Lorn wrote:
alex - It was just like a normal ad in a normal place. Nothing more, except it was for Drivecleaner and it had javascript in it.
I think it was the top ad bit though.
Yes javascript replaces the normal banner with drivecleaner. I've got a special JavaScript debugger which will show attempts to hide the true operation of the code. I have to trall through each of the javasprits that have been called in relation to this site. I found vulnerabilities in sites before including ebay, I'll give it a shot.
Alex it typically happens after clicking new post, when the new post page load after a short timeout.