PDA

View Full Version : Tracking Down a Virus

gophergas
10-17-2006, 03:07 AM
I'm fairly sure that one of the ad networks I'm using is sending out a virus. My Norton autoprotect is showing three actions (although it might all be from the same thing): Trojan.Ducky.B (or Bloodhound.Exploit.56) is showing a "Repair Failed" and "Access Denied" -- and then Downloader is "Automatically Deleted." This is the third time I've had this problem, but I don't know where it's coming from.

I'm presently using Casale, Valueclick, and RealCastMedia in my daisy chain. I know Valueclick has previously had problems with viruses embedded in their ads; have any of you experienced problems like this recently? If so, what ads are causing it?

Thanks.
-Gopher
Tyler
11-13-2006, 04:19 AM
I haven't Gopher. If I had to choose from one of those three though I'd pick RealCastMedia, simply because I've never heard of it before.

Are you running any 'rich' media ads, or just regular banners?
gophergas
11-13-2006, 06:25 AM
Well, I did find the actual source of the virus, but I don't know which network served it. I sent the offending ad to all of my main networks, and I tracked down the IP address owner and sent them a note. Haven't seen the virus in a little while, so maybe they've fixed it.

The banners vary. Most of them are straight banners, but a few are pointrolls. I do stay away from auto-audio ads, though.
aloksingh
01-16-2007, 05:38 AM
Never heard of viruses being served in banners. Hope this will not become a big problem in the future.
Arthur07
03-27-2007, 11:01 AM
Never heard of viruses being served in banners. Hope this will not become a big problem in the future.

Me neither, it depends though, for example if your including a script it would be fairly easy to tweak the script at the other end to included some form of download.

Of course no serious advertising agency would allow this to happen.
Submerge
03-27-2007, 01:05 PM
Maybe it was you AV acting up?
Arthur07
03-27-2007, 01:10 PM
Do you have any frames on your website??? That are reliant on other websites? If so they are worth investigating.
masm50
03-31-2007, 04:52 AM
Viruses can be served through ads just like anything else just like any webpage.
Most are caught in the vetting process of the ad networks, but some 'advertisers' are not reputable and when serving ads via third parties slip in some virus or trojan code.

Most networks have been caught out at some point, but it is rare especially with the top tier networks such as Valueclick, Casale, Burst etc...

I would agree that RealCast are the most likely culprit out of your list as they are the smallest company and I imagine use lower rate advertisers than the other two.

-Tim
Submerge
03-31-2007, 11:51 AM
Ad networks don't filter out their advertisers advertisements? You think they would catch this, unless they are a shady company.
carbonscripts
03-31-2007, 01:30 PM
Ad networks don't filter out their advertisers advertisements? You think they would catch this, unless they are a shady company.

This happen on myspace, pretty old news though
http://blog.washingtonpost.com/securityfix/2006/07/myspace_ad_served_adware_to_mo.html

Guess myspace is one shady company (although we already knew that)
Submerge
03-31-2007, 05:01 PM
This happen on myspace, pretty old news though
http://blog.washingtonpost.com/securityfix/2006/07/myspace_ad_served_adware_to_mo.html

Guess myspace is one shady company (although we already knew that)

I never heard of this news, but it is very interesting. You would think they would stop this. But with MySpace being an adult site prior, it isn't anything stunning from what I've heard before.