Possible Malware spreading via advertisements on ATS?

Hey everyone, my antivirus software has gone off 2 days in a row now while reading thru the forums on ATS, and it seems pretty strange to me.

Just because I like to make a habit of "better being safe than sorry", I thought it would be a good idea to post this on here and make sure it doesn't end up being a problem further down the road.

I currently am using avast antivirus and have it set to automatically scan internet traffic, and have got the following result the last two days in a row:

I took a screen shot and will post it up here in a few minutes after I upload it to my ATS account.

After doing a little bit further investigation, I'm not really having a whole lot of luck...

the IP address that is being blocked by avast is 64.34.127.134 which after doing a traceroute is showing me that it's a node off of 1ge.ge-2-1.lax-600w-sbdis-2 [216.187.89.214], branching off of 1ge.ge-2-8.la-600w-cor-1 [216.187.89.45] which is apparently coming from a high level domain, LosAngeles1.Level3.net.... very strange.

Hopefully the "lax" does NOT mean LAX as in Los Angeles International Airport..

Anyway, here's a screen shot below: (As soon as I get it uploaded)

[atsimg]http://files.abovetopsecret.com/images/member/ada439e6cfda.jpg[/atsimg]

[atsimg]http://files.abovetopsecret.com/images/member/58c997d1b385.jpg[/atsimg]


(You have to right click and view the images for them to display properly on your screen)

Strange, my Avast has done the same with ATS for the past few days. I'm turning on ABP again and possibly noscript if the problem continues.

Thanks for giving others the heads up.

reply to post by TheOneElectric


Sadly it's against the T&C to use adblocking software to view this site. I believe no script is allowed as that's entirely security related, but don't mention ad blocking software, you'll learn why soon enough I'm sure.

Well the other funny part to it is that Avast doesn't do anything while simply looking at the forums, it's apparently only going off for certain specific advertisements - which in this case, I guess, was the advertisement for Motorola? Note *** I do NOT in anyway have any affiliation or anything against Motorola *** I am simply stating what it appears to be giving the circumstances while taking the screen shot - it's very possible it was the advert directly BEFORE the Motorola advert as well, giving the fact that I obviously could not immediately take a screenshot - I just was lucky enough to catch it because of the fact the same thing had come up previously.

reply to post by Time2Think


Intresting... i guess the moral is can you really trust any site on the internet....

On a side note and i don't know if this is related but i get this security warning pop up everytime i open ATS -


[atsimg]http://files.abovetopsecret.com/images/member/b099ea8d4546.jpg[/atsimg]


??

reply to post by Time2Think


ive noticed it since day 1. They animately denied any harmfulness. My computer blocks an attack almost everytime.. Not to mention the one time a survey poppd up forcing me to either click the survey, or restarting my computer.. Those were my two options. It was a survey to make sure I wasnt a "bot". They also denied this was them.. Truth is.. No where on the net is "safe".

reply to post by phishyblankwaters


It may be against T&C to use an ad blocker, but if ATS doesn't properly vet their source of advertisements, they cannot expect their users to open themselves to possible malware attacks just to preserve ATS's revenue stream.

I know ATS cannot be held directly accountable for the lack of security in the advertisements themselves, but they can hold accountable the advertising agency they are using to serve these ads.

reply to post by Myendica


If you're getting pop-ups on your screen for survey's or whatever else, like "Click here to install blah blah blah" you're infected with malware and need to do a scan as soon as possible. It has nothing to do with ATS. If it did, there would already be thousands of posts on these forums concerning that specific issue.

Originally posted by BomSquad
reply to post by phishyblankwaters

 

It may be against T&C to use an ad blocker, but if ATS doesn't properly vet their source of advertisements, they cannot expect their users to open themselves to possible malware attacks just to preserve ATS's revenue stream.

I know ATS cannot be held directly accountable for the lack of security in the advertisements themselves, but they can hold accountable the advertising agency they are using to serve these ads.

Exactly, that is the logic behind me doing a Trace Route and taking a screen shot of it, as well as me commenting about LAX -- while I HIGHLY doubt it, it IS possible that LAX has been infected with some sort of malware, and I'm hoping that somebody out there is checking into it as we speak.

An infected high level domain would not exactly be a good thing.

reply to post by Time2Think


no. This happened the one time.. And it was in ATS format. Same lettering.. Same color schemes.. It may have even had ATS on it.. But I was just trying to get rid of it so didnt pay too much attention.. Eta- it literally said.. "take this survey so we know your not a bot." may not be exact wording, but close

I'm new here (Hiya! :lol, and know next to nothing about computers and the nasty littler viruses they can catch, However..

I use Norton Internet Security, and it's popped up a few times during my browsing of ATS. If I remember correctly, the programs wording was "Suspicious Java Activity Blocked" or something relatively close. I don't blame ATS for this, though, just the adds.. And hell, For all I know Norton is just being fickle. Then again, whatever it was is being blocked, So I'm a happy camper.. for now.

heres a popup i got today.
MALWARE DETECTED
img401.imageshack.us...

Looks like a new one is going around.

Infection Details
URL: www.laminark.com...
Process: file://Crogram FilesMozilla Firefox...
Infection: jsownloader-gen@bhv [Expl]

looked at laminark's main page, just a blank html file
it's "routed" thru internetserviceteam.com