Malicious advertisement at diepresse.com

Yet another non-English language web site has been targeted by a malicious advertising campaign.  I'm beginning to wonder if it is simply becoming to hard for the fraudsters to sell their wares to English language web sites because of the persistent attention we have been focusing on this problem, and the publicity that has resulted, and that they are therefore shifting their attention to European countries in the hope that victims there have not seen the publicity that has been so prevalent in English speaking countries.

I'm going to expand on the new table format for this blog entry, in the hope that it will make the information easier to read and understand (and take up less space).  I'll be interested to hear if you like the idea of placing all of the information in tables, and if you like the idea of a summary at the beginning of each report.

As always, let's work backwards from the final target site. 

Malicious behaviour

The diepresse.com page begins to load.  If the malicious advertisement is displayed, and the computer displaying the advertisment is not captured by the banned cities and IP list mentioned above, the web browser is redirected to the malicious domain.

Here is the malicious advertisement in situ:

First the victim will see this:

as well as this small window which will be in the corner of the monitor screen - yes, this is the actual size of the window as it appears:

As always, do not click on the OK or Cancel button.  As always, click on the close (X) button.  When we do that, we see the following - yes, that's right, the Performance Optimizer web site opens regardless of which option is selected.  Note that the info bar has appeared in IE7 warning that the site has tried to install an ActiveX control - older web browsers, or web browsers with lowered security settings, may automatically install the fraudware at this time.

Ok, so the next thing we try to do is close the Web page using the red close (X) button.  When we do that, we see the following.  Note that the OK button has focus.

Again, we ignore the OK and Cancel buttons and install use the red close (X) button.  When then see the following.  Note that there is no Cancel button this time - the site's owners are trying to trick visitors into thinking that they have no choice but to select OK.

Again, do not click on the OK button, instead click on the red close (X) button.  Once we do that, we see the following (persistent bastards, aren't they).  Note the info bar warning that the Web site in question has tried to download files to the target computer.  Simply click on the red close (X) button.  Once you do that, you have finally escaped from the tentacles thrown out by the PerformanceOptimizer site.