ALERT: Please treat adtrafficserv.com with extreme caution

I have found a bad URL that redirects viewers to the fraudware domain systemscanner2008.com page, being:

adtrafficserv.com/?ref=md&aff=tr.

This URL in turn redirects to:

3gigabytes.com/soft.php?aid=<<removed>>&d=3&product=XPA

and from there the viewer is led to:

systemscanner2008.com/2008/3/freescan.php?aid=<<removed>>.

adtrafficserv.com shares A-Record IP with the site winerrorfixer.com.  It also shares IP with adnovations.com and winsolution.org.

Such redirects are often geographically targeted.  Do not be surprised if you end up at a different fraudware site when testing the URL, or if you end up at a "safe" site.

image

Published Thu, Aug 21 2008 13:30 by sandi
Filed under: ,

Comments

# re: ALERT: Please treat adtrafficserv.com with extreme caution

Sunday, August 24, 2008 10:40 AM by Tommy

Hi,

For the past week or so I have had that warning popup to direrct me to install XP antivirus... but have seen it as a potential threat so have ignored it.  But I am having new explorer windos pop-up with web sites I have not asked for. SO my PC is obviously infected. Have done several Ad Aware scanns ( normally this works great ) but it has not found this virus, trojan, worm ... what ever it is.  

Any suggestions?

The warning pop-up has an address of : systemsanner2008.com/.../freescan.php Internet Explorer

Very irritating and alarming,

Thanks,

Tommy

# re: ALERT: Please treat adtrafficserv.com with extreme caution

Sunday, August 24, 2008 7:27 PM by sandi

The criminals behind systemscanner2008.com have infiltrated the advertising networks used by advertising supported freeware (AdVantage is a recent example) - AdVantage (Vomba) is used by several 'freeware' applications to supply advertising.  

Do you have any freeware installed?

# re: ALERT: Please treat adtrafficserv.com with extreme caution

Tuesday, August 26, 2008 7:14 AM by Rob Clapworthy

Was having the same problem. Was caused by a Virtumonde variant. Ran SuperAntiSpyware Home Edition (free) & problem was removed after a full scan. Result