Hijacked

kathycf · Post by **kathycf** » Thu Mar 29, 2007 9:34 am

Forgive this post if this issue has already been brought up. While browsing the forum just now, I went to check my PMs. My browser was hijacked and immediately brought to some "scan your computer site" and I had to shut down my browser to escape. This is the third time it has happened, so I figured I would report it. I understand the necessity of ads, but this is far too aggressive and I don't like it. My anti-virus scanner reported it as ad-ware and it starts a download without one even consenting to that.

Gosh, I feel stupid because I tried getting the address of the site, but apparently didn't. I get startled pretty easily and the virus scanner makes a loud noise when it detects threats and I got very rattled trying to shut that off and get away from the adware site. I will report the name of this site if (when) it happens again. Thanks.

Siberys · Post by **Siberys** » Thu Mar 29, 2007 9:39 am

It hasn't been brought up on the forums, but I've experienced this before and shown it to Buck.

I dunno what's causing it, but I have noticed that I only get it on gamebanshee.

kathycf · Post by **kathycf** » Thu Mar 29, 2007 9:55 am

Ok, thank you.

I too, have only had this happen to me on this site. As I say, this goes beyond advertising.

fable · Post by **fable** » Thu Mar 29, 2007 10:25 am

Kathycf, please send on a PM to Buck about it, with any details you can provide.

galraen · Post by **galraen** » Thu Mar 29, 2007 11:52 am

I've had that happen to me a few times lately, but only when accessing my E-Mail account, which has recently been transferred to AOL (Abomination On Line as I call it, and no not as a bash on America!). I've now opened another account elsewhere. Problem sorted.

kathycf · Post by **kathycf** » Thu Mar 29, 2007 12:06 pm

Well, I know what you mean about general hijacking, galrean, but this is a bit different. I am referring to a site that has hijacked my browser only when I have been reading and browsing at GameBanshee. For example, I was in the DL forum earlier today and went to check my PM box, and wham, was instantly transported to some weird "scan your computer for spyware" site. This is the third time that this has happened and always to this particular "scan" site and always while browsing GameBanshee.

Again, in all the confusion I experienced I did not make a note of the website address. I had my browser set to delete history when I close it, so that doesn't help me either. I changed that setting so if or when this happens again, I will be able to provide more information. (*note to self, don't panic!*) :laugh:

Thanks again, everybody.

Tricky · Post by **Tricky** » Thu Mar 29, 2007 12:10 pm

When they get that annoying, I'll usually block the source with Firefox's [url="http://adblock.mozdev.org/"]Adblock[/url] extension. Works rather well.

I've been hearing a lot about [url="http://www.projectwonderful.com/"]Project Wonderful[/url] lately. Might provide BG a good alternative to the current crop?

Xandax · Post by **Xandax** » Thu Mar 29, 2007 1:44 pm

kathycf wrote:Well, I know what you mean about general hijacking, galrean, but this is a bit different. I am referring to a site that has hijacked my browser only when I have been reading and browsing at GameBanshee. For example, I was in the DL forum earlier today and went to check my PM box, and wham, was instantly transported to some weird "scan your computer for spyware" site. This is the third time that this has happened and always to this particular "scan" site and always while browsing GameBanshee.

Again, in all the confusion I experienced I did not make a note of the website address. I had my browser set to delete history when I close it, so that doesn't help me either. I changed that setting so if or when this happens again, I will be able to provide more information. (*note to self, don't panic!*) :laugh:

Thanks again, everybody.

The problem is that advertisements are rotated by a third part service, so Buck has little direct control (other then complaining) towards the adds, save of canceling the agreement.
Also because adds are based on localization, it will be difficult to provide much information from Buck to the advertisement company without concrete informations.
So if you experience it again, then make sure you note what advertisement did it, and what the site you got redirected to. This will make it possible for Buck to take it further to the advertisement company.

Also it is easy for a less-then-honest company to get into the rotation and then cause some problems before getting kicked out, especially if it is difficult to pinpoint a culprit. It is very bad etiquette, but these companies do use dirty tactics.

Post by **BuckGB** » Thu Mar 29, 2007 2:32 pm

Thanks for pointing this out. I just sent UGO an email about the problem, so hopefully they'll be investigating this yet today. You shouldn't ever be prompted to download or install any software (aside from maybe Flash or Adobe Reader) while browsing GameBanshee.

Like Xandax said, the more information you can provide about the ad, the better. It's most likely a country- or region-specific ad that shouldn't be in our rotation.

Fiberfar · Post by **Fiberfar** » Thu Mar 29, 2007 2:59 pm

Starts to download?

Could be a rogue security program?
Those use a javascript of some kind, and in some devilish manner manage to bypass the popup-blockers.

I was reading about them, and they usually pop up on pages that uses adverts.

kathycf · Post by **kathycf** » Thu Mar 29, 2007 3:15 pm

Ok, the actual download didn't happen until after the hijacking had taken place...

Here is what happened:
1.) I went to check my PMs here
2.) Immediatly hijacked to another site, offering a spyware scan
3.) As I click windows closed to get away from this other site, doing so somehow prompts a download of whatever software they use to "scan" with.

All of which strikes me as somewhat ironic for a website that hijacks me and rather forcibly offers to scan my computer for spyware...the means by which they do their "scanning" sets off my anti-virus software with an alarm about adware/spyware. I was able to stop the download because of my anti-virus program.

My apologies again for not getting their name and address. I just got so flustered by the whole thing, and I felt I had to say something about it. By the time I realized I didn't have the address, it was too late. If this happens again, I will try to remain calm and get the name and website url of this company.

Siberys · Post by **Siberys** » Thu Mar 29, 2007 3:49 pm

kathycf wrote:Ok, the actual download didn't happen until after the hijacking had taken place...

Here is what happened:
1.) I went to check my PMs here
2.) Immediatly hijacked to another site, offering a spyware scan
3.) As I click windows closed to get away from this other site, doing so somehow prompts a download of whatever software they use to "scan" with.

All of which strikes me as somewhat ironic for a website that hijacks me and rather forcibly offers to scan my computer for spyware...the means by which they do their "scanning" sets off my anti-virus software with an alarm about adware/spyware. I was able to stop the download because of my anti-virus program.

My apologies again for not getting their name and address. I just got so flustered by the whole thing, and I felt I had to say something about it. By the time I realized I didn't have the address, it was too late. If this happens again, I will try to remain calm and get the name and website url of this company.

No worries, as I said, I've had this problem before myself as well, and I have the site and information needed.

http://i15.photobucket.com/albums/a368/ ... BVirus.jpg

Xandax · Post by **Xandax** » Fri Mar 30, 2007 12:31 am

kathycf wrote:Ok, the actual download didn't happen until after the hijacking had taken place...

Here is what happened:
1.) I went to check my PMs here
2.) Immediatly hijacked to another site, offering a spyware scan
3.) As I click windows closed to get away from this other site, doing so somehow prompts a download of whatever software they use to "scan" with.

All of which strikes me as somewhat ironic for a website that hijacks me and rather forcibly offers to scan my computer for spyware...the means by which they do their "scanning" sets off my anti-virus software with an alarm about adware/spyware. I was able to stop the download because of my anti-virus program.
<snip>

That technique is common one for some of the less then honest sites out there. Pressing close on a pop up/window will prompt a download, which of course should always be canceled.

kathycf · Post by **kathycf** » Fri Mar 30, 2007 12:53 pm

That picture that Siberys posted seems to be the site in question, as far as I can tell. Thank you for posting that.

kathycf · Post by **kathycf** » Mon Apr 02, 2007 6:41 pm

Ok, I was browsing through the Neverwinter Nights forum and the same thing happened again. I was here, and then without my consent or even me doing anything I was brought to this website.

DriveCleaner 2006 - Home

This is what computer security people at Symantec say about this website and it's application that they keep trying to force on people.

DriveCleaner
Updated: February 13, 2007 11:50:30 AM
Type: Other
Version: 1.10.19.0
Publisher: Drive Cleaner, Inc
Risk Impact: Medium
File Names: installdrivecleanerstart.exe UDC2006.exe UDCPChk.dll UDCShell.dll
Systems Affected: Windows 2000, Windows 95, Windows 98, Windows CE, Windows Me, Windows NT, Windows Server 2003, Windows XP
SUMMARY
Behavior

DriveCleaner is a misleading application, which gives exaggerated reports of security and privacy risks on a computer. The program then prompts the user to purchase a registered version of the software in order to remove the reported risks.

Lady Dragonfly · Post by **Lady Dragonfly** » Mon Apr 02, 2007 8:41 pm

I have bad experience too... even 5 min ago when I attempted to open GB FORUMS page I was attacked by a similar website TWICE.

kathycf · Post by **kathycf** » Mon Apr 02, 2007 10:08 pm

OK, I hate to seem like a pain in the neck about this, but it happened again. This time to a site called "ErrorSafe" (ErrorSafe - Fix computer problem. Fix slow computer, corrupt file and hard drive errors.) Since a picture can be worth a 1000 words here are some screenshots.

In the first you can see by the address bar that I was browsing the SYM forum. So between the site that Siberys posted a screen of, the one I mentioned previously plus this one just now we have three. I am not sure which one Lady Dragonfly encountered, hopefully it was one of these three and not yet another.

I understand that these sites go into a rotation, and there may not always be direct control over their actions. However, I have to say, it seems counter productive to have advertisers here on the site that whisk members AWAY from here. It is also disconcerting to say the least.

Thanks for reading this, anyway.