Adware / Spyware / ErrorSafe Ad Thread - NEW

[arn]

Ok,

I have to apologize for the users who are getting this ad. It's not intentional, and I've been working to try to eliminate it.

We've made some changes today and hopefully that will be it for these ads... but it's a very hard problem to track down due to how erratic the ad is and that its geographically targetted to certain countries. I have never seen one of these ads myself, presumably since it doesn't target U.S. readers.

Here's what information would be very helpful in tracking down this problem.

Please reply if its happened since I've posted this message, as we did make some changes.

1) What country are you in?
2) Please try to take a screenshot of the Top Banner ad AND the one immediately below the first story.

also, if you are getting it reproducable... please IM me: AIM: chaosmint

thanks,
arn

 

[skoker]

I got it before logging into my ad-free Demi-God account the other day. Once at home, once at school, although the school one was cut off by my firewall/filtering system.

I'm in the northeast US.

 

[arn]

A couple of people have said the ad is no longer happening...

Here's an explanation of how this happened in case you are curious.

MacRumors outsources ad sales to a 3rd party network
3rd Party Network negotiates ads with Companies.

Bad Company #1 signs on for ads... and gives them a Flash Ad for a fake-site. This ad looks normal when loaded in the U.S. by the Ad Network people. Ad is placed into the rotation.

The ad has certain criteria where if the viewer is in a certain country (norway, australia), it triggers the redirect to send them to spamware-site.

Meanwhile, myself and the ad networks have a hard time tracking them down do to this erratic nature.

Again... if someone has one come up again... please post here.

arn

 

[Bern]

It happened to me this morning.

I was directed without me doing anything to another website. A dialogue box appeared in front of safari telling me that I needed to do an "error scan" on my hard drive followed by another dialogue box telling me that the scan was about to begin with an "OK" button as the only option. I had to force quit safari to get rid of the message.

 

[redeye be]

Hey Arn,

Got hit again a few minutes ago.

IT appeared when opening a tabbed bookmark folder of MR front page, new posts and subscribed threads.

Belgium

Here are some pics you asked for.
The full page as it hit me
The ad on the front page
The ad on the new posts page
The ad on the subscribed posts page

The behaviour was quite different this time. Instead of opening a website and/or start downloading a certain exe, the window just flashed a bit and then resized itsself, that was it, nothing else happened.

Good luck.

EDIT: Damn, forgot the google ads below the story... sry

 

[Belly-laughs]

I too got a pop-up again this morning, albeit from another "service":

SystemDoctor 2006

The pop-up didn´t redirect me.

Screengrab with top ad and google ads:

http://www.retromacs.com/yngve/errorsafe/systemdoctor_page.jpg

 

[Arnaud]

Hello,

Got the "SafeError recommended check" pop-up when loading the main page of Macrumors. On a PC, in the Netherlands. Right now, i.e. 13.45.

Addendum: After cancelling the invitation, the MacRumors page is quite messed up, with the ad of ErrorSafe in the background; the second time I open the page, it starts downloading the archive by itself, despite my clicking "cancel", and I need to cancel the download.

 

[arn]

these people are persistent.... looking into it again.

arn

 

[NJuul]

Got it here as well, Denmark, 5 pm local.
Looked exactly like that posted by redeye be.
If I refresh the front page, it pops up once or twice every tenth time.

 

[arn]

if it happens repeatedly.... the easiest way to track it down is this.

#1 use a browser you can clear ALL cookies in. Clear all your cookies.
#2 load macrumors.
#3a. If it happens, take a screenshot of the cookies. post it here.
#3b. If it doesn't happen, go to step #1 again.

this will help the most.

arn

 

[Arnaud]

Ran the steps, clearing the cookies and then opening the macrumors window.

The faulty ad didn't appear before a couple of refreshes, which means that some "innocent" ads were loaded as well, like the chat software ("imws"?) a couple of times.

I took two snapshots straight after the faulty ad appeared. I copied cookies, as well as some other bits of info. I tried to keep the rubbish away, like .gif etc.

If you want emphasis on some missing info, please mention it.

A.

PS: Some parts are covered for privacy reasons.

 

[arn]

Ran the steps, clearing the cookies and then opening the macrumors window.

The faulty ad didn't appear before a couple of refreshes, which means that some "innocent" ads were loaded as well, like the chat software ("imws"?) a couple of times.

I took two snapshots straight after the faulty ad appeared. I copied cookies, as well as some other bits of info. I tried to keep the rubbish away, like .gif etc.

If you want emphasis on some missing info, please mention it.

A.

PS: Some parts are covered for privacy reasons.

Sorry I wasn't clear.

It helps if you clear ALL cookies with each refresh. So only the offending cookies are listed.

arn

 

[arn]

Alright...

Found it. and this time, removed an entire ad network from the rotation.

Sorry again,
arn

 

[Arnaud]

Sorry I wasn't clear.

It helps if you clear ALL cookies with each refresh. So only the offending cookies are listed.

arn

Uh, no, sorry, you were clear, I just didn't get it right the first time. I realized it later (like, in my car, on the way home...)

But if it's fixed now, then good

 

[imacintel]

I had one of those annoying ads(again).

It minimized Safari and Popped it up. I don't mind ads like the "your ipod repair shop", but I don't like the ones I get.

 

[arn]

I had one of those annoying ads(again).

It minimized Safari and Popped it up. I don't mind ads like the "your ipod repair shop", but I don't like the ones I get.

where'd you get this and are u sure it came on macrumors?

arn

 

[imacintel]

where'd you get this and are u sure it came on macrumors?

arn

Yes, at the time I was only doing MacRumors. I got it on the forums(where all the forums are listed).

 

[iDav]

I too got a pop-up again this morning, albeit from another "service":

SystemDoctor 2006

The pop-up didn´t redirect me.

Screengrab with top ad and google ads:

http://www.retromacs.com/yngve/errorsafe/systemdoctor_page.jpg

I had this earlier, though not on macrumors.com. I clicked 'cancel' when i got it and it took me to their site, i quickly closed the tab but now i'm concerned. I know very little about this sort of thing, would this have affected my mac in anyway?

Thanks for any help. Apologies for posting my question in the wrong thread, but it seemed like the most relevant place to post it.

iDav

 

[arn]

I had this earlier, though not on macrumors.com. I clicked 'cancel' when i got it and it took me to their site, i quickly closed the tab but now i'm concerned. I know very little about this sort of thing, would this have affected my mac in anyway?

Thanks for any help. Apologies for posting my question in the wrong thread, but it seemed like the most relevant place to post it.

iDav

It wouldn't have affected your mac. it's just a deceptive ad.

arn

 

[iDav]

It wouldn't have affected your mac. it's just a deceptive ad.

arn

Okay, thanks Arn. I don't have much of a clue about these sorts of things.

iDav

 

[shiv]

I've been having the errorsafe situation for a few days now. It's not just on my mbp. It's on my wife's mb as well.

It's been happening on different sites, but not on macrumors as far as I remember.

We're in Japan.

 

[redeye be]

It's been happening on different sites, but not on macrumors as far as I remember.

That would mean that the sites that did shove you the "error" were allowing some ads arn managed to filter out.
Nothing to worry about, just inform the site owners, they have to sort it out.

 

[shiv]

That would mean that the sites that did shove you the "error" were allowing some ads arn managed to filter out.
Nothing to worry about, just inform the site owners, they have to sort it out.

right on! will do, thanks for the suggestion

 

[calimom]

Network Culprit

Hi Arn-

Can you let me know who the network was running errorsafe? I am also having issues with our internationally targeted pops and cannot figure out where its coming from.

Thanks

 

[Frieda]

ErrorSafe/SystemDoctor

Hi Arn,

living in the UK, I got ErrorSafe two or three days ago (don't remember in what situation) and SystemDoctor today while scrolling down the weather forecast (http://ukie.accuweather.com/ukie/in...er=accuweather&traveler=0&postalcode=CB1 1AZ).

I think that both times I had not clicked on anything.

Sorry, no screenshots.

Frieda