Forced Spyware Download from FT Ad
May 31, 2008 | 8:28 pm
#1
Original Poster
Join Date: Aug 2000
Location: AUS - Formerly MSP, IAD/DCA, SYD, CBR, BNE, JNB
Programs: QF & NW Clubs. Will never buy another ticket on UA or US.
Posts: 1,100
Forced Spyware Download from FT Ad
I just launched a new browser session, went to flyertalk, and had the window close and a bogus dialogue start about needing to download "anti-spyware master" with some fake screens (obvious since they were faking windows but I am on a mac) - it then downloaded a .exe file (fortunately this is a powerpc mac so windows .exe's don't run).
Clearly the result of a rogue banner ad on FT - I suggest you check into it and complain to your ad serving companies.
Clearly the result of a rogue banner ad on FT - I suggest you check into it and complain to your ad serving companies.
Jun 1, 2008 | 8:12 am
#2
Join Date: Mar 2005
Location: HYX
Programs: ~IHG(p)/BW~Nat'l.Exec~ ~NW(SE)~ ~Cessna~ NASM.do-07 ~AAAF.do-05/06/07/08/09
Posts: 1,530
Similar occurance ~ IIRC a few hours prior to your post... got a java alert window which spawned a 'download in progress' page; had to dump the browser (IE6) to kill it.
S&D scan shows no damage ~ irritating, nonetheless.
Have no idea which forum or ad ...
/.
S&D scan shows no damage ~ irritating, nonetheless.
Have no idea which forum or ad ...
/.
Jun 1, 2008 | 2:33 pm
#3
Join Date: Aug 2002
Location: New Jersey
Programs: UA 1MM Gold, Hertz Gold, Hyatt, Marriott
Posts: 309
The same thing happened to me yesterday and then again today while I was browsing the United Mileage Plus forum. And it happened even though I did not click any banner or ad; I only clicked on threads.
On both occasions my antivirus software popped up and said it had prevented some kind of download. It identified yesterday's virus as TROJ_DLOADER.XAA, and today's as TROJ_RENOS.FV.
I urge the IT folks at FT to look into this.
On both occasions my antivirus software popped up and said it had prevented some kind of download. It identified yesterday's virus as TROJ_DLOADER.XAA, and today's as TROJ_RENOS.FV.
I urge the IT folks at FT to look into this.
Jun 2, 2008 | 3:13 am
#4
Join Date: Oct 2000
Location: Birmingham, England
Programs: LH SEN, Hilton Diamond, AF/KL & BA basic memberships, Tufty Club Exec Plutonium
Posts: 1,668
I just launched a new browser session, went to flyertalk, and had the window close and a bogus dialogue start about needing to download "anti-spyware master" with some fake screens (obvious since they were faking windows but I am on a mac) - it then downloaded a .exe file (fortunately this is a powerpc mac so windows .exe's don't run).
Clearly the result of a rogue banner ad on FT - I suggest you check into it and complain to your ad serving companies.
Clearly the result of a rogue banner ad on FT - I suggest you check into it and complain to your ad serving companies.
Antivirus software stopped it downloading.
Jun 2, 2008 | 9:32 am
#7
Join Date: Apr 2005
Posts: 2,312
A notice has been sent to the ad trafficking group. If anyone happens to get a screenshot, please send it to me at [email protected].
Jun 2, 2008 | 11:51 am
#8
Join Date: Jan 2003
Location: Manchester, United Kingdom
Programs: Hilton Gold, Priority Club Platinum (until December), FB Explorer, BA Blue, M&M Pleb
Posts: 8,616
I'm seeing something similar
It calls itself "Performance Optimizer" and I've seen it twice today - once on my work laptop and now here. It is very aggressive and leaves Firefox unusable (had to restart just to be able to type in the title field of this page). I'm downloading the latest copy of Ad-Aware as I type!
On both occasions, I didn't think to get a screen shot (doh!!! - sorry Mikel)!
On both occasions, I didn't think to get a screen shot (doh!!! - sorry Mikel)!
Jun 2, 2008 | 3:13 pm
#9
Join Date: Jan 2004
Location: EXT, LHR & ORD
Programs: AA EXP MM, HH Diamond
Posts: 1,636
It calls itself "Performance Optimizer" and I've seen it twice today - once on my work laptop and now here. It is very aggressive and leaves Firefox unusable (had to restart just to be able to type in the title field of this page). I'm downloading the latest copy of Ad-Aware as I type!
On both occasions, I didn't think to get a screen shot (doh!!! - sorry Mikel)!
On both occasions, I didn't think to get a screen shot (doh!!! - sorry Mikel)!
That's the one ... had it occasionally yesterday and today (but not this time I logged in !)
Jun 2, 2008 | 3:18 pm
#10
Join Date: Jan 2006
Location: ELP
Programs: AA EXP/LT PLAT, Marriott Titanium/LT PLAT
Posts: 4,140
It calls itself "Performance Optimizer" and I've seen it twice today - once on my work laptop and now here. It is very aggressive and leaves Firefox unusable (had to restart just to be able to type in the title field of this page). I'm downloading the latest copy of Ad-Aware as I type!
On both occasions, I didn't think to get a screen shot (doh!!! - sorry Mikel)!
On both occasions, I didn't think to get a screen shot (doh!!! - sorry Mikel)!
Jun 2, 2008 | 9:27 pm
#11
Join Date: May 2004
Location: Home
Programs: AA, Delta, UA & thanks to FTers for my PC Gold!
Posts: 7,674
I think having ....... Plus installed has protected me from running into the same problem. I believe there were at least two similar "virus" attacks in the last couple of months. May not be exactly the same as this one you guy are running into, but they are all ad-feeder-related (I think).
Malware ad on FT are very bad form
Virus on FT?
While I understand it's nearly impossible to have a virus-free virtual world nowadays, is there a way to prevent this sort of "attacks" more effectively from our House of Miles?
Malware ad on FT are very bad form
Virus on FT?
While I understand it's nearly impossible to have a virus-free virtual world nowadays, is there a way to prevent this sort of "attacks" more effectively from our House of Miles?
Jun 3, 2008 | 4:30 am
#12
FlyerTalk Evangelist
Join Date: Mar 2002
Location: An NPR mind living in a Fox News world
Posts: 14,343
Wirelessly posted (Mozilla/4.0 (compatible; MSIE 6.0; Windows 98; PalmSource/Palm-D052; Blazer/4.5) 16;320x320)
Same thing happened to me last night while browsing either the TS&S or OMNI. I was in IE6. I got a pop-up asking me to download some anti-spyware.
The first thing I did was disconnect my wireless connection. Then, I went into task manager (cntl-alt-del) and killed it that way. I ran my anti-virus and anti-spyware programs to make sure it hadn't downloaded itself.... WHEW!
Same thing happened to me last night while browsing either the TS&S or OMNI. I was in IE6. I got a pop-up asking me to download some anti-spyware.
The first thing I did was disconnect my wireless connection. Then, I went into task manager (cntl-alt-del) and killed it that way. I ran my anti-virus and anti-spyware programs to make sure it hadn't downloaded itself.... WHEW!
