CastleCops, Internet Crime Fighters
Need help? Click here to register for free! Absolutely zero advertisements on this site!

$9736.22 of $21422.68
left sidedonated so farneed $11686.46 donated to reach our goalright side, our goal
Help CastleCops serve the community on new servers, Donate Here to reach our goal.

Donation/Premium
spacer
block bottom
Security Central
spacer
· Home
· PIRT/Fried Phish
· MIRT
· SIRT
· Deutsch
· Wiki
· Newsletter
· O16/ActiveX
· CLSID List
· Contest2007
· Downloads
· Feedback (send)
· Forums
· HijackThis
· Hijacktrend
· LSPs
· My Downloads
· O18
· O20
· O21
· O22
· O23
· O9
· Premium
· Private Messages
· Proxomitron
· Reviews
· Search
· StartupList
· Stories Archive
· Submit News
· WsIRT
· Your Account
· Acceptable Use Policy
block bottom
Survey
spacer
Was 2007 a good year?

Yes it was a wonderful year
Yes, but there is always room for improvement
Status quo
It was a challenge
Other (leave comment)



Results
Polls

Votes: 937
Comments: 25
block bottom
spacer spacer

clean "servedby.advertising.com" tied to i.e. 7

 
Post new topic   Reply to topic       All -> FavForums -> Trend Micro HijackThis Logs [del.icio.us!] [digg it!] [reddit!]
View previous topic :: View next topic  
Author Message
Joe Back

Guest
IP: 88.218.*.*






PostPosted: Tue Jan 23, 2007 9:24 pm    Post subject: clean "servedby.advertising.com" tied to i.e. 7
Reply with quote

If anyone can help: when I connect to imdb to look up something (i.e. a movie title) and then trying to get back to the first page of imdb, two "servedby.advertising.com" linked pages get between the current and the original page. So, I need three "back" clicks to return to imdb's home page.

Does anyone know how to clean my ie7 from this very annoying spyware?

Thanks in advance!

P.S. I have xp sp2 with norton internet security 5 antivirus. Full antivirus scans (updated) cannot find this spyware.

Back to top
PCBruiser

SRT Team Lead
SRT Team Lead
Forums Admin

Joined: May 11, 2005
Posts: 11723

1st Responder Mentors 1st Responders Forums Admin MIRT Moderators Premium Rootkit Experts Security Experts SRT Team CC Committee

PostPosted: Tue Jan 23, 2007 9:39 pm    Post subject:
Reply with quote

I have moved your thread to the HiJackThis forum. Please post a HJT log to this thread. Read the Hijackthis Guidelines Read Before Posting

The HJT forum is very busy ... please be patient ... while waiting, follow the MRP to clean your system.

If you complete the MRP before one of the 1st Responders or Security Experts assists you, please post an after MRP HJT log in this same thread.


_________________
Don't read? Can't learn!
Back to top
View users profile Send private message
dwynne

Cadet
Cadet


Joined: Aug 11, 2007
Posts: 1
Location: USA

PostPosted: Sat Aug 11, 2007 4:38 am    Post subject: Re: clean "servedby.advertising.com" tied to i.e.
Reply with quote

Joe Back wrote:
If anyone can help: when I connect to imdb to look up something (i.e. a movie title) and then trying to get back to the first page of imdb, two "servedby.advertising.com" linked pages get between the current and the original page. So, I need three "back" clicks to return to imdb's home page.

Does anyone know how to clean my ie7 from this very annoying spyware?
.


I had this exact same problem and found this thread by doing a Google search. Before I posted my hijackthis logs I went through the steps outlined here - virus scans, malware scans using 5 different products, cclean, etc. When I was ready to post my logs I found out the real problem and solution. I will post it here in case others seeing the same problem in IE7 find this thread via Google.

It is NOT spyware/malware in my case nor is it likely in user Joe Back's case. It is a bug in IE7!

I would bet you are running a hosts file full of entries from ad and bad sites set to resolve to localhost. In the file you have entries like this:

127.0.0.1 servedby.advertising.com

This keeps IE from displaying ads from this site and it worked fine in IE6 and does block the ads in IE7 - but the bug in IE7 causes it to hose up your back (previous page) function. You visit a page, like the main Amazon or imdb pages that have ads on them. You click onto a different page that has and ad or ads on it, the hosts file prevents the ad from displaying but IE7 inserts the URL you block into the browser previous page history. If there are 2 ads from the same place on the page you click on it will insert 2 bad records in the history. When you click back you don't go back, you go to the bad reference so nothing happens. Depending on the number of blocked ads it may take several clicks to get back to the actual previous page.

The fix:

Comment out or remove the entry in the hosts file for the problematic URLs and the problem goes away. Simple as that - just insert a # in column one of that line and save the changes, go back to imdb or Amazon or wherever and click around and the bad previous page bug vanishes. Of course, the pages will likely load slower and you will see the ads now.

To block the ads in a way that does not expose the IE7 bug, just add the URLs of the ad sites to the restricted sites list. Go to Internet options, security tab, click on restricted sites, then the sites button and add the URL (e.g. servedby.advertising.com) and save the changes. Exit and restart IE7 and re-do the test. The web pages should once again load faster and no ads from the sites you added should appear - and the back button once again works as it should.

I have seen this with a couple of other sites I had in my hosts file, it just depends on what page you are on and where they are pulling the ads. So when you see the bad page in your previous page history - or find you backup button did not work the first time - get the URL and check to see if it is in your hosts file and remove it and add it to your restricted sites list if you want to.

I hope this saves others lots of time and trouble. I scanned and scanned, and booted into safe mode and unloaded/uninstalled programs and found nothing wrong and nothing showed as spy or mal ware. Now I know the problem and the fix Very Happy

Dennis

Back to top
View users profile Send private message
Display posts from previous:   
Post new topic   Reply to topic       All -> FavForums -> Trend Micro HijackThis Logs All times are GMT
Page 1 of 1

 
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001 phpBB Group
spacer spacer