Welcome to the new spam of the milenium...spyware.

Thanks guys for 4 hours of tracking down and cleaning up your shit that you install.

To the rest of you folks...I suggest that you are careful with what sponsors you work with...pay attention to every aspect of that program. You never know when a hosted gallery is going to try to install spyware on your surfers machine. It even goes past sponsor programs... you even have to be careful of any traffic trading you are doing.

All the surfer knows is that they clicked on a link on your site and Norton went off saying that your site is trying to load a trojan on their machine.

Rest assured this is a future topic of both discussion and a radio show.

FREE MY BROWSER!!!

Let's start naming names gonzo, I hate spyware as well. we should ask KC, he is the spyware expert around here. He hates that shit too...

Unfortunately, the ones I have been having to deal with end up getting in under the radar.

The one I dealt with earlier in the week (twaintec) hooked itself on to windows update somehow, so the next windows update installed twaintec as a browser helper object (BHO).

On a friends computer, I have spend well over 12 hours total cleaning up spyware/adware messes and every single one that I had to deal with were installed clandestinely (no matter how many of the spyware developers claim that you have to say yes to the download).

:grrr:

OK simple question for you computer people.. how do you know if you have spyware ??

very easily...
1) your PC starts sending e-mails to addresses you never heard of....all by itself

2) you start getting pop-ups and you have no clue what triggered them...

3) yours and 50,000,000 other computers with the same trojan start downloading the site all at the same time, thus creating the effective DOS attack
(ask Lensman for details, one disgruntled GFYer used it on him,
shutting down all Lensman's sites)

need more?

I'm wondering that too...I've been using Adaware every night, but if Sare's spending 12 hour and Gonzo 4 to clean things up, I'm betting my 5 minute run of Adaware's not doing the trick. :(

Something needs to be done about this, or else it will make the internet worthless!!

Let's start naming names gonzo, I hate spyware as well. we should ask KC, he is the spyware expert around here. He hates that shit too...[/b][/quote]
I can give you the name of a domain that has me pissed off right now. Im in the middle of updating this machine with spyware removal tools.

softnewz.com

Makes spam look like a cakewalk.

I'm wondering that too...I've been using Adaware every night, but if Sare's spending 12 hour and Gonzo 4 to clean things up, I'm betting my 5 minute run of Adaware's not doing the trick. :([/b][/quote]
i usually let adaware do all the work until something bad happens LOL but in the last few weeks there's been another influx of them. i hate the ones that no matter how many times you remove them there is entry after entry in the registry that keeps putting all the other entries back after you've deleted them GRRRRR :headwall:

I'm wondering that too...I've been using Adaware every night, but if Sare's spending 12 hour and Gonzo 4 to clean things up, I'm betting my 5 minute run of Adaware's not doing the trick. :([/b][/quote]
Peaches - this site has excellent instructions for manually removing all kinds of adware, spyware and trojans that even ad-aware can't completetly get rid of.

Just scroll down that page and you'll see a long list of links to various removal procedures.

http://www.pchell.com/support/fastsearch.shtml

http://www.pchell.com/virus/index.shtml

Some things to watch for:

1. Getting popups from sites such as Yahoo or Google. They don't do popups. You get popups there. You probably have adware/spyware.

2. You go to search in yahoo or any other search page and you end up at a different page. You probably have adware/spyware.

3. Your homepage changes on you without you telling it to. You probably have adware/spyware.

4. New icons that you do not remember being there show up in your systray. You probably have adware/spyware.

5. Your computer starts taking longer than normal to boot up. You probably have adware/spyware.

6. Secure pages that you normally go to (bank accounts etc) do not accept your username/password combination. You probably have adware/spyware.

7. You get popups after you close your browser. You probably have adware/spyware.

8. You get errors that say stuff like "could not connect" when you aren't trying to connect to anything. You probably have adware/spyware.



Serge, the email going out could be a symptom, unfortunately many programs have their own email engine so your email program will not see the email going out and it won't show up in your sent messages box. The only way to see the email going out is to monitor port 25.

I have spybot seek&destory downloaded and everytime I do a scan it gets half way thur then stops. I'm thinking that it is just going thur that file but 20min later it still hasn't moved. I have to control+alt+delete spybot just to get it to quit.



is there a better spyware detector for novices like me?



Last edited by masterp74 at Apr 17 2004, 06:02 AM

Peaches - this site has excellent instructions for manually removing all kinds of adware, spyware and trojans that even ad-aware can't completetly get rid of.

Just scroll down that page and you'll see a long list of links to various removal procedures.

http://www.pchell.com/support/fastsearch.shtml

http://www.pchell.com/virus/index.shtml[/b][/quote]
Nice links Mike!

What is everyone using to detect that this shit its being loaded on your machine?

If you know what you are doing, I have found "hijack this" to be a really effective tool.

It lists out pretty much everything going on in your computer and you can get rid of anything you want from their screen. Unfortunately, it does not distinguish good from bad so you can end up fucking yourself if you go overboard.

The spyware/adware checkeres help, but they are only as current as their last database update.

To clean up, I normally run spybot and let it clean up what it finds, then adaware and let it clean up. Then I run hijackthis and remove anything I do not recognize as being ok. This is where most of the time comes in because when I am in doubt, I do a search on what file I am getting ready to turn off before so I can see what it is associated with before I kill it.

I agree Hijackthis is excellent. Im trying to find something to detect the activity as its happening while Im surfing more efficently.

A typical Hijak This list:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - D:\Program Files\Norton AntiVirus\NavShExt.dll
O2 - BHO: (no name) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: (no name) - {49E0E0F0-5C30-11D4-945D-010002000012} - D:\PROGRA~1\COFFEE~1\POPUPB~1\CCPOPB~1.DLL
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - D:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\SYSTEM\MSDXM.OCX
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [TaskMonitor] C:\WINDOWS\taskmon.exe
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\WINDOWS\SYSTEM\QTTASK.EXE" -atboottime
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [SchedulingAgent] mstask.exe
O4 - HKLM\..\RunServices: [ccEvtMgr] "C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe"
O4 - HKLM\..\RunServices: [ScriptBlocking] "C:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O4 - HKLM\..\RunServices: [Viking Server] C:\VIKING\VIKING.EXE
O8 - Extra context menu item: &Google Search - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmsearch.html
O8 - Extra context menu item: Cac&hed Snapshot of Page - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmcache.html
O8 - Extra context menu item: Si&milar Pages - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmsimilar.html
O8 - Extra context menu item: Backward &Links - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmbacklinks.html
O8 - Extra context menu item: Translate Page - res://C:\PROGRAM FILES\GOOGLE\GOOGLETOOLBAR1.DLL/cmtrans.html
O9 - Extra button: Related (HKLM)
O9 - Extra 'Tools' menuitem: Show &Related Links (HKLM)
O9 - Extra button: ICQ Pro (HKLM)
O9 - Extra 'Tools' menuitem: ICQ (HKLM)
O12 - Plugin for .spop: D:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://download.macromedia.com/pub/shockwa...ash/swflash.cab
O16 - DPF: {9F1C11AA-197B-4942-BA54-47A8489BB47F} (Update Class) - http://v4.windowsupdate.microsoft.com/CAB/...7883.7265972222
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://www.apple.com/qtactivex/qtplugin.cab
O17 - HKLM\System\CCS\Services\VxD\MSTCP: Domain = swbell.net
O17 - HKLM\System\CCS\Services\VxD\MSTCP: NameServer = 151.164.1.8,151.164.1.7

Ones to look at carefully because the spyware/adware often use them:

BHOs - Browser Helper Objects - IE acts as if it assumes that all BHO's are friendly. Apparently this is a rather easy install to make under the covers.

Search bars and Search assistants (usually a HKLM entry - Local Machine key entry in the registry) Again, an easy install

Toolbars that you did not invite or don't recognize.

Run and runservices entries on programs that you don't recognize.

Ectra tools and menus often can alert you to the fact that something has gotten in.

Plugins are probably the hardest to install under stealth, but are probably the most damaging because these are full blown apps that can take over your whole puter.

well .... that counts me out :biglaugh:

Sounds like your Spybot database is corrupted or something MasterP. I would start up spybot and run a full update, make sure that you are on the most curent version of the proggy and the database. I have never had an issue with Spybot and have been using it for quite a while now.

Cool - thanks :) Cleaning up the computer will be after cleaning the house today. :awinky:

Are you coming to Atlanta? No planes :)

I had my own issue with this a few months back. Hard to know who you can trust any more. :(

yes and now...I have Norton and on one of my michines,
every 15 mins the screen saver disappers and Norton's "Checking outgoing mail" screen pops up...
this how I know-
we got it!

Guys, let me give you the best advise you can ever get:

Decline all email with attachments.
Don't download "demo" software without a major virus check
Anything that is free is being paid for somehow
Keep your windows machine 100% up to date, run the windows update regularly
run adaware or similar every morning, and keep those up to date.
delete those annoying hosts file, nobody really needs it.
connect to the internet only via a HARDWARE firewall
install and use a popup blocker (the google toolbar one isn't bad)
turn on prompt for cookies, and start blocking everything you don't 100% need.

It won't solve all your problems, but you won't have as many either.

Alex

Thanks Alex that helps all us newbies...

Serge, sounds like you have a zombie, not spyware or adware... and there is a HUGE difference.

Spyware - Tracks your surfing habits and reports back to a central server in order to build a "profile" of you.

Adware - Displays advertisements

Keyloggers - Tracks what you type and sends it back to a central server. These are usually used to steal personal information such as passwords or credit card #'s.

Zombies - Turn your computer into a part of a distributed network, used for spamming or denial of service attacks.

Sometimes products are adware, spyware, keyloggers and zombies all in one, sometimes they are just adware and spyware, sometimes they are just zombies, sometimes they are just spyware.. any mix of the above.

Serge, just to clarify, the product of ours that you keep posting about is adware ( a very non-agressive adware, basically we just want you to use our search engine ) and only adware, no spying, no keylogging and does not cause your system to participate in a distributed network.

The government is looking to eliminate spyware, which i think is a great idea, but since we do not track surfers individually or build profiles of any kind we are not considered "spyware".

You can find out more at http://www.isearch.com/faq.php or you can download the toolbar at http://toolbar.isearch.com

I use a mac as does our entire company. If you insist on using a pc, use firefox, opera, or netscape, if you insist on using internet explorer, set your security settings to high and in "internet options" under "security" select "disable 3rd party browser extensions"

If you use internet explorer with default or low settings, you're a walking target. JMHO



Last edited by Hooper at Apr 17 2004, 10:09 AM

Check to see if you have Windows ;-)

Hooper,
there is way too much infor riding on my machine,
including a few launch codes of Finland nuclear submarines
http://cotac.com/knight/

I'll do EVERYTHING in my power to guard against all sorts of intrusions.

now when you provide expertise on the subject,
how long would it take to turn your software you claim to be safe into zombie distributor?

and PLEASE, don't insult my intelligence with answers which are not true.

I am NOT an expert on the subject,
but my Internet Security advisor is.

I think hes busy this weekend having Darci model all the goodies from Milan. Hooper better answer quick!

I think hes busy this weekend having Darci model all the goodies from Milan. Hooper better answer quick![/b][/quote]
Gonzo,
please do webmasters service and post on GFY and weasel's board
the link to
http://www.safer-networking.org/index.php?...p?page=download

it also innaculates the PC from new spyware.

tell webmasters to run the update AFTER installation and remove/innaculate 500+ spy/ad bots from their machines.

I'm sure Hooper and Co will thank you for it
;-))

fuck it, I'm going back to using WebTV

Well you are correct in that manner serge, it is very easy to modify things to turn adware into a zombie or keylogger program, but that would be a pretty serious criminal offense, so while i'm sure there are lots of people who would do that, i'd prefer to spend my days outside of prison walls.

Well you are correct in that manner serge, it is very easy to modify things to turn adware into a zombie or keylogger program, but that would be a pretty serious criminal offense, so while i'm sure there are lots of people who would do that, i'd prefer to spend my days outside of prison walls.[/b][/quote]
Hooper, there is not much criminal charges one would face today under the current laws. Stealing traffic from webmasters, replacing their reference codes is NOT illegal today, and we all know some people who do it and laugh at the poor webmaster suckers who lost 30% of sign ups due to the zombie networks.

I do NOT say you do it right now, but..
the dark side does have it's grip on everyone, and you are not immune, like the most of us are not immune.

Therefore,
it's in the best interest of webmasters to distribute FREE software to the surfers to save THEIR OWN PROFITS.

Hooper, your "program" is an invasion of my privacy, your modifying my computer without permission, and redirecting me to a site I don't want to use.

it sucks.

Serge, some of the best known people on this board, friends of friends, use various scumware to strip referal codes, redirect surfers (people who try to visit sites like the hun, tommys and other major link / tgp sites are redirected). I had one VERY well known person here explain to me exactly how they did it, having added it into a program that people would commonly download.

One of the 4free type programs (since closed) had a toolbar (that was fourced download on their for free sites) that included making wholesale changes to favorites, search destination, and added about 50 items to the hosts file to redirect people from other search sites.

It sucks all around... but proof of the matter that there is no limit to what people will do to make money, even if they have to steal it from someone else. Oh well

Gonzo: you don't know how many "experienced" webmasters still don't have firewalls, don't filter their mail, and download bucketloads of freeware. I had to remove viruses / scumware more than one from a past partner's computer, and he had been at this since 1995.

Alex

Alex,
all true, no arguments from me.

Funny this came up. My computer was completely taken over by several programs. I struggled with trying to remove them for the last couple weeks. I started getting all kinds of errors. Then i tried to repair windows and nothing worked. Then i finally tried to reinstall windows to overwrite some files that were replaced and it I could no install windows.... but of course, reinstalling XP overwrites existing user settings and I could not get back into folders i had previously. After a 3 days of fucking around, i finally had to go to a data recovery expert to salvage the stuff I needed off my drive so I could then just reformat it.

I am sure there will be some spyware legislation in the near future. The "definitions" of "spyware" "adware" etc is just semantics. People will never distinguish between good and bad or any good or bad combination of all of them... just as they dont distinguish between good and bad pornographers. I think Gonzo said it correctly, "its the new spam" and just like spam, there is going to be a lot of people doing extremely nasty shit with it that will cast a dark shadow on those who don't.

Check to see if you have Windows ;-)[/b][/quote]
This brings up something - I was reading something recently (honestly can't remember where, but for once, I don't THINK it was "People" :) ) that said it's not that Mac's are any more protected from viruses than Windows based machines, but that no one bothers to write viruses for them because so few are in use and they want more bang for the buck. Is that true?

This brings up something - I was reading something recently (honestly can't remember where, but for once, I don't THINK it was "People" :) ) that said it's not that Mac's are any more protected from viruses than Windows based machines, but that no one bothers to write viruses for them because so few are in use and they want more bang for the buck. Is that true?[/b][/quote]
This is very true Peaches. The Mac is a very fertile playground for abuse, but you're dealing with much smaller number of users and an even smaller number of skilled programmers who know how to exploit it.

But here's an example, on a Mac, it would be absolutely trivial for me to give you an MP3 file that when you played it would launch a browser in the background and go to a URL of my choice.

Think of the possibilities....

I agree Hijackthis is excellent. Im trying to find something to detect the activity as its happening while Im surfing more efficently.[/b][/quote]
My advice, in no particular order of importance:

1) Dont trade traffic with anyone running Hoopers shit or anything remotely similar. I dont like the taste of piss in my well water.

2) At the very minimum run a hardware firewall, Linksys and similar products are so cheap there's no excuse not to. Throw in Zonealarm, a soft firewall or similar if you want another layer of protection.

3) Keep your browser and OS patched current.

4) Use Norton Antivirus or another virus detection product that will detect not only viruses but nasty scripts while browsing as well. Keep it patched. If Liveupdate has expired, give 'em the $20 or buy the latest version or it's worthless.

5) Dont surf potential circle jerks such as TGPs with MSIE. Nutscrape or Opera aren't near as susceptible.

6) Tighten your MSIE security settings. Everything related to ActiveX should be set to prompt or disable.

7) Blacklist anyone who tries to hit you or your surfers with any of this bullshit from everything you own.


As fucks get desperate to scrape pennies out of this industry this shit is only going to get worse. Others are bound and determined to go out in flames and strip mine everything they can before Visa, the FTC or whoever shuts their shit down.

I'm sure everybody is changing their links up right now hp. please dont pull all that traffic you've been sending us.

software is just like spam, the whiners will stay poor and in a few years go "gosh, i should make some software" but the money will already be dried up... if you had a guess how much money was being made with software you'd be doing it yourself already.

There is a difference between spam and spyware. A more accurate comparison would be the old-school dialers that disconnected peoples local dial-ups, and called placed like Moldovia.

Justifying shady behavior with cash is the last refuge of Cockholsters.

Sorry Hoop, I dont whore myself, there are limits to what I'll do for money. I guess my mommy and daddy just raised me a little different than your's.

Call me old fashioned, but I look at people who pay me as my customers or clients, not my marks. I try to offer them a service they want for a reasonable fee. I dont try to fleece their ass for every penny I can possibly extract.

Hey MasterP,

Do you really want to start that shit up again?

This is the third time I thought the issue was closed and you've brought it up again. I guess you don't want it to go away.

So did ChoicePoker ever fix that spyware problem people were posting about over here?
http://forumserver.twoplustwo.com/showflat...o=&fpart=2&vc=1

It's funny, even the people in that thread know why you'll never make any money with APT... The answer is right in that thread.

Instead of fixing your broken poker business model, you choose to come attack me. I'm sure you're too ignorant to realize there's even a problem with your "business" model.

KC, do you feel like "they just pull me bacl"?
;-)))

Hey MasterP,

Do you really want to start that shit up again?

This is the third time I thought the issue was closed and you've brought it up again. I guess you don't want it to go away.

So did ChoicePoker ever fix that spyware problem people were posting about over here?
http://forumserver.twoplustwo.com/showflat...o=&fpart=2&vc=1

It's funny, even the people in that thread know why you'll never make any money with APT... The answer is right in that thread.

Instead of fixing your broken poker business model, you choose to come attack me. I'm sure you're too ignorant to realize there's even a problem with your "business" model.[/b][/quote]
lol, you want to dance, let's dance you fucking idiot. that thread has 20 replies, not one said they got spyware. no one has replied to that thread in 7 days. it is on page 27 now on that site.




I'll stop right now if your suck my cock.

otherwise, let's see what i can find out at gfy about paycounter.com

There is a difference between spam and spyware. A more accurate comparison would be the old-school dialers that disconnected peoples local dial-ups, and called placed like Moldovia.

Justifying shady behavior with cash is the last refuge of Cockholsters.[/b][/quote]
you think Ron Tan has anything to do with this new scam?

I'd be shocked to learn he does
;-)))

Pat,
I understand LOTS of things, but this is beyond me..
why would you want KC suck your cock??????

I'd think of 999 candidates in front of him to do that.

if you say you REALLY would rather have KC suck your cock than all the beauties out there-
I'll oficially pronbounce you a perve!
;-)))

BTW,
I'd appreciate you share everything you find on GFY about KC's counter...I had my suspicions that something is fishy since he TOTALLY ducked all my counter related questions.

I have something I got to finish before poker time, so I just did a quick search and bookmarked it. I will go thur it in a few and see what super putz has posted about him

this one is no biggie, just people he havn't been paid for 3 years for sending him traffic.

http://board.FuckYouLensman.com/showthread...ght=pay+counter


edit: i forgot about the hotlink stuff. I'll post quotes in a sec



Last edited by masterp74 at Apr 17 2004, 03:27 PM

Yes ;)))

Just when I think I'm out....

I have something I got to finish before poker time, so I just did a quick search and bookmarked it. I will go thur it in a few and see what super putz has posted about him

this one is no biggie, just people he havn't been paid for 3 years for sending him traffic.

http://board.FuckYouLensman.com/showthread...ght=pay+counter


edit: i forgot about the hotlink stuff. I'll post quotes in a sec[/b][/quote]
See what you can dig up you scumbag.

It's much easier to throw dirt than to fix your piece of shit business.

I have something I got to finish before poker time, so I just did a quick search and bookmarked it. I will go thur it in a few and see what super putz has posted about him

this one is no biggie, just people he havn't been paid for 3 years for sending him traffic.

http://board.FuckYouLensman.com/showthread...ght=pay+counter


edit: i forgot about the hotlink stuff. I'll post quotes in a sec[/b][/quote]
pornjudge



Does not load half of the time, refferers never work... WTF whats the point staying in business if you guys will not fix your problems. Could someone refer me a counter that keeps tracks of all refferers, not like porngraph that also as refferer issues.




quote:
--------------------------------------------------------------------------------
Originally posted by Krome
THe great thing about pay counter is that it helps you get trades through being in their ranking list, plus you do get great stats and you get paid for it on a per click basis.
--------------------------------------------------------------------------------

pornjudge

LOL are you fuckin joking me, getting paid? I have been with them for the past 3 years & I never got paid


-----------------------------------------------------------------------------------------
suesheboy


I don't do big numbers with them but I never got paid either. There is no place to see what is in your account as well.

-----------------------------------------------------------------------------------------------
senseidru




I'm also owed monies from paycounter, got a check once from them but I'm surprised it got here cos they messed up the address, + the form on the site doesn't allow me to put in my postcode, it is too long apparantly.

--------------------------------------------------------------------------------------------------SABAI



because you don t send traffic, because you hide the counters or i dunno.... even with my shitty traffic i sent them i got some checks....

stop badmouthing them and send them some traffic and you ll get paid...

i know that paycounter is full of glitches and is not the top but its free and they pay the traffic they take from you... what else do you want ? that they send you a biatche everymorning to suck your dick?


----------------------------------------------------------------------------------------