False Positive? adnxs.com

[knicks_fan 1]

I am getting multiple "address blocked" messages when hitting multiple websites, including www.wtop.com, www.wjla.com, www.wral.com,

and Washington.cbslocal.com.  The messages are generally as follows:

 

5/6/2014 1:46:12 PM      Blocked by PUA blacklist    C:\Program Files\Internet Explorer\iexplore.exe    <domain>\<userid>

 

5/6/2014 1:46:10 PM    h xxp://lax1.ib.adnxs.com/ab?enc=nxpQ4zpf7D9i2sNDl2TpPwAAAAAAACBAYtrDQ5dk6T-eGlDjOl_sPyf7RAD1m880A8ohj_aY3QdQIGlTAAAAAC27BwDLAQAA6QMAAAIAAAC_Ct8AcgkBAAAAAQBVU0QAVVNEACwB-gBtNIkDzrsBAgUAAQMAAIwAuSQCbAAAAAA.&tt_code=12851&cnd=!viic5QjfvLUBEL-V_AYYACDykgQwADgAQABI6QdQrfYeWABgywRoAHAAeACAARyIAe74AZABAZgBAaABAagBA7ABALkBnhpQ4zpf7D_BAZ4aUOM6X-w_yQGeGlDjOl_cP9kBAAAAAAAA8D_gAQDqAQcxNDQ2NTYz9QGamUlA&ccd=!gAZxPgjfvLUBEL-V_AYY8pIEIAA.&udj=uf('a',+256674,+1399398480);uf('c',+2973279,+1399398480);uf('r',+14617279,+1399398480);ppv(146626,+'3805431686725172007',+1399398480,+1400608080,+2973279,+67954,+0,+0,+1209600);&vpid=533&apid=28456&referrer=hxxp://www.wral.com/&media_subtypes=1&ct=12&dlo=1&pp=49DE702336A8A8BA    Blocked by PUA blacklist    C:\Program Files\Internet Explorer\iexplore.exe   <domain>\<userid>

 

I have sent samples to ESET to determine if this is a false positive or something the technical folks at these websites need to be

made aware of.

 

ESET 7.0.302.26

Firefox 28

IE 11

Windows 7

 

Used Malware Bytes and ESET to scan my system and nothing is found

[Marcos 5,070]

Please follow the official guidelines for reporting blocks to ESET: hxxp://kb.eset.com/esetkb/index?page=content&id=SOLN141

[jadinolf 131]

For the record, I get no reports when clicking on your links. Tried several times.

I was expecting for others to join in, but nothing.

[knicks_fan 1]

Done yesterday - false positive report sent to the e-mail address listed - I have not heard back. And I went to one of the websites listed above today and nothing came up. (defs 9767). Weird. I'll see what happens.

 

Thanks

[Marcos 5,070]

Done yesterday - false positive report sent to the e-mail address listed - I have not heard back. And I went to one of the websites listed above today and nothing came up. (defs 9767). Weird. I'll see what happens.

 

Thanks

 

Weird. We replied to all who had sent complaints about the block to samples[at]eset.com. Anyways, the issue is still investigated as the domain is involved in scam so the domain may be blocked again after the investigation has been completed.

[knicks_fan 1]

Thanks Marcos. If you do block this domain, can it be overridden by a whitelist entry on my end? I use the websites listed in the OP a lot. I have let several

of the webmasters who replied to me know what's up. I NEVER click on ads. Even reputable websites like the ones I visit have some very

strange ads on them.

Edited May 7, 2014 by knicks_fan