What I do to help counteract Scumware

[Drewbert]

OK. My first post. I don't do a lot of casino stuff, but a friend recommended this board when I mentioned I was loking for sportsbook sponsors.

Anyway, on my main site, I've inserted the javascript code found at http://www.doxdesk.com/software/js/parasite.html on my most viewed page.

This adds nothing to the page UNLESS the javascript code detects a parasite on the persons browser. If it does, it posts a warning about that particular scumware, and a link to where they can find instructions to remove it.

Here's 1 hours worth of stats, 6 to 7pm on a Saturday:

1278 unique surfers visited the site
1132 of those were using MS IE
1089 of those were using MS IE on Windows

786 BHO instances reported (most surfers, if they had parasites, had more than one)

Instances found, BHO name

89 BDE (that's 8% of the people using MSIE/Win! - 3d media popup adverts)
72 NewDotNet (DNS extension)
54 NetworkEssentials (delivers targetted pop-up's)
50 HuntBar (23 are HuntBar/Link - typically used to hijack affiliate fees from merchant sites)
47 MoneyTree (porn site dialler)
43 IEAccess (porn site dialler)
28 IPInsight (form entry logger/spy)
26 MySearch (search hijacker)
23 HotBar (dynamically adds toolbar buttons to competitors' sites)
21 CometCursor (dynamically delivers competing advertisements)
21 IGetNet (hijacks MSN/Netscape search queries)
20 lop
20 RapidBlaster
19 Comload
19 OnlineDialer
17 FavoriteMan
15 webHancer
14 CnsMin
13 BargainBuddy
13 Transponder
12 CommonName
11 FreeScratchAndWin
11 TopText
10 SaveNow
10 UCmore
10 Xupiter
9 WurldMedia
9 DialerOffline
8 DownloadReceiver
8 Onflow
7 SubSearch
6 TinyBar
6 InetSpeak
6 StarDialer
5 StripPlayer
5 Gator
3 BrowserToolbar
2 DailyWinner
2 AdultLinks
2 ezCyberSearch
2 NetPal
2 SideStep
2 Srng
1 AccessPlugin
1 Aornum
1 BrowserAid
1 DialerActiveX
1 eXactSearch
1 FlashTrack
1 IEPlugin
1 InternetWasher
1 MasterDialer
1 NewtonKnows
1 NowBox
1 SearchAndBrowse
1 SearchExplorer
1 XDialer

Descriptions of all these parasites can be found at http://www.doxdesk.com/parasite/

If everyone slapped that little javascript code on their websites, joe average surfer would find out he had parasites a lot quicker, and hopefully remove them and return the revenue potential to the people that deserve it - the site owners!

[Pam712]

Welcome to the board Drewbert and thanks for a great first post

Yes educating your visitors about the spyware/parasiteware which may be installed on their computer is one of the most important things you can do to counteract scumware. Im not familiar with that particular script but I guess it points infected visitors to a removal program such as Adaware which helps them to clean up their system.

I run Adaware on a regular basis and I never fail to be amazed at the amount of scumware which manages to sneak itself onto my system - and I consider myself an educated user! It is truly a minefield out there but education is our best line of defence

Pam

[Dominique]

Thank you Drewbert!

I will install this for sure.

That one piece of code is all that is needed?

[VPJunkie]

WOW!! :eeek: THANK YOU for that post - what great information that is!!

[Joel]

Drewbert,

Hey great post thanks for taking the time to look us up, and to then post this info

I do have one question though.

Where do I run the script from in

Between the <head>tags</head> 

or 

can I place it in a table, thus if a bug is found, it writes the
message to the surfer in the table?

or can I place it in an <iframe>tag</iframe>

Take it easy



Joel

[Drewbert]

>That one piece of code is all that is needed?

Yup.

And the links that appear if a surfer is infected just go to web pages to telling them exactly how to manually remove the software from their computer. No extra programs or downloads are required.

Here's an email from a happy customer from my site:

"I would just like to drop an email to thank your website, i stumbled upon it by accident but as a result found that my computer was riddled by parasites which i have been able to eliminate.

Again, many thanks,"

Together, we CAN make a difference. :^)

You have to be careful when recommending software that cleans up parasites. Some of them have it in for cookies as well, which ruins affiliates who use places like Commission Junction and Befree for revenue streams.

Also, many adblocker programs (that block banner adverts from appearing) do it in such a way that - currently - break all links (even text links) going to Commission Junction and many other advertising systems.

You may well find some casino systems being blocked this way. I can delve further into this if you are interested.

[Dominique]

That would surely be extremely interesting!

Do you know of any sportsbooks being blocked like that?

[Spearmaster]

Great timing LOL - just today I literally went to download the script (having not seen your post yet) - and at the same time searched for a script to detect ad blockers (nothing good, all either encrypted and require connection to their servers).

What a strange mix - trying to prevent ads (Gators) and yet make sure ads appear (preventing ad blockers)... and yet neither suit my purposes at this time.

With the doxdesk script, I am going to be looking for only Gator installations and trying to develop something that will prevent Gator pops.

For the anti-ad blockers, the ones I found are not good because they prevent access to the site - which is not what I want to do - what I want to do is get the ad delivered

Your stats are tremendous - I am shocked that only 5 Gator installations were detected...

NewDotNet is nothing to worry about, it helps to recognize the .game, .chat, .club and other New Net extensions... (I own nine) - the only thing it does is redirect you to a search page when you try to access a domain that does not exist.

I would be very interested if you manage to find or write a script which can detect ad blockers.

BTW, welcome to GPWA!

Joel - you can add the script, or the link to it, anywhere on your pages. According to Doxdesk:

To add the script to a page, include code like the following (which assumes a direct link to the script at my site) in your HTML at the point in the page you want the warnings to appear: 

<script type="text/javascript" src="http://www.doxdesk.com/file/software/js/parasite.js"></script>

[Drewbert]

Joel,

It won't work if you stick it in the header.

In a table is fine. Not sure about an iframe, but that shouldn't cause any problems.

OK, time to type up the post on adblockers...

[Drewbert]

I am shocked that only 5 Gator installations were detected...

Unfortunately, it will only detect a half-installed gator. Once gator is completely installed, the javascript can't detect it. :^(

But the parasite that was found the most was BDE - that is apparently installed by Kazaa, which also installs a version of TopMoxie which is a big commission-diversion system.

There are lists out there of what sponsors/merchants that scumware like TopMoxie and Gator divert commissions from. I need to have a hunt around.

[Spearmaster]

Actually, it worked fine in a header, or at least it did on my test page which had nothing but the header.

The problem with that is that the detection message will show up wherever the script is installed.

My advice is to do one of two things: install it wherever you want the message to display, or modify the script by removing the last few lines:

/*@cc_on
@if (@_jscript_version>4)
  try { parasite_write(); }
  catch (e) { parasite_wscript(); }
@end @*/

then putting the script in your header. Then, where you want to perform the check, you put in this code:

<script>parasite_write();</script>

I don't think there will be many instances where parasite_wscript() is called, I think that's meant for other uses such as checking one's own computer.

Unfortunately, it will only detect a half-installed gator. Once gator is completely installed, the javascript can't detect it. :^(

Ah yes, I see that now Gotta have a look at my registry... surely if it can detect the installer DLLs, it can also detect Gator somehow...

... but wait a minute - I have Gator completely installed... and it detected it just fine...

[former member 2]

welcome to the boards Drew.

interesting stuff. Thx much.

[aces2]

Great info. Thank you

[Drewbert]

Just in case you haven;t seen this one already, an article from a couple of months ago where the scumware CEO's plead innocence, and sainthood...


http://www.clickz.com/aff_mkt/aff_mk...le.php/1580691

[VPJunkie]

Cool article, Drew - thank you! k: I want to go back and read all the articles in the series when I get a few more minutes.