anandtech ad server got compromised beware

[onex]

seems some ad server has got maleware in it delivering it to the site, asking for a plug-in install containing trojans.
it's not the first time AT has had issues since they moved into VB,
yet they're aware of it and working to solve it,
good luck over there guys.

[zalbard]

Ow...
I'm sure it will be sorted ASAP, though.
Just glad I've read their Fermi review earlier today, just in time before the crisis!

[mutantmagnet]

I love coincidental timing. This was the first place I went to the moment I also received a warning that Anand might upload a trojan to me to get my Fermi review fix

[anubis]

Went to anand via chrome and got message that its not safe, had the little WTF?! moment, then entered.


Figures

[zalbard]

Went to anand via chrome and got message that its not safe, had the little WTF?! moment, then entered.


Figures

So its your computer that sent me 250 viagra spam emails today?!

Just kidding.

[Musho]

Lol, had an unsafe warning as well, but I just entered regardless. I'm not that stupid to randomly install addons/plugins

[anubis]

So its your computer that sent me 250 viagra spam emails today?!

Just kidding.

Only 250? have to give the little critters access to bit more BW i guess

[antiacid]

Lol, had an unsafe warning as well, but I just entered regardless. I'm not that stupid to randomly install addons/plugins

Except that you don't even need to accept anything to get infected through certain types of vulnerabilities. Do you run noscript? If not, or if you have it whitelisted for that site, chances are you can get hit by an attack without even realizing it. It doesn't matter what IQ you have or how many AV softwares you run, it can and will still happen.

Welcome to the internet.

[ferrari_freak]

Yeah I got the same message while trying to see the Fermi review again this morning. Good thing I had already read it last night.

[-n7-]

3rd party ads got hacked actually, not Anandtech per say.

Anand speaketh.
http://forums.anandtech.com/showpost...4&postcount=51

[Musho]

Except that you don't even need to accept anything to get infected through certain types of vulnerabilities. Do you run noscript? If not, or if you have it whitelisted for that site, chances are you can get hit by an attack without even realizing it. It doesn't matter what IQ you have or how many AV softwares you run, it can and will still happen.

Welcome to the internet.

Already ran a scan. Didn't get infected

Adblock plus blocked the infected ads. I love that addon

[anubis]

Im clean, seems like adblock saved me aswell.

[Helmore]

This thread title is slightly misleading. I wouldn't really say that AnandTech got hacked, they were unknowingly serving evil ads. They're working to fix it though, if they haven't already fixed it.

[JAWS]

Went to anand via chrome and got message that its not safe, had the little WTF?! moment, then entered.


Figures

wow same here. last night reading fermi review clicked on 2nd page and got "not safe message". I didn't think anything about it at the time.

[onex]

3rd party ads got hacked actually, not Anandtech per say.

Anand speaketh.
http://forums.anandtech.com/showpost...4&postcount=51

yeah seen it,

This thread title is slightly misleading. I wouldn't really say that AnandTech got hacked, they were unknowingly serving evil ads. They're working to fix it though, if they haven't already fixed it.

title would be changed.
it sounds a bit like yellow gossip, it isn't the meaning.

[[XC] Synthetickiller]

So what exactly is the malware we have? I trusted the site & ads, although nothing popped up to install.

avg won't scan... hmmm... lol

[jaredpace]

So what exactly is the malware we have? I trusted the site & ads, although nothing popped up to install.

avg won't scan... hmmm... lol

It attempts to install a spoof antivirus program called "antivirus soft" which is a trojan rehash of "antivirus live" auto installer. It blocks most run32dll executions with an error message and trys to get you to buy the software via pop-ups. It also will attempt a fake virus scan. If you really got something a "antivirus soft" virus scanner would pop up, and you would be unable to use most programs. IE would take you to their purchase page

[[XC] Oj101]

I didn't see a thing when I visited them about two hours ago I'm using Opera 9.64 and ESET Smart Security 4, not so much as a warning and judging by the above post I'm not infected either.

[Eson]

So how does Google fit in this picture? You get the message even if you don't go through their search engine. How can Google control other sites?

[Humminn55]

Saw the warning earlier today, too. Hacked ad server really screwing with AT over there.

3rd party ads got hacked actually, not Anandtech per say.

If you're going to use per se, spell it correctly at least.

[BrowncoatGR]

So how does Google fit in this picture? You get the message even if you don't go through their search engine. How can Google control other sites?

It can't. Chrome actually always searches google, even if you enter the http address of the site.

[Sam_oslo]

It attempts to install a spoof antivirus program called "antivirus soft" which is a trojan rehash of "antivirus live" auto installer. It blocks most run32dll executions with an error message and trys to get you to buy the software via pop-ups. It also will attempt a fake virus scan. If you really got something a "antivirus soft" virus scanner would pop up, and you would be unable to use most programs. IE would take you to their purchase page

I have seen the exact same fake virus scan attempt while using IE on a couple of other sites, including trustedreviews.com and photographyblog.com. It is not there all the time, but pops up sometimes. I guess one of the tech ad-servers is infected.
It stops by ALF F4 if you are really fast, but one time I didn't see it and it could deliver a virus that MS security essential could catch and clean.
I'm not sure if anandtechis is compromised by the same virus, (and I don't want to go there to find out ) , but it sounds similar.

[onex]

So how does Google fit in this picture? You get the message even if you don't go through their search engine. How can Google control other sites?

it's going through G servers when there is a request for the site.

Of the 1101 pages we tested on the site over the past 90 days, 86 page(s) resulted in malicious software being downloaded and installed without user consent. The last time Google visited this site was on 2010-03-27, and the last time suspicious content was found on this site was on 2010-03-27.

now have a look at what has happened during the last few hours.
after receiving suspicious information from the site, G analysis apparently emulate a series of test on different pages to get a view of the site's malicious behavior.
it probably goes over pages with background daemon searching for destructive code

E: sorry, missed earlier posts.

[Eson]

It can't. Chrome actually always searches google, even if you enter the http address of the site.

I use Firefox, but Ive seen screens like this when i follow links from a site.

[noroger]

Right click on Sanboxie -> Chrome -> Delete Contents.
I still don't know why everyone isn't using Sandboxie