Pop-up ad when I click on AW threads?

CassandraW · Jan 4, 2015

The strangest thing has been happening the last couple of days, and I'm wondering if it is happening to anyone else, and/or if anyone has any suggestions.

Not every time, but much too often, when I click on a thread in AW, a full-page ad pops up (always from the same address -- something like "lemode" something or other). When I close the window, AW is closed as well. It's very annoying. A few points:

(1) It is NOT one of the ads at the top of the AW window, and it is NOT something I am accidentally clicking. I'm definitely clicking on thread titles.

(2) Yes, I have my pop-up blocker turned on. I checked and double-checked.

(3) No, it does not happen when I am on any website other than AW.

(4) Yes, I have anti-virus and malware protection installed, and it's working.

(5) This has only been happening the last few days.

WTF?

Cella · Jan 4, 2015

FWIW, yesterday while browsing AW on my phone I was redirected to a fitness magazine ad when clicking on various threads.

It stopped after a while and I'd forgotten about it until you mentioned this here.

Maryn · Jan 5, 2015

My understanding is that AW Admin is hypervigilant about ads and malware on AW's servers. The odds are very good that despite antivirus and malware software, some program has managed to infect your computer, revealing itself as a pop-up.

I had this happen to a desktop a few generations back. My antivirus provider insisted it didn't happen, that I was fully protected, but I continued to see this pop-up with audio. It took a lot of doing to get rid of it (rootkit trojan, whatever that means), but I did, with the help of MyBleepingComputer.

Maryn, pretty sure AW Admin is on the job as always

CassandraW · Jan 5, 2015

Possible, of course. But I'm pretty hypervigilant/paranoid about my computer. And it has not happened on any other site. It also has not happened randomly (e.g., when reading a thread). It has only happened when clicking on a thread title. (So far today it has been fine. It doesn't happen every time by any means.)

I'll run yet another scan on my computer to be safe, but Mcafee and Malwarbytes indicate I'm clean, FWIW.

Williebee · Jan 5, 2015

Pretty good odds this is something in past browsing. That's not a big deal. Dump the browsing history and temp files in your browser program, restart the computer.

CassandraW · Jan 5, 2015

I did. And after doing all of that, it happened again last night. Gaah!

I'm going through the whole process again, and might also do some research to see if there's anything else I might do. FWIW, I'm fairly neurotic about where I browse; no porn cites or the like, and I'd sooner sever my head than open unknown email attachments.

I'll post again if it happens again. But meanwhile, since it seems only to happen when on AW, I thought it worth flagging.

mirandashell · Jan 9, 2015

I'm also getting this now.

I've run CCleaner, Spybot and AVG. I've rebooted and it's still happening. And only on this site. And I came straight here after the cleaning and scanning. So it's not past browsing.

Mr Flibble · Jan 9, 2015

Me too -- started today. I'll be reading a thread and then with no clicking on anything and no warning it takes me to "Le-mode" or something. ETA it's not a pop up btw. It takes me to that website (lemode-mgz.com)

CassandraW · Jan 9, 2015

I'm sorry you guys are having the issue, too, but I'm sort of relieved it's not just me! I was beginning to feel a bit silly. And Mr. Flibble, it sounds like you're getting the same site I've been seeing.

And yes, only when on AW. And right after scanning and scrubbing my computer (more than once, with more than one program).

Locke · Jan 9, 2015

I just dropped my ad blocker for a moment and started going through Cass's post history trying to get a pop-up, and it didn't happen. Just thinking off the cuff, I've been on some sites where ad partners have managed to push an ad through using code that creates pop-ups. However, it may be platform-specific, because I'm just not seeing it on Linux.

I am, however, noticing that one of the Google ads right now is for virus removal. It wouldn't be the first time an ad has tried to use confirmation bias to sell a product.

mirandashell · Jan 9, 2015

Ok, this is happening every few minutes now. It's seriously annoying. I've just cleaned and rebooted again and came straight here and it's happened twice in a few seconds.

It's the Lemode ad and a warning about phishing attacks with a link for 'details'. Obviously I've not clicked on it. I'm not daft.

But it is putting me off coming here.

Locke · Jan 9, 2015

I did a little more research, and it seems it is a recent attack on Google Adsense: https://productforums.google.com/forum/#!topic/adsense/szfNNkPrkLI

It's not likely JavaScript, as that would also affect me. It's more likely to be a Flash hack.

Edit to add:

Google replied that a fix should be in place today:

Thanks for sending us this information. I've forwarded it to the AdWords malvertising team for their ongoing investigation. At this point, the redirect issue is known and our engineers are currently working on a fix as we speak. It appears to be one source that is changing destination URLs. Hopefully a permanent fix should be delivered today or ASAP.

mirandashell · Jan 9, 2015

Ah! I did update Adobe Flash yesterday. Is that what's causing it? Why is it only this site though? And what can I do?

mirandashell · Jan 9, 2015

This is the latest message from Google:

Google replied that a fix should be in place today:

Thanks for sending us this information. I've forwarded it to the AdWords malvertising team for their ongoing investigation. At this point, the redirect issue is known and our engineers are currently working on a fix as we speak. It appears to be one source that is changing destination URLs. Hopefully a permanent fix should be delivered today or ASAP.

Locke · Jan 9, 2015

I doubt the Flash update is what's causing it. I only mentioned it because I don't run Flash on my laptop and it's blocked from work, so it's a possible vector. You could try disabling it, and that might work, but no promises. You could also try installing the AdBlock plugin on your browser.

Basically what's going on is somebody has managed to get a hacked ad into Google's Adsense queue and it's constantly redirecting URL's every time it spawns. It's affecting multiple websites that use Adsense. I'd recommend to the moderators that they temporarily disable Adsense if possible until Google resolves the issue.

mirandashell · Jan 9, 2015

Thank you! At least I know it's not something I've done.

CassandraW · Jan 9, 2015

mirandashell said:
Thank you! At least I know it's not something I've done.

Yes, thank you!

mirandashell · Jan 9, 2015

Is the lemode site genuine? Do they really think that this will make me want to buy the product?

It's driving me so fucking mad at the moment, I wouldn't buy that product if I had a gun to my head.

Alessandra Kelley · Jan 9, 2015

I am getting that too! Starting a few minutes ago, the threads I clicked on would show up for a split second, then forward me to a random tabloid women's magazine garbage site called lemode-mgz.com.

The url is always the same, but I am getting random garbagy weight loss and wrinkle-removal article pages.

I now hate that website with a cold burning passion.

CassandraW · Jan 9, 2015

Yes, I also deeply despise that website. It is damn annoying.

But, to be honest, that feeling is mixed with this one:

:snoopy:

It's not just me! I am not crazy and clueless! Woo hoo! Woo hoo!

:snoopy:

ETA:

OK, I am crazy.

franky_s · Jan 9, 2015

I'm getting the same thing but it's not lemode. It's made up to look like it's from google chrome but the URL is www.dowenfhrbng.com/andthenawholelotofcharacters

I took a screenshot but don't know how to post that here.

Only happening on this website when I click on a forum or subforum.

I've reported it to google chrome as well.

alleycat · Jan 9, 2015

franky_s said:
I took a screenshot but don't know how to post that here.

Do you have an account with a photo hosting website such as Photobucket or Flickr?

franky_s · Jan 9, 2015

I'm not very internet-y. I have dropbox, would that work?

Locke · Jan 9, 2015

mirandashell said:
Is the lemode site genuine? Do they really think that this will make me want to buy the product?

It's driving me so fucking mad at the moment, I wouldn't buy that product if I had a gun to my head.

Well, if there's anything I learned from retail, people will buy anything you slap a price on, eventually. Especially if you do it in a way that makes people think it's an intentional ad. A fool and his money are soon parted.

franky_s said:
I'm getting the same thing but it's not lemode. It's made up to look like it's from google chrome but the URL is www.dowenfhrbng.com/andthenawholelotofcharacters

I took a screenshot but don't know how to post that here.

Only happening on this website when I click on a forum or subforum.

I've reported it to google chrome as well.

Probably another URL redirection off of the same attacker after people started blocking one domain. They're playing whack-a-mole.

alleycat · Jan 9, 2015

This is the screenshot franky_s wanted to post.

Pop-up ad when I click on AW threads?

CassandraW

Cella

Cella

Maryn

At Sea

CassandraW

Williebee

Capeless, wingless, & yet I fly.

CassandraW

mirandashell

Mr Flibble

They've been very bad, Mr Flibble

CassandraW

Locke

Lost the instruction manual

mirandashell

Locke

Lost the instruction manual

mirandashell

mirandashell

Locke

Lost the instruction manual

mirandashell

CassandraW

mirandashell

Alessandra Kelley

Sophipygian

CassandraW

franky_s

still procrastinating

alleycat

Still around

franky_s

still procrastinating

Locke

Lost the instruction manual

alleycat

Still around