CLICKSOR Advertising can be a danger to your website and your traffic!

Use Clicksor Advertising as a Publisher and kill off your visitors.

One major problem with owning adult web sites with free access, is making ends meet with advertising. As a publisher there are many advertising companies, but too few who will accept web sites containing adult content. However Clicksor is one company that does. Sadly I heard their payout rate was lousy, but a dollar a day is better than none right?
Signing up is easy, and their approval was a breeze. The control panel was easy to use and although their site was painfully slow I obtained the code for everything, pop-ups, pop-unders, banners, and in line text ads.
Admittedly using this maximum impact was not a welcomed experience to visitors, I did offer the option for members to pay a small fee to avoid the advertising.
My first payout was in April 2006 for a whopping $24 and basically it remained in or around $25-30 a month there after. I had quite a few complaints from members and some left saying their computers had got infected. With no evidence, because I also was able to avoid these ads, a member sent me a email containing the malicious code that had infected his computer via Clicksor advertising.
I contacted Clicksor immediately with this email.

=================================================================================
Date: 2006-12-11 14:38:45

I’ve had several members tell me their anti-virus has reported trojan infection after and during the visit to my site.
One particular person supplied me with detailed information regarding this.
Is it possible for an advertiser to add Trojans to their pop-ups even after you have supposedly approved them? or can you confirm or not whether the information below should be of great concern to other publishers their visitors and yourselves
This is the information received via email, I have removed the chit-chat
Thanks
———————————————————-
To whit I offer this report generated by Norton AntiVirus Corporate Edition:

The pop-up page is http://www.find.sc/

Scan type: Realtime Protection Scan
Event: Virus Found!
Virus name: Downloader
File: C:\Documents and Settings\*********\Local Settings\Temporary Internet Files\Content.IE5\Z9N9PUNH\cursor[1].htm
Location: C:\Documents and Settings\*********\Local Settings\Temporary Internet Files\Content.IE5\Z9N9PUNH
Computer: **********
User: ***************
Action taken: Clean failed : Quarantine : Access denied
Date found: Monday, December 11, 2006 6:28:48 AM

The payload was count.jar-1f4eade5-370ebc7f.zip

Nice job, I wonder how many people on this site who are a bit less careful are now infected.
======================================================================================

This was their reply which indicates they wait until a publisher screams with proof before they take action instead of monitoring advertisers in the first place, why would they remove any advert on my say so? was it removed from their system, or just my web site ? Did they close down the advertisers account for misuse and breaking their TOS? who knows but I am guessing not, business is business after all and the incomings from advertisers is more important than the outgoings to publishers and their reputation, and the visitors who are infected.

========================================
Date: 2006-12-12 09:26:30

Hi,

I apologize for the inconvenience this matter has brought you. This could be a problem caused by the setup on the advertiser’s side. The indicated ad has been removed permanently. Thank you for providing us the information.

Please contact us if you have any further question or concern regarding this issue.

Regards,
Ada

========================================

As time went on I received complaints from members but without proof to submit to Clicksor I was at a loss. To lessen the impact on visitors, and because I was also using another advertiser, I removed the inline text-links, or lets put it this way I tried to remove them having discovered I needed to submit a support ticket for that to happen. It seems this is added to your web site by default and you have no control over it. Having visited my site as a guest I got to witness just how bad their ILT advertising was, with links all over the pages causing complete disruption. Even though the inserted code for inline text ads had “show=false”, they still showed on my pages, this is their reply to my ticket.

=========================================================================
re:In line text ads

The inline text link option for your site has been disabled now. And please make sure our ad code state “clicksor_enable_text_link=false” .
Please verify and let us know if you have any further questions regarding this issue.

Enos Chong Account Manager

========================================

Then I received another email from a member, so i fired off another complaint email to Clicksor.

========================================
Date: 2008-07-14 19:10:31

Yet again one of your advertisers is forcing a download carrying a EXPLOIT.HTML. virus. I have turned off pop-ups and will now look for other advertising to replace it
========================================

Their reply

========================================
Date: 2008-07-15 10:40
Hi,
Can you please send us that ad’s IP or URL so we can suspend it for you from our network.
Thank you,
Enos Chong Account Manager
========================================

So I sent them this email, and you notice they said suspend it for ME! what about other publishers.

========================================
Date: 2008-07-15 18:07:15

These is one report given to me by member
********************************************************
My curiosity got the better of me and I clicked on one of the video’s on the popup “PornTube”; that occasionally shows up when I first sign on. Of course the vid wouldn’t load, and a message comes up that I am missing an Active X file and I’ll need to download it. The first time or two this happened over the last few weeks, I stopped there. This week I went ahead and downloaded the “setup” file. And….sure enough… It tries to load the trojan horse known as “Win 32 TrojanDownloader.Zlob”. I have very good virus protection via NOD32 and Spy Sweeper, so I think I killed it right off the bat. We’ll see. I’m not sure If you have any control over their site or if they are doing it intentionally or whatever, but that is a major pain in the ass trojan horse to clean. Thought you would want to know about that. Thanks, Paul
********************************************************
The other I’m not to sure about but its a forced spyware download. This has happened before and I really need to warn other sites they could be infecting their visitors through lack of security checks by clicksor.
========================================

So this is quite serious making all visitors vulnerable to this forced download which would leave their computers possibly with some back door exploit. I received this reply from Clicksor.

========================================
Date: 2008-07-16 10:03:15
Hi,

Thank you for your report, we would like to eliminate all virus ads that would harm our publishers. But in order for us to identify the problem ads we need your help. You can take a screen shot or send us the ad IP or URL, so we can remove it from our network.

On the other hand we will work on security improvement.

Thank you for your help,

Enos Chong Account Manager
========================================

EH! WTF they want me to police their advertisers after they have potentially put at risk all visitors prior to my sending them screen shots and urls!!. Hadn’t I given them enough info as it was. My reply reflected my disgust

========================================
Date: 2008-07-17 15:55:54

Your asking a lot for the little payment we receive, I have given enough time on this and supplied info and if you consider yourselves to be responsible you should at least investigate the matter and make sure publishers are not infecting their visitors with clicksor/yesup advertising. This is not the first time viruses have been distributed through you on my site, and we as publishers have no control over what crap is being targeted on our sites therefore it is your responsibility to make sure the advertising is CLEAN as its the website owners who have to deal with the complaints caused by your lack of security checks on advertisers. I may well seek advice on some web hosting forums I cant believe this can keep happening, the little money I earn is lost by visitors who keep away from the site.
========================================

I then removed all code from my website except one small banner advert. I left that so I could top-up the minimum pay out after which I removed all code leaving my account with Clicksor with zero cents.
Has things improved since? nope if you search the web or twitter you will discover publishers are still having malicious code placed on their web sites through Clicksor/Yesup. Just recently they have launched a file sharing service, now if they were to put the same effort into vetting their advertisers as they do into trying to develop new businesses plans then maybe they could build up their advertising network with positive reputation and recommendations….oh and increase publishers earnings, I didn’t realize how abysmal they were until I used another company and was paid more, and without the need to litter my web site with pop-ups, pop-unders, and contextual advertising.
Incidentally I visited a site not too long ago and received this warning and a blocked page from my Nod32 Anti virus. So here you go Clicksor you can have this report including the screenshot for free while you all sit around dreaming up your next brain storm whilst infecting computers.

http://www.bu520.com/links.php?data=rSe_2/{-0(3}0*+$S\7XjS[eW_Xf_g$]m\^b’*.*7″}n^b’),*4|-.-.+&serverfile=popdirect&id=clickbanner&subid=24598&tid=1256354806&clater=0&m=127&o=1&c=32767&a=32767&q=6&s=_=&ah=10&al=3&l=english&campaign=&rurl=http://serw.clicksor.com/serving/clicktrack.php?tr=21350&cpx=cpv&qid=1256354806732track&defurl=http://serw.clicksor.com/newServing/cpalinks.php?qid=1256354806732track&memkey=a9294f8f95ef3ed5e95681b053f2b406&clck_sid=144320&clck_pid=97806

Description:
Access to the web page was blocked by ESET NOD32 Antivirus.
The web page is on the list of websites with potentially dangerous content

CLICKSOR Advertising can be a danger to your website and your traffic!

This guy actually captured the distribution of malware by Clicksor on video

And another, and these are all recent!!

So the bottom line is this.
If you want to increase your earning potential as a publisher don’t use Clicksor. If you want to offer a good experience to visitors so hopefully they will bookmark your web site and return one day then don’t use Clicksor.
If you as an advertiser want to serve ads containing mailicious code, forced downloads, dialers, and browser hijacking, then hey why are you still reading this? jump on it now and DO sign up with Clicksor, there are millions of computers just begging to be infected.

Infected With CLICKSOR
How to Remove CLICKSOR from your Infected Computer
CLICKSOR Advertising Sucks
Get rid of CLICKSOR Inline Text Links and Pop-ups