Popups and adware

[paulnaj]

I've been discussing with weedpacket the fact that adware and popups are appearing on the forum.

I've attached a screenshot of the popup - some kind of survey.

This is just for info ... but if anyone else is getting something different, then it might be worth adding here.

[stolzyboy]

That's the same one I've seen...

Not sure if it is "supposed" to be here or not!

[paulnaj]

No, it's not.

I think jstarkey is on the case but needed examples - it seemed to him that it might only be a Windows problem, so if you're not on Windows, let us know.

P.S. I also pointed out that, at the same time, adware is trying to download itself. (I use SpyBot to warn me about adware/spyware).

The only one I'm getting is from 'Avenue A Inc.' - let us know if you're getting any others.

[stolzyboy]

I am on Windows and use IE and Firebird, and have seen it on both. I regularly scan for adware and it finds nothing.

[jstarkey]

I've gotten it a few times on Linux/Mozilla. What I was referring to as Windows specific is the adware.

I very rarely use Windows, can you explain what Avenue A Inc is?

[stolzyboy]

It's an advertising agency. There are many like it that businesses will use to create adware/spyware/spam/etc... Not sure how they get away with doing it to people's websites legally...

PHPB has NO affiliation with them? Thru any of the ads, etc...

[bad76]

I've looked it at least one per day.
Last happens when I've clicked this thread.
But in the html there is nothing...

Some ad open it?:confused:

(maybe the blue banner telling "take a five minute..." and "we care about what you are thinking" ?)

[jstarkey]

Looking into this now.

[paulnaj]

jstarkey asked:
I very rarely use Windows, can you explain what Avenue A Inc is?

This is what SpyBot says (not very much!)
==============================
Company: Avenue A, Inc.
Product: Cookie
Threat: Tracking cookie or cookie of tracking site
Description:
They say they no longer do tracking.
==============================

[jstarkey]

Paul, that looks like just a "little warning". To let you know that a site that "doesn't track anymore" is setting a cookie. Not necessarily that they are trying to track you or to plant anything.

[stolzyboy]

Originally posted by jstarkey
Paul, that looks like just a "little warning". To let you know that a site that "doesn't track anymore" is setting a cookie. Not necessarily that they are trying to track you or to plant anything.

But the popup is still unauthorized correct?

[paulnaj]

Hi jstarkey,

I must admit, I'm not really 'up' on how adware/spyware works, but as far as I'm concerned, if the adware doesn't give you an option to NOT download, or to set a cookie, it should be treated as malicious.

It's only SpyBot that telling me that cookies are being set, not Avenue A Inc.

It would be good to hear from anyone on the forum who knows how this stuff gets propagated.

[jstarkey]

You always have the option of rejecting a cookie.

Stolzy, the popup is coming from the ad server, so I need to ask around.

[jstarkey]

Also worth noting: when we do a survey for the sales team, we set a cookie to make sure the survey request doesn't pop up everytime you load a page.

It's only setting one cookie, as far as I can see.

[jebster]

I've gotten pop-up's here to, well atleast they tried to popup, but the Google Toolbar gave them a big ole DENIED! :D But yea, I get them quite often, more then once per visit atleast.

[jstarkey]

Originally posted by stolzyboy

PHPB has NO affiliation with them?

Sorry, I missed this stoly.

If Avenue A is doing anything that's invading your privacy, I'm sure it will be dealt with very quickly.

Let's not jump to conclusions though. Avenue A says it's no longer tracking. If they in fact have a history of anything suspicious, they have dealt with it and probably deserve another chance.

The vast majority of us use cookies to track our sessions. Let's not slam others for doing something we do .

[edit]

I don't know if we have any affiliation with Avenue A, sorry. Dave, our VP of sales, just replied and asked for more info. I sent him some that Weed provided via PM. I'll keep you posted.

[goldbug]

Just for the record-keeping:

I've never ever seen that or really any ads at all when visiting phpbuilder.

Platforms:
Windows, Linux, OS X
All running latest 'release' of Mozilla Firebird (0.7 currently)
All running the Adblock extension <-- key imho
All rejecting third-party cookies.

[LordShryku]

Well, I guess I can chime in here...

I usually use a browser with some sort of popup blocking utility, but I have seen this when using IE. I'll have to run a scan when I get home tonight to see if it's being caught as adware/spyware.

[jstarkey]

Could someone here, using Windows system, run spybot or adaware? I want to see if anything has been planted. So far, the alarm seems to be a cookie. Something that, by nature, can't infect your system.

If you'd like to email me the results, rather than post them, please send to the staff alias.

TIA.

[jstarkey]

Thank you Lord!!

:D

[stolzyboy]

Just finally got the popup again, it places a cookie for questionmarket. Lavasoft's Adaware doesn't flag it as anything bad for that particular ad.

[keith73]

I block popups using mozilla's popup blocking feature on winxp at work.

I poked around the site, checking my cookies each time I went to a new page. Finally I loaded up the same page for the 4th time and 2 cookies were set by questionmarket.com.

the add was a nortel networks banner at the top that had a web form in it as well.

Attached is a screen shot of the mozilla page info window and a screen shot of the ad.

- keith

[Weedpacket]

I spent an hour on this last night; Avenue A's advert consists of an iframe the src of which includes an onunload handler which brings up the first popup. That popup is comes from questionmarket.com and further activity is by them.

Both Avenue A and questionmarket attempt to set cookies, e.g.,

AA002=001071570621-82635/1072780221; expires=Sunday, 14-Dec-2008 00:00:00 GMT; path=/; domain=.atdmt.com


AS1=1928800-4-1071570640-1-1071570640_; expires=Sat, 05-Feb-05 02:30:40 GMT; path=/; domain=.questionmarket.com

LP=1071570640; expires=Sat, 20-Dec-03 14:30:40 GMT; path=/; domain=.questionmarket.com

- the ostensible reason would presumably to avoid asking the same person to take the same survey multiple times.

[LordShryku]

Used adaware 5 and 6. Neither came up with anything for this.

[paulnaj]

Here's another popup screenshot ... I'll carry on doing this 'til someone tells me to stop bothering.

[stolzyboy]

Yep, I got that one too...

That one generated a cookie from atdmt.com and adaware flagged that one for some reason as a data miner/tracking cookie for advertisement.

[Merve]

What I don't understand is that I'm on Win 2000 with IE 6 and I haven't gotten any popups from here...maybe I'm just a lucky bum...:confused:

[jebster]

Do you have the Google Toolbar or something else that might be blocking them? Cause I usually get one each time I post, on that page that redirects you to your post!