Adware on Neowin


Recommended Posts

Heh. Darn those Firefox users! *shake fist*

Hmmm, that's a BC-registered numbered corporation, in the same province where I'm in (where I happen to head up the security/abuse desk of a Tier 1 carrier). I hope those clowns aren't with us. :|

Anyone know the IP address where the first download is coming from? If the ad's still up, maybe I'll fire up a vmware win98 session and see if I can capture it.

It seems to me that neowin or its ads are changing my homepage, cuase after a hour browsing around in other forum (after using ccleaner to clean all the interent stuff on my comp,run adaware and spybot) nothing happen. Until just now when my homepage changed.

Before my homepage change i get this pop-up from object.passthison.com/vu083003/object.cgi?homepage1

ANY help

The same IP address range keeps appearing. I would suggest using your firewall to block 209.50.252.0/24:

Non-authoritative answer:

Name: object.passthison.com

Addresses: 209.50.252.113, 209.50.252.114, 209.50.252.116

%whois -a 209.50.252.113

ServInt Corp. SERVINT-CIDR-1 (NET-209-50-224-0-1)

209.50.224.0 - 209.50.255.255

ServInt Internet Services SERVINT-INTR-2 (NET-209-50-252-0-1)

209.50.252.0 - 209.50.252.255

# ARIN WHOIS database, last updated 2004-03-17 19:15

# Enter ? for additional hints on searching ARIN's WHOIS database.

%whois -a servint-intr-2

OrgName: ServInt Internet Services

OrgID: SIS-31

Address: 6861 Elm St.

City: McLean

StateProv: VA

PostalCode: 22101

Country: US

NetRange: 209.50.252.0 - 209.50.252.255

CIDR: 209.50.252.0/24

NetName: SERVINT-INTR-2

NetHandle: NET-209-50-252-0-1

Parent: NET-209-50-224-0-1

NetType: Reassigned

NameServer: NS.SERVINT.COM

NameServer: NS2.SERVINT.COM

Comment:

RegDate: 1998-06-30

Updated: 2001-05-15

TechHandle: NO178-ARIN

TechName: Network Operations

TechPhone: +1-703-847-1421

TechEmail: [email protected]

I can tell you right now, Neowin does not (nor ever has) support any forms of Spyware/Adware/Malware/Asshatware. The blame for this one lies in one of the Advertising companies that Neowin receives it's banners from, Redmak will resolve this issue as soon as possible.

Thanks again for your concern,

Cara

Global Moderator

All of you Firefox users are blocking our Ads I suppose...great to help out the site's funding.  :rolleyes:

I'm using firefox and i'm not blocking anything related to neowin's ads. :)

So "ALL" is not a good way to say it :/

Weak ass trojan can't even infect with my McAfee disabled lol.

Well the "trojan" is hosted on http://www.achtungachtung.com/0021 (this is where all the parts of the "trojan" are located) but I can't tell you much more because I can't get the whole thing downloaded. I have the part that installs the trojan but not the part it downloads after you're infected.

I'm willing to bet though that this trojan aint a trojan but a crappy spyware program. The infecter part(index[1].html is pretty small but makes several references to LaunchJpu.php which in turn references scriptbody.jsp which then references payloadexe.exe(which I can't seem to get). It also mentions C:/WINDOWS/PCHEALTH/HELPCTR/System/panels/Context.htm and has several paths to notepad coded into it but just what it does I can't say because I can't get payloadexe.exe, and on top of that even if I could I probably wouldn't understand it as easy as I would a script like the other files.

I'm working on this but as I don't get these ads myself it's quite hard to pinpoint its origin.

If any of you get this ad again could you please provide me with:

The link of the banner that is showing at that time (so do a mouseover and read your IE status bar) and if you could even provide me with the source code of the page (the neowin page) so I can check the ad code in there.

I was in this thread

https://www.neowin.net/forum/index.php?showtopic=149643

And the ad above was

http://oz.valueclick.com/cycle?host=hs0279...script=1;msizes

"Free! Online Diabetes menu planner Click here to use it now"

Hoped i have help, off to scan my comp, how gay :blush:

Oh can someone look in there registry and go to

Hkey_Current_user\software\microsoft\internet Explorer\main

and look for

search bar

search page

And tell me what is the defualt data suppose to be. So i can change mines :)

i found that mines said smartbotpro which i guess is affiliated with the Passthison crap, after doin research on it.

Currently in my registy (pic below)

post-19-1079623857.jpg

Oh can someone look in there registry and go to

Hkey_Current_user\software\microsoft\internet Explorer\main

and look for

search bar

search page

And tell me what is the defualt data suppose to be. So i can change mines :)

i found that mines said smartbotpro which i guess is affiliated with the Passthison crap, after doin research on it.

Currently in my registy (pic below)

Those registry keys are not a default part of Internet Explorer. They are a part of the "adware" you are describing. I would delete them personally.

after some time again researching about passthison, i have learn that this Hijacking occured becuase of some flaw/hole in IE.

Would it be in my best interest to switch to firefox. Will it rid me of my problem.

Other forum also sent me a popup and reset my homepage. i have tried everything to get rid of it, including going to safe mode with CMD and del index.dat/s. I manage to browse around neowin by pressing hte stop button before the ads load.

Firefox - yay or nay?

I was getting the same crap yesterday. I thought it was just me, but looks like others are complaining now as well. I got rid of it by running HiJackThis and removing the entries for it. I didn't even get one of those installer windows, like in some screenshots. I just got a normal popup that opened and was closed instantly by the google toolbar, and then after that popup I had problems.

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.
  • Posts

    • Nice, hope they *finally* fixed the issue with the NTFS driver where the system would completely brick during large file copies using the built in driver. It's been broken for years requiring me to use the older, slower, NTFS-3G FUSE driver.
    • Windows 11 KB5094126 BSODing, freezing, forcing BitLocker lockout, breaks OneDrive, and more by Sayan Sen Microsoft released Windows 11 KB5094126 and KB5093998 last week as the latest Patch Tuesday updates. Following that the company also published the accompanying dynamic updates under KB5094149, KB5095971, and KB5094156. While Microsoft has so far not acknowledged any major problems with the release, some users online are running into problems. These range from OneDrive and Dropbox access issues, BitLocker recovery lockouts, to blue screens and BSODs. The most common one seems to be happening with HP systems wherein affected users say they hit 0xc0430001 BSOD (blue screen of death) error code after the KB5094126 update. We wonder if this could be related to the recent bug we covered on HP devices wherein the ongoing Secure Boot certificate updates are leading to similar issues. While we are not certain, users affected by this issue likely need to ensure that the boot.stl file is included on the installation media (such as a USB installer or ISO), if the above-mentioned dynamic updates are deployed. If this file is missing, computers may fail to boot from the installation media and could display the error 0xc0430001. This STL file is used by Secure Boot to verify that the boot files are trusted, so it must match the same Windows version and system architecture. To ensure the file is included, Microsoft recommends using the Update WinPE script, which automatically updates the image and handles the required files. Alternatively, you can manually copy the boot.stl file from the Windows\Boot\EFI folder on a Windows device and place it in the matching folder on your installation media before deploying the updated image. Aside from blue screening some users also note their systems have been freezing following the update. This could be happening to Lenovo PCs specifically. In the case of the OneDrive and Dropbox access issues, a user figured out that there could be a conflict with UAC. He explained: "Okay, so I did some digging, and in our environment KB5094126 breaks OneDrive and Dropbox in Explorer. I went through all our GPOs and found out that the combination of disabling UAC and having my user being a local admin breaks OneDrive in Explorer. ... If I enable UAC again, then it works, even with KB5094126 still installed." Hopefully, Microsoft will look into these issues. Source: Microsoft forum (link1, link2, link3, link4), Reddit (link1, link2, link3, link4)
    • It is when it's a desktop in my house though for a PC that's lightly used and not really important when it is. If it was a laptop, it would be a different story. The real solution is varied and begins starting at post #22 in that thread.
    • Win11Debloat 2026.06.14 by Razvan Serea Win11Debloat is a lightweight, easy to use PowerShell script that allows you to quickly declutter and customize your Windows experience. It can remove pre-installed bloatware apps, disable telemetry, remove intrusive interface elements and much more. The script also includes many features that system administrators and power users will enjoy. Such as a powerful command-line interface, support for Windows Audit mode and the option to make changes to other Windows users. All changes made by Win11Debloat can be easily reversed, and most removed apps can be restored via the Microsoft Store. A full guide on how to undo the changes is available here. Win11Debloat features: Below is an overview of the key features and functionality offered by Win11Debloat. Please refer to the wiki for more information about the default settings preset. Remove a wide variety of preinstalled apps. Click here for more info. Disable telemetry, diagnostic data, activity history, app-launch tracking & targeted ads. Disable tips, tricks, suggestions & ads across Windows. Disable Windows location services & app location access. Disable Find My Device location tracking. Disable 'Windows Spotlight' and tips & tricks on the lock screen. Disable 'Windows Spotlight' desktop background option. Disable ads, suggestions and the MSN news feed in Microsoft Edge. Hide Microsoft 365 ads on the Settings 'Home' page, or hide the 'Home' page entirely. Disable & remove Microsoft Copilot. Disable Windows Recall. Disable Click to Do, AI text & image analysis tool. Prevent AI service (WSAIFabricSvc) from starting automatically. Disable AI Features in Edge. Disable AI Features in Paint. Disable AI Features in Notepad. Disable the Drag Tray for sharing & moving files. Restore the old Windows 10 style context menu. Turn off Enhance Pointer Precision, also known as mouse acceleration. Disable the Sticky Keys keyboard shortcut. Disable Storage Sense automatic disk cleanup. Disable fast start-up to ensure a full shutdown. ...and more. Once you’ve downloaded the Win11Debloat file (Get.ps1), just follow these quick steps: Locate the Get.ps1 script file. Right-click the file and select Run with PowerShell from the context menu. If prompted by User Account Control (UAC), select Yes to grant the script the necessary administrative permissions. Win11Debloat 2026.06.14 changes: This is a minor release that hopefully addresses the false positives in Windows Defender and Bitdefender that prevented users from downloading and/or running Win11Debloat. Refactor Get-RegFileOperations.ps1 to address false positives by @Raphire in #626 Add logging around WinGet app retrieval and increase timeout to 20s by @Raphire Download: Win11Debloat 2026.06.14 | Open Source View: Win11Debloat Home Page | Screenshots 1| 2 Get alerted to all of our Software updates on Twitter at @NeowinSoftware
  • Recent Achievements

    • Week One Done
      Jeroen Wilms earned a badge
      Week One Done
    • Week One Done
      rolfus earned a badge
      Week One Done
    • One Month Later
      Leroy Jethro Gibbs earned a badge
      One Month Later
    • Conversation Starter
      flexorcist earned a badge
      Conversation Starter
    • One Month Later
      AndreaB earned a badge
      One Month Later
  • Popular Contributors

    1. 1
      +primortal
      508
    2. 2
      +Edouard
      198
    3. 3
      PsYcHoKiLLa
      138
    4. 4
      ATLien_0
      90
    5. 5
      Steven P.
      81
  • Tell a friend

    Love Neowin? Tell a friend!