Avast Anti Virus and TractorByNet

[fixitman123]

When surfing tractorbynet I keep getting the popup from my avast software telling me that "avast web shield has blocked a harmful webpage or file"
It also shows tractorbynet as having a bad reputation. I think it is coming from one of the advertisements. The file is listed as coming from Http://symonash.org
Is it really a harmful file or is it just a "false positive" I thoroughly enjoy tractorbynet but this is annoying to say the least.

 

[davesl708]

I have to clean my PC after every visit to TBN. I have dozen to hundreds of meg of junk downloaded. A lot of tracking cookies. Symonash is not good. My security blocks it automatically.

 

[Sysop]

It really isn't TBN, it is the advertisers. If you want, I can provide you with information on how to eliminate many web advertisements without the need for additional software and cut down on the rate at which that sort of stuff clogs your system.

After doing it, any places in webpages that used to have ads will show the page cannot be displayed within the ad region, as shown:

 

[Soundguy]

I agree, it's something in an add. kaspersky constantly complains about something when i'm on tbn. What it boils down to are a couple issues. page redirects always look fishy to malware software, and 2, sometimes adds get hijacked.

 

[Sysop]

What I'm recommending will make any browser unable to reach the advertisers servers. No data ever changes hands between your system and the advertisers, and it totally eliminates the extra work your security software is doing. It also eliminates a legitimately malicious advertisement from slipping by the security software and infecting your system.

About two years ago one of the advertisers on NBC.com had a bad ad cycling for a few hours and infected over a quarter million visitors. It happens more often than people realize, that is just one that happened to make major headlines...

 

[fixitman123]

What I'm recommending will make any browser unable to reach the advertisers servers. No data ever changes hands between your system and the advertisers, and it totally eliminates the extra work your security software is doing. It also eliminates a legitimately malicious advertisement from slipping by the security software and infecting your system.

About two years ago one of the advertisers on NBC.com had a bad ad cycling for a few hours and infected over a quarter million visitors. It happens more often than people realize, that is just one that happened to make major headlines...

What is it you recommend?

 

[aczlan]

What is it you recommend?

I would hazard a guess that he is recommending a hosts file ad block (such as Using a Hosts File To Make The Internet Not Suck (as much)) which sends all requests to ad servers to the bit bucket. The downside is that you need to update it frequently or it will get out of date.
I like Ad Block Plus (for Firefox, Chrome and IE) as it knocks out 95% of it and its easy for the user to bypass if needed.

Aaron Z

 

[Sysop]

Correct, it is a modification of the HOSTS file in Windows. I can provide instructions and a list of well known malicious advertising URLs to add. Anytime any program wants to communicate with one of these servers, the entry in the HOSTS file provides an 'incorrect' address for the URL and makes it unreachable. I update mine about once a year or when I see something that starts to appear on sites I frequent. It is a good solution as it prevents the communications from beginning without any extra software processing on the side.

 

[MikePA]

I solved the problem by not running Windows and using AdBlock

 

[MossRoad]

I solved the problem by not surfing **** on the internet....

But seriously, I've been on TBN for 14 years and never have problems... until someone at our house goes shopping on the computer. Then when I go to TBN, I get ads for female clothing, shoes, chick flicks, etc... everything they were shopping for shows up on anything linked to google ads.

Right now, on this page, I see an ad for Xfinity at the top, John Deere on the right, and low and behold, an ad for AVG Antivirus below the Deere ad. Its all based on what you look for at home or work, and what the conversation is about. It found keywords for anti-virus and targeted the ad to that.

 

[Bird]

For a lot of years, I used Norton's anti-virus, but finally dumped it since I have Charter cable TV, telephone, and Internet, and they have their "Charter Security Suite" at no additional cost. It's by F-secure which I'd never heard of before.

https://www.f-secure.com/en/web/home_global/home

never have problems... until someone at our house goes shopping on the computer. Then when I go to TBN, I get ads

Very seldom does anyone use my computer, but me. But, yep, I get lots of ads for anything I've looked about but they don't cause any problems.

 

[rich_ncal]

I had this problem today while on TBN. My virus protection software detected Exploit:Win32/Fiexp.A with threat level severe. A few months ago while on TBN it detected Backdoor:win32/Simda.gen. I haven't had this problem on other sites only TBN.

 

[Soundguy]

it's almost deffinately associated with the rotating adds. some of the advertisements are infected. the advertiser could care less.

 

[Sysop]

Actually it is the advertisers' intention. TBN (and other sites) creates "holes" in their pages that they contract out to advertising agencies. These agencies pay TBN (and other contracted sites) for use of these empty spots. They in turn take money from advertisers or folk of malicious intent to display ads they create in a cycle on TBN (and other contracted sites). They don't check to see if their customers are legitimate advertisers or malicious individuals seeking to exploit vulnerable systems. I think personally it is all a scheme to prevent liability. TBN doesn't make the ads, the company TBN contracts those ad spaces out to doesn't create the ads, the ads are all made by the third party advertiser (or malicious scum that wants you to be infected). TBN and other similar sites claim to have no control over such things (yet they continue to accept money and renew contracts with known evil advertisers who infect their users).

The best solution is to use the HOSTS file to prevent your system from ever contacting these sites. One of these days there will be an infection imbedded in one of these ads that your security software is unable to catch, then you'll be reloading your infected system (if not dealing with identity theft or something else really bad). It happened to NBC.com users, it can happen here.

 

[Soundguy]

i'm finding it hard to figure out why you thought you had to correect me, when i said what you said, just chose to use a single sentence.???

We all know how the rotating add space works..

Actually it is the advertisers' intention. TBN (and other sites) creates "holes" in their pages that they contract out to advertising agencies. These agencies pay TBN (and other contracted sites) for use of these empty spots. They in turn take money from advertisers or folk of malicious intent to display ads they create in a cycle on TBN (and other contracted sites). They don't check to see if their customers are legitimate advertisers or malicious individuals seeking to exploit vulnerable systems. I think personally it is all a scheme to prevent liability. TBN doesn't make the ads, the company TBN contracts those ad spaces out to doesn't create the ads, the ads are all made by the third party advertiser (or malicious scum that wants you to be infected). TBN and other similar sites claim to have no control over such things (yet they continue to accept money and renew contracts with known evil advertisers who infect their users).

The best solution is to use the HOSTS file to prevent your system from ever contacting these sites. One of these days there will be an infection imbedded in one of these ads that your security software is unable to catch, then you'll be reloading your infected system (if not dealing with identity theft or something else really bad). It happened to NBC.com users, it can happen here.

 

[Sysop]

I was mainly trying to clarify that it is TBN and the company hosting the ads that don't care (because they're paid to not care), but also that the ones that are actually creating the ads to be displayed are acting with malicious intent and targeting the users of TBN and other sites.

I also was adding the point that leaving it up to your security software to deal with doesn't remove the target from you. A good analogy would be:
Leaving it up to your security software amounts to putting on a bullet proof vest and running back and forth across a live firing range in front of all the targets. As long as you only get hit in the vest, you're good to go. Creating proper additions to the HOSTS file is basically the equivalent of not running across a live firing range at all...

If everyone knew how the rotating ad spaces worked there wouldn't be such topics on TBN about it.

 

[BLUE ME]

Add No Script and Add block Plus to fire fox or chrome.

 

[Sysop]

Why add more stuff to already bloated systems? You're adding an entirely new step for the process of loading a page, it may be quick for you in your environment but it isn't always in everyone else's... It still can't be as fast as the alternative. There is already a HOSTS file (part of Windows) that is processed every time a URL comes up in any application. If you just tell the HOSTS file to look to home (same as having the URLs ignored completely) and all applications are covered. It really does work well and doesn't need very much maintenance (5 minutes, once a year on average).

 

[Ibrahim]

There was some injection attack on our end that I got rid of. So we should be good now!

 

[aasrs]

There was some injection attack on our end that I got rid of. So we should be good now!

it's doing it now - avast is finding it I had to turn it off to log in tto see what I could find outt this morning here is what avast said

infection blocked by avast

URL: http://www.tractorbynet.com/forums/trailers-transportation/93747-american-made-grade-70-chain.html|{gzip}
Infection: HTML:Script-inf