Hijacked

kathycf · #1 (**permalink**) 03-29-2007, 09:34 AM

Forgive this post if this issue has already been brought up. While browsing the forum just now, I went to check my PMs. My browser was hijacked and immediately brought to some "scan your computer site" and I had to shut down my browser to escape. This is the third time it has happened, so I figured I would report it. I understand the necessity of ads, but this is far too aggressive and I don't like it. My anti-virus scanner reported it as ad-ware and it starts a download without one even consenting to that.

Gosh, I feel stupid because I tried getting the address of the site, but apparently didn't. I get startled pretty easily and the virus scanner makes a loud noise when it detects threats and I got very rattled trying to shut that off and get away from the adware site. I will report the name of this site if (when) it happens again. Thanks.

Siberys · #2 (**permalink**) 03-29-2007, 09:39 AM

It hasn't been brought up on the forums, but I've experienced this before and shown it to Buck.

I dunno what's causing it, but I have noticed that I only get it on gamebanshee.

kathycf · #3 (**permalink**) 03-29-2007, 09:55 AM

Ok, thank you.

I too, have only had this happen to me on this site. As I say, this goes beyond advertising.

fable · #4 (**permalink**) 03-29-2007, 10:25 AM

Kathycf, please send on a PM to Buck about it, with any details you can provide.

galraen · #5 (**permalink**) 03-29-2007, 11:52 AM

I've had that happen to me a few times lately, but only when accessing my E-Mail account, which has recently been transferred to AOL (Abomination On Line as I call it, and no not as a bash on America!). I've now opened another account elsewhere. Problem sorted.

kathycf · #6 (**permalink**) 03-29-2007, 12:06 PM

Well, I know what you mean about general hijacking, galrean, but this is a bit different. I am referring to a site that has hijacked my browser only when I have been reading and browsing at GameBanshee. For example, I was in the DL forum earlier today and went to check my PM box, and wham, was instantly transported to some weird "scan your computer for spyware" site. This is the third time that this has happened and always to this particular "scan" site and always while browsing GameBanshee.

Again, in all the confusion I experienced I did not make a note of the website address. I had my browser set to delete history when I close it, so that doesn't help me either. I changed that setting so if or when this happens again, I will be able to provide more information. (*note to self, don't panic!*)

Thanks again, everybody.

Tricky · #7 (**permalink**) 03-29-2007, 12:10 PM

When they get that annoying, I'll usually block the source with Firefox's Adblock extension. Works rather well.

I've been hearing a lot about Project Wonderful lately. Might provide BG a good alternative to the current crop?

Xandax · #8 (**permalink**) 03-29-2007, 01:44 PM

Quote:

Originally Posted by kathycf

Well, I know what you mean about general hijacking, galrean, but this is a bit different. I am referring to a site that has hijacked my browser only when I have been reading and browsing at GameBanshee. For example, I was in the DL forum earlier today and went to check my PM box, and wham, was instantly transported to some weird "scan your computer for spyware" site. This is the third time that this has happened and always to this particular "scan" site and always while browsing GameBanshee.

Again, in all the confusion I experienced I did not make a note of the website address. I had my browser set to delete history when I close it, so that doesn't help me either. I changed that setting so if or when this happens again, I will be able to provide more information. (*note to self, don't panic!*)

Thanks again, everybody.

The problem is that advertisements are rotated by a third part service, so Buck has little direct control (other then complaining) towards the adds, save of canceling the agreement.
Also because adds are based on localization, it will be difficult to provide much information from Buck to the advertisement company without concrete informations.
So if you experience it again, then make sure you note what advertisement did it, and what the site you got redirected to. This will make it possible for Buck to take it further to the advertisement company.

Also it is easy for a less-then-honest company to get into the rotation and then cause some problems before getting kicked out, especially if it is difficult to pinpoint a culprit. It is very bad etiquette, but these companies do use dirty tactics.

BuckGB · #9 (**permalink**) 03-29-2007, 02:32 PM

Thanks for pointing this out. I just sent UGO an email about the problem, so hopefully they'll be investigating this yet today. You shouldn't ever be prompted to download or install any software (aside from maybe Flash or Adobe Reader) while browsing GameBanshee.

Like Xandax said, the more information you can provide about the ad, the better. It's most likely a country- or region-specific ad that shouldn't be in our rotation.

Fiberfar · #10 (**permalink**) 03-29-2007, 02:59 PM

Starts to download?

Could be a rogue security program?
Those use a javascript of some kind, and in some devilish manner manage to bypass the popup-blockers.

I was reading about them, and they usually pop up on pages that uses adverts.

kathycf · #11 (**permalink**) 03-29-2007, 03:15 PM

Ok, the actual download didn't happen until after the hijacking had taken place...

Here is what happened:
1.) I went to check my PMs here
2.) Immediatly hijacked to another site, offering a spyware scan
3.) As I click windows closed to get away from this other site, doing so somehow prompts a download of whatever software they use to "scan" with.

All of which strikes me as somewhat ironic for a website that hijacks me and rather forcibly offers to scan my computer for spyware...the means by which they do their "scanning" sets off my anti-virus software with an alarm about adware/spyware. I was able to stop the download because of my anti-virus program.

My apologies again for not getting their name and address. I just got so flustered by the whole thing, and I felt I had to say something about it. By the time I realized I didn't have the address, it was too late. If this happens again, I will try to remain calm and get the name and website url of this company.

Siberys · #12 (**permalink**) 03-29-2007, 03:49 PM

Quote:

Originally Posted by kathycf

Ok, the actual download didn't happen until after the hijacking had taken place...

Here is what happened:
1.) I went to check my PMs here
2.) Immediatly hijacked to another site, offering a spyware scan
3.) As I click windows closed to get away from this other site, doing so somehow prompts a download of whatever software they use to "scan" with.

All of which strikes me as somewhat ironic for a website that hijacks me and rather forcibly offers to scan my computer for spyware...the means by which they do their "scanning" sets off my anti-virus software with an alarm about adware/spyware. I was able to stop the download because of my anti-virus program.

My apologies again for not getting their name and address. I just got so flustered by the whole thing, and I felt I had to say something about it. By the time I realized I didn't have the address, it was too late. If this happens again, I will try to remain calm and get the name and website url of this company.

No worries, as I said, I've had this problem before myself as well, and I have the site and information needed.

http://i15.photobucket.com/albums/a3...oc/GBVirus.jpg

Xandax · #13 (**permalink**) 03-30-2007, 12:31 AM

Quote:

Originally Posted by kathycf

Ok, the actual download didn't happen until after the hijacking had taken place...

Here is what happened:
1.) I went to check my PMs here
2.) Immediatly hijacked to another site, offering a spyware scan
3.) As I click windows closed to get away from this other site, doing so somehow prompts a download of whatever software they use to "scan" with.

All of which strikes me as somewhat ironic for a website that hijacks me and rather forcibly offers to scan my computer for spyware...the means by which they do their "scanning" sets off my anti-virus software with an alarm about adware/spyware. I was able to stop the download because of my anti-virus program.
<snip>

That technique is common one for some of the less then honest sites out there. Pressing close on a pop up/window will prompt a download, which of course should always be canceled.

kathycf · #14 (**permalink**) 03-30-2007, 12:53 PM

That picture that Siberys posted seems to be the site in question, as far as I can tell. Thank you for posting that.

kathycf · #15 (**permalink**) 04-02-2007, 06:41 PM

Ok, I was browsing through the Neverwinter Nights forum and the same thing happened again. I was here, and then without my consent or even me doing anything I was brought to this website.

DriveCleaner 2006 - Home

This is what computer security people at Symantec say about this website and it's application that they keep trying to force on people.

Quote:

DriveCleaner
Updated: February 13, 2007 11:50:30 AM
Type: Other
Version: 1.10.19.0
Publisher: Drive Cleaner, Inc
Risk Impact: Medium
File Names: installdrivecleanerstart.exe UDC2006.exe UDCPChk.dll UDCShell.dll
Systems Affected: Windows 2000, Windows 95, Windows 98, Windows CE, Windows Me, Windows NT, Windows Server 2003, Windows XP
SUMMARY
Behavior

DriveCleaner is a misleading application, which gives exaggerated reports of security and privacy risks on a computer. The program then prompts the user to purchase a registered version of the software in order to remove the reported risks.