Adware on Neowin


Recommended Posts

Heh. Darn those Firefox users! *shake fist*

Hmmm, that's a BC-registered numbered corporation, in the same province where I'm in (where I happen to head up the security/abuse desk of a Tier 1 carrier). I hope those clowns aren't with us. :|

Anyone know the IP address where the first download is coming from? If the ad's still up, maybe I'll fire up a vmware win98 session and see if I can capture it.

It seems to me that neowin or its ads are changing my homepage, cuase after a hour browsing around in other forum (after using ccleaner to clean all the interent stuff on my comp,run adaware and spybot) nothing happen. Until just now when my homepage changed.

Before my homepage change i get this pop-up from object.passthison.com/vu083003/object.cgi?homepage1

ANY help

The same IP address range keeps appearing. I would suggest using your firewall to block 209.50.252.0/24:

Non-authoritative answer:

Name: object.passthison.com

Addresses: 209.50.252.113, 209.50.252.114, 209.50.252.116

%whois -a 209.50.252.113

ServInt Corp. SERVINT-CIDR-1 (NET-209-50-224-0-1)

209.50.224.0 - 209.50.255.255

ServInt Internet Services SERVINT-INTR-2 (NET-209-50-252-0-1)

209.50.252.0 - 209.50.252.255

# ARIN WHOIS database, last updated 2004-03-17 19:15

# Enter ? for additional hints on searching ARIN's WHOIS database.

%whois -a servint-intr-2

OrgName: ServInt Internet Services

OrgID: SIS-31

Address: 6861 Elm St.

City: McLean

StateProv: VA

PostalCode: 22101

Country: US

NetRange: 209.50.252.0 - 209.50.252.255

CIDR: 209.50.252.0/24

NetName: SERVINT-INTR-2

NetHandle: NET-209-50-252-0-1

Parent: NET-209-50-224-0-1

NetType: Reassigned

NameServer: NS.SERVINT.COM

NameServer: NS2.SERVINT.COM

Comment:

RegDate: 1998-06-30

Updated: 2001-05-15

TechHandle: NO178-ARIN

TechName: Network Operations

TechPhone: +1-703-847-1421

TechEmail: [email protected]

I can tell you right now, Neowin does not (nor ever has) support any forms of Spyware/Adware/Malware/Asshatware. The blame for this one lies in one of the Advertising companies that Neowin receives it's banners from, Redmak will resolve this issue as soon as possible.

Thanks again for your concern,

Cara

Global Moderator

All of you Firefox users are blocking our Ads I suppose...great to help out the site's funding.  :rolleyes:

I'm using firefox and i'm not blocking anything related to neowin's ads. :)

So "ALL" is not a good way to say it :/

Weak ass trojan can't even infect with my McAfee disabled lol.

Well the "trojan" is hosted on http://www.achtungachtung.com/0021 (this is where all the parts of the "trojan" are located) but I can't tell you much more because I can't get the whole thing downloaded. I have the part that installs the trojan but not the part it downloads after you're infected.

I'm willing to bet though that this trojan aint a trojan but a crappy spyware program. The infecter part(index[1].html is pretty small but makes several references to LaunchJpu.php which in turn references scriptbody.jsp which then references payloadexe.exe(which I can't seem to get). It also mentions C:/WINDOWS/PCHEALTH/HELPCTR/System/panels/Context.htm and has several paths to notepad coded into it but just what it does I can't say because I can't get payloadexe.exe, and on top of that even if I could I probably wouldn't understand it as easy as I would a script like the other files.

I'm working on this but as I don't get these ads myself it's quite hard to pinpoint its origin.

If any of you get this ad again could you please provide me with:

The link of the banner that is showing at that time (so do a mouseover and read your IE status bar) and if you could even provide me with the source code of the page (the neowin page) so I can check the ad code in there.

I was in this thread

https://www.neowin.net/forum/index.php?showtopic=149643

And the ad above was

http://oz.valueclick.com/cycle?host=hs0279...script=1;msizes

"Free! Online Diabetes menu planner Click here to use it now"

Hoped i have help, off to scan my comp, how gay :blush:

Oh can someone look in there registry and go to

Hkey_Current_user\software\microsoft\internet Explorer\main

and look for

search bar

search page

And tell me what is the defualt data suppose to be. So i can change mines :)

i found that mines said smartbotpro which i guess is affiliated with the Passthison crap, after doin research on it.

Currently in my registy (pic below)

post-19-1079623857.jpg

Oh can someone look in there registry and go to

Hkey_Current_user\software\microsoft\internet Explorer\main

and look for

search bar

search page

And tell me what is the defualt data suppose to be. So i can change mines :)

i found that mines said smartbotpro which i guess is affiliated with the Passthison crap, after doin research on it.

Currently in my registy (pic below)

Those registry keys are not a default part of Internet Explorer. They are a part of the "adware" you are describing. I would delete them personally.

after some time again researching about passthison, i have learn that this Hijacking occured becuase of some flaw/hole in IE.

Would it be in my best interest to switch to firefox. Will it rid me of my problem.

Other forum also sent me a popup and reset my homepage. i have tried everything to get rid of it, including going to safe mode with CMD and del index.dat/s. I manage to browse around neowin by pressing hte stop button before the ads load.

Firefox - yay or nay?

I was getting the same crap yesterday. I thought it was just me, but looks like others are complaining now as well. I got rid of it by running HiJackThis and removing the entries for it. I didn't even get one of those installer windows, like in some screenshots. I just got a normal popup that opened and was closed instantly by the google toolbar, and then after that popup I had problems.

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • This is about the EU given consumers options, Apple is all about not giving options and locking you into its own services, this hurts Apple far more than it hurts the EU market because it makes Apple products look less appealing by Apple refusing to offer its own service because they have to give options to rivals, the end results are consumers might look at alternatives like Android. It's a game Apple can't really win when there are alternatives and Apple will in time change course on this, until then, let Apple hurt themselves in the EU market.
    • Microsoft unveils new Surface Laptop with improved trackpad, Snapdragon X2, and more by Taras Buria Microsoft's new Surface Laptop Ultra generated a lot of buzz earlier this month, but in addition to its most powerful laptop with an NVIDIA chip, Microsoft also has a more affordable laptop lineup, which has been waiting for an update for quite a while. Today, Microsoft announced the eighth-generation Surface Laptop. The new Surface Laptop is powered by the Snapdragon X2 Plus and X2 Elite processors. These chips offer faster CPU performance, up to 58% faster graphics, and 80 TOPS Neural Processing Units (NPUs) for on-device AI processing. Like the previous models, these chips retain their great energy efficiency, and Microsoft says that buyers can expect up to 20 hours of work on a single charge. The laptop is available in two sizes: 13.8-inch and 15-inch. You will have a hard time finding visual differences between the new and previous models, as Microsoft is not taking any major design leaps, except for the new Jade color, which may look familiar to Surface Laptop 5 owners. Other colors include Platinum, Black, and Dune. The 15-inch variant got a higher-resolution display. It is a 3,270 x 2,180 resolution screen with a pixel density of 262 ppi (the 13-inch model has a 201 ppi density) and a maximum brightness of 600 nits SDR and HDR. Unlike the Surface Pro 12th-gen, which is available with optional OLED displays, the Surface Laptop sticks with IPS, a 1,300:1 contrast ratio, a 120Hz refresh rate, and a 3:2 aspect ratio. Another notable change in the Surface Laptop 8 is its trackpad. It now provides haptic feedback when you perform various actions in apps and the operating system. It is a relatively new feature that Microsoft brought to Windows 11 in recent updates, and it is only available on certain devices, such as the Logitech MX Master 4, Surface Slim Pen 2, the upcoming Surface Laptop Ultra, and now the Surface Laptop 8. The new Surface Laptop with the new Surface Pro Like its tablet-shaped sibling, the new Surface Laptop is notably more expensive. It starts at a $1,599 for a 13.8-inch configuration with a 256GB SSD and 16GB of RAM. However, in the US, the base model has double the storage while keeping the same price. Available configurations include up to 64GB of memory and up to 2TB SSD (user-removable PCIe Gen4). The Surface Laptop 8 is now available for purchase on the official Microsoft website.
    • Microsoft announces 12th-gen Surface Pro with Snapdragon X2 processors by Taras Buria So far, 2026 has been rich in Surface announcements. Microsoft started with a fresh lineup of Surface for Business devices powered by Intel's new Core Ultra 300 processors. Then the company revealed the Surface Laptop Ultra, its most powerful laptop with NVIDIA's RTX Spark processor. Now, it is time for new Surface Pro and Surface Laptop models with Qualcomm processors. Microsoft's original Copilot+ PCs with Snapdragon X1 chips debuted in late May 2024. Two years later, Microsoft is finally updating the lineup with new models featuring Snapdragon X2 processors. The 12th-gen Surface Pro continues the well-established formula of Microsoft's flagship tablet, and Microsoft is not even changing colors, as the tablet will be available in three colors: Dune, Black, and Platinum. The most important changes are mostly hidden inside. Microsoft switched from the Snapdragon X1 to the new Snapdragon X2, which promises up to 53% faster graphics performance than the previous generation and up to 15.5 hours of battery life. The built-in NPU is also much more powerful, and it can run at up to 80 TOPS for on-device AI processing. Like before, the new Surface Pro is available with a 13-inch IPS display, and Microsoft is still offering OLED as a separate, more expensive configuration. Speaking of configurations, the Surface Pro will be available with a 10-core Snapdragon X2 Plus or a 12-core Snapdragon X2 Elite. Microsoft expanded the available RAM configurations to 64GB (previously 32GB was the maximum), while storage remains unchanged at 256GB, 512GB, or 1TB of user-replaceable PCIe Gen4 SSDs. The new Surface Pro and the Surface Laptop Other specs remain mostly unchanged. The computer has the same 1440p Windows Hello webcam, two USB4 ports for charging, data, and display output, Wi-Fi 7 and Bluetooth 5.4 support, dual speakers, and compatibility with Surface Pro Signature and Flex keyboards. With that said, there is one very important aspect of the Surface Pro that changed significantly, and it is the price. While the previous-gen Surface Pro launched at $999 for the base configuration, in 2026, the entry-level Surface Pro with Snapdragon X2, 16GB of memory, and 256GB will set you back an eye-watering $1,499. To sweeten the pill, Microsoft is running a limited-time promotion where Surface Pro buyers can get a free Surface Pro 13-inch Keyboard. The promo runs from June 16 through June 30. The new Surface Pro is available now on the official Microsoft Store website.
  • Recent Achievements

    • One Year In
      Console General earned a badge
      One Year In
    • One Year In
      Twozo Technologies earned a badge
      One Year In
    • One Month Later
      Twozo Technologies earned a badge
      One Month Later
    • Week One Done
      Twozo Technologies earned a badge
      Week One Done
    • Veteran
      branfont went up a rank
      Veteran
  • Popular Contributors

    1. 1
      +primortal
      525
    2. 2
      +Edouard
      209
    3. 3
      PsYcHoKiLLa
      113
    4. 4
      Steven P.
      89
    5. 5
      Nick H.
      71
  • Tell a friend

    Love Neowin? Tell a friend!