Dodgy ad banners?

Noone here uses AdBlock or NoScript?

If they do block ads, they’re courteous enough not to brag about it here.

Actually many people do brag about it.

Disabling Java from Firefox seems to be the best workaround for now.

As of a few seconds ago, Chrome won’t load quartertothree.com without clicking a checkbox saying I understand that the site appears to contain malware. Whoever currently hosts qt3 needs to get this taken care of.

Yep, this suddenly popped up for me. Chrome now identifies QT3 as a malware site.

It’s possible something has infected the board software itself and is occasionally replacing the scripting that pulls in Google ads with its own redirection, but I haven’t caught anything like that in the page source yet – it’s always still listed pagead2.googlesyndication.com.

<!--
google_ad_client = "pub-5008003621943549";
/* 728x90, created 7/7/08 */
google_ad_slot = "8596948173";
google_ad_width = 728;
google_ad_height = 90;
//-->

Dunno if that helps squelch it or not – can Tom/stusser tell Google to blacklist a given ad client? (assuming it’s coming from an ad client, that is)

In any event, I’ve turned my ad blocker back on for QT3 for the time being.

I’m getting it here periodically too; if that means my machine is trojaned, it’s gotta be a pretty devious trojan, as I’m running firefox on Ubuntu :)

Lovely, google is calling Qt3 a malware site due to their own ads.

Also if the machine is already trojaned, what would be the point of having it run an installer to install another trojan?

Can Qt3 just do a ban on anything from google-adsense.com or whatever the link is, since that is absolutely not the actual google address?

If this can get taken care of sooner, rather than later…

Who are the admins for Qt3 nowadays anyway? I know Tom deals with a lot of stuff, but isn’t someone else dealing with the hosting and optimization?

stusser?

Opera tells me a java applet wants to run, but gives me the option to reject it. I wonder if it’s that downadup trojan in the news at the moment.

I just help out with the tech side. I (and I assume everybody else) already sent him a PM, nothing we can do until he checks them out.

Do not accept any java or security alerts.

And I wouldn’t begin to know how to check out individual ads. I’m not even sure from the posts what exactly is going on. There’s an ad trying to something malicious via Java that’s specific to Qt3? Is it this issue?

If someone can post more specific information that I need to pass along to Google, I’ll do so. I’m trying to figure out how to simply switch ads off, but I don’t see any way to do that. Anyone know if this is possible?

Finally, if you’re blocking ads, please don’t come to Qt3. We have a single banner ad that barely pays for the cost of the servers. The least you can do to support the forum by letting it load.

-Tom

I had the problem for awhile this morning but then it stopped. It was happening in Firefox and Chrome. Not sure what made it stop since I never allowed it to run.

You know, why don’t you just set up a paypal donation / subscription service? Morn did this over at planetcrap and made a reasonable amount of money (I think, he at least made a bunch off me) off a bunch of misanthropic philistines. Surely you can cover servers that way as well?

Yes, that is the issue in question.

The symptom is that upon loading a page, instead of an ad banner appearing you get a prompt that asks you if you want to allow an unverified Java app to run (see shang’s screenshot above). This is rather suspicious behaviour, because it’s attempting to impersonate a Google URL (the WHOIS data for google-adservice.com is foreign and anonymized), an advertising Java app should certainly be signed properly, and Java is a known vector for certain types of malware infections.

It’s connected to the Google ads by the ad banner iframe at the time also coming from google-adservice.com, and it loads some obfuscated Javascript, which is even more suspicious.

And yes, it’s that incident, as that’s my post about it on the AdSense forum. ;) I haven’t seen it occur for at least a few hours now, even though I want it to as I now have the Mozilla developer tools installed so I could capture the full generated page source…

I’m trying to figure out how to simply switch ads off, but I don’t see any way to do that. Anyone know if this is possible?

It’s possible, as chet was able to do so, but I don’t know how. You have to do it through Google’s AdSense pages, I’d guess, not through the forum software.