About

You're viewing one of 40,737 blog entries. Click here to read some more.

Other views

Recent Comments
Comments By...
Last 100 Entries
Read Chronologically
Random Entry
Random Image
View by Category
Mobile Edition


Ad

Advertise Here



Wednesday, 09 November, 2005

Firefox And Red Orbit
(with comments)

Have any of you Firefox users noticed anything weird lately? This has happened to me 5-6 times in the past few weeks: I click on a link. The site shows up for a second or two, and then I'm taken to a page at Red Orbit.

Clearly, it's some type of pop-up ad gone haywire -- probably intentionally. The most recent site that exhibited this is Expecting Rain. I recently added this site to my "Blogs I Read" list, but if they're using this type of pop-up, I'll take it off my list and never go back.

Although the site displayed is Red Orbit, the URL in the address bar is something like this:

http://ilead.itrack.it/clients/Nedstat/c4989/popup.asp?campaignid=4989

This URL displays a frameset with Red Orbit as the only visible frame. It's either an obnoxious ad technique, or someone has figured out how to hijack Firefox browsers.


  1. By roger. Comment posted 09-Nov-2005 @07:10pm:
    I haven't experienced this with Firefox - and I use it way too much every day. Most of the time I'm using it through a vpn to my university's servers, but occasionally bare through my cable ISP. I don't suppose you picked up a little hitch-hiker bug recently?
  2. By J-Walk. Comment posted 09-Nov-2005 @07:12pm:
    Yeah, hitch-hiker bug. That's what I'm wondering. That sort of thing is very common with IE, but I haven't heard of it with Firefox.
  3. By Darius Young. Comment posted 09-Nov-2005 @07:13pm:
    I haven't noticed anything different or suspicious lately, and I also use it "way too much." Of course I haven't been visiting any malicious site either :P. I've mostly been occupying my time with game downloads.
  4. By Annette Makinitupasigo. Comment posted 09-Nov-2005 @07:25pm:
    It hasn't happened to me with Firefox/Mac.
  5. By pat. Comment posted 09-Nov-2005 @07:38pm:
    Nope!
    Firefox/XP pro
  6. By Michael. Comment posted 09-Nov-2005 @08:06pm:
    try spybot S&D or ad-aware. should find it and kill it. it's definitely malware.
  7. By krackass. Comment posted 09-Nov-2005 @08:24pm:
    nada. using fire fox 1.5. and yes, i use it way to much as well. but hey, i don`t watch the idiot box at all now.
  8. By ~Q~. Comment posted 09-Nov-2005 @08:52pm:
    nope - FF + XP...
  9. By ~Q~. Comment posted 09-Nov-2005 @08:55pm:
    Well, slap me nekkid. When I closed FF, there was your Red Orbit, in a new window! It's like magic.
  10. By Juls. Comment posted 09-Nov-2005 @09:15pm:
    It hasn't happened to me previously, but RedOrbit popped up in a new window when I went to the blog you mentioned above. I have had one or two other pop-unders recently, but not from this company (and yes, I have run S&D and AdAware).
  11. By cobra427. Comment posted 09-Nov-2005 @10:15pm:
    Not noticed anything - but then I have spybot/adaware/spydotor/ms antispyware running along with sophos

    Maybe we just dont "visit" the sort of site you do John




    (joking)
  12. By Don. Comment posted 09-Nov-2005 @10:44pm:
    Not on my Firefox, John. I wonder if it's something that's infected your windows registry. I use Linux and no problems here.
  13. By 12-stringer. Comment posted 09-Nov-2005 @11:00pm:
    Firefox with XP at home, Win2k at work. Haven't seen Red Orbit, but, like Juls, I've seen some other pop-unders fairly recently. I also avoided visiting these links.
  14. By major_danny. Comment posted 09-Nov-2005 @11:15pm:
    I recently went to a site to download non-nude wallpapers of models and such. Some of their pop-unders sneaked past firefox's blocker. The ads on that site were sleazy, more so than the content. Not worth the trouble. some good parasite info
  15. By jaf. Comment posted 09-Nov-2005 @11:27pm:
    The ads are generated by these people stat.gif align=absmiddle webstats4u, which used to be nedstat basic, hence the Nedstat reference in the popup URI.

    I think I recall Chris at Cynical C talking about this, he removed them from his site. I think a lot of people are.
  16. By Gerard. Comment posted 09-Nov-2005 @11:29pm:
    The answer to this problem is in the url that shows up in the address bar. You can see it says 'Nedstat.' And that's where the problem lies.
    Nedstat is a free counter service that recently has been sold to a German company called Ad Pepper Media.

    Ad Pepper Media is providing those pop-unders.
    Visitors to my site were also complaining about those annoying ads and that's the reason I dumped Nedstat and am now using the Pro version of eXTReMe Tracking.

    So, whenever you visit a site that still uses the free version of Nedstat, you can expect these pop-unders.
  17. By Gerard. Comment posted 09-Nov-2005 @11:32pm:
    I see that jaf just beat me to this by 2 minutes.
    And jaf is right when he says that Nedstat is now called webstats4u.
  18. By TonyE. Comment posted 10-Nov-2005 @02:55am:
    This has not happened to me. I use the nightly version of Firefox 1.5, with the Adblock Plus extension and filterset.g to block most popups. In addition I have set the about:config setting privacy.popups.disable_from_plugins to 2 to block pop-ups from plugins.
    More details at http://forums.mozillazine.org/viewtopic.php?t=240548
  19. By mhe. Comment posted 10-Nov-2005 @05:17am:
    "Well, slap me nekkid. When I closed FF, there was your Red Orbit, in a new window! It's like magic."

    "It hasn't happened to me previously, but RedOrbit popped up in a new window when I went to the blog you mentioned above."


    Maybe you guys picked up a virus when you followed that link J-Walk posted?
  20. By Russel Maxwell. Comment posted 10-Nov-2005 @06:28am:
    I just went to http://www.expectingrain.com/ and had no problems, I did see that Firefox blocked a popup, is your browser and/or extensions up to date?
  21. By Dick. Comment posted 10-Nov-2005 @07:07am:
    I've been getting a lot of popunders the last couple weeks, but nothing like that.
  22. By J-Walk. Comment posted 10-Nov-2005 @07:11am:
    Mystery solved. webstats4u is indeed the culprit.
  23. By David. Comment posted 10-Nov-2005 @07:38am:
    Hooray for the humble HOSTS files. Mine has 52k entries courtesy of Hosts Manager from BISS which makes it easy to manage. Nedstat had 20+ entries so I didn't see popups or popoup alerts.
  24. By Daniel. Comment posted 10-Nov-2005 @08:12am:
    My Firefox 1.5rc has been crashing though.

    And what's up with no hosts file on Windows XP 64 bit edition? It's a bit silly.
  25. By chatcougar. Comment posted 10-Nov-2005 @09:38am:
    No problems with Firefox 1.5 RC1 on Windows XP Pro. Of course I'm using the Adblock extension and running PeerGuardian.
  26. By Annette Makinitupasigo. Comment posted 10-Nov-2005 @10:22am:
    OK. Now it's started with a visit to http://www.timetales.com/

    The campaignid though is 4990, rather than the 4989 J-Walk reported.
  27. By J-Walk. Comment posted 10-Nov-2005 @10:32am:
    That one's kind of intersting. The webstats4u link is in a tiny frame at the bottom. If you drag the horizontal bar upwards, you can increase the size of that frame and see the icon.
Commenting is not available in this weblog entry.