OT: Weird Pop-Up Boxes On This Site

[Ash]

ulthar wrote:


> You mentioned scanning with Adaware and Spybot.  Are the defs
> up-to-date?  (Hint: I don't run ANY antivirus or spyware
> software, AT ALL, PERIOD.  Guess which OS I'm not using).
>
> 3.  Worm/spyware infection on your computer (if this is
> infection on your own box) generally happens due to something
> you've done.  There are very few true self replicated viruses
> in the wild these days.  A worm by definition REQUIRES user
> interaction to infect the host.  This may mean that your
> PREVENTION efforts might require a self-examination of habits
> and practices.
>
> Do you download a lot of free software, screensavers and other
> stuff?
> Do you click a lot of banner ads?
> Do you respond to ANY spam at all, even 'to remove from list'?
> etc.  The list goes on.

No...I'm very savvy when it comes to those things.

> 4.  Are you running a popup blocker?  If so, and this is still
> getting through, I'd say your box is p0wned and the popup
> blocker has been disabled.  Firefox includes it's own (very
> effective) popup blocker, as well as mature javascript
> managment tools.  (Internet Explorer never seems to really
> trust the security settings you request in Options, so it is
> not very secure even if you request it).

I use Yahoo pop-up blocker.

> 5.  If the issue is infection of Andrew's forum, we need to
> understand WHY only two people of many are seeing the effect.
> I can guess why some of us are not seeing it, but we need data.
> This would help know if the problem is on the forum side or the
> client side.

Obviously, if two of us are seing the same pop-ups, it can't be a coincidence.

And I've tried Firefox and hated it

[Scott]

I'm not getting any pop-ups. My pop-up blocker isn't blocking anything at this moment.

[Mr. Hockstatter]

I suppose you guys are gonna make me walk around in a big plastic bubble now?

I'm running internet explorer, and 3 pop-up blockers.  I've got the whole Norton internet security package which updates itself automatically.  I just downloaded the newest Ad-aware update and ran that, found 7 objects.  I see Spyware Blaster requires you to buy their updates now.  I'll have to run Spybot today.  I might as well have Norton scan for viruses as long as I'm at it.  In the two years I've had it, it's never found a virus on my computer, but it's blocked quite a few people have tried to send me in e-mails.

Funny, I rebooted my computer and now I'm not getting the pop-ups any more.  For like 1/2 hour now.

[Ash]

Scott wrote:

> I'm not getting any pop-ups. My pop-up blocker isn't blocking
> anything at this moment.

That's the thing....my pop-up blocker cannot block these pop-ups.

[Ash]

Mr. Hockstatter wrote:


> Funny, I rebooted my computer and now I'm not getting the
> pop-ups any more.  For like 1/2 hour now.

I can surf for up to 1/2 hour to an hour and eventually, one of those boxes will come up.
And ONLY here.
I even restarted my p.c. twice and they still pop up.
I got another one when I posted this post.

It's NO coincidence.
I believe that this site has been compromised.



Post Edited (09-13-05 09:47)

[Scott]

Something must be going on and sounds like some have already e-mailed Andrew.

[Ash]

Mr. Hockstatter wrote:

> I got several of those yesterday (pop-ups, not countertops).
> And of course, I just got one right now.  It asks me if I want
> to download a file called sona_728.90new.js.  All the ones I've
> gotten have been from a place called www.hi5.com, and I only
> get them here.

That's the EXACT same pop-up box I got.

[odinn7]

Ash and Mr. Hockstatter:
Please cover your mouth when you post...we don't need you spreading your germs to infect us also.

[ulthar]

ASHTHECAT wrote:

>
> It's NO coincidence.
> I believe that this site has been compromised.
>

Ash, once again, the forum MAY be infected, but maybe not.  That others are NOT seeing the problem is significant, too.  It *IS* possible that YOUR computer (and Mr. H's) is infected.  I'm only saying this to emphasize that right now, we cannot jump to conclusions to solve such a problem.

[Ash]

I understand ulthar.
Notice how it appears to be Operating System sensitive?

It's obviously something to do with IE.

[ulthar]

ASHTHECAT wrote:

> I understand ulthar.
> Notice how it appears to be Operating System sensitive?
>
> It's obviously something to do with IE.

Not necessarily; in the poll thread, there are others using WinXP and IE (I believe Odinn is one) that are seeing no problem.

I agree it's probably IE related, though.  Sorry you did not like Firefox.  It may take some getting used to, but it is a FAR superior product, and problems like this will be minimized.

[ulthar]

Okay, some facts:

1. Folks with popup blockers active that are NOT getting this behavior report that their popup blocker is not blocking anything.

2. Only IE seems to be involved.

3. With Mozilla, I 'allowed popups from' badmovies.org, and have not seen anything while browsing lots of messages in multiple threads.  I'm running Linux; anyone running  Windows with popup blocking care to attempt this?

4. The only two systems reportedly affected are pre Windows XP SP2.

*My* preliminary conclusion (others welcome):  this is a local, client infection of some kind, not a 'popup' being served by badmovies.org.  I could be wrong, but that's where the data seem to be leading at the moment.

In other words, I don't think this is a 'popup' in the normal sense (a served web site issuing script commands to open a window), but is a local executable or script on the client computer.

Ash, will you try an experiment?  With the Popup "open," go to task manager (Ctrl-Alt-Delete, click Task Manager) and write down every process in your process list.  Either post the list, or do a Google search for all of them yourself.  Unless it is something VERY sophisticated (some malware infections trojan the task manager executable to hide themselves), the culprit should be there if it is a local executable infection.

[odinn7]

3. With Mozilla, I 'allowed popups from' badmovies.org, and have not seen anything while browsing lots of messages in multiple threads. I'm running Linux; anyone running Windows with popup blocking care to attempt this?

My pop-up blocker alerts me every time it stops something and it hasn't given me an alert yet. I will shut it off and see what happens but I'm really doubting it's anything here.


***EDIT*** I disabled the pop-up blocker and I got nothing. It really doesn't look like it's a problem here unless it's just related to SP1 or below.



Post Edited (09-13-05 11:54)

[raj]

I do use Win XP/2000, depending on which machine I'm at, but generally I'm using Mozilla, and have checked the "no pop-ups" box.

[Ash]

Sure, I can do that....but
Is there any way to copy & paste the running processes within Task Manager?
It would take a long time to write each one down individually.