ottawa foodies

Sorry about this - I'm just trying to fish out a particular google ad to try to reproduce a problem that I had. More details if I can reproduce it ...

Canadian Living Chicken Breast Recipes

I just clicked on an ad named "Chicken Breast Recipes" and was redirected to a Performance Optimizer page which featured a whole lot of spyware-ish pop-up dialogs. Never got to the recipe page.

Yes, that was exactly what I experienced! Fortunately my AV caught it.

FF - perhaps something to report to google.

The link appeared to be from Canadian Living but obviously was not. So it could be that someone has compromised the Canadian Living website

I caught it here but this time it did not perform the offensive behavior :

pagead2.googlesyndication.com

Kind of makes me think that Canadian Living has been compromised

Hmm, I just clicked on your link and got the spyware-ish behaviour. The strange thing is, the second time I clicked it was fine and connected with the Canadian Living site.

I also tried deleting the associated Canadian Living and Performance Optimizer cookies from my browser cache, but still could not reproduce the initial behaviour.

I'm not allowed to click on the ad myself but I was able to dissect it and reproduce the problem. I reported it to Google and pointed them to this discussion.

I agree that Canadian Living seems either to have been hacked or they have some pretty dubious advertising connections.

Thanks, guys. N8, I experienced the same thing, where I only got the Performance Optimizer stuff on my *first* visit.

Can I ask you all to NOT click on zymurgist's link anymore -- I'm assuming it's an active adsense link, so using it could qualify as fraudulent clicks.

Here is what Canadian Living says :

Dear Alan,

Thanks for your feedback. Yours isn't the only one I've received on this topic and rest assured we take all feedback seriously.

At this point in time, we believe that our site is triggering some spyware that has been installed by something else. I'm told that there is nothing on our site that would actually be installing malicious programs, but that somehow, some features are being hijacked by this. My tech support recommends that you follow the instructions on this site

www.symantec.com

In order to remove the spyware.

Again, thanks for your feedback and please let me know if you have further input into this problem.

Regards,

---snip---

I am currently in the process of doing a full scan with Avira

Hmm... it happened to me on a Mac though. The fact that the same thing happens on a Mac and a PC all but rules out any local spyware issue. Google is looking into it too...

Yes, I told Canadian Living that the explanation they got from their IT is quite unlikely and that I was also an "IT expert" and it looked almost 100% certain to me that their site was doing something bad.

I've also sent the case off to a good buddy of mine who does happen to be an IT security expert - will see what he says.

Well, I happen to do IT security for a living :)

I tracked what happens when I click the link, there is some interesting sublinks to doubleclick, which cookie tracks, and it even eventually hit a page that was blocked by our Websense software under a spyware category. There's definitely something funky going on.