problem, and has been for days. But i've seen this exact same redirect on hotmail.com lately.

These ads come in through banners that appear to be totally innocuous, unfortunately. Even the ad network that's showing the banner doesn't know it. And Right Media doesn't narrow it down as much as we'd like, since Right Media is an exchange platform that all of our ad networks use at one point or another--nearly every ad network in the business does. =/

The banner spoken of, originates from "ad.yieldmanager.com", and will produce a redirect to "xpantivirus.com".
The exact source and origin is a little more complicated than that however.

Quote:

Wowhead said...

I've been tearing my hair out trying to find this ad and get it pulled. The trouble is that the redirect code is hidden in a banner ad that, unless loaded in an actual webpage, looks completely innocuous. Not even our ad serving providers know which banner it's located in--if they did, it would be blocked by them on their end, they don't allow this kind of thing either. I promise we're trying. If we can't track this ad down soon we may have to pull all advertisement from the site entirely.

Hopefully the matter will be resolved soon.
Until then, consider yourself warned.

beep · 03-11-2008, 02:26 AM

General suggestion from this:

1. Use Firefox WITH NoScript Addon

JAMerica · 03-11-2008, 11:16 AM

Good find, thanks for the info.

xylotism · 03-11-2008, 05:59 PM

Another reason to use WAU, no?

ScratchMonkey · 03-13-2008, 02:24 PM

http://matureasskickers.net/wbb2/thr...threadid=16910

If you run your own DNS you can also black hole the two offending ad suppliers (and any other sites you don't want people on your LAN visiting):

http://malwaredomains.com/?page_id=6