2

I was watching the video linked below and every time I refresh the page, a file named f.txt is downloaded that contains the following text.

Video: https://www.youtube.com/watch?v=enbTb8PizTI

Text:

document.write('\x3cscript type\x3d\x22text/javascript\x22 src\x3d\x22https://sb.voicefive.com/c2/6035329/rs.js#c1\x3d3\x26amp;amp;c3\x3d8271572\x26amp;amp;c4\x3d60886142\x26amp;amp;c5\x3d114232512\x26amp;amp;c6\x3d\x26amp;amp;c10\x3d1\x26amp;amp;c11\x3d1497811\x26amp;amp;c13\x3d\x26amp;amp;c16\x3ddfa\x26amp;amp;ax_i\x3d\x26amp;amp;ax_g\x3d\x26amp;amp;\x22\x3e\x3c/script\x3e');

Is this a potential security risk?

Mark
  • 34,646
  • 9
  • 87
  • 137
Eric Siegal
  • 23
  • 2

2 Answers2

4
  1. This script shouldn't be doing that. Let both youtube and subscriber and the advertiser know. Rogue Ads aren't to be toyed with.

  2. The decoded script looks like this:

    <script type="text/javascript" src="https://sb.voicefive.com/c2/6035329/rs.js#c1=3&amp;amp;c3=8271572&amp;amp;c4=60886142&amp;amp;c5=114232512&amp;amp;c6=&amp;amp;c10=1&amp;amp;c11=1497811&amp;amp;c13=&amp;amp;c16=dfa&amp;amp;ax_i=&amp;amp;ax_g=&amp;amp;"></script>'

  3. Turns out Voicefive is not for taking agressive advertising tactics: http://en.wikipedia.org/wiki/VoiceFive

  4. Also for distributing viruses.... http://forums.anvisoft.com/viewtopic-57-6844-0.html

Summary

  • The add may or may not be malicious. Malicious javascript isn't always obvious. It may be trying to take advantage of a browser flaw you just don't have. However, given the companies reputation, I'd say it's trying something funky here.
  • Make sure to research the company distributing the advert. In this case VoiceFive has a very nasty track record.
  • Report it! Google does not take kindly to this kind of thing.
MrSynAckSter
  • 2,040
  • 11
  • 16
0

It just is a fragment of advertising code that accidentally just got downloaded onto your system, nothing to really worry about because it isn't malware. I tried getting the file to download on VM with adblock on for each browser that I tried, Chrome, and Firefox, and internet explorer none worked with adblock on. It didn't set off any alarms on any of my systems either. But once I turned adblock off it went through. Just another note I was able to catch the script taking the chunk out with no script, but again it didn't appear malicious in any way. I'm pretty sure someone else will be able to tell you more and give you more detail

salmaass
  • 39
  • 2
  • -1: Just because AdBlock blocks it and none of your virus scanners know it doesn't mean it isn't malicious. – Philipp Feb 16 '15 at 13:48