Strange ads appearing in Spiceworks

mikewoulfe · 2013-12-03T17:43:27.000Z

Today I was looking at a few posts when I noticed strange advertisments appearing. For example, one was for “Google Pays me $173 an hour” while another was “This is not a joke! You are the 100,000 visitor.”

See attached screenshot of a few that appeared in Spiceworks. At the bottom of the ad it says “Ad not from this site”

I’m scanning my PC for malware but I just wanted to see if anyone else has seen these ads.

mikewoulfe · 2013-12-03T17:44:50.000Z

I added the wrong screenshot - this one has 3 examples of different ads that appeared.

Sean-Spiceworks · 2013-12-03T17:46:39.000Z

Sounds like malware…

tuckerm · 2013-12-03T17:47:04.000Z

Smells of malware. Malware Bytes scan should reveal your issues.

molan · 2013-12-03T17:48:00.000Z

Yep I had a similar incident about a year ago, turned out it was malware on my machine

cpunty · 2013-12-03T17:48:34.000Z

you computer has computer aids.

matt248 · 2013-12-03T17:54:06.000Z

Not HIV.

http://video.adultswim.com/family-guy/full-blown-aids.html

brucecross · 2013-12-03T17:58:31.000Z

Chris19delta:

you computer has computer aids.

I think you meant “computer ads”.

evanalmightyyy · 2013-12-03T17:58:37.000Z

We had this issue about a year ago on a similar topic and I believe it was malware injecting ads into your browser page. Sorry but scan and move on!

cpunty · 2013-12-03T17:59:46.000Z

The Spruce Bruce:

Chris19delta:

you computer has computer aids.

I think you meant “computer ads”.

both

starg33ker · 2013-12-03T18:04:33.000Z

Nope. It’s obviously adware

mikewoulfe · 2013-12-05T11:04:08.000Z

Spybot and Malwarebytes both came back clean on the PC. I scanned the server I have Spiceworks on with both options - nothing major found. I’m running different scans on other machines but nothing showing up so far.

I’m not noticing any issues with any other websites or programs - just Spiceworks.

aboushard · 2013-12-11T12:55:28.000Z

What browser are you using? I have seen this and it turned out to be a plugin within Firefox, addon in IE and a Chrome Extension. Since it was one of those like you said Michael Malwarebytes and Spybot didn’t pick it up. Look there and disable any unknown Addon, Plugin, Extension etc. in whichever browser you use. This should stop it.

justinmiller · 2013-12-11T13:13:58.000Z

If it’ll let you. Learning to use OTL might be a good move here.

Sean-Spiceworks · 2013-12-11T13:19:43.000Z

Michael3504:

Spybot and Malwarebytes both came back clean on the PC. I scanned the server I have Spiceworks on with both options - nothing major found. I’m running different scans on other machines but nothing showing up so far.

I’m not noticing any issues with any other websites or programs - just Spiceworks.

Much like ABoushard asks, can you give us some more details? What browser are you using? When the ads do appear, can you inspect them to see where exactly they are coming from?

aboushard · 2013-12-11T13:58:26.000Z

Random IT Flunky:

If it’ll let you. Learning to use OTL might be a good move here.

I have heard of OTL before. Never used it myself. I checked out the link and was baffled that there was a tutorial on it that was very good. I also train people so this was very exciting to me.

justinmiller · 2013-12-11T14:21:01.000Z

PenguinWrangler:

Random IT Flunky:

If it’ll let you. Learning to use OTL might be a good move here.

I have heard of OTL before. Never used it myself. I checked out the link and was baffled that there was a tutorial on it that was very good. I also train people so this was very exciting to me.

Keep in mind that virus removal training through a UNITE school can take a year or more, and things are constantly changing. I wasn’t able to complete my training because I just don’t have the time to dedicate to it. I say this because powerful tools like OTL can really hose a system if you use it incorrectly, so this is definitely an “at your own risk” thing.

aboushard · 2013-12-12T15:04:49.000Z

Random IT Flunky:

PenguinWrangler:

Random IT Flunky:

If it’ll let you. Learning to use OTL might be a good move here.

I have heard of OTL before. Never used it myself. I checked out the link and was baffled that there was a tutorial on it that was very good. I also train people so this was very exciting to me.

Keep in mind that virus removal training through a UNITE school can take a year or more, and things are constantly changing. I wasn’t able to complete my training because I just don’t have the time to dedicate to it. I say this because powerful tools like OTL can really hose a system if you use it incorrectly, so this is definitely an “at your own risk” thing.

If someone doesn’t back up their files then they are living dangerously. If the system has malware on it, technically it is hosed up to begin with and therefor useless. If standard malware tools will not remove it where do you stand? Honestly you can keep slowly removing the malware but it becomes easier and safer to wipe the machine and start over. If your at that point whats the harm in running a tool that could “hose” up system. Honestly do you trust a machine that’s been infected?

justinmiller · 2013-12-12T17:53:06.000Z

Most people do not have backups at all, much less proper, redundant ones that they’ve tested to be good. This is getting a bit off-topic, but whenever I work on a PC (using the P in the literal sense here), I take great pains to avoid altering existing data. More than half the time, they don’t have installation media anymore because either a) they never had it, or b) they lost it because the computer is 6 years old and things happen. In that case, a wipe and reinstall can be almost as much trouble as cleaning the existing install up.

And to answer your trust question, that depends on the infection. They’re not all created equal. If it’s something like a rootkit, the answer is almost invariably no. If it’s “just” a MyWebSearch browser hijack or even “just” a rogue anti-virus program, then it’s reasonable to think that cleaning the machine will be effective.

hanklea · 2013-12-12T18:24:33.000Z

Agree with the plugin suggestion. Also might want to check your pop-up settings…