0

Here is some information I research about cloudfront.net AdWare:

I've seen several topics talk abou this malware: Cloudfront.net Malware

According to this article: How to remove CloudFront.net adware (Virus Help Guide)

Cloudfront.net is a legitimate and safe content delivery network owned by Amazon, however cyber criminals are abusing this CDN to deliver malicious content.

And

This CloudFront.net redirect is usually caused by adware installed on your computer. These adware programs are bundled with other free software that you download off of the Internet. Unfortunately, some free downloads do not adequately disclose that other software will also be installed and you may find that you have installed adware without your knowledge.


So here is what exactly happen:

I just click a link on the internet and my Kaspersky pop up notification, said it's not-a-virus:HEUR:AdWare.Script.Generic (so the adware come from the link, not because I install any adware programs which are bundled with other free software)

So I just click the link (not install any exe file), here is the links Kaspersky claims to be adware, don't go to these link below

http://d1dqwj4dc78lwy.cloudfront.net/?jwqdd=634223
http://d10lumateci472.cloudfront.net/TbnJtZU9RBgQBclhBWVd9XQ%3D%3D

Is there any chance my PC has been infected? I mean if the Windows' administrator permission right doesn't pop up, then the cyber criminal can't harm me right? Is it just a false positive from Kaspersky?

So what exactly cloudfront.net adware and how can it infected me? Does it mean every cloudfront.net is detected as adware?

  • 1
    I'd say it's very unlikely that you're infected, unless you start getting these popups randomly on sites that should be safe. It's way more likely that the adware Kaspersky warned about was part of the website you were visiting. – FINDarkside May 10 '18 at 9:21
1

I mean if the Windows' administrator permission right doesn't pop up, then the cyber criminal can't harm me right?

There are no administrator permissions needed to install extensions into your browser, change the start page or generally run and programs as your user which then also can read, modify or delete any kind of data owned by the user. For example ransomware does not need administrator permissions to encrypt the data of the non-privileged user.

Is there any chance my PC has been infected?

This is not clear from the information you provide. It might be that you've tried to visit a site which incorporates lots like ads in a way similar to how adware does it. It might also be that these scripts serving ads were injected by some adware locally on your system. If the problem happened only with this specific site it is more likely that it is a problem or feature of the site you visited, if it happens with lots of other sites it is probably a problem local to your system.

So what exactly cloudfront.net adware

Adware, as the name says. That is it might place ads into pages you visit, replace existing ads, maybe clicks on ads in the background so that it looks like that a user is interacting was the ads (i.e. ad fraud).

... and how can it infected me?

You've already cited the typical infection vector:

These adware programs are bundled with other free software that you download off of the Internet.

  • He said he clicked a link and got the following warning, that doesn't mean that he's infected. You'd get the same warning too if you click the link – FINDarkside May 9 '18 at 18:40
  • @FINDarkside: the question is about confusing but I interpret it this way that the browser detected links which should not belong there, which suggests for me that these were included by the Adware. – Steffen Ullrich May 9 '18 at 19:13
  • Might be, but I interpreted it other way. To me it just seems that OP is confused and thinks cloudfront is adware. If you skip all the quotes at the start, it just sounds like he clicked a link, Kaspersky said it blocked adware and now he's wondering if he's infected. – FINDarkside May 9 '18 at 19:44
  • 1
    Thank you, @FINDarkside understand me correctly, I just click a link and Kaspersky pop the warning Adware, so I wonder how dangerous is this Adware, Is there any chance it infect me. The quote at the beginning just to show the effort I research. – 123iamking May 10 '18 at 2:27
  • 1
    @123iamking: it is unclear for me where the links come from you've included in your question since these are not links to click on but script loaded by HTML pages. Apart from that the damage from adware is just more ads. But the ability to inject arbitrary content into the sites you visit could be misused much more, for example to read passwords. But this would not be called adware anymore then. – Steffen Ullrich May 10 '18 at 7:04
0

CloudFront is the CDN service of Amazon Web Services (Source: Wikipedia). You can create an AWS account and use it, but obviously also people who do malicious things can use it.

But unless there is a really bad security breach in your browser, there is no way your computer was infected just by visiting this website.

I think that your virus scanner alerted because that subdomain may be known as a virus server or something like that.

protected by Community Feb 21 at 16:15

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.