Apple Event: May 7th at 7 am PT

Looks like no one’s replied in a while. To start the conversation again, simply ask a new question.

Level 1

5 points

Takeover by male enhancement product ads....HELP!

It seems that banner ads and other ads on a variety of very tame websites (e.g., tvguide.com) have been taken over by ads for Vimax Pills. There are pictures of mostly naked men (hats strategically located) and comments about a larger *****. What's going on? I downloaded Safari thinking it would override the existing program, but it didn't help. Do I need to delete the existing Safari and download a new one?

I am extremely unsavvy about anything of this sort, always counting on my iMac to be free from all concerns such as this and to run smoothly allowing me to maintain complete ignorance. So now, I'd appreciate any help possible in the simplest explanation possible.

Thanks in advance.

iMac 500 Special Edition 128 MG PowerPC G3, Mac OS X (10.2.x)

Posted on Oct 12, 2008 6:38 PM

43 replies

Mulder

Level 6

8,990 points

Oct 13, 2008 5:23 PM in response to Kyle Shackley

Perhaps this issue is so new that it has not hit the Virus Scanning companies yet...

It's not a virus, so there's nothing for any antivirus company to do. This is a server-side issue and that means the web sites' systems have probably been infiltrated to serve up these types of pop-up ads, which are activated with Flash and JavaScript.

Mulder

Gerie Lopez Author

Level 1

5 points

Oct 13, 2008 6:20 PM in response to Mulder

Mulder, do you see this being solved by the website servers, or will individual users have to clean it up themselves?

Do you recommend the adblock and pith helmet programs to rectify the situation?

You keep saying "pop up," which I have always thought were new windows that open, just popping up out of nowhere. These ads are showing up in the website window itself. I just wanted to clarify. Not sure if it makes a difference or not.

I'm kind of getting used to these mostly naked guys. I might even start giving them names.

Oct 13, 2008 7:33 PM in response to Mulder

Hi Mulder,
Thanks for explaining. Could you comment on why only some computers see these ads? I loaded the Globe & Mail on my work laptop and the normal ads appeared.
Thanks.

Mulder

Level 6

8,990 points

Oct 13, 2008 8:21 PM in response to Gerie Lopez

You keep saying "pop up," which I have always thought were new windows that open, just popping up out of nowhere. These ads are showing up in the website window itself. I just wanted to clarify.

I did ask whether or not these were pop-up windows at the beginning of the topic thread, but you never answered that question, so I made the assumption that they were. If they are not, then I would have to say that it could be a Trojan Horse, which is caused by something you downloaded and installed. If it is, you should be being redirected to web sites different from the one you entered in the address bar or clicked on a link to reach. Otherwise, you probably don't have a Trojan Horse and the issue is really one of the web site itself being hijacked to serve up these types of ads.

To find out if this is the case and remove it, you need to download and run the DNSChanger Removal Tool and if it finds it, you need to restart your Mac for it to finish the task, and with any luck you will not see those ads again.

Mulder

Mulder

Level 6

8,990 points

Oct 13, 2008 8:25 PM in response to Kyle Shackley

The computers that are affected could have a Trojan Horse that is causing this, but I know of none for this purpose for Windows, nor any tool to check for and remove it if you did have it. I do know that I'm not being affected by these ads on my Mac.

Mulder

Gerie Lopez Author

Level 1

5 points

Oct 13, 2008 8:55 PM in response to Mulder

Mulder wrote:

I would have to say that it could be a Trojan Horse, which is caused by something you downloaded and installed. If it is, you should be being redirected to web sites different from the one you entered in the address bar or clicked on a link to reach. Otherwise, you probably don't have a Trojan Horse and the issue is really one of the web site itself being hijacked to serve up these types of ads.

To find out if this is the case and remove it, you need to download and run the DNSChanger Removal Tool and if it finds it, you need to restart your Mac for it to finish the task, and with any luck you will not see those ads again.

Mulder

Mulder, thanks again. I followed your advice above and it did the trick. It took less than 5 minutes to download and scan and did indeed find the trojan horse. The ads are gone on both Safari and Firefox and my computer is back up to its normal peppy speed. It had slowed down tremendously recently, which I attributed to my son's activity with music creation. You are my hero tonight.

BTW, I did have a talk with my son about his viewing habits!!!!!

AllisonR

Level 1

0 points

Oct 14, 2008 3:29 AM in response to Mulder

sigh

As I mentioned yesterday this is *browser hijack* malware and nothing to do with your OS, server side issues or anything similar.

Oct 14, 2008 6:54 AM in response to Gerie Lopez

The answer is: You have a Trojan Horse called DNSChanger 1.1 or other variation that is causing unauthorized ads to load in place of various websites’ scheduled ads.
The Trojan Horse is most likely in (root) /library/Internet Plug-Ins, but don't bother to try to find it in the finder or with spotlight - It's invisible.
A free trial version of MacScan will find it, isolate it, and allow it to be trashed.
Be sure to do a full scan of the entire hard drive –
I found the Trojan in the “main” library – not the user library.
If you purchase MacScan, you can perform custom scans of smaller areas of the hard drive.
You don’t need to re-install Safari
You don’t need to disable your JavaScript
You don’t need to disable your Plugins
You don’t need to install blocking programs
Just get rid of the Trojan Horse!

Oct 14, 2008 9:17 AM in response to 12th Root of 2

I used the trial version of Ad-Aware this morning and it appears to have fixed the issue. No more naked men!
Thank you to all for the help with fixing my problem! I really appreciate it.

shaplaa

Level 1

0 points

Oct 15, 2008 9:03 AM in response to Gerie Lopez

Vimax Banner ads are ridiculous. Why have they taken over? Who can we complain to?

rat666

Level 1

0 points

Oct 17, 2008 10:28 PM in response to shaplaa

Thank you so much for that solution (re. DNS Removal Tool). I was going nuts for my kids to
have to see those ads. I'm not prissy, but this is unacceptable for my kids to see while surfing news sites. I'd like to join a complaint, if anyone can help.

any idea how the trojan horse got in?

Nov 4, 2008 6:45 AM in response to rat666

I've been having these vimax banner problems, too. I was overjoyed to find out that so many other people are having this problem, and it's not just me.

However, my problem just won't go away. I've downloaded and installed MacScan and the DNS Trojan remover, and used both to scan my system. I've run multiple full system scans with MacScan, and successfully removed the trojan with the DNS remover.

But when I go to macworld, I still get those naked guys in the top banner.

I downloaded PithHelmet for Safari, and it successfully blocks the ads from appearing - which is all right by itself, but I'd much rather fix the problem and remove this offending file instead of covering it up.

I have no idea how to kill this thing. Is there a terminal fix?

Nov 6, 2008 1:16 PM in response to GuitarWolf101

This article on Macworld does shed some light on the issue. They say a product called Virus Barrier by Intego might help. I'm not endorsing it or anything, since I've never used it, but I would be interested in hearing if anyone else has tried it.
http://www.macworld.com/article/60823/2007/10/trojanhorse.html

bugmore

Level 1

0 points

Nov 16, 2008 12:13 AM in response to GuitarWolf101

It is your wi-fi router. The infection blocks windows update and re-directs searches to god-knows-where, mainly msn.com to start. Reset it, replace it, whatever. I found it without any forum help. Just what to "gift" this info to the world.

Kevin S.

Level 1

94 points

Nov 18, 2008 5:51 PM in response to bugmore

bugmore wrote:
It is your wi-fi router. The infection blocks windows update and re-directs searches to god-knows-where, mainly msn.com to start. Reset it, replace it, whatever. I found it without any forum help. Just what to "gift" this info to the world.

Could anyone confirm if this indeed WAS a router issue?

Sorry to keep this thread going, but I'm trying to diagnose an issue remotely for a family member. It seemed to first infect his computer (he installed something), and then his room mates (on xp pc's) ended up seeing the same ads... very strange..

Takeover by male enhancement product ads....HELP!