uggabugga

HOME RSS | .

Thursday, October 15, 2009

AVG security warning for Yahoo ads?

On XP w/FF 3.14 & AVG Free 8.0.238 the following warning appears when visiting eschatonblog.com:

Danger: AVG Search-Shield has detected active threats on this page and has blocked access for your protection.
The page you are trying to access has been identified as a known exploit, phishing, or social engineering web site and therefore has been blocked for your safety. Without protection, such as that in the AVG Security Toolbar and AVG, your computer is at risk of being compromised, corrupted or having your identity stolen. Please follow one of the suggestions below to continue.

IP Address: 66.94.242.24

Another report (from Spain) has the IP address of 77.238.174.11.

IP lookup for those two IPs are:
ad3.rm.vip.sp2.yahoo.com
ad1.c3.vip.rm.ch1.yahoo.com

[UPDATE: also this: ad1.vip.rm.sk1.yahoo.com]

Somebody else gets the message when visiting a Yahoo homepage.

The warning appears about one second after the page begins to fill, as if the basic skeleton is okay, but a callout for an ad is triggering the warning.

Looks as if AVG has some sort of entry that indicates trouble from a Yahoo source. May not actually be trouble, but putting it out here in case anybody has encountered the same problem and is Googling around to see if others have had the same experience.

posted by Quiddity at 10/15/2009 11:39:00 PM

3 comments

Yesterday I found this bit of code in a yahoo ad -

img src="http://ads.bluelithium.com/pixel?id=372009&t=2" width="1" height="1"

which appears to be the nasty bit that triggered AVG. Basically it's a 1x1 pixel image (invisible) that is an old form of tracking browser usage back before there were tracking cookies. Dunno if it's innocuous but Yahoo gets the "benefit of the doubt" from me while other sites do not.

By darms, at 10/16/2009 6:02 AM

darms: I agree Yahoo gets the benefit of the doubt. Good catch on the 1x1 pixel.

By Quiddity, at 10/16/2009 7:48 AM

Long time ago I set up my hosts file to block bluelithium.com. I forget why but I must have done it for a reason.

By Anonymous, at 10/16/2009 5:48 PM