Kasperksy Trojan warnings several times a day on this site

[Jong]

Unique to this site!

Been getting this for a couple of weeks now, presumably from an advertising partner?

Attached is a log of the more recent ones. Any chance someone can kick back at those feeding these ads and fix?

Inactive    other-discussions    http://vma.tgdaily.net/www/delivery/ajs.php?zoneid=255&target=_blank&cb=85990089107&charset=UTF-8&loc=http://www.snbforums.com/forums/other-discussions.30/create-thread&referer=http://www.snbforums.com/forums/other-discussions.30/&mmm_fo=1//?     09/04/2015 11:29:06    HEUR:Trojan.Script.Generic   
Inactive    time-scheduling-ip-blocking    http://vma.tgdaily.net/www/delivery/ajs.php?zoneid=255&target=_blank&cb=19607858918&charset=UTF-8&loc=http://www.snbforums.com/forums/asus-wireless.37/&referer=http://www.snbforums.com/threads/time-scheduling-ip-blocking.23813/&mmm_fo=1//?     09/04/2015 11:25:43    HEUR:Trojan.Script.Generic   
Inactive    time-scheduling-ip-blocking    http://vma.tgdaily.net/www/delivery/ajs.php?zoneid=255&target=_blank&cb=17925364826&charset=UTF-8&loc=http://www.snbforums.com/forums/asus-wireless.37/&referer=http://www.snbforums.com/threads/time-scheduling-ip-blocking.23813/&mmm_fo=1//?     09/04/2015 10:33:51    HEUR:Trojan.Script.Generic   
Inactive    rt-ac55u-a-newer-rt-ac56u    http://vma.tgdaily.net/www/delivery/ajs.php?zoneid=255&target=_blank&cb=34561886870&charset=UTF-8&loc=http://www.snbforums.com/forums/asus-ac-routers-adapters.47/&referer=http://www.snbforums.com/threads/rt-ac55u-a-newer-rt-ac56u.23829/&mmm_fo=1//?     09/04/2015 10:32:12    HEUR:Trojan.Script.Generic   
Inactive    rt-ac87u-tweaks-and-tips    http://vma.tgdaily.net/www/delivery/ajs.php?zoneid=255&target=_blank&cb=82120017543&charset=UTF-8&loc=http://www.snbforums.com/forums/asus-ac-routers-adapters.47/&referer=http://www.snbforums.com/threads/rt-ac87u-tweaks-and-tips.23822/&mmm_fo=1//?     09/04/2015 10:11:03    HEUR:Trojan.Script.Generic

 

[thiggins]

I can't do much without knowing which ads trigger the warning

 

[Jong]

Sorry, not an expert in this at all , but don't those links help you at all? What's the link with you and tgdaily?

 

[thiggins]

vma.tgdaily is the ad server. The information you sent indicates the ads are coming from Google AdSense. But they don't identify the specific ad.

This happens from time to time. But Google usually finds and kills the ads quickly. Since you say they are happening for "weeks", it would help if you took a screenshot next time it happens so we can see what the ad is.

 

[Jong]

I understand. Yep, "weeks" isn't very clear is it. Just had a look on this PC and the 1st was on the 2nd of April, but I think I had them earlier on another. I'll let you know if I find anything.

I'll also try to give you a screen grab. Of course there are a few ads on a page and I'm not sure what Kaspersky does when it disables them - are they still visible? We'll see.

 

[Jong]

Just got it on 2 pages - one browsing around to try and trigger it and once coming back here to post about it! No obvious bad ads here. I don't know if the bad ad is not being displayed or if it is a "web bug".

Edit: looks like the top banner ad is being blocked by Kaspersky or is a web bug.

 

[L&LD]

Those attachments are too small and low quality to be of any use.

 

[Jong]

Yep, I was worried about that, but I had to zoom out Chrome to fit the whole page on the screen and to make things worse the forum seems to resize them when it imports them (the originals are bigger). Yes, I could have uploaded to Imgur or something but really all you can see on the originals is that the top ad is missing in each shot and you can see that in these too. Not a lot of help tbh.

 

[Jong]

Just had another and once again all there is to see is there is no top banner.

 

[thiggins]

Ok. Nothing else for you to do. I'm confirming they are coming from Google, then will see what I can do. Sorry for the hassle, but this stuff happens.

Meanwhile, be glad you have AV running!

 

[Jong]

Yep, no worries. As you say, stuff happens. Thanks for the swift attention.

 

[thiggins]

One other experiment you can try. Narrow your browser window so that the right side column moves to the bottom of the screen. That will serve a mobile size ad.

That way, we can see what size the poisoned ads are.

 

[thiggins]

Our ad operations found the problem. Should be fixed shortly. Sorry for the problem.