Carl Tyler's Blog :: Anyone else seen this?

Category None
Reading a couple of blogs, I have seen a popup appear as a layer on them. I have seen it happen on Richard Schwartz's and Rocky Oliver's so far. I have the latest virus scanning software on my machine and have ran adware scans etc. They all turn up nothing. Here's what I see:

Then when I leave the page I see:

Has anyone else seen this? Perhaps Rocky and Richard have some code on their pages that is coming across from somewhere else that has been hijacked? I notice they both have the creative common license logo, is that code generated?

Not sure if this helps Rocky or Richard, but here are the cookie contents for both sites, I think cookies might be involved as I don't see it everytime.

Power of the Schwartz
ASLTRG1=28#24#.net#21070#18866#.hfc.comcastbusiness.net#70.88.208.81#en-us##21601094#18813#14659#506#5;
FRQSTR=18786156x198205:1:4297|18786156|18786156|18786156|18786156;
WIDYMD=#32432:EIS#30560:EIS#;
KIDYMD=#196723:EISD#198205:EISA#;
VISKAM=#196723-66986#198205-65581#;
VISWEB=#32432-441705-66986#30560-410100-65581#;
SESTEST=1;
BSUID=1

Lotus Geek
FRQSTR=18786157|18786157|18786157|18786157|18786157;
WIDYMD=#32432:EIS#30560:EIP#;
KIDYMD=#196723:EISB#195617:EIPA#195236:EILA#;
VISKAM=#196723-67020#;
VISWEB=#32432-441705-67020#;
ASLTRG1=28#24#.net#21070#18866#.hfc.comcastbusiness.net#70.88.208.81#en-us##21601500#18813#14659#506#5;
BSUID=1;
SESTEST=1

Comments

1 - I've noticed this too - on both. Using Firefox, no adware according to Ad-Aware, I get several popups....

Posted by Brian Benz At 06:44:37 PM On 09/19/2005 | - Website - |

2 - When did this start? One thing that Rocky and I have in common is are use of NedStat, and there was a recent change in name (and possibly in ownership) there.

I don't get the popups on my own site or Rocky's, and I can't imagine where those cookies are coming from. When I go to my own site I see one cookie from Nedstat, and the BSUID cookie, but no others.

Posted by Richard Schwartz At 07:19:25 PM On 09/19/2005 | - Website - |

3 - I use NedStat too, so if that's the problem you should see it when you go to my blog...

Posted by Duffbert At 07:21:23 PM On 09/19/2005 | - Website - |

4 - I have gotten it a few times recently as well.

Posted by Ben Langhinrichs At 07:58:08 PM On 09/19/2005 | - Website - |

5 - It's the NedStat code. Will post my results shortly.

Posted by Richard Schwartz At 09:25:55 PM On 09/19/2005 | - Website - |

6 - First time I saw it was last week.

Posted by Carl At 10:06:02 PM On 09/19/2005 | - Website - |

7 - The opinion people might have about NedStat, you explicitly excluded reminds me on a dialogue with a cop "How expensive would it be to call a police officer a {if-you-say-the-word-mother-will-wash-your-mouth-with-soap}?" "Very expensive, it could land you even in jail". "Oh, ok. How lucky I didn't say it".

stw

Posted by Stephan H. Wissel At 04:46:43 AM On 09/20/2005 | - Website - |

8 - Well, I have noticed random popups, but couldn't pin it down. Nedstat was recently purchased by someone else, so I am sure it is the culprit.

I have removed Nedstat from my blog, and have deleted my account with them. Please let me know if the popups continue, and I'll investigate further.

Rock

Posted by Rock At 03:18:01 PM On 09/20/2005 | - Website - |

9 - I have blogged about this situation and my decision to remove Nedstat/WebStats4U from my site. You can read about it here:

http://www.lotusgeek.com/SapphireOak/LotusGeekBlog.nsf/d6plinks/ROLR-6GEQPR

Thanks for the heads-up, Carl. And to everyone else, sorry about the popups...