Its back...I'll try to get it with FiddlerCap, but for now, here is a screenshot...note the new IP adress:
Please take a screenshot of AfterDawn's advertisements as well when the problem occurs. Seeing the end result doesn't aid much in tracking the cause of the problem. I'll inform Google that the problem still exists.
I can't take a screenshot because the malware closes the browser to the desktop with only a dialog box saying message from webpage in the center of the screen. Afterdawn gets closed out with only the dialog box left . Nothing to take a screen shot of except for the dialog box in the center of the screen . The problem has seemed to stop , atleast for today it has . Yesterday the message was appearing though .
It just did it again. I don't know why, but it refuses to do it while Fiddlercap is running. When it happens, it forwards off of afterdawn before any images load. If google realy can't find these kinds of things, then the ads should have more limited capabilities...banner ads should not have control over the browser.
Unfortunately that makes tracking it next to impossible then. Hopefully we can find a solution anyway. I would recommend using a different browser if you can.
Ok, I know it comes up with firefox as well, so I'll try to grab it with that. {edit1} Hmm...it just happened again. I stopped it while it was loading and it looks like it came from a Symantec ad. Still no proof though... {edit2} I am getting more and more suspicious of the Symantec ad. When firebug is installed, this is the only ad that does not load (there is just a blank space where the banner should be sometimes; I can't be sure what is meant to be there; but Symantec is the only ad that does not show up no matter how hard i search). I'll keep trying to grab it, but if it was made by symantec, then I am guessing that they would dissable it on proxy'd connections.
Alright, excellent. Now we are getting somewhere. =) Can you try and save the complete page when the problem occurs? Does the ad manage to close firefox as well? Please install Firebug and grab the HTML code from the page as follows: 1) Open the Firebug console by clicking the Firebug icon 2) The Firebug console view opens in the HTML view. If it opens in a different view, click on the HTML tab at the top of the console view. 3) Click on the <html> tag, right click and choose "Copy HTML". Open your favourite text editor (Notepad++ , Textpad or whatever) and paste the code there. Save it to a file and email the file to me at support at afterdawndotcom. By saving the page this way you save all the Javascript code that is dynamically written to the page. That way we can see exactly which advertisements have loaded and what code they have loaded.
When firebug is installed, the problem stops, but I think that it is because of these error messages: "Permission denied for <http://ad.doubleclick.net> to call method Location.toString on <http://forums.afterdawn.com>." "Permission denied for <http://googleads.g.doubleclick.net> to call method Location.toString on <http://forums.afterdawn.com>."
Both those errors are "normal", and not related to this problem. The permission denied error appears when an external Flash tries to access the parent window's location information. Firebug just shows the error that would normally be hidden.
Well then I guess I'm out of ideas...I'll just use a firebug'd firefox on the forums from now on. It is very odd that this is the only site this seems to happen on; while there are thousands of sites with google advertising. Perhapse it has something to do with all the instances of the words, "Spyware", "Virus", and "Malware". Still, I would have loved to catch these bastards. I guess Symantec will get away with it...
Yeah, I hope we can get to the bottom of this eventually. Google has ruled out the possibility of the ad originating from their own services. They do serve 3rd party advertisements though, and are going through them to rule out the possibility it is coming from one of those. Keep us posted!
Don't know if this will help, but this is what i found in my microsoft security essentials removed box. It sent me to this http://www.microsoft.com/security/p...TrojanDownloader:JS/Renos&threatid=2147609530 Since i switched from avg to MSE I have not had that pop up any more.
I like the pop-ups; they let me know that I am being attacked. If it were not for the fact that I like afterdawn so much, I would be smart enough to never come back.
We all have popups, it's just that it's wise to suppress them. The thing to remember/realise is, is that out of the gazillions of members here, there's only one or two of you (that we know about, granted) that are having such problems.. it might be time to rethink those popups..
The thing to remember/realise is, is that out of the gazillions of members here, there's only one or two of you (that we know about, granted) that are having such problems.. it might be time to rethink those popups.. Believe me, it's not just two of us. when mirosoft puts this on their web site http://www.microsoft.com/security/p...TrojanDownloader:JS/Renos&threatid=2147609530 I have in the last two weeks reformated 4 of my friends computers because they fell for this. and they all got it from different sites not afterdawn. I have many friends that i have recomended afterdawn and cd freaks to, for info. Not all are getting this but some do. They do not belong or sign in, just vist to read the forms and learn, like i did for a long time. Anyway Hope this is the end of that, as i nolonger get it.