[uday]

Jan, Robert, Claus

I've turned off ads on your usernames. But I'd still like to know where they came from.


Our ad network guy says "Not us" (valueclick)
We know it is not "us" (bbo)
Your spyware checkers say "not us" (your pc)

What I'd like to do, if you don't mind, is run some tests

This is the URL that we embed when showing ads in the lobby
http://online.bridge.../location1.html

It shows an ad from valueclick, sleeps 2 minutes, then does it again.

Would you mind running that URL in an IE instance and seeing if the obnoxious popup happens again when it is just IE and the ad working together?

We know that the popup seems to target non-english (or perhaps non-us) pcs.

BTW, this is only an obnoxious popup. As with all random popups from ads, you shouldn't accept/download/install. The problem we're trying to solve is how to find the source of the popups.


My current guesses as to popup source

1. ad network is delivering popup (inadvertently bec. they say they arent doing it on purpose, or, rather unlikely, maliciously)
2. something is replacing the ad network ads with these ads. could be malicious software on the PC or at the ISP or a proxy server.

But we'll see.

[inquiry]

I have never seen this ad.. I clicked the link in udays post 58 times on three seperate trials and never got one.. When I get 59 IE windows open, it will not open a 60th one (dicovery doing this test). Don't know if that helps any, but I am in the US... and it seems uday knows we don't get the ad....

[csdenmark]

uday, on Nov 17 2006, 05:54 PM, said:

Jan, Robert, Claus

I've turned off ads on your usernames. But I'd still like to know where they came from.


Our ad network guy says "Not us"  (valueclick)
We know it is not "us" (bbo)
Your spyware checkers say "not us" (your pc)

What I'd like to do, if you don't mind, is run some tests

This is the URL that we embed when showing ads in the lobby
http://online.bridge.../location1.html

It shows an ad from valueclick, sleeps 2 minutes, then does it again.

Would you mind running that URL in an IE instance and seeing if the obnoxious popup happens again when it is just IE and the ad working together?

We know that the popup seems to target non-english (or perhaps non-us) pcs.

BTW, this is only an obnoxious popup. As with all random popups from ads, you shouldn't accept/download/install.  The problem we're trying to solve is how to find the source of the popups.


My current guesses as to popup source

1. ad network is delivering popup (inadvertently bec. they say they arent doing it on purpose, or, rather unlikely, maliciously)
2. something is replacing the ad network ads with these ads. could be malicious software on the PC or at the ISP or a proxy server.

But we'll see.

Uday you dont need to do anything special to my used ID. I care very little about commercials and I think I have fairly good proctection levels.

I clicked your link. It opened in a new window, not in a tab-window. There were some text from World Bridge - 15 seconds or so - then text came again. After 3-4 times it changed to ACBL text.

Oh - if it is targetting non-english I may not be good for testing as I use IE7 downloaded in USA and english version. I have just read today that it will take approx. 3 months until all local versions of IE7 will be aut. distributed.

From what I read from help-topic about pop-up blockers it ought to display a message bar if a site has been blocked. I think it is therefore likely that nothing has tried to pop-up by me here.

Nothing else happened.

[uday]

Could you try this URL in IE and see if it produces ads ?


http://online.bridge.../location2.html

This is something I wrote, and all it does is cycle between a couple of BBO ads.

if running *this* one in IE produces a popup for that weird product, then would be very interesting data (since this one doesnt involve the ad network at all)

This other URL DOES use the ad network

http://online.bridge.../location1.html

What i'd love to know is how each one behaves, independent of the other

Thanks for the help ..

U

[geller]

BINGO! I ran both of them at the same time. One of them (it seems to be Location 1) produces the obnoxious popups for DriveCleaner (basically the same ones as before). I just killed it. I'll let location 2 run for a few more min to confirm it's OK (i.e., no popups), then I'll kill it and run location 1 only to confirm that location 1 is the culprit.

[csdenmark]

uday, on Nov 17 2006, 10:43 PM, said:

Could you try this URL in IE and see if it produces ads ?


http://online.bridge.../location2.html

This is something I wrote, and all it does is cycle between a couple of BBO ads.

if running *this* one in IE produces a popup for that weird product, then would be very interesting data (since this one doesnt involve the ad network at all)

This other URL DOES use the ad network

http://online.bridge.../location1.html

What i'd love to know is how each one behaves, independent of the other

Thanks for the help ..

U

http://online.bridge.../location2.html
This one produces nothing but text cyclus.

http://online.bridge.../location1.html
This one did the same but once I was lucky Drivecleaner commercial turned up. Then nothing more happened. No message of any kind of blocking.

As the Drivecleaner commercial came up I noticed a yellow triangel at the bottom of left corner. I dont know what it means as no text came up setting pointer to it.

[geller]

Confirmation: Location 1 is guilty!

[barmar]

Walddk, on Nov 17 2006, 10:17 AM, said:

Claus, must we really see the enormous ad for your web site every time you post? This is the third time in this thread. There is probably no law against it, but I am with Richard on this topic. Bad taste is the term I would use .... unless you pay for the advertisement, of course.

Roland

Do what I do -- set your forum preferences so you don't see signatures. I've never seen Claus's (apparently obnoxious, since two posters commented on it) ad.

[uday]

For the three of us who see the drivecleaner ads:

If you have another browser to try, could you try location 1 in a browser other than IE?

No one is admitting ownership of these pesky popups; it is possible that they are a symptom of malware on the victims pc. of course, our ad network rep might be wrong, and they might be sneaking past their own tests by masquerading as something else.

[jw_nl]

Uday,
I have seen the DriveCleaner ad with Firefox running immediately after starting location 1 yesterday. I stopped running Firefox then.

On my 3 PC's I have seen these DC ads many times now (20+).
Sometimes I can't see why they show up, but I think that it might be a good idea to focus on the Travelocity ad or the software that runs that ad. When that ad is starting on location1 it's almost always bingo. Unfortunately the ratio Forums, ACBL, The Bridge World, Kensington, Travelocity is about 15:15:15:1:1 so I have to wait very long sometimes before my patience is rewarded. Please change the 2 minutes per ad in a short interval or even better make a location3 next to location1 with only the Travelocity part of location1.html. I think that I will have to wait less than 2 minutes then.

On location2 I have never seen the Kensington and Travelocity ads. Comparing location1 and location2 wasn't possible sofar.

To people who like to join our DC-fanclub (3 members now): When the DC ad shows up click Cancel and then close the browser window immediately. Otherwise DC will keep you in an endless loop. Clicking Cancel / No and so on will only be followed by other DC suggestions to download DC.

By the way : I have never seen the complete Travelocity ad. At the end the ad is flickering. Is that happening only on my PC?

[geller]

Quote

If you have another browser to try, could you try location 1 in a browser other than IE?

Tried location 1 it with Mozilla Firefox for about 15 min. No popups.

Quote

No one is admitting ownership of these pesky popups; it is possible that they are a symptom of malware on the victims pc. of course, our ad network rep might be wrong, and they might be sneaking past their own tests by masquerading as something else.

I'm belaboring the obvious, but even a cursory search with google confirms that DriveCleaner is not a product with the world's greatest reputation. (Whether this is unfair to them or is an accurate reflection of reality may be debatable.) That means, to me at least, that they're starting out with two strikes against them (possibly unfairly).

All I know is (1) I'd never had DriveCleaner popups before, (2) I get driveCleaner popups now is when I'm logged onto BBO with ads enabled or when I'm accessing location 1 with IE; (3) I don't get the DriveCleaner popups now that I'm not accessing location 1 or BBO (if this ever changes I'll post it right away).

In view of the above, I think the chance that DriveCleaner is innocent is even less than the chance OJ didn't do it. Maybe I'm wrong though, but if so I'd like some hard evidence.

[csdenmark]

geller, on Nov 18 2006, 02:21 PM, said:

In view of the above, I think the chance that DriveCleaner is innocent is even less than the chance OJ didn't do it.  Maybe I'm wrong though, but if so I'd like some hard evidence.

No Drivecleaner is not innocent here. I have reported 2 serious scriptfauls by Drivecleaner and also reported that my security settings not only warns me entering but completely disables my options to do so. Therefore Drivecleaner is not harmful to me - they are in fact completely harmless.

But I would say they are some kind of fools. With solid security settings it will produce nothing for them and is pure waste of money. They simply need to look over their programming features.

[uday]

i've removed the travelocity ad. I'm unsure where to go with all this, but lets see if that helped.

[geller]

Quote

i've removed the travelocity ad. I'm unsure where to go with all this, but lets see if that helped.

I've been running location 1 using IE for two hours, with no popups. So unless I get the popups from now on when I'm not logged onto BBO or looking at "location 1" I will tentatively conclude that the Travelocity ad was the culprit.

Incidentally,
(1) Uday explained to me by email that BBO did not accept any ads from DriveCleaner (so however they popped up--now seems to me this was somehow connected to the Travelocity ad--this was not a conscious decision by BBO).
(2) There is a technique called exit popups. The Travelocity ad might have contained an exit popup script. Can someone check the HTML source code for the Travelocity ad to see if this was the case?

[jw_nl]

I have been running location1 using 8 copies of IE for 15 hours (3 PC's) .
I have been running location2 using 2 copies of IE for 15 hours (2 PC's) .

No DriveCleaner popups.

[geller]

Quote

But I would say they are some kind of fools. With solid security settings it will produce nothing for them and is pure waste of money. They simply need to look over their programming features.

The people who visit this Forum are unlikely to click on the DriveCleaner ads, let alone to install the product. But there are probably plenty of people (including some less computer-savvy BBO users) who would click on the ad and install DriveCleaner (if their business model didn't yield some customers they wouldn't still be in business). So I hope the cause of the problem can be identified and the problem can be eliminated before 4.9.9 goes into general release.

[jikl]

Quote

QUOTE 
But I would say they are some kind of fools. With solid security settings it will produce nothing for them and is pure waste of money. They simply need to look over their programming features. 

The people who visit this Forum are unlikely to click on the DriveCleaner ads, let alone to install the product. But there are probably plenty of people (including some less computer-savvy BBO users) who would click on the ad and install DriveCleaner (if their business model didn't yield some customers they wouldn't still be in business). So I hope the cause of the problem can be identified and the problem can be eliminated before 4.9.9 goes into general release.

Exactly Geller, just because it won't affect you is not the reason to not care about it. In fact that is a rather selfish position that I have seen from many people over the years.

Sean

[geller]

Four days ago Uday wrote:

Quote

So far, two of us have reported the aggressive popup from Drivecleaner.

Our ad supplier says it isnt them. So we're trying to figure out where this came from. is it possible that both the reporters were infected with similar malware prior to this beta? That our ad supplier is mistaken, or is being misleading ? That a third party (program, proxy, isp ) is intercepting and replacing the ads?

Anyway, please let us know if this happens again, while we check this out.

Just for the record, except when I was logged onto BBO or "location 1" a few days ago (when the Travelocity ad was running) there have been no popups on my machine (neither DriveCleaner nor any others). Also, as I noted above, MicrosoftDefender and AdawareSE say my machine is clean. So I tentatively will eliminate the first of Uday's hypotheses (that my machine is infected with Malware). But if there's anyone here who knows how to read HijackThis logs, I'll be happy to send one for further checking.

Anyway, it appears from Claus's comments that the Travelocity ad had a script of some kind (or this was intercepted en route) that caused the DriveCleaner popups. If Uday makes any further progress I hope he'll let us know what he found.

Anyway, as these kinds of popups could really vex unsophisticated users I hope they can be gotten rid of from now on.

[julie5607]

Hi Geller,

It's not perfect but this a good place to start - here is a link to an online hijackthis analyzer that I have used with good results. Simply run HJT, creating a log, and copy and paste the log into the textbox.

http://www.hijackthis.de/


Julie

[geller]

Hi Julie,

Thanks for the tip. I checked. No malware. This confirms what WindowsDefender and AdAwareSE already said.

-Bob Geller