Viruses detected while browsing RF.net

[Chigworthy]

For the last five minutes, Kaspersky has been detecting a Trojan.JS.redirector.ar whenever I load a page on RF.net. I tried various other pages that I visit and the trojan only pops up when I load a page here. Anyone else having issues? Could be a problem for unprotected netandos.

Edit:

Copy from Kaspersky report:

1/24/2010 9:53:13 PM Denied: Trojan.JS.Redirector.ar Google Chrome [url]http://pagead2.googlesyndication.com/pagead/show_ads.js//show_ads[url]


(I screwed up the url tag up so that it wouldn't post as a link. The url tags were added by rf.net.)

[PapaBear]

This has nothing to do with RF.net, but a coworker of mine, who's computer is very well protected, got a catastrophic virus while using Google Chrome the other day. Maybe it has something to do with that.

[Chigworthy]

It happens with IE as well, and only on RF.net. That would seem to mean it has something to do with this site.

Edit:

1/24/2010 10:14:16 PM Detected: Trojan.JS.Redirector.ar Internet Explorer [url]http://pagead2.googlesyndication.com/pagead/show_ads.js//show_ads[url]

[PapaBear]

That's very odd. My comp just finished it's scheduled scan. No problems.

[Chigworthy]

Here's a thread regarding a similar trojan tied to google syndication/ adsense, which is present in the trojans kaspersky is finding for me:

http://www.google.com/support/forum/p/AdSense/thread?tid=40ce71d66721b826&hl=en

[JustJon]

It's reading the google adsense javascript as a false positive for some reason. It's not a true virus coming from the site.

[Chigworthy]

It's reading the google adsense javascript as a false positive for some reason. It's not a true virus coming from the site.

That seems possible. If so, it would seem to be a Kaspersky issue, and not something on your server. But that link I posted from the adsense forums seems to indicate that that particular issue was a server problem. This shit gives me a headache.

[Chigworthy]

Does anyone know of a trusted site that uses adsense besides RF.net? It would be a control to determine if it was coming from .net.

[sailor]

what page was it on. i remember i had a problem like that a while back and it was an image/link that someone posted on a page.

[Chigworthy]

what page was it on. i remember i had a problem like that a while back and it was an image/link that someone posted on a page.

It is every single page I load on .net.

[~Katja~]

what page was it on. i remember i had a problem like that a while back and it was an image/link that someone posted on a page.
from what he posts it is the banner ads which are visible on every site.
Maybe if you get ad-block you won't see the problem.

[burrben]

Does anyone know of a trusted site that uses adsense besides RF.net? It would be a control to determine if it was coming from .net.

my blog (http://butwhatthehell.blogspot.com/)

[ScottFromGA]

thats odd. It hasn't done it for me here, but when I looked WB this morning, I got the same detection from Kaspersky as well.


weird.

[Snoogans]

i use firefox, ive never had shit pop up

[hanso]

Get the no script add on also.

[Chigworthy]

I didn't change a thing, and it has now stopped. Whatever was done has worked.