Blloko adresat reklame me HOSTS file.

nga **Geri** Fri 12 Mar 2010 - 7:06

Ne rastet me te shpeshta AntiViruset qe
kemi ne dispozicion - nuk mjaftojne per "shetitje" te sigurt ne
internet. Disa rreziqe na vijne nga
shtresat e fundme te faqeve tona te besueshme qe i vizitojme
rregullisht.

Shumica e anetareve te forumit ndodhe qe poaq shpesh vizitojne edhe
faqen e njohur FACEBOOK, e cila poashtu sherben reklama nga sajte te
treta nder te
cilat eshte edhe ad. bannerconnect.net.

Nese BannerConnect ads nuk eshte jane te "rrezikshme" vetvetiu,
afiliatët e tyre nuk ka pse te mos jene!

Thenie:

Roger Thomson nga Exploit Prevention Labs rrefehet:

No rootkit, and no detection from any AVs that I had access to, but
after a reboot, I found that now, when I started IE and went to my home
page,
I got extra copies of the browser starting, and ads being served.

It’s hard to sort out, but here’s the critical sequence of
connections …
Facebook calls to bannerconnect
208.67.70.3 Referer: http://ads.ak.facebook.com/ads
[snip], Host: ad.bannerconnect.net

bannerconnect calls to yieldmanager
208.67.70.3 Referer: http://ad.bannerconnect.net/st?ad_t
[snip], Host: ad.yieldmanager.com 208.67.70.3 Referer: http://ad.bannerconnect.net/st?ad_t
[snip], Host: ad.yieldmanager.com

yieldmanager calls to valuead
69.63.219.104 Referer: http://ad.yieldmanager.com/iframe3?
[snip], Host: reduxads.valuead.com 69.63.219.104 Referer: http://ad.yieldmanager.com/iframe3?
[snip], Host: reduxads.valuead.com

valuead calls to megapromition,
which throws an exploit (MS06-014), which runs an adware
installer85.17.161.17 Referer: http://reduxads.valuead.com/test?pi
[snip], Host: http://www.megapromition.net

After reboot, an Internet Explorer launch that should just show
google looked like this …[mungon fotoja]
etj.

Pra, ad.bannerconnect.net therret ad.yieldmanager.com -
ad.yieldmanager.com, me tej therret reduxads.valuead.com dhe ky i fundit
mund te therrase
megapromition apo cilendo faqe tjeter me 'expoite' te treta qe hapin
vrima ne sistemin tuaj te mbrojtjes.

Eshte e qarte se "...", dhe "pse" bannerconnect eshte futur ne listen e
"hostereve" te rrezikshem, dhe perse shumica e AV me te avancuar do ta
bllokojne automatikisht permbajtjen qe servohet prej tyre. Por sic thame
jo te gjithe mund te kene mundesine per te poseduar AV gardiane aq te
avancuar ne laptopet dhe PC e tyre.

Keto "aditive" anash rrezikun permanent ndaj sigurise se sitemit tuaj,
rendojne faqet dhe lidhjen tuaj...

A KA SHPETIM?

Krijoni shtekun si ne vijim:

[Djathtas-klik ne "Desktop"] (zgjidhni) New \ Shortcut
[Ne panelin e hapur te fusha "Browse" kopjo vargun e meposhtem]
Target:
%WINDIR%\NOTEPAD.EXE %WINDIR%\SYSTEM32\DRIVERS\etc\HOSTS
[Kliko] Next \ [Tek "type a name for this..." shkuaj: "EDIT HOST"
[kliko] Finish
(Ne Desktop do te shihni ikonen e krijuar)

1. Hapeni shtekun "Edit Host" || Selektoni dhe fshini cdo gje!
2. Kopjoni kodin ne vijim dhe mbylleni\ruajeni dokumentin.

Kodi:

127.0.0.1 localhost
#------------------------------------
127.0.0.1 content.bannerconnect.net
127.0.0.1 ad.bannerconnect.net
127.0.0.1 ym.bannerconnect.net
127.0.0.1 ad.yieldmanager.com
127.0.0.1 reduxads.valuead.com
127.0.0.1 ad.yieldmanager.com
127.0.0.1 clk.atdmt.com
127.0.0.1 click.atdmt.com #!
127.0.0.1 atdmt.com #!
127.0.0.1 image.atdmt.com
127.0.0.1 ll.atdmt.com
127.0.0.1 mir.atdmt.com
127.0.0.1 nc.atdmt.com
127.0.0.1 rmd.atdmt.com
127.0.0.1 spd.atdmt.com #!
127.0.0.1 spe.atdmt.com
127.0.0.1 srch.atdmt.com
127.0.0.1 view.atdmt.com
127.0.0.1 www.atdmt.com
127.0.0.1 spd.atdmt.speedera.net
127.0.0.1 cts.channelintelligence.com
127.0.0.1 media.fastclick.net #!
127.0.0.1 reklama.albasoul.com
127.0.0.1 tag.contextweb.com
127.0.0.1 ad.doubleclick.net
127.0.0.1 doubleclick.net
127.0.0.1 www.smartadserver.com
127.0.0.1 www.doubleclick.com
127.0.0.1 googleads.g.doubleclick.net
127.0.0.1 pagead2.googlesyndication.com
127.0.0.1 sc1.sclive.net
127.0.0.1 scripts.chitika.net
127.0.0.1 mm.chitika.net
127.0.0.1 chitika.net
127.0.0.1 kontera.com
127.0.0.1 ads.bridgetrack.com
127.0.0.1 bncnt.com
#------------------------------------

Keshilla: kopjoni permbajtjen te tere saktesisht ashtu si eshte me
gjiteh vijat ndarese (#--..), kjo do tua mundesoje te dalloni me sy nese
ndonje
adware ka ndryshuar ndogje ne kete file - kete do ta dini nese vereni
rrjeshta te shtuar perfundi vijes se fundit ndarese.

URIME
Posa forcuat "vine e pare te frontit" qe do t'ju mbroje nga "ads"
[aditivet] me te shpeshte te faqeve] dhe spiun-veshjeve me te shpeshta
ne
internet.

Hapi qe keni marre do t'ua shpejtoje hapjen e faqeve te forumit deri ne
30% ndoshta edhe me shume. Kete do te mund ta vereni ne praktike poasa
te keni
kryer proceduren e dhene siper dhe te keni mbyllur e hapur Browserin.
Efektive ne Mozilla, Explorer, Opera, etj...