Anything.com Ad Problem

[themediaguy]

I've been having a problem with anything.com ads popping up randomly within ad spaces on websites. For example, I can be going through www.Truckblog.com and then random Anything.com ads pop up in place of the google or banner ads (image below)

Another problem is when a request is sent, for example clicking the header graphic to go back to the home page, and a wonderful blank page appears with the text "Apache/2.2.8 (Fedora) Server at hash.vern.com Port 80" displays for 3 seconds or so, then forwards over to Anything.com .

I've downloaded netbarrier, clamxav, avast, and numerous other programs but have had no success in deleting the apparent spyware, or whatever is on my system.

Any ideas? I'm also using Firefox 3 on OSX 10.5.4

 

[NAG]

The DNS server you connect to may have been compromised. I'd contact your system admin and tell them about the situation.

 

[themediaguy]

What if it's not Cox Communications?

 

[NAG]

The only thing I can think of that would do this via your computer and not a server you're connecting to is if you installed a quicktime "codec" from a pornography website. If you didn't do that it probably isn't on your end.

Try using OpenDNS on your router and see if that fixes it.

 

[themediaguy]

how can i go about detecting the quicktime plug in? file name?

 

[NAG]

Read this.

 

[themediaguy]

I installed OpenDNS on the server but it hasn't done anything. The ads are erratic too, occuring several times at once then none at all for several days.

 

[themediaguy]

Read the macworld trojan article. I only have one DNS, no plugin.setting or anything were found in my internet plugins folder. Also have not been on any porn sites or warez sites to encourage malware.

 

[NAG]

Well you don't need to install anything for OpenDNS, you just need to put those 2 IP addresses into your router or computer (whatever is connected to your modem).

Edit: Just hit me that you're using Firefox. What plugins do you have installed? Does this happen if you use Safari?

 

[themediaguy]

Current plugins installed in FF are

AOL Media Playback Plugin (XPCOM)
(plugin to support aol media playback)

Default Plugin
Netscape Navigator Default Plugin

Flip4Mac Windows Media Plugin 2.2
The Flip4Mac WMV plugin allows you to view windows media content

Java Embedding Plugin 0.9.6.4
Runs Java applets using the latest installed versionf of Java.

Quicktime Plugin 7.5
The quicktime plugin allows you to view a wide variety of multimedia content...

Shockwave Flash
Shockwave Flash 9.0 r124

Unity Web Player
Unity web player for mac os

 

[NAG]

Disable Unity Web Player and the AOL one and see if that fixes it.

 

[themediaguy]

http://unity3d.com/unity-web-player-2.x.html

Seems legit. Disabled anyway, although I do not think it's the problem.

 

[NAG]

Yeah, I doubt either is adware but it may have some sort of conflict. I'm still thinking it is related to the DNS security issue rather than anything on your end.

 

[themediaguy]

Well if I decide to call them, what are they going to be able to do? feed me a new ip?

 

[NAG]

No because that isn't related to the issue. Have you switch out the DNS servers for the openDNS servers in your router and/or computer?

 

[themediaguy]

no

 

[NAG]

Do that. If you do not know how to do that I'll need to know what kind of router you have.

 

[themediaguy]

I set up opendns with the router, it just hasn't found any problems. It's actually off ( i set it back) and there haven't been any ad attacks.

The problem may be at Cox but it wouldn't make sense because if they had attacks on their servers they would have taken care of it.

 

[themediaguy]

opendns did not help

 

[themediaguy]

contacted cox communications finally and told them about the problem. They assured me the issue is not on their end and that it's spyware related. I've ran macscan on every part of my set up (hd, externals,etc) and it cant find any problems.

Any other solutions?

 

[qwerty12]

i really dont understand this, "mediaguy" i think ive got exactly the same problem as you, repeated ads for anything.com and

"You were looking for "fdsfdsfdsfdsfds" but that domain is not on this server.
Apache/2.2.8 (Fedora) Server at hash.vern.com Port 80"

the thing is though im on a windows pc (I know, I know wrong site..) but this is the only page on the internet I could find with someone who has the same problem, im not new to spyware and virus' etc... i use Kaspersky and spybot s&d... no extra bho's or activex objects, but the really weird thing is that all 3 of my computers at home have it, so either its spyware thats managed to infect all 3 of my computers, its not on my side (so its my isp), (but its not because my next door neighbour doesn't have it and hes with "virgin media" also...) or possibly its some sort of router infection/corruption/poisoning, (im on a linksys 54g with the dd-wrt firmware how about you?)
all of the above sound implausible to me though so im stumped
I am using the opendns servers btw and am using Firefox (though i checked and its the same story with IE aswell...

help/ideas/suggestions?... anyone?

ow btw im new here nice to meet you all..