Adware on Neowin


Recommended Posts

Heh. Darn those Firefox users! *shake fist*

Hmmm, that's a BC-registered numbered corporation, in the same province where I'm in (where I happen to head up the security/abuse desk of a Tier 1 carrier). I hope those clowns aren't with us. :|

Anyone know the IP address where the first download is coming from? If the ad's still up, maybe I'll fire up a vmware win98 session and see if I can capture it.

It seems to me that neowin or its ads are changing my homepage, cuase after a hour browsing around in other forum (after using ccleaner to clean all the interent stuff on my comp,run adaware and spybot) nothing happen. Until just now when my homepage changed.

Before my homepage change i get this pop-up from object.passthison.com/vu083003/object.cgi?homepage1

ANY help

The same IP address range keeps appearing. I would suggest using your firewall to block 209.50.252.0/24:

Non-authoritative answer:

Name: object.passthison.com

Addresses: 209.50.252.113, 209.50.252.114, 209.50.252.116

%whois -a 209.50.252.113

ServInt Corp. SERVINT-CIDR-1 (NET-209-50-224-0-1)

209.50.224.0 - 209.50.255.255

ServInt Internet Services SERVINT-INTR-2 (NET-209-50-252-0-1)

209.50.252.0 - 209.50.252.255

# ARIN WHOIS database, last updated 2004-03-17 19:15

# Enter ? for additional hints on searching ARIN's WHOIS database.

%whois -a servint-intr-2

OrgName: ServInt Internet Services

OrgID: SIS-31

Address: 6861 Elm St.

City: McLean

StateProv: VA

PostalCode: 22101

Country: US

NetRange: 209.50.252.0 - 209.50.252.255

CIDR: 209.50.252.0/24

NetName: SERVINT-INTR-2

NetHandle: NET-209-50-252-0-1

Parent: NET-209-50-224-0-1

NetType: Reassigned

NameServer: NS.SERVINT.COM

NameServer: NS2.SERVINT.COM

Comment:

RegDate: 1998-06-30

Updated: 2001-05-15

TechHandle: NO178-ARIN

TechName: Network Operations

TechPhone: +1-703-847-1421

TechEmail: [email protected]

I can tell you right now, Neowin does not (nor ever has) support any forms of Spyware/Adware/Malware/Asshatware. The blame for this one lies in one of the Advertising companies that Neowin receives it's banners from, Redmak will resolve this issue as soon as possible.

Thanks again for your concern,

Cara

Global Moderator

All of you Firefox users are blocking our Ads I suppose...great to help out the site's funding.  :rolleyes:

I'm using firefox and i'm not blocking anything related to neowin's ads. :)

So "ALL" is not a good way to say it :/

Weak ass trojan can't even infect with my McAfee disabled lol.

Well the "trojan" is hosted on http://www.achtungachtung.com/0021 (this is where all the parts of the "trojan" are located) but I can't tell you much more because I can't get the whole thing downloaded. I have the part that installs the trojan but not the part it downloads after you're infected.

I'm willing to bet though that this trojan aint a trojan but a crappy spyware program. The infecter part(index[1].html is pretty small but makes several references to LaunchJpu.php which in turn references scriptbody.jsp which then references payloadexe.exe(which I can't seem to get). It also mentions C:/WINDOWS/PCHEALTH/HELPCTR/System/panels/Context.htm and has several paths to notepad coded into it but just what it does I can't say because I can't get payloadexe.exe, and on top of that even if I could I probably wouldn't understand it as easy as I would a script like the other files.

I'm working on this but as I don't get these ads myself it's quite hard to pinpoint its origin.

If any of you get this ad again could you please provide me with:

The link of the banner that is showing at that time (so do a mouseover and read your IE status bar) and if you could even provide me with the source code of the page (the neowin page) so I can check the ad code in there.

I was in this thread

https://www.neowin.net/forum/index.php?showtopic=149643

And the ad above was

http://oz.valueclick.com/cycle?host=hs0279...script=1;msizes

"Free! Online Diabetes menu planner Click here to use it now"

Hoped i have help, off to scan my comp, how gay :blush:

Oh can someone look in there registry and go to

Hkey_Current_user\software\microsoft\internet Explorer\main

and look for

search bar

search page

And tell me what is the defualt data suppose to be. So i can change mines :)

i found that mines said smartbotpro which i guess is affiliated with the Passthison crap, after doin research on it.

Currently in my registy (pic below)

post-19-1079623857.jpg

Oh can someone look in there registry and go to

Hkey_Current_user\software\microsoft\internet Explorer\main

and look for

search bar

search page

And tell me what is the defualt data suppose to be. So i can change mines :)

i found that mines said smartbotpro which i guess is affiliated with the Passthison crap, after doin research on it.

Currently in my registy (pic below)

Those registry keys are not a default part of Internet Explorer. They are a part of the "adware" you are describing. I would delete them personally.

after some time again researching about passthison, i have learn that this Hijacking occured becuase of some flaw/hole in IE.

Would it be in my best interest to switch to firefox. Will it rid me of my problem.

Other forum also sent me a popup and reset my homepage. i have tried everything to get rid of it, including going to safe mode with CMD and del index.dat/s. I manage to browse around neowin by pressing hte stop button before the ads load.

Firefox - yay or nay?

I was getting the same crap yesterday. I thought it was just me, but looks like others are complaining now as well. I got rid of it by running HiJackThis and removing the entries for it. I didn't even get one of those installer windows, like in some screenshots. I just got a normal popup that opened and was closed instantly by the google toolbar, and then after that popup I had problems.

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • Microsoft Edge 149.0.4022.80 by Razvan Serea Microsoft Edge is a super fast and secure web browser from Microsoft. It works on almost any device, including PCs, iPhones and Androids. It keeps you safe online, protects your privacy, and lets you browse the web quickly. You can even use it on all your devices and keep your browsing history and favorites synced up. Built on the same technology as Chrome, Microsoft Edge has additional built-in features like Startup boost and Sleeping tabs, which boost your browsing experience with world class performance and speed that are optimized to work best with Windows. Microsoft Edge security and privacy features such as Microsoft Defender SmartScreen, Password Monitor, InPrivate search, and Kids Mode help keep you and your loved ones protected and secure online. Microsoft Edge has features to keep both you and your family protected. Enable content filters and access activity reports with your Microsoft Family Safety account and experience a kid-friendly web with Kids Mode. The new Microsoft Edge is now compatible with your favorite extensions, so it’s easy to personalize your browsing experience. Microsoft Edge 149.0.4022.80 changelog: Fixes Fixed an issue that prevented QR code generation from working. Feature updates Intune MAM Protected Downloads. The protected downloads feature for Intune MAM will now save downloaded files to the Documents > Microsoft Edge > Downloads folder in OneDrive. Extensions monitoring in the Edge management service. The Microsoft Edge management service now allows admins to gain visibility into extensions installed across their managed users. From the extensions monitoring page, admins can see which extensions have been installed as well as manage user requests for blocked extensions. For more information, see Microsoft Edge Extensions Monitoring. Validate Edge builds early with enterprise preview. Enterprise preview provides a simpler way for admins to flight pre-release Edge builds to their users. To reduce friction and bolster usage, users will receive pre-release builds directly inside of their Stable Edge application. Admins can allow users to easily opt-out of the preview experience, using built-in rollback to switch between their pre-release and stable channels with ease. Microsoft 365 admin center users can configure the feature, view their flighting population, and receive personalized recommendations all in one place. For more information, see Get started with Enterprise Preview in Microsoft Edge. Download: Microsoft Edge (64-bit) | 193.0 MB (Freeware) Download: Microsoft Edge (32-bit) | 170.0 MB Download: Microsoft Edge (ARM64) | 188.0 MB View: Microsoft Edge Website | Release History Get alerted to all of our Software updates on Twitter at @NeowinSoftware
    • The machines are starting to fight back any way they can.
    • No news articles about the Arch Linux repo being majorly infected with malware?!?
    • Waymo recalls self-driving software after cars enter closed freeway work zones by Paul Hill Waymo, the self-driving car maker owned by Alphabet – the parent company of Google –, has recalled some of its fifth-generation Automated Driving Systems (ADS). It did so after some of its cars drove through closed construction zones. According to the National Highway Traffic Safety Administration (NHTSA), the affected vehicles were capable of driving through a closed freeway construction zone and continuing to drive at speed. The listing on the NHTSA website says that Waymo is currently developing a solution to fix this issue, but in the meantime, freeway driving is being restricted. Waymo will update its ADS software so that vehicles can detect when they can avoid entering construction zones. According to the Safety Recall Report, on April 20, 2026, Waymo’s Field Safety Committee began meetings reviewing an event from April 11, 2026, and five events from April 19, 2026, where Waymo’s autonomous vehicles didn’t recognize and drove past ramp closure signs into the pre-planned freeway construction zones. This took place in Phoenix, Arizona. Separately, on May 18, 2026, seven Waymo vehicles entered freeway lanes with active construction in the San Francisco Bay Area by driving between cones that were placed to show the lane was closed. On the back of both of these events, Waymo restricted freeway driving until it could address the issue. In June, Waymo’s Safety Board reviewed the issue and additional information related to ADS performances around construction zones; then, as a result, it decided to conduct a recall. This development is not good for Waymo as it adds to a growing list of technical hiccups its cars have experienced. Ultimately, it will lead to more scrutiny from lawmakers around the world who will be more cautious about letting autonomous vehicles on their roads without tighter regulation. For readers in areas where Waymo operates, does this news make you more wary about stepping into one of these vehicles?
    • I'm still on Windows 10 22H2 because I didn't want to deal with all the issues in Windows 11, so I waited almost a week before installing the latest Patch Tuesday update (KB5094127), I went ahead and did it, and it was a huge mistake—ever since then, my File Explorer has seen a performance drop of about 30% when transferring large files... Once again, Microsoft has outdone itself! This update cannot be uninstalled, either through the Control Panel (via Settings) or by accessing Advanced Startup Options. The only possible alternative would be to use system restore points, but I’d have to reinstall all app and driver updates (and there’s no guarantee it would work). Or there’s the “nuclear option” of a in-place repair without losing files or apps, but even then, all my customizations would be lost! Microsoft just can’t help but mess everything up! Way to go, Microsoft! But I still don’t want your c****y Windows 11!
  • Recent Achievements

    • Week One Done
      Eurosoft10 earned a badge
      Week One Done
    • One Month Later
      Eurosoft10 earned a badge
      One Month Later
    • One Year In
      Skeet Campbell earned a badge
      One Year In
    • One Month Later
      Sharbel earned a badge
      One Month Later
    • First Post
      BizSAR earned a badge
      First Post
  • Popular Contributors

    1. 1
      +primortal
      599
    2. 2
      +Edouard
      190
    3. 3
      PsYcHoKiLLa
      79
    4. 4
      Michael Scrip
      77
    5. 5
      Steven P.
      70
  • Tell a friend

    Love Neowin? Tell a friend!