Interesting- a virus that injects ads directly into the DOM.

On Sun, Mar 11, 2012 at 19:03, Bala Jeyaraman <sodabot...@gmail.com> wrote:

> mostprobably adware in his machine. A smiliar report in portugese
> wikipedia is here:
>
> http://translate.google.co.in/translate?hl=en&sl=pt&u=http://pt.wikipedia.org/wiki/Wikip%25C3%25A9dia:Esplanada/geral/Spam_na_Wikipedia,_problema_%2810mar2012%29&ei=TqlcT9fyMs2rrAe468GlDA&sa=X&oi=translate&ct=result&resnum=5&ved=0CE4Q7gEwBA&prev=/search%3Fq%3D%2522ads%2Bnot%2Bby%2Bthis%2Bsite%2522%2Binjection%26hl%3Den%26safe%3Doff%26client%3Dfirefox-a%26hs%3D6zj%26rls%3Dorg.mozilla:en-US:official%26prmd%3Dimvns
>
> On Sun, Mar 11, 2012 at 4:57 PM, Aditya Sengupta <apsengu...@gmail.com>wrote:
>
>> A friend got in touch with me about this. He is currently seeing
>> advertisements on Wikipedia pages (on all pages except the home page). Here
>> is a link to a screenshot:
>>
>> http://i.imgur.com/dhKyR.jpg
>>
>> These advertisements were not visible to him when I asked him to check
>> through the secure WM server. These advertisements are also not visible to
>> him on any other web page. To the bottom right of each ad, there is some
>> text that says, "ads not by this site". I've taken a quick look through the
>> page source he forwarded, nothing looks untoward. His right-click menu does
>> not appear when he right-clicks on the ad.
>>
>> He is based out of Mumbai and ISP is "Tata Teleservices Maharashtra Ltd".
>> His IP address is 114.143.88.193 (or was, while he accessed this page; I've
>> since had him change his IP address since I'm sharing this one). I'm not
>> sure if this issue is restricted to Mumbai; since the IP address shows up
>> in Pune when I try to geolocate it (though I understand this is fairly
>> common).
>>
>> The link he is directed to when he clicks the ad is this:
>> http://www.inkfruit.com/combo-landing?utm_source=CMP1002Combo&utm_medium=CPM&utm_content=combobanner&utm_campaign=Combo.
>> I'm adding this here and copying the founder of Inkfruit since the campaign
>> data in the URL parameters may help identify the problem (also, I'm not
>> sure if Inkfruit is aware of this campaign).
>>
>> I've copied my friend here in case there are further questions he could
>> help answer.
>>
>> Could this be a case of DPI by his ISP, or simply malware on his machine?
>> If it were the former, what would be the legal status of the issue?
>>
>> _______________________________________________
>> Wikimediaindia-l mailing list
>> Wikimediaindia-l@lists.wikimedia.org
>> To unsubscribe from the list / change mailing preferences visit
>> https://lists.wikimedia.org/mailman/listinfo/wikimediaindia-l
>>
>>
>
> _______________________________________________
> Wikimediaindia-l mailing list
> Wikimediaindia-l@lists.wikimedia.org
> To unsubscribe from the list / change mailing preferences visit
> https://lists.wikimedia.org/mailman/listinfo/wikimediaindia-l
>
>
_______________________________________________
Wikimediaindia-l mailing list
Wikimediaindia-l@lists.wikimedia.org
To unsubscribe from the list / change mailing preferences visit 
https://lists.wikimedia.org/mailman/listinfo/wikimediaindia-l

Reply via email to