Photo.net hacked?

[mendel_leisk]

<p>A couple of times in as many days, going from one page to another within Photo.net, I've received a pop-up warning that my computer is comprimised, that I better click here if I want to resolve it. Mouse-over the link reveals destination:</p>

<p>spywarescannerv4.com</p>

<p>Doing <alt> f4 to close the pop-up, and then another to close the photo.net window, there remains one more explorer window showing a bogus image of "My Computer". One more <alt> f4 and that is closed.</p>

<p>So far no additional problems, and Norton Internet Security is running. This has only happened on Photo.net, which isn't that conclusive, this is one of my favourite sites. Anyway, since it's happened twice, thought I'd mention it.</p>

[dave_s]

<p>Malware comes in with the ads. Not the first time-- for example, <a href="00RmhW">click here</a>.</p>

[mendel_leisk]

<p>If I was going to nominate an ad for culprit, it would be the cheesy weight-loss ones ;0</p>

[johncrosley]

<p>I had to completely restore my computer after inadvertently clicking on what turned out to be an IQ ad - it shut down my virus scanner, (and all others) stopped Ad-Aware and Ad-Aware from communicating with its server, and all other such products from working, and I hadn't even clicked on the site (I think I sneezed as I was mousing over to something else). Worst malware I ever encountered. I even removed my hard drive and tried scans from other computers to get to it, but they couldn't find it; so a restoral was necessary (took days).<br>

John (Crosley)</p>

[joshroot]

<p>This stuff happens from time to time. on photo.net, it's usually just a case of mistaken identity, an adserver is tagged as malicious for one reason or another and then photo.net using that ad server sets it off. In almost all cases, it's just a false alarm rather than any real sketchyness or malware.</p>

<p>We've got the ad guys looking into it.</p>

[mendel_leisk]

<p>Thanks Josh.</p>

<p>I notice when I mouse-over some ads the address field along the bottom of the window show the destination. Other ads, usually the more spurious seeming ones, do not show the destination. What have they got to hide, and could there be a stipulation that all ads on the site must show their destination (or sent packing)? Would this even help?</p>

<p>Probably wishful thinking, I know.</p>

[mendel_leisk]

<p>Just had it happen again. While reading this thread:</p>

<p><a href="http://www.photo.net/site-help-forum/00UFtI?unified_p=1">http://www.photo.net/site-help-forum/00UFtI?unified_p=1</a></p>

<p>I got a popup warning of virus problem, and was redirected to:</p>

<p><a href="http://online-best-scanv3.com/1/?sess=pWT4yjzxMC0xJmlwPTcwLjY4LjEyMy4xMzkmdGltZT0xMjU1NAAMPQZM">http://online-best-scanv3.com/1/?sess=pWT4yjzxMC0xJmlwPTcwLjY4LjEyMy4xMzkmdGltZT0xMjU1NAAMPQZM</a></p>

<p>A rogue ad? Or? Anyway, it's still happening, at least for me. I have WinXP, and browsing with IE8.</p>

[mendel_leisk]

<p>Just happened again: redirected to:</p>

<p><a href="http://safeonlinescanv4.com/1/?sess=p2Ty1jDxMC0xJmlwPTcwLjY4LjEyMy4xMzkmdGltZT0xMjU1OcAMPQdM">http://safeonlinescanv4.com/1/?sess=p2Ty1jDxMC0xJmlwPTcwLjY4LjEyMy4xMzkmdGltZT0xMjU1OcAMPQdM</a></p>

[michaeljlawson]

<p>Mendel, I think it's more likely at this point an infection on your PC that is hijacking the photo.net ads. Try going to http://www.malwarebytes.org/ and click on the "Download Free Version" button on the left. Run a full scan and see if it picks up anything, this great little program finds a lot of ad-ware stuff that Norton doesn't register as an actual virus.</p>