Adsense ads hijacked! Please Help!

viswablr · 07-06-2007, 08:31 AM

Hello Web Comrades,

For the past one week, all the adsense ads are getting replaced with adult/gambling related banner ads on my PC. (Not only the adsense ads of my site, but those of any site I visit from my PC).

Here are the clues:
1) Only if I use Internet Explorer.
Firebox, Netscape browsers: No issues.(Adsense are displayed without getting hijacked.)

2) Browser hits googlesyndication.com, but immediately changes to a site called "ad.directanetworks.com", which in turn loads banner ads.

3) If I press "reload/ refresh" button, adsense ads are correctly displayed.

4) I have already verified "hosts" file. It is Ok only.

5) I have already run latest version of Mcafee antivirus, latest version of ad-aware etc. I have already wasted two full days trying to fix the issue. But the problem still persists.

Someone please help me. Otherwise I will throw away my
PC :-(, then I will not be able to talk to you again :-(

Ferre · 07-07-2007, 03:57 AM

*Moved to computerforums.

Me thinks you need to do a couple of trojan and virus scans. You seem to have a virus/trojan.

viswablr · 07-07-2007, 07:26 AM

Even the latest antivirus software or spyware detector is not able to detect it ...

astrovineet · 07-07-2007, 07:43 AM

may be u need to get latest updated AVG or go for online scan by trend micro

I wish you get your pc clean and free from any trojans or spyware or virus of any kind

viineet jain

blackeden · 07-07-2007, 07:57 AM

hum,the worst plan,U should re-install your system,that's a good idea,it can solve all the troubles

Musica · 07-09-2007, 07:15 AM

Well if you do go the format way, just don't forget to backup the important stuff, and b4 u download it back to ur clean system just remember to scan the files first.

I suggest you download hijackthis and search online for each item listed in its log. In my opinion tis is way better than formatting ur pc

GiorgosK · 07-09-2007, 07:59 AM

Try running any or all of the following
in safe mode (PRESS F8 when computer starts)
not all programs can run in safe mode though.

- Spybot search and destroy (can definetelly run in safe mode)
- HijackThis (can also run in safe mode) erase anything suspicious, don't be afraid, everything is backed up by the program and can be restored ....

If first 2 don't do it
- AVG or BitDefender or PC tools Antivirus
(all free, some will detect some viruses some will detect other, no Antivirus is perfect even the paid ones, McAfee and Norton probably the worse out there)

- Last but not least AND definetelly NOT for the faint hearted,
Start > RUN > services.msc > right click on any service that looks suspicious
stop and put to manual or disable "startup type"

viswablr · 07-09-2007, 08:59 AM

Hey GiorgosK and Musica,

HijackThis tool finally did the magic. It identified suspicious objects (Some BHO based Trojan), and I removed them. Now the hijacking story is over! Thanks a lot folks!

And thanks a lot to everyone else who came up with a suggestion. Every suggestion had some valuable information.

I agree with GiorgosK. I ran Mcafee at least 10 times, and each time it took 3 hours to complete the scanning, but it was never able to identify the trojan.

HijackThis on the other hand took 10 seconds, and identified the trojan.

oddjob · 07-09-2007, 09:29 AM

Quote:

Originally Posted by viswablr

I removed them.

Can I ask ... what did you do? Fix the entry with HijackThis? Did you also remove the file/folder itself where the malware was located?

Just fixing things with HJT doesn't mean the malware is gone ... just that it's not running.

OJ

viswablr · 07-09-2007, 10:05 PM

Removed the associated DLLs also ...

GiorgosK · 07-10-2007, 11:04 PM

@oddjob inactive is better than having it run!! right ?

@visualblr hijackthis is not an antivirus it is a spyware remover, and IE spyware remover (of sorts), so keep both in your computer and run when needed but I would suggest the PC Tools antivirus for an antivirus (free, I was satisfied)

Some rep is always welcome, from anyone that thinks the post was helpful

oddjob · 07-11-2007, 12:54 AM

Quote:

Originally Posted by GiorgosK

inactive is better than having it run!! right ?

Yes but would you like an unexploded bomb in your house?

Surely you would want it removed, wouldn't you?

HJT does NOT remove things. It just stops them running.

You must go and find the offending files etc. and remove them manually. An unwanted bit of code may reactive them.

OJ

GiorgosK · 07-11-2007, 03:06 AM

I don't worry that much about it, if you don't detonate that bomb noone will and it wont be done automatically either ....

So, I agree it would be nice to erase it, but its no big deal for me, it will be cleaned up the next time I format my hard drive ....