Malaware / viruses in popups

[Fumin]

For the last couple weeks I've been having an issue with one part of this site more and more frequently.

My virus scanner has repeatedly blocked all parts of warcraftpets due to the antivirus flagging it for transmitting malicious software. It has also on more than one occasion over the last couple of days attempted to trick me into installing a malaware virus posing as a windows security system. A simple google search showed that these virus's originate from popups and advertisements that appear within this website.

While I completely understand the need to allow popups and ads on the website to help sustain it, I would like to bring this issue to the attention of the moderators. I would hate to see potential keyloggers work their way into the site via the above mentioned methods. Is there any way for the site administrator to limit or filter what kind of advertisements are allowed on this site? So far I haven't had my system damaged, but I'm sure there are people out there that have more vulnerable systems then mine.

Thanks for taking the time to read this.

Fumin

[Breanni]

I'm not aware of any particular advertisement causing these kinds of alerts. But if you're noticing ANYTHING that's being flagged by your antivirus, we need to know the specifics in order to do anything about it.

Note that it wouldn't be one of the WoWTCGLoot ads -- those are clean. But it may be an ad being randomly served up by one of our ad networks, in which case we need to know what the ad is for in order to have it blocked. So please take the following steps:

1. Take a screenshot of the popup and/or ads at the top of the site and in the sidebar.

2. Post that screenshot in this thread.

[Fumin]

Will do, the occurenances have been irregular. I'll do my best to document it the next time it happens.

For reference my anti virus software is McAfee Security Center.

Fumin

[Guest]

Will do, the occurenances have been irregular. I'll do my best to document it the next time it happens.

For reference my anti virus software is McAfee Security Center.

Fumin

Hello Furmin,
I have the same problems, I tried yesterday to give a reaction on this,
but my attribution was ignored for some unknown reason. I have documented
these pop-ups.
The problem:
if you hit the login button of this site, you are immediately redirected to unknown game sites
with names like Warfare or Forge of Empires.
I made screenshots of these sites and documented the links. If anybody is interested, I can send these.
Agrith

[Breanni]

I made screenshots of these sites and documented the links. If anybody is interested, I can send these.
Agrith

Yes, please post those screenshots here.

For anyone else running into issues along these lines, we've spoken with our ad network and they require the campaignID of the delinquent ads. Please take a few moments to get that ID and send it to us:

1) Start up an inspector tool
- For chrome this is developer tools. It can be activated by hitting f12, ctrl+shift+i, or clicking the settings menu in the upper right, clicking tools and selecting developer tools.
- For firefox hit f12 or, if you have the firebug addon, click the icon.
- For IE hit f12.

2) While in your inspector tool, hit ctrl+f (in chrome) and type campaignid the search field that pops up.
- In firebug there is a default search field.

3) There will likely be a few results for your campaignid search. For each result, hover your mouse over the line of code until you find one that pops up a icon over the offending creative that reads "0 px x 0 px".

4) Once you've completed step 3 to ensure you're inspecting the correct ad, right click on the highlighted line of code and select "copy as HTML".

5) Paste the copied HTML into a text document or email and send it over to admin{at}warcraftpets.com with the subject line "Bad Ad - CampaignID".

We really appreciate your help in this matter.

[Guest]

I made screenshots of these sites and documented the links. If anybody is interested, I can send these.
Agrith

Yes, please post those screenshots here.

OK, here they are. In the text file you will find the links, accompanied by 3 screenshots.

[Zíra]

Hi.

I have to write this from my android cell phone, because on my pc with chrome or firefox i can't manage to come across this damn ad popup... it tells me i have to install a new player (designed as the adobe flash site) on download.adodoc.com... my virus scanner report this as malware. Even on my cellphone an ad pops up recently wanting to install an "important" app...

I know that you need those ad's for reducing the costs of the site, but at the moment those ad's are a big problem.

[Breanni]

I'm terribly sorry about the number of problematic ads being served up by our site. We've contacted our ad network. If they don't resolve these issues soon, we will begin to hunt down another ad network. You guys shouldn't have to deal with these headaches.

[Zíra]

Hi Breanni,

so far it works flawless. No ad pops up on my pc and on my cell phone.
But i can only speak for a german ip and for those ip directed ad.

Many thanks for this!

[Breanni]

I contacted or ad group rep and she assured me that the suspect campaigns would be switched off.

Please let us know if you come across any ads that cause any problems.

[Guest]

This is still happening just so you're aware:

I just (13/03/14 22:39 GMT) received a chrome warning about a phishing attempt from one of the ads: Didn't see the advert myself as chrome was much faster at blocking it than I was at looking.

I've spent about 15 mins following your instructions trying to work out which campaignid it was and ended up losing the page in the process, so can't tell you what it was sorry


Edit:

However, chrome now refuses to load the advert below (just a blank grey box instead)

lwp_parent_ad_id=17246;
if(typeof ljt_beacon_vals==="undefined"){ljt_beacon_vals=[];}
ljt_beacon_vals[128834]="bannerid=17246&campaignid=1085";
if((typeof(LJT_bCInfo)!=="undefined")&&(typeof(LJT_bCInfo[128834])!=="undefined")){ljt_beacon_vals[128834]+=LJT_bCInfo[128834];}

[Guest]

Edit: Just received another malware advert, this time attempting to pretend to be a java update (the URL it managed to redirect me to - away from warcraftpets.com was clearly fake. Something like http://java2012.com/)