Download warning

[AtomicCEO]

On the forums, something is trying to launch through Adobe Reader again. No other websites open, and this is a brand new laptop running anti-virus and Google Chrome.

 

Last time this problem came up, it would crash Firefox constantly or launch a mysterious Adobe file.

[AtomicCEO]

Seemed to happen when an ad was trying to load.

[WJW]

This is likely not a virus but some rouge banner that's wanting to display a pdf file. If you can identify what banner or URL that was downloading at that time it would be helpful. We've received no other notifications of this happening and there are thousands of possible display banners. So troubleshooting will be difficult. Thanks.

[ts]

Not that it helps in the identification process any, but I had this happen earlier today (maybe around 11am ET) when accessing a topic, don't recall which ... Firefox crashed to the desktop ... re-launch and all was well, so I didn't think about it further until I saw this thread ... but if nothing else, it possibly confirms what Atomic reported.

Edited November 28, 2009 by ts

[WJW]

Thanks ts. After looking into this some it does appear to be just a momentary rouge banner that caused the problem earlier today. There is no indication that anything exists in the forum software or on the forum server that would cause any of these type of issues.

[AtomicCEO]

If you're keeping track, this problem totally crushed my week-old brand new laptop. Next boot was a total failure, and I can't figure out how to fix it. I'm booted from a CD right now.

 

Are you giving out free memberships to users to lose all their data?

[Azazello1313]

If you're keeping track, this problem totally crushed my week-old brand new laptop. Next boot was a total failure, and I can't figure out how to fix it. I'm booted from a CD right now.

 

Are you giving out free memberships to users to lose all their data?

 

clearly user error, there are no problems here.

[kennslp]

I CANNOT say for sure that it was this site, as I had other open windows at the time. But at around 11: 50 AM EST I had a spyware/malware issue suddenly pop up. I had JUST clicked to submit a reply to a thread. I've cleaned it up, but I think there may be an issue with an ad on the site somewhere.

[gilthorp]

Forefront just caught something on my laptop as well...not good fellas.

[WJW]

This is still being looked into, but it appears that the problem was limited to a very small piece of our ad serving puzzle. The ad tags were removed from the site as soon as we became aware of the issue this morning and won't be re-installed until the issue is resolved.

[i_am_the_swammi]

This is still being looked into, but it appears that the problem was limited to a very small piece of our ad serving puzzle. The ad tags were removed from the site as soon as we became aware of the issue this morning and won't be re-installed until the issue is resolved.

 

You must have re-installed them before they were fixed. Last night, I got this message pop-up from my virus protection software:

 

exploit: win32/shellcode.A

 

I googled it, and clicked my way thru an IT message board that defined it:

 

Exploit

Description:

This program is dangerous and exploits the computer on which it is run.

Advice:

Remove this software immediately.

View more information online about this threat

Resources:

file:

<path removed>\sNode[1].htm->(SCRIPT0000)->(EmbeddedCode)

 

The moderator of that forum then offered this advice:

 

Yea, unfortunately that's the problem with using banner ads (well, any ads) the ad agencies don't try very hard to keep the bad ones out, it's up to the person allowing the agency to put ads on their page to disallow ads on a case-by-case basis, and of the consumer to keep their flash up to date . download the latest edition of Adobe Flash (should be version 10).....http://get.adobe.com/flashplayer/

 

FWIW, Microsoft Encyclopedia offered this definition:

 

Technical Information (Analysis)

 

Exploit:Win32/ShellCode.A is a generic detection for script objects that construct shellcodes. These scripts may be embedded within other types of documents, for example, specially-crafted PDF files.

 

The resulting shellcode may be executed by this script, other scripts, or when a software vulnerability is exploited.

 

The detection for Exploit:Win32/ShellCode.A may be triggered on malformed documents containing exploit code or when visiting compromised or malicious Web pages.

 

Certainly appears your advertisier is doing its best to allow rogue banner ads to be placed on the Huddle, compromising the security of your customers.

[WJW]

We had a lengthy conference call with the gatekeeper of all the remnant ad sources yesterday and after discussions and assurances we did indeed reinstall some of the ad tags to test it out. They ran without issue for several hours but it appears the problem did pop up again later in the evening. So the ads were immediately pulled again.

 

Thanks for the info swammi. These kind of specifics about the user's issues is helpful. What is of greatest use is a screen print showing the banners possibly being displayed when the initial problem or warning happens.