On two separate computers (same network), I have been redirected while trying to leave Zap2It.com. It looks like a rogue spyware removal program that's trying to get me to install. I found others who have noticed this just this evening with Zap2it. See http://groups.google.com/group/alt.atheism/browse_thread/thread/0d8bbb1cc2ee1733.
After closing out (Alt + F4) for the pop-up and then for the new browser window which looked like a scan (I closed it pretty quick), I scanned my computer with Bazooka and SpyBod S&D. Nothing came up.
Should I be concerned?

I ran into the same thing.Thought it was my machine at first, but Spyware Terminator & Hijack This says no.It uses CTtoolbar to display an error thru IE.From there the Hijack takes you to the Spyware Destructor website & intrudes on your machine to initiate a from site scan of your computer.Something seems illegal the way its done.I've never seen it overtly before- ZAP2IT is the thru gate & Microsft isn't sendiing you to this site as the Warning seems to infer.Its a Hijackied IE.The question is ZAP2IT allowing this? Both Microsoft & ZAP2IT should be alarmed at this...

I just checked Zap2It.com and nothing happend on my PC.

Could you post a link to the websites which it tried to get you to visit? The fake scan ones are just that, fake scans which try to trick users into downloading a fake anti-malware product.

After installing the fake anti-malware product it will do a "scan", find loads of "malware" and then ask you to pay to "remove" it.

The Google groups link above says that one of the links is

When you close out the alert warning you are sent to this web page & the scan immediately commences - there is no download.

I've also had the same popup 3 times when exiting:
http://tvlistings.zap2it.com/tvlistings/ZCGrid.do

Here's the URL of the popup just in case that might also help.

http://scan.spywaredestructor.com/scan.php?landid=1&depid=maxc%5Fclr08&cid=2271&parid=mc%5F422127921

I have striped down all the .js script files. I found the below files:

And while tracing back, I found there was an advertisement to Colgate that was getting displayed by calling a SWF file:

Code:

http://atlas-ads.com/89000/300x250.swf?clickURL=http://www.colgate.com/?om21&clickTARGET=_blank\\

My point is, there is some external call in some .js file or some .swf file which is redirecting the browser to the hxxp://scan.spywaredestructor.com site.

Yesterday, I was playing with the swf files and how malware authors make use of the swf files to redirect traffic of good sites to bad sites and I have posted a small article about that activity in CC itself. Refer below:

/t220423-Analyzing_Malicious_SWF_Files.html

In reference to the problem that we are facing regarding the Zap2it.com, it seems very likely that the same mechanism has been deployed. The fault may be because of a .js or a .swf file thats redirecting the traffic to the malware site.

Its really hectic task to do a code review of all the .js files cus one .js file calls another and till now I have checked at least 15 .js files.

Instead of scavenging it like this, its better if the message can be passed on to the zap2it admin. Its very unlikely that they have done it knowingly or the site has been hacked lol... Anyways, good example.

_________________
.:: Malicious Brains ::.
http://www.malwareinfo.org
http://blog.malwareinfo.org
http://forum.malwareinfo.org

There are no patches or service packs for ignorance!

Great work maliciousbrains!

I did contact the "general" contact at zap2it since they don't seem to have anything more technical, and I pointed them back to this thread.

Hopefully they'll take it seriously.

Steve

I have encountered the same phenomenon for the past 2 days while visiting Zap2it using Firefox

I also use zap2it and have seen this popup
over the past 48 hours. As it turns out, I also
run a debug version of the Flash Player and
it captured a stream of *** Security Sandbox Violation ***
messages that arrive from URLs associated with

view.atdmt.com
and
spe.atdmt.com

if that will help you find the culprits.

Thank you for compiling this information. I have forwarded it to the administrators at Zap2it and they have removed the offending advertisement.

Heather,
Zap2it Forums Admin

I had her click the X on the prompt. I searched Google and found this page.
The URL she was at is
http://profile.myspace.com/index.cfm?fuseaction=user.viewprofile&friendid=17654018
I guess it is an infected ad.
She hit the Back key after going to another site and the same popup happened. She hit Cancel instead and it started scanning. She closed the window immediately. I 'kicked' her off and added spywaredestructor to her hosts file.

I'm running SpyBot S&D right now as a precaution.