Popup ads on my website?

Status
Not open for further replies.

gabereis

New Member
Messages
14
Reaction score
0
Points
1
Hi,
I'm getting a lot of popup ads on my website and I don't know why. This didn't used to be the case, and I don't believe it's anything I uploaded myself.
Help!
 

bdistler

Well-Known Member
Prime Account
Messages
3,534
Reaction score
196
Points
63
I'm getting a lot of popup ads on my website and I don't know why.
NO pop-up ads are put on your 'site' (Web page) by x10hosting

what is the URL (Web address) where you 'see' these ads ?
 

gabereis

New Member
Messages
14
Reaction score
0
Points
1
www.gabereiss.com. Most of the pages are down right now because I tried to upload but it said "disk full, try later" even though Cpanel says I have plenty of space.
 

gabereis

New Member
Messages
14
Reaction score
0
Points
1
Actually it looks like EVERYTHING is down now. I guess I have to figure out this problem first...
 

Dead-i

x10Hosting Support Ninja
Community Support
Messages
6,084
Reaction score
368
Points
83
Hi gabereis,

I can't see any advertisements on either of those websites. Please could you provide us with a screenshot? Could this be a browser extension or adware, perhaps? :)

Thank you,
 

gabereis

New Member
Messages
14
Reaction score
0
Points
1
They are pop-up ads, and you have to click around a bit for them to come up, though it usually happens the first time you open the page. Make sure your own ad blocker is off.
It's definitely not my computer, as I've seen it on others as well.
It also doesn't happen every time–I'm struggling to replicate it right now myself!
 

gabereis

New Member
Messages
14
Reaction score
0
Points
1
Oh man that totally might be adware on my computer, I think you're right. I don't know why it only targets my own site though! So strange!
 

gabereis

New Member
Messages
14
Reaction score
0
Points
1
No wait, sorry, I'm back to thinking it's on my website–there are no traces of that adware on my machine.
 

Livewire

Abuse Compliance Officer
Staff member
Messages
18,169
Reaction score
216
Points
63
I'm going to venture to bet you've got a rogue virus or something similar running either in your browser or on your home system; if it's new enough or unique enough it may not be getting caught by an antivirus/antimalware solution. The main reason I'm leaning toward this is that we don't insert random popups (and never have), nor did me searching through all files on the account for the phrase "rdsa2012" turn anything up - if it's caused by a file on the account, that should have identified it.

I also spent a good five minutes doing nothing but clicking links; I never received a popup warning or notification on either site, which combined with the absence of rdsa2012 in the code of any files within public_html leads me to believe either you've got something bad running on the machine itself, or if you're on a network you don't control that the network owner may be inserting ads on-the-fly (which is a sign of a terrible network operator, but this only applies if it's at a workplace, school, net-cafe, etc).

If it's happening on other systems as well, are they running on the same network? Any of the same plugins? Same browser? The only thing I can confidently say is it's not coming from our end of the connection, but that doesn't help isolate -where- it's coming from unfortunately :(


Edit: Bit more info, RDSA2012.com is displaying this when you view it directly:

Rdsa2012.com
This domain is used by the RevenueHits Ad Network for ad serving. If you're a publisher and would like to monetize your inventory, you can .

Otherwise, if you have any questions or interested in more information, please fill out the contact form below and we will get back to you shortly.

Further clicking goes here:

RevenueHits is owned and operated by MyAdWise Ltd - a privately-held, Israeli-based, start-up company founded in 2008 by a team of experienced tech professionals, finance experts and successful online marketers.

This sounds like a plugin or other application causing it; it would also explain why I'm not seeing it, as the Windows 7 install I'm on right now is about 5 days old, with a very limited subset of programs installed, all of which I either personally coded or vetted for ad-serving junk like this :(
 
Last edited:

gabereis

New Member
Messages
14
Reaction score
0
Points
1
Very interesting.
I know it's been a while, but the ads have now reappeared, after being gone for a month or so.
It's interesting because I've had several people tell me there are ads on my site, and they obviously are using different computers and different operating systems.
I do appreciate you looking into this for me, though! Anything else you can think of?
 

essellar

Community Advocate
Community Support
Messages
3,295
Reaction score
227
Points
63
You might want to check out this posting over at botcrawl.com: http://botcrawl.com/how-to-block-and-remove-revenuehits/

The usual culprit these days is free software installers (they often contain installers for unwanted toolbars and adware; you need to be very careful to deselect everything thaat wasn't the software you actually intended to install) and browser extensions (several extensions for both Firefox and Chrome were purchased from their originators by unscrupulous operators; they use the auto-update feature of the extension to put their crap on your machine). And, of course, the perennial favourites: cracked commercial software and keygens. Not everyone who offers somebody else's goods for "free" is actually a well-meaning arnarcho-libertarian, you know.
 

gabereis

New Member
Messages
14
Reaction score
0
Points
1
What's strange to me is that it is only on my own website, not any others that I visit. I keep a pretty clean machine, and malwarebytes says my mac is free of any adware or viruses. Perhaps it's something on the website, but on the server side and not client side?
 

bdistler

Well-Known Member
Prime Account
Messages
3,534
Reaction score
196
Points
63
If it's helpful, this is the website that I keep getting linked to:
http://majormacgenius.com/mac/ibr-3...551023782541987&fln=Home+-+GabeReiss.com&lr=1
at that link - this is what my browser throws...
Phishing attack ahead

Attackers on majormacgenius.com might try to trick you to steal your information (for example, passwords, messages, or credit cards).
Automatically report details of possible security incidents to Google. Privacy policy
Back to safety Hide details
Google Safe Browsing recently detected phishing on majormacgenius.com. Phishing sites pretend to be other websites to trick you.

If you understand the risks to your security, you may visit this infected site.
click on above to expand
 

Skizzerz

Contributors
Staff member
Contributors
Messages
2,928
Reaction score
118
Points
63
I took a look at your account and I do not see any signs of a server-side compromise that would be serving these ads. Try accessing your sites from different computers (for example, at the public library or via a Virtual Machine), if you do not see the ads there then that is highly indicative that there is something on your local computer that is causing the issue. Alternatively, you are possibly connected via a VPN or other proxy service that is injecting ads into the page on-the-fly, check your connection settings and consider securing your websites with HTTPS (such as via CloudFlare's offerings as HTTPS is not directly supported on x10free); if using HTTPS prevents the ads from occurring then that may indicate that there is a bad actor on your network. If they still appear, then that indicates something on your machine is causing it.
 

caftpx10

Well-Known Member
Messages
1,534
Reaction score
114
Points
63
Try ADWCleaner. Malwarebytes isn't designed to deal with adware specifically.
 

gabereis

New Member
Messages
14
Reaction score
0
Points
1
I'm on a mac so I used adwaremedic, which was just bought by Malwarebytes and is now integrated. I *do* use cloudflare already! I understand that it's probably on my side, but it just baffles me that the only time these ads show up is when I'm on one of the three websites that I have created through x10, which is what makes me think it's x10...
 
Status
Not open for further replies.
Top