I received a strange issue reported by one of my web application users. Apparently they are getting "ads" within the browser window when using my application.

I didn't add advertisements at all. It's a straightforward ASP.NET web application.

What I believe is happening is that the end user's PC is infected with malware that "hops" onto their browser session to display the ads. This could happen with any website, I guess. I recommended they scan their PC with Malwarebytes.

Is this something that can only be controlled by the end-user, or are there steps that web application developers can take to prevent this from happening? In addition, some hints regarding the mechanism employed by this type of malware would be nice.

6 Answers 6


While I also believe the most likely explanation is definitely that the users system is infected with adware, I would like to present some alternative explanations.

There is still a small possibility that your website is indeed serving advertisement. It isn't unheard of that criminals hack into insecure web applications and modify them to deliver ads or malware. When they do, they might take precautions to conceal this from the administrator, like serving unmodified output to certain IP ranges. When you receive similar reports from many other users, you might want to check if any source files on the server got modified somehow.

Your server could also serve advertisement because of an unlicensed 3rd party library you are using. There are, for example, DotNetNuke modules which inject advertisement into the website when they aren't properly licensed (thanks to Jasmine for the comment).

Another possible explanation could be that the advertisement isn't injected by you or by adware on the users machine but by a man-in-the-middle. The user might use an anonymous proxy server to improve their privacy. Some of these proxy servers generate revenue by injecting their own advertisement into the websites they relay.

  • 5
    The ads could also be injected by un-licensed modules or components. I've seen DotNetNuke modules that "work" but throw ads when you don't have a license.
    – Jasmine
    Commented May 9, 2014 at 16:46
  • 1
    @Jasmine thanks for the comment. I added this to the answer.
    – Philipp
    Commented May 9, 2014 at 17:06
  • 1
    Thank you, greatly appreciated. Interesting point about components. While I am very careful as I hate ads for professional facing sites, they could get through. Having said all of that nothing has been experienced by other users or in testing. Also I have just been informed that my colleague helped the end user remove the quilty malware !! So happy customer....
    – SamJolly
    Commented May 9, 2014 at 18:17

Look for browser extensions maybe the user have downloaded some malicious extension that is tracking user's browsing history and sending him ads and stuff

  • Thanks for comment. So is this something that is user related only ie they need to keep their machines clean, or is there something that web developers can do to prevent the web application being hijacked/overlayed by ads when used?
    – SamJolly
    Commented May 9, 2014 at 12:59
  • 3
    @SamJolly Not really, unless you want to restructure your website in such an absurd way that adware doesn't know where to insert any advertising and stops doing so. But that way you would also make it equally incomprehensible to search engines and likely also negatively affect the usability.
    – Philipp
    Commented May 9, 2014 at 14:20

Is this something that is under the control of the end user, or are there things web application developers can do to prevent this happening.

Hack the user and install malwarebytes and AV for them. :)

Honestly there is nothing you can do and it is entirely outside of your control. Get them to find a local tech person to help as the user may be infected with something that does more than just show ads. Typically adware programs also have other surprises, in addition a user who accidentally gets adware could also accidentally get a virus.


I have seen a piece of ad-injection malware that installs a proxy server on the user's machine, and change the proxy settings redirect traffic to that proxy. The proxy injects a script that inserts ads, and it also quite effectively blocks any page that might have information of itself and its removal, I guess it uses some heuristic filter.

I think the primary reason for this course is to be able to hide behind a legal protection, it doesn't use any malware-only techniques, it simply delivers a product that no-one in their right mind would want. A bit like the Ask toolbar, but far more aggressive.

I can't say if that is it, but it certainly fits the description.

The name of the "product" unfortunately slipped my mind.


As @Philipp has already stated, the most likely cause of the inserted advertising is coming from the end users machine IMHO. I would like to expand upon his point about proxy traffic.

The reality is that any hop in the network path is capable of altering the traffic/inserting code. There have been examples of this happening at a government level and also at an ISP level and you didn't mention if your app is served over a secure connection? (not that https is any guarantee these days).

Other examples of ISPs inserting advertising can be found at superuser.com (question 652995) "Why-does-my-browser-try-to-open-ads-from-fwdsnp.com" (sorry, rep limited for <2 links) and also a blog post by Eric Helgeson on his github.io titled "I fought my ISPs bad behavior and won"(google this).

Taking my tin foil hat off for a couple of moments... Other answers have touched on browser extensions, I recently had a client ask me to help clean his PC that was displaying similar symptoms to your end user. However, this adware(malware) was inserting itself onto only a specific set of websites. The client had first noticed the advertising on my country's equivalent to ebay - where the adware would insert an image into the last slot of the gallery slider of the item the user happened to be looking at. Clicking on the inserted image would whisk you off to a third party auction site, complete with affiliate links for good measure. When browsing amazon, ebay, [insert well known shopping/auction site here] the end result was the same.

Turns out the cause was a browser extension in chrome. I was able to narrow down the possibilities quickly by asking my client to check and see if the symptoms persisted in I.E or Firefox - answer came back 'no extra ads'. 'Could he please open a chrome incognito tab and re-test?' - nope, no inserted advertising there. 'Installed any browser extensions recently?', 'ah yes I have - funny you mention it, I found a great little extension that helps take screenshots...'

I understand that you are a asp.net developer and not a help desk, so trouble shooting your end users machine shouldn't be your concern. It may help them(and you) if you can lock onto where and when your app displays these ads. Do they have a secondary broswer they could test it on? Does it happen at home, or only at work etc. Depending on the nature of your app it's not beyond the realms of possibility that some malware writer loves you enough to write some code that focuses on your app. (puts tin foil hat back on...)


Certain compromised websites could lead to malware installation on your computer by simpling visiting them and without noticing anything suspecious. Other websites can perform the same goal by poping-up annoying windows that whether you click on Ok or Cancel or even click on the close corner X could trigger malware installation. In both cases the scenario is called drive-by download attack which simply exploits the vulnerabilities of your browsers or the plugins you installed within them. Lot of computers become zombies using this schema or simply have been infected by adware, spyware or other malware types.

This is not a fiction. May be one of the best examples I could mention is the famous PHP.net website that you may used already if you have developed in PHP. Thus, on 24-Oct-2013, 6,500 computers are infected by DGA.Changer, a malware title whose sole job is to surreptitiously download other malware onto compromised systems. Also, on June 2011, Amnesty International‘s homepage served malware that exploits a recently-patched vulnerability in Java.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .