Porn ads on otherwise clean sites

Viruses and worms
1

Not my problem, but a lady friend with children. When she visits otherwise clean sites (like WeightWatchers), the ads at the top and on the sides of the page are porno instead of the usual car, phone, food, vacation ads. What kind of malware attack would this be, and what advice should I give her on where to start? I’m not with her, just someone I chat with.

Thanks, KW

2

There are a number of things it could be from a browser hijack to adware or spyware trojans.

If you haven’t already got this software (freeware), download, install, update and run it, preferably in safe mode.

  1. If using winXP AVG anti-spyware (formerly Ewido) Resident scanner during trial On-Demand after trial ends. Or SUPERantispyware On-Demand only in free version. Or Spyware Terminator Resident scanner. Or a-Squared free On-Demand only with free version(if using win98/ME).
  2. Ad-Aware SE Personal Edition
  3. Spybot Search and Destroy

This isn’t something to attempt through a third party as it could become quite complex and take a long tome extracting information, etc.

What OS is she using ?
You don’t say what browser she uses, but I would say it is probably IE ?
If that is the case, I would suggest firefox with its adblock plus extension, but there should also be ad blocking tools for IE.

3

Thanks, I gave her links to some of the above freeware sites already and I’m waiting to hear back. I was just curious whether it was more an ad/spy or virus problem.

:slight_smile: KW

4

Common cleaning procedures (antispyware/antitrojan) could fail in these porn adds. My experience is that if you still detecting any strange behavior or even you’re sure you’re not clean, maybe it will be good to test your machine with anti-rootkit applications. I suggest AVG, Panda and/or F-Secure BlackLight.

But, most of all, if you still detecting strange behaviors or you want to be sure you’re clean, maybe making a HijackThis log to post here and, specially, scan and submit to on-line analysis the RunScanner log would help to identify the problem and the solution.

5

As far as I’m aware BlackLight is no longer available the beta/evaluation ended 01 October 2007, though you can still get it the downloaded file when run program shows , evaluation expired, see image. It will now only be available as a part of their paid for security suite. So end of game fot BlackLight free.

6

Thanks David. Updating my info…

7

Thanks, David and Tech. She was lucky. She was able to get rid of it with Spybot S&D. Turns out she didn’t have much of any protection on her computer, but that has now changed. Thanks again.

8

Your welcome.