Malaware / viruses in popups

Report bugs and share your ideas to improve WarcraftPets.
Post Reply
User avatar
Fumin
Posts:117
Joined:August 9th, 2013
Pet Score:8641
Realm:Shattered Hand-us
Contact:
Malaware / viruses in popups

Post by Fumin » January 29th, 2014, 10:10 pm

For the last couple weeks I've been having an issue with one part of this site more and more frequently.

My virus scanner has repeatedly blocked all parts of warcraftpets due to the antivirus flagging it for transmitting malicious software. It has also on more than one occasion over the last couple of days attempted to trick me into installing a malaware virus posing as a windows security system. A simple google search showed that these virus's originate from popups and advertisements that appear within this website.

While I completely understand the need to allow popups and ads on the website to help sustain it, I would like to bring this issue to the attention of the moderators. I would hate to see potential keyloggers work their way into the site via the above mentioned methods. Is there any way for the site administrator to limit or filter what kind of advertisements are allowed on this site? So far I haven't had my system damaged, but I'm sure there are people out there that have more vulnerable systems then mine.

Thanks for taking the time to read this.

Fumin

User avatar
Breanni
Site Admin
Posts:474
Joined:December 1st, 2007
Pet Score:1499
Realm:Scarlet Crusade-us
Contact:

Re: Malaware / viruses in popups

Post by Breanni » February 2nd, 2014, 12:31 pm

I'm not aware of any particular advertisement causing these kinds of alerts. But if you're noticing ANYTHING that's being flagged by your antivirus, we need to know the specifics in order to do anything about it.

Note that it wouldn't be one of the WoWTCGLoot ads -- those are clean. But it may be an ad being randomly served up by one of our ad networks, in which case we need to know what the ad is for in order to have it blocked. So please take the following steps:

1. Take a screenshot of the popup and/or ads at the top of the site and in the sidebar.

2. Post that screenshot in this thread.
Image

User avatar
Fumin
Posts:117
Joined:August 9th, 2013
Pet Score:8641
Realm:Shattered Hand-us
Contact:

Re: Malaware / viruses in popups

Post by Fumin » February 5th, 2014, 10:33 pm

Will do, the occurenances have been irregular. I'll do my best to document it the next time it happens.

For reference my anti virus software is McAfee Security Center.

Fumin

Guest
Contact:

Re: Malaware / viruses in popups

Post by Guest » February 10th, 2014, 4:35 pm

Fumin wrote:Will do, the occurenances have been irregular. I'll do my best to document it the next time it happens.

For reference my anti virus software is McAfee Security Center.

Fumin
Hello Furmin,
I have the same problems, I tried yesterday to give a reaction on this,
but my attribution was ignored for some unknown reason. I have documented
these pop-ups.
The problem:
if you hit the login button of this site, you are immediately redirected to unknown game sites
with names like Warfare or Forge of Empires.
I made screenshots of these sites and documented the links. If anybody is interested, I can send these.
Agrith

User avatar
Breanni
Site Admin
Posts:474
Joined:December 1st, 2007
Pet Score:1499
Realm:Scarlet Crusade-us
Contact:

Re: Malaware / viruses in popups

Post by Breanni » February 10th, 2014, 10:58 pm

Agrith wrote:I made screenshots of these sites and documented the links. If anybody is interested, I can send these.
Agrith
Yes, please post those screenshots here.

For anyone else running into issues along these lines, we've spoken with our ad network and they require the campaignID of the delinquent ads. Please take a few moments to get that ID and send it to us:

1) Start up an inspector tool
- For chrome this is developer tools. It can be activated by hitting f12, ctrl+shift+i, or clicking the settings menu in the upper right, clicking tools and selecting developer tools.
- For firefox hit f12 or, if you have the firebug addon, click the icon.
- For IE hit f12.

2) While in your inspector tool, hit ctrl+f (in chrome) and type campaignid the search field that pops up.
- In firebug there is a default search field.

3) There will likely be a few results for your campaignid search. For each result, hover your mouse over the line of code until you find one that pops up a icon over the offending creative that reads "0 px x 0 px".

4) Once you've completed step 3 to ensure you're inspecting the correct ad, right click on the highlighted line of code and select "copy as HTML".

5) Paste the copied HTML into a text document or email and send it over to admin{at}warcraftpets.com with the subject line "Bad Ad - CampaignID".

We really appreciate your help in this matter.
Image

Guest
Contact:

Re: Malaware / viruses in popups

Post by Guest » February 11th, 2014, 9:52 am

Breanni wrote:
Agrith wrote:I made screenshots of these sites and documented the links. If anybody is interested, I can send these.
Agrith
Yes, please post those screenshots here.

OK, here they are. In the text file you will find the links, accompanied by 3 screenshots.

User avatar
Zíra
MVP
Posts:43
Joined:July 30th, 2012
Pet Score:10596
BattleTag®:Ziradon#2550
Realm:Arygos-eu
Contact:

Re: Malaware / viruses in popups

Post by Zíra » February 12th, 2014, 4:10 am

Hi.

I have to write this from my android cell phone, because on my pc with chrome or firefox i can't manage to come across this damn ad popup... it tells me i have to install a new player (designed as the adobe flash site) on download.adodoc.com... my virus scanner report this as malware. Even on my cellphone an ad pops up recently wanting to install an "important" app...

I know that you need those ad's for reducing the costs of the site, but at the moment those ad's are a big problem.
Image

User avatar
Breanni
Site Admin
Posts:474
Joined:December 1st, 2007
Pet Score:1499
Realm:Scarlet Crusade-us
Contact:

Re: Malaware / viruses in popups

Post by Breanni » February 12th, 2014, 3:16 pm

I'm terribly sorry about the number of problematic ads being served up by our site. We've contacted our ad network. If they don't resolve these issues soon, we will begin to hunt down another ad network. You guys shouldn't have to deal with these headaches.
Image

User avatar
Zíra
MVP
Posts:43
Joined:July 30th, 2012
Pet Score:10596
BattleTag®:Ziradon#2550
Realm:Arygos-eu
Contact:

Re: Malaware / viruses in popups

Post by Zíra » February 13th, 2014, 4:14 am

Hi Breanni,

so far it works flawless. No ad pops up on my pc and on my cell phone.
But i can only speak for a german ip and for those ip directed ad.

Many thanks for this! :D
Image

User avatar
Breanni
Site Admin
Posts:474
Joined:December 1st, 2007
Pet Score:1499
Realm:Scarlet Crusade-us
Contact:

Re: Malaware / viruses in popups

Post by Breanni » February 13th, 2014, 7:43 am

I contacted or ad group rep and she assured me that the suspect campaigns would be switched off.

Please let us know if you come across any ads that cause any problems.
Image

Guest
Contact:

Re: Malaware / viruses in popups

Post by Guest » March 13th, 2014, 5:42 pm

This is still happening just so you're aware:

I just (13/03/14 22:39 GMT) received a chrome warning about a phishing attempt from one of the ads: Didn't see the advert myself as chrome was much faster at blocking it than I was at looking.

I've spent about 15 mins following your instructions trying to work out which campaignid it was and ended up losing the page in the process, so can't tell you what it was sorry :(


Edit:

However, chrome now refuses to load the advert below (just a blank grey box instead)

lwp_parent_ad_id=17246;
if(typeof ljt_beacon_vals==="undefined"){ljt_beacon_vals=[];}
ljt_beacon_vals[128834]="bannerid=17246&campaignid=1085";
if((typeof(LJT_bCInfo)!=="undefined")&&(typeof(LJT_bCInfo[128834])!=="undefined")){ljt_beacon_vals[128834]+=LJT_bCInfo[128834];}

Guest
Contact:

Re: Malaware / viruses in popups

Post by Guest » March 13th, 2014, 6:14 pm

Edit: Just received another malware advert, this time attempting to pretend to be a java update (the URL it managed to redirect me to - away from warcraftpets.com was clearly fake. Something like http://java2012.com/)

Post Reply