System Doctor annoyance

[CrunchyFrog]

I get this problem too. System Doctor is not present on my system and I'm using Firefox. It looks like systemdoctor's redirect is being inserted into the datorrents HTML stream in some fashion. Can I ask if the datorrents servers have been checked for this malware?

Regards

Steve Murphy

[CrunchyFrog]

I've been doing a bit of digging and System Doctor appears to be associated with AdBrite text ads. On the index page and occasionally here in the forums I get words double underlined and moving the mouse over them causes a small pop-up ad to appear temporarily. Clicking on the About this advertisement link bring up a page saying:

This is an Inline ad developed by AdBrite for DaTorrents Bittorrent Community. It is identified with a double-underline and all corresponding text ads are clearly marked with "Advertisement" or "Sponsored Link". Thanks for supporting DaTorrents Bittorrent Community!

If this is really something they've negotiated with DaTorrents then I'd guess we've found the vector for infection. The fact that the text specifically names DaTorrents web site would at least indicate that the site is targeted by these low lifes and that the problems people are experiencing are not related to their own setups.

Any thoughts?

Steve Murphy

[Blanchimont]

Are you sure about Adbrite?
Pg2 blocks AdBrite by default, and I checked the log for the last 24 hours and there was no entry of it as far as I could find.(It's easy to check too because it belongs in the HTTP-range which Pg2 also blocks by default and is thus color-coded)
And believe me, I've been on Datorrents a lot during that time.
I also have a hard time believing Adbrite would be cause of this, because a lot of sites use it, and something like this would too easily turn against them..

Sincerely, Blanchimont

[CrunchyFrog]

No, I'm not certain about AdBrite: perhaps I'm doing them a disservice, it has however arisen as a factor in a number of similar reported problems on other forums. I don't know what the source data for AdBrite ads are but the whole mechanism of inserting external HTML into an otherwise stable page seems ripe for exploitation if the source checking isn't up to snuff. I'll try blocking adbrite.com in my browser and seeing if that makes the problem go away.

OK, blocking ads.adbrite.com in Firefox using Adblock stops the problem immediately and completely. I think this is pretty strong evidence that AdBrite is the vector for the dodgy redirects. Even if we allow that they are not directly responsible but have had their source data interfered with, then they should be held accountable for the problem.

I'll hold my hand up and admit that I'm no expert in HTML spoofing and stream insertion, but twenty years of working in the computer industry tells me that contacting AdBrite is the starting point for a solution to this problem and I wouldn't be looking anywhere else until I was sure that they had addressed the issue very seriously.

I guess we wait and see what happens next. At least I have a solution that works . I hope others will find it useful too.

Regards

Steve Murphy

[cloudy]

I just have Norton for protection but still this doc pops up, but once I click off and come back on it is ok
I think this docker contraption is a virus it'self trying to get you to download it.
I mean why here and now I mean alot of people get all sorts of virus's and this just pops up huh