Welcome! Log In Create A New Profile

Advanced

valueclick?

Posted by Anonymous User 
Anonymous User
valueclick?
June 24, 2010 09:07PM
I recently started getting this ValueClick Corporation getting blocked from several places, and was wonder if i have a virus? This thing is trying to connect a lot, most often through port 80 but i have had it hit 2698 a few times also.


[EDIT]

Now when this Valueclick is going to attempt to connect is almost impossible to tell. Sometimes it will try to connect when going to a site, for example google, and the page will not load unless i allow Valueclick. Now if i just close my browser then go back to the same page, it will not even try to connect that time, but then it will on a different website, even on my own website, youtube, google, anywhere! I watch my peerblock rather closely and this thing is weird, it just started appearing out of nowhere and i am getting a bit concerned.

I did a bit of research on valueclick, they are marketing company that has been successfully taken for $2.9 million by the Federal Trade Commission in a lawsuit for spam/spyware. I can not locate any virus, i never get any, i never browse anywhere suspicious, download crap, nothing.

I ask again, is anyone getting this blocked regularly in their peerblock? Any help is appreciated a ton!



Edited 5 time(s). Last edit at 06/30/2010 06:11PM by Cliffo.
Re: valueclick?
June 25, 2010 08:49PM
avatar
ValueClick is a marketing company. I'd start checking Add/Remove programs for anything malicious. Also try a scan with MalwareBytes and Microsoft Security Essentials.




This business is binary. You're either a one or a zero.
Anonymous User
Re: valueclick?
June 25, 2010 11:26PM
All clean on both of those programs and avg. I never get viruses or browse risky places, but why is this thing coming up only the past few days?
Re: valueclick?
June 26, 2010 09:08AM
avatar
Its a program running in the background that is contacting that site. Could be any 3rd party app.

Disable PeerBlock, then try a "netstat -b" in a command prompt window (DOS). It will show each connection, listening port and the program associated with it. Might reveal which application is connecting to that IP address.




This business is binary. You're either a one or a zero.
fxm
Re: valueclick?
June 26, 2010 09:11AM
Cliffo Wrote:
-------------------------------------------------------

> why
> is this thing coming up only the past few days?

Possibly the target address was only then added to a blocklist you use.
Anonymous User
Re: valueclick?
June 26, 2010 05:40PM
Man this is crazy, nobody has seen this before?
fxm
Re: valueclick?
June 26, 2010 06:13PM
Cliffo Wrote:
-------------------------------------------------------
> nobody has seen this before?

Why on earth do you think that?
I daresay anyone with http blocked (and the PB GUI open) has seen "New Route..." in the PB window hundreds - or even thousands - of times.
Anonymous User
Re: valueclick?
June 26, 2010 09:56PM
I think you misunderstand, i am asking if anyone has every seen this ValueClick Corp try to connect to them, who they are, and where they are coming from? I have tried all the suggestions, uninstalled many programs, did all the virus scans, and nothing.
Re: valueclick?
June 26, 2010 10:49PM
avatar
Have you tried a netstat -a when you see connection attempt?




This business is binary. You're either a one or a zero.
Anonymous User
Re: valueclick?
June 27, 2010 01:06AM
I tried a netstats -b the other day but couldn't recognize anything out of the norm, though i have never used that command before. Now for some reason when i go to the run then cmd and type in a command (like netstats -b or ip config) it tells me

'netstats' is not recognized as an internal or external command, operable program or batch file.

What did i mess up there?

Now when this Valueclick is going to attempt to connect is almost impossible to tell. Sometimes it will try to connect when going to a site, for example google, and the page will not load unless i allow Valueclick. Now if i just close my browser then go back to the same page, it will not even try to connect that time, but then it will on a different website, even on my own website, youtube, google, anywhere! I watch my peerblock rather closely and this thing is weird, it just started appearing out of nowhere and i am getting a bit concerned.

I did a bit of research on valueclick, they are marketing company that has been successfully taken for $2.9 million by the Federal Trade Commission in a lawsuit for spam/spyware. I can not locate any virus, i never get any, i never browse anywhere suspicious, download crap, nothing.

I ask again, is anyone getting this blocked regularly in their peerblock? Any help is appreciated a ton!



Edited 1 time(s). Last edit at 06/27/2010 01:15AM by Cliffo.
fxm
Re: valueclick?
June 27, 2010 04:11AM
Cliffo Wrote:
-------------------------------------------------------

> 'netstats' is not recognized as an internal or
> external command, operable program or batch file.

> What did i mess up there?

The spelling of 'netstat'.
fxm
Re: valueclick?
June 27, 2010 04:23AM
Cliffo Wrote:
-------------------------------------------------------

> Sometimes it
> will try to connect when going to a site, for
> example google, and the page will not load unless
> i allow Valueclick. Now if i just close my browser
> then go back to the same page, it will not even
> try to connect that time,

That is because the [primary] function of Valueclick is to deliver ads. When the site you are visiting includes one of their ads, you see them being blocked. A few seconds later [when the page has automatically changed to replace their ad with an ad from someone else], they no longer try to connect.

Then you go to another site and - by chance - that site also happens to be presenting one of their ads. Or not.

BTW: I have never run across a page which will not load at all with Valueclick blocked, but some of them can take a very long time. For each Valueclick ad that you block, the script that loads the page may make from 3 to 15 try/retry cycles before it gives up and moves on to trying to load the next element on the page. Waiting for multiple tries on multiple ads can seem like an eternity. The Washington Post is a good example.
Anonymous User
Re: valueclick?
June 27, 2010 04:48AM
Actually Cliffo I have been getting tons of ValueClick Corporation activity.

Started Thursday morning. First time I had ever seen it. It's non-stop, and yes it prevents my
searches sometimes when using the Google search bar.

At first I though it was from Firefox's latest update to 3.6.4 but I noticed it attempting to connect
when I don't have a browser open. Still could be from Firefox though.

There is only one other possibility it could be in my instance, in my opinion.
Late Wedmesday night I tried Steam for the first time. Wanted to play Worms.
Haven't played that game in ages and it's a classic so I gave it a shot.

Of course you have to disable http blocking or you can't connect to Valve's servers.

As soon as I woke up Thursday I uninstalled Steam, used Revo Pro, and only then did
I connect to my network. Unfortunately I hadn't disabled Firefox's automatic updates
so that was the very first thing I was greeted with.

That's when the ValueClick madness began. It is as you say.
I am almost %100 positive it came from one of those two programs.

fxm could be right about it being recently added to the lists but I don't think so. An
advertising company this large would have been on there long ago. I'm not even sure
if I updated my lists before connecting that morning either. It was early and I was still
half asleep.

Wish I could help you more. I haven't had time to do a whole lot of digging into it.
I cant find a process or service that it's running. I did look at my ports with cports and it
comes up as unknown. I was able to do a WhoIs on them to see their IP ranges and the
physical address but that was about it.

lawls.While I was typing this Firefox just notified me a new update to 3.6.6 is recommended.
It's been three days. What happened to 3.6.5? Glad I turned auto updating off.
I'm rolling back to on older version.

I'll let you know if I figure it out.
fxm
Re: valueclick?
June 27, 2010 05:04AM
iamjohnsmith21 Wrote:
-------------------------------------------------------

> I am almost %100 positive it came from one of
> those two programs.

It is not Firefox (although it could be a plugin or addon).

> advertising company this large would have been on
> there long ago.

And it also acquires new companies, adds new services, and deploys new servers in new address ranges.
fxm
Re: valueclick?
June 27, 2010 05:21AM
iamjohnsmith21 Wrote:
-------------------------------------------------------

> I cant find a process or service that it's
> running.

If the connection attempts are incoming, there wouldn't have to be any.
Anonymous User
Re: valueclick?
June 27, 2010 05:32AM
fxm Wrote:
-------------------------------------------------------

> That is because the function of Valueclick is to
> deliver ads. When the site you are visiting
> includes one of their ads, you see them being
> blocked. A few seconds later , they no longer try
> to connect.
>
> Then you go to another site and - by chance - that
> site also happens to be presenting one of their
> ads. Or not.
>
> BTW: I have never run across a page which will
> not load at all with Valueclick blocked, but some
> of them can take a very long time. For each
> Valueclick ad that you block, the script that
> loads the page may make from 3 to 15 try/retry
> cycles before it gives up and moves on to trying
> to load the next element on the page. Waiting for
> multiple tries on multiple ads can seem like an
> eternity. The Washington Post is a good example.


The thing about this ValueClick is it's trying to connect constantly.
Not just during web browsing.
I can let the browser sit idle for ten or fifteen minutes, come back, and I've
blocked twenty connection attempts.
It also attempts to connect when I don't have a web browser open at all.
Just simply connected to the internet.

I can also tell you that it does indeed prevent pages from loading.
I can start to type something into the search bar (or from Google's
home page for that matter) and ValueClick is already all over it, before
I even go to a page or type the second letter. When this occurs any page
I go to, doesn't matter what it is, might even be a page that doesn't
have ads, will be blocked. Other times none of that happens. As though
the thing is dormant.

I believe that is what Cliffo is trying to convey here.

I'm treating this thing as malware/spyware until I figure out exactly what's
going on.

Edit: When that behavior is present it actually doesn't let you finish the search.
As soon as you hit search or enter or whatever that page is immediately blocked.
Doesn't matter what you're searching.



Edited 1 time(s). Last edit at 06/27/2010 05:40AM by iamjohnsmith21.
Anonymous User
Re: valueclick?
June 27, 2010 05:34AM
fxm Wrote:
-------------------------------------------------------

> And it also acquires new companies, adds new
> services, and deploys new servers in new address
> ranges.


Yes, that would be true.
fxm
Re: valueclick?
June 27, 2010 05:40AM
iamjohnsmith21 Wrote:
-------------------------------------------------------

> The thing about this ValueClick is it's trying to
> connect constantly.

A common explanation for that is that you have visited a site where Valueclick set a tracking cookie.
Your IP address was then added to their polling list, so for some time - a week, a month, the length of their contract, your natural life - the Valueclick servers keep trying to access that cookie.

> I can start to type something into the search bar
> (or from Google's
> home page for that matter) and ValueClick is
> already all over it, before
> I even go to a page or type the second letter.

Whose search bar? Have you disabled Google's completion/suggestion service?
Anonymous User
Re: valueclick?
June 27, 2010 05:42AM
fxm Wrote:
-------------------------------------------------------
> iamjohnsmith21 Wrote:
> --------------------------------------------------
> -----
>
> > The thing about this ValueClick is it's trying
> to
> > connect constantly.
>
> A common explanation for that is that you have
> visited a site where Valueclick set a tracking
> cookie.
> Your IP address was then added to their polling
> list, so for some time - a week, a month, the
> length of their contract, your natural life - the
> Valueclick servers keep trying to access that
> cookie.
>
> > I can start to type something into the search
> bar
> > (or from Google's
> > home page for that matter) and ValueClick is
> > already all over it, before
> > I even go to a page or type the second letter.
>
> Whose search bar? Have you disabled Google's
> completion/suggestion service?

I delete my cookies. Even my LSO's.
Unless they're being stored in an unusual cache.
Anonymous User
Re: valueclick?
June 27, 2010 05:45AM
I thought about the search suggestions options too.
I guess there's only one way for me to find out.

I'll let you know if that changes anything.
Anonymous User
Re: valueclick?
June 27, 2010 05:48AM
Nope.

Continues to do it with suggestions/auto-complete off.
I deleted my search history first just to make sure.
Re: valueclick?
June 27, 2010 06:06AM
avatar
What port is it trying to connect to ValueClick from? If it's 80/443, that's normal and shouldn't affect you much since it's mainly web brwosing.


Also, do you use any IM programs like MSN/Yahoo messenger as they usually bundle a lot of crap on as well.


You may also have some other background processes which has ads like some free anti viruses.
fxm
Re: valueclick?
June 27, 2010 06:11AM
iamjohnsmith21 Wrote:

> I delete my cookies.

Deleting cookies [or even blocking them in the first place] has no effect whatever.
Once they have your IP address, they have it.
fxm
Re: valueclick?
June 27, 2010 06:20AM
iamjohnsmith21 Wrote:
-------------------------------------------------------

> Continues to do it with suggestions/auto-complete off.

Whose search bar are you using?
Have you checked/disabled BHOs?
Anonymous User
Re: valueclick?
June 27, 2010 06:21AM
Yes it's the normal http/https ports 80/443.

I don't use nor have any IM programs.

The only antivirus I'm using at the moment is updated
and registered Malwarebytes. I've been using it for
some time now while this problem just presented itself
in the last week.

I did recently download itunes and redsn0w to jailbreak
a friends iphone. That was last Monday and ValueClick
didn't show up until Thursday. It's still a possibility though.

fxm and night stalker z, thanks for the feedback and trying
to help me figure this out..

I appreciate it.
Anonymous User
Re: valueclick?
June 27, 2010 06:34AM
fxm Wrote:
-------------------------------------------------------

> Whose search bar are you using?
> Have you checked/disabled BHOs?


I don't have any search bars installed
for firefox. I use it as default.
Just the default search bar with firefox.

BHO's? Boyhood Odor?

Kidding.

Don't know what those are but I see it's a
dll module for IE. Honestly I don't think I've
ever used IE on this installation BUT I do
know the Google Toolbar is installed.


I'll have to do some research to see if ff
uses BHO's or a BHO like component.

I may also run NoScripts and see if this
behavior continues. At this point I'm kind of
curious as to what the exact cause of this is.
Anonymous User
Re: valueclick?
June 27, 2010 06:39AM
fxm Wrote:
-------------------------------------------------------
> iamjohnsmith21 Wrote:
>
> > I delete my cookies.
>
> Deleting cookies has no effect whatever.
> Once they have your IP address, they have it.


I'm long overdue for learning how to configure
proxy.

Any suggestions? A simple gui program maybe?
Anonymous User
Re: valueclick?
June 27, 2010 01:29PM
fxm Wrote:
-------------------------------------------------------
> Cliffo Wrote:
> --------------------------------------------------
> -----
>
> > Sometimes it
> > will try to connect when going to a site, for
> > example google, and the page will not load
> unless
> > i allow Valueclick. Now if i just close my
> browser
> > then go back to the same page, it will not even
> > try to connect that time,
>
> That is because the function of Valueclick is to
> deliver ads. When the site you are visiting
> includes one of their ads, you see them being
> blocked. A few seconds later , they no longer try
> to connect.
>
> Then you go to another site and - by chance - that
> site also happens to be presenting one of their
> ads. Or not.
>
> BTW: I have never run across a page which will
> not load at all with Valueclick blocked, but some
> of them can take a very long time. For each
> Valueclick ad that you block, the script that
> loads the page may make from 3 to 15 try/retry
> cycles before it gives up and moves on to trying
> to load the next element on the page. Waiting for
> multiple tries on multiple ads can seem like an
> eternity. The Washington Post is a good example.


Then why is it happening with sites that have no ads, to include MY OWN WEBSITES that i made myself, this is what makes me worry the most, i know damn well valueclick is not a part of my websites.
fxm
Re: valueclick?
June 27, 2010 01:52PM
Cliffo Wrote:

> Then why is it happening with sites that have no
> ads, to include MY OWN WEBSITES

You seem to be under the impression that incoming connection attempts from Valueclick must have something to do with the site(s) currently open in your browser(s).

They don't.



Edited 1 time(s). Last edit at 06/27/2010 01:53PM by fxm.
Re: valueclick?
June 27, 2010 02:47PM
avatar
Do you have some kind of proxy or DNS server configured on your machine?
Sorry, only registered users may post in this forum.

Click here to login