Malware ads?

[Skodaforum]

This ad shows on my site from time to time (skodaforum.no) instead of normal Adsense ads.

It shows on different computers, and different browsers. My visitors have reported viewing the same ad.

Any clue why? I've deleted all third party extensions. The ad shows regardless of what theme I use.

[Skodaforum]

In my search I also found this ad to appear on another forum as well.. funny thing is that it's also a invision power forum. 

http://www.arcforums.com/forums/air/index.php?/topic/280792-watch-out-for-phishing-banners-on-arc/

other forum, alsom usin IP.board: www.theadminzone.com

PS! I got nothing to do with the other forum.

[MADMAN32395]

is it presented through google adsense? ive had to blacklist and report a few ads that were being displayed on my site.

[Makoto]

That doesn't look like a Google Adsense ad.

What version of IP.Board are you running? This is a common type of malware that gets injected into vulnerable versions of IP.Board - the ads are set to display randomly to avoid suspicion and make them harder to detect.

If you need help scanning your forum for infections, shoot me a message and I'll see what I can do to help.

[Mack_au]

It's a google adsense ad. I've got the same thing (but in English). I though I'd blocked all these dodgy categories.

[Makoto]

If it is Google Adsense you can report it and also block the domain(s) from advertising on your site via the Google Adsense control panel.

[Mack_au]

If you download the Google Publisher Toolbar and refresh a few times it should eventually come up again, and you can block it from there.

You should also block the URL in Adsense itself using the "Content -> Advertiser URLs" option.

Put in:

http://www.nowand2day.com
(you will probably need to remove the http:// part when you put it into the block window)

[Skodaforum]

17 hours ago, Mack_au said:

If you download the Google Publisher Toolbar and refresh a few times it should eventually come up again, and you can block it from there.

You should also block the URL in Adsense itself using the "Content -> Advertiser URLs" option.

Put in:

http://www.nowand2day.com
(you will probably need to remove the http:// part when you put it into the block window)

Installed now, of course, now the ad doesnt appear.. Have to wait

 

18 hours ago, Mack_au said:

It's a google adsense ad. I've got the same thing (but in English). I though I'd blocked all these dodgy categories.

If it's a google adsense ad, why isn't there a Google ad "frame" around it. 

18 hours ago, Makoto said:

That doesn't look like a Google Adsense ad.

What version of IP.Board are you running? This is a common type of malware that gets injected into vulnerable versions of IP.Board - the ads are set to display randomly to avoid suspicion and make them harder to detect.

If you need help scanning your forum for infections, shoot me a message and I'll see what I can do to help.

I'm running 4.2.1.

18 hours ago, MADMAN32395 said:

is it presented through google adsense? ive had to blacklist and report a few ads that were being displayed on my site.

Thats a good question... I was afraid it was somekind of injection via IP.board

[Mack_au]

2 hours ago, Tor2r said:

If it's a google adsense ad, why isn't there a Google ad "frame" around it. 

21 hours ago, Makoto said:

No idea.

But it's 100% from Adsense.

[Makoto]

Yeah, that's the main reason I had a hard time believing it was from adsense too - I don't see the traditional frame or identifier anywhere on it. Unless Google lets you disable that on ads, I'm not 100% sure to be honest.

[Skodaforum]

Lately the ad has not shown at all. So I havent had the oppurtunity to block it or look more closely with the Google publisher toolbar.

Again, thanks for all the replies!