What can we do to slow down Spyware programs?

**Klen** · 10-07-2007, 03:14 AM

Program a worm which will install million copies over world and add blocking of spyware links to .hosts file.

**Zester** · 10-07-2007, 03:35 AM

we can insert the .htaccess code in our sites to detect if those are installed in redirect them to a page which will educate them about it and how to remove it.

**johnspider** · 10-07-2007, 04:05 AM

Originally posted by Paul Markham

As you all know I'm no computer expert. Can barely type. ;)

Can we start to protect and educate our surfers?

Maybe by promoting sites and programs that will detect and slow these scum down we might help ourselves. I would love some input from the experts on this. I did find these and if you know of more post the URL.

http://www.safer-networking.org/

http://www.lavasoftusa.com/

Anyone got any better advice? I'm listening and will put up some advice on my sites Monday.

Yes i think that is a good idea , as well taking these spyware companys one by one down whether through the legal system or complaining and reporting to there webhosts.

**mikeyddddd** · 10-07-2007, 04:39 AM

Originally posted by Zester

we can insert the .htaccess code in our sites to detect if those are installed in redirect them to a page which will educate them about it and how to remove it.

That's what I'm doing. Eveyone would benefit if each of us did this to get the spyware removed from surfers' machines one by one.

I may be losing some traffic by not letting those that are infected into my sites, but why waste a single bit of bandwidth if a sale may be stolen?

The biggest problem is keeping up with all the scumware that needs to be in .htaccess. Until this latest episode I was unaware of some of the names they were using.

I'd appreciate having a resource listing everything that should be in .htaccess.

**Paul Markham** · 10-07-2007, 08:16 AM

Getting the htaccess is good, educating the surfer to not fall into the trap is even better. IMO.

**RawAlex** · 10-07-2007, 08:32 AM

Paul, I think that maybe what you should do is just drop your membership prices down to, say, $1 and see what happens. That would be good I think.

**Paul Markham** · 10-07-2007, 12:17 PM

Originally posted by RawAlex

Paul, I think that maybe what you should do is just drop your membership prices down to, say, $1 and see what happens. That would be good I think.

As someone who is anti Zango I would of thought you would come up with a better post than that.

I'm looking for solutions, informing the surfer how to guard against his computer being hijacked seems a step in the right direction. It's closing the barn doors before the horse bolts. Do you have a better suggestion?

**onlytease** · 10-07-2007, 12:59 PM

anyone like to share some htacess code to redirect zango installs?? please

**»Rob Content«** · 10-07-2007, 01:07 PM

Paul you understand that you are working with people that spread spyware?

I see you adding your videos to megarotic all the time, you understand before you play a video it has a link to "download the megarotic toolbar" Toolbar that is spyware. So people who are watching your videos, that you put there, can also get spyware.

Just a thought, but maybe it's better to not work with the people you want to fight?

**qxm** · 10-07-2007, 01:08 PM

Originally posted by onlytease

anyone like to share some htacess code to redirect zango installs?? please

This would actually be helpful........anyone with an .htacess code please post it here. It is a small step but it is better than just complaining and doing shit...

**»Rob Content«** · 10-07-2007, 01:12 PM

I can feel the answer coming.. We need to adapt

**Diligent** · 10-07-2007, 04:20 PM

This would be the best solution I think...

All sponsors (AND BILLERS WITH AFF.MANAGEMENT, like CCBill & Verotel) make sure
there's a system in place (in their stats collection) that checks:

1: Domain Referrer (all affiliates must register domains they send traffic from)
2: Join ratio (if exceptionally good, raise flag to look into more deeply)
3: Browser Agent (if "Zango" etc., raise flag to match Aff-ID extra hard with Domain Referrer)

And then, whenever it's seems the true source of a sale can't be determined, send the sale amount into a pool that is distributed among all affiliates, depending on each and everyones normal stats.

If all sponsors does this, the assholes behind all this will see their income dry up.
Not immediately, but pretty damn fast..

I think this is the only way to do it.
This solution also has this benefit: if everyone does this, as an industry-wide solution, no sponsor loses any revenue, and no legitimate affiliate gets any less than what is rightfully theirs. Funds distribution from the pool hits everyone as equally right as possible.

**GrouchyAdmin** · 10-07-2007, 04:35 PM

Originally posted by qxm

This would actually be helpful........anyone with an .htacess code please post it here. It is a small step but it is better than just complaining and doing shit...

I'm pretty sure 'Zango' is an identifier in the user agent. I haven't actually tested for it, as I do not have an infected system, nor will I create one on purpose without a personal or monitary reason.

This should work. change nozang.php to whatever you like; this example passes url=where_they_came_from, so you can log it for your own records, or whatnot.

You can add this to your .htaccess; This one is set to redirect anyone that has a user agent set to zango

Code:

<IfModule mod_rewrite.c>
  RewriteEngine on
  RewriteCond %{HTTP_USER_AGENT} Zango [NC]
  RewriteRule (.*) http://site/where/nozang.php?URL=$1 [R=302,L]
</IfModule>

**rowan** · 10-07-2007, 04:53 PM

Originally posted by Diligent

This would be the best solution I think...

All sponsors (AND BILLERS WITH AFF.MANAGEMENT, like CCBill & Verotel) make sure
there's a system in place (in their stats collection) that checks:

1: Domain Referrer (all affiliates must register domains they send traffic from)
2: Join ratio (if exceptionally good, raise flag to look into more deeply)
3: Browser Agent (if "Zango" etc., raise flag to match Aff-ID extra hard with Domain Referrer)

And then, whenever it's seems the true source of a sale can't be determined, send the sale amount into a pool that is distributed among all affiliates, depending on each and everyones normal stats.

If all sponsors does this, the assholes behind all this will see their income dry up.
Not immediately, but pretty damn fast..

I think this is the only way to do it.
This solution also has this benefit: if everyone does this, as an industry-wide solution, no sponsor loses any revenue, and no legitimate affiliate gets any less than what is rightfully theirs. Funds distribution from the pool hits everyone as equally right as possible.

This only solves the issue of replacing an affiliate ID... what happens when Zango pops up a Quickbuck (merchant) join page over the ccbill or epoch form?

**st0ned** · 10-07-2007, 05:01 PM

I may try and put up a site over the next few days which will be a command post of sorts. Including .htaccess codes, Sites to blacklist (Trading wise since these fuckers are spreading via TGPs), Contacts so we can try and shut them down, Maybe even make a fund where we can all chip in to get a legal team together. This shit is serious and we need to put a stop to it A.S.A.P. If anyone feels they can contribute something in organizing this, Please feel free to contact me.

**Compdoctor** · 10-07-2007, 05:02 PM

Originally posted by Paul Markham

As you all know I'm no computer expert. Can barely type. ;)

Can we start to protect and educate our surfers?

Maybe by promoting sites and programs that will detect and slow these scum down we might help ourselves. I would love some input from the experts on this. I did find these and if you know of more post the URL.

http://www.safer-networking.org/

http://www.lavasoftusa.com/

Anyone got any better advice? I'm listening and will put up some advice on my sites Monday.

Are you aware of how many hacking boards are out there teaching the newbies how to hack? The only way you can stop it is by shutting down the boards that teach hacking, but good luck on that, becasue they are mostly hosted in countries other than the US

**porn blogger** · 10-07-2007, 05:02 PM

.htaccess wont help... anyone can change the user-agent on their software, they can pretend to be using IE6 or firefox if they want... this is how people were getting free wifi access @ starbucks for a while for purchasing windows vista.

honestly, there is nothing that you can do to slow them down, because it's harder for you to find a way to stop it, then it is for them to go around your methods.

**GrouchyAdmin** · 10-07-2007, 05:14 PM

Originally posted by porn blogger

.htaccess wont help... anyone can change the user-agent on their software, they can pretend to be using IE6 or firefox if they want... this is how people were getting free wifi access @ starbucks for a while for purchasing windows vista.

As a corollary: People who have Zango installed and actually pay for porn are not going to be these kind of people.

**mikeyddddd** · 10-07-2007, 05:23 PM

From one of the threads yesterday I picked up that zango also uses seekmo, hotbar and hbtools.

So in .htaccess use:

RewriteCond %{HTTP_USER_AGENT} zango|seekmo|hotbar|hbtools [NC]

As I said earlier, I'd like a more complete list of spyware headers.

**uno** · 10-07-2007, 05:41 PM

Originally posted by johnspider

Yes i think that is a good idea , as well taking these spyware companys one by one down whether through the legal system or complaining and reporting to there webhosts.

I got hit by some NASTY ones a day or 2 ago. The programs kept trying to ping sites hosted by web***.

**Diligent** · 10-07-2007, 05:58 PM

Originally posted by rowan

This only solves the issue of replacing an affiliate ID... what happens when Zango pops up a Quickbuck (merchant) join page over the ccbill or epoch form?

Well, in such a case QuickBuck (assuming they were a clean sponsor, which we all would find an amusing statement) should react to the numbers & referrers (or lack of!) on that specific affiliate account...

So, You're right... it wouldn't work as long as there are such blatantly shady sponsors co-existing alongside our industry.

Guess we would also need a systematic "scam merchant reporting" routine set up as well, and all billing companies should not only listen to us there...
But actually proactively monitor their merchants in pretty much the same way I suggested. And then SHUT THEM OFF due to a "no malware allowed" in their terms.

It would take efforts to get a unified going with this, that's for sure... but it would eliminate the problem.
IF ALL OPERATORS INVOLVED in the industry participated (at least down to the paysite biller level, affiliates can pretty much just inform their surfers)... then this *should* really be the best, most fair, and least complex solution!

**hungry hungry hippy** · 10-07-2007, 06:07 PM

Originally posted by porn blogger

honestly, there is nothing that you can do to slow them down, because it's harder for you to find a way to stop it, then it is for them to go around your methods.

bingo

8

**qxm** · 10-07-2007, 06:15 PM

I just posted an .htaccess in all of my sites........even the mainstream ones........

What freaking amazes me is that this problem affects all g-dam webmasters on this board and yet no one else seems to be concerned about this stupid spyware company (zango)......

It seems that the Quickbuck problem diffused the attention and then focused it towards that particular scam but if you ask me.......zango is the bigger scam here........at least I'm looking at the big picture.....

**qxm** · 10-07-2007, 06:18 PM

wrong post.........bump

**Mutt** · 10-07-2007, 06:24 PM

Originally posted by uno

I got hit by some NASTY ones a day or 2 ago. The programs kept trying to ping sites hosted by web***.

webair? u removed the spyware - what was the name of it?

**Diligent** · 10-07-2007, 06:31 PM

gxm:

You're definitely right there, I mean.. there's a small circle of people that are doing this, and have been for a while.
So there should be a lot of ill accumulated assets in action, I'm talking BIG deals here.
We really need to close the loopholes they're abusing, it's the only way to get rid of them.

**Quickdraw** · 10-07-2007, 06:46 PM

and check all the sites you trade/link with at http://cheaterhell.com (not mine, just useful.)
Might not be a bad idea to check who your trades are linking to as well. Like TheHun does. No need to send surfers to a spot where exploits are only 1 click away.

**uno** · 10-07-2007, 07:39 PM

Originally posted by Mutt

webair? u removed the spyware - what was the name of it?

I had so many I can't be sure which was which. I kept getting sent to this ip: 209.200.45.73, not sure which domain.

**Thurbs** · 10-07-2007, 10:32 PM

in all seriousness, this issue is moot. most of these infected users are one, not interested in wasting time to fix it, or simply don't understand the problem and then get all scared about breaking their computer (which by all rights works, just with more ads) in an effort to fix it.

sad to say, people still act like its a big mystery box with a screen that could breakdown completely if they press the wrong OK button.

**Mutt** · 10-07-2007, 10:43 PM

Originally posted by uno

I had so many I can't be sure which was which. I kept getting sent to this ip: 209.200.45.73, not sure which domain.

it's an Apache default page instead of the standard Webair placeholder page.

i will keep an eye out to see what shows up there.

thanks

**uno** · 10-08-2007, 12:52 AM

Originally posted by Mutt

it's an Apache default page instead of the standard Webair placeholder page.

i will keep an eye out to see what shows up there.

thanks

You can do a reverse-ip lookup on the server to see what's hosted there. www.whois.sc

**GrouchyAdmin** · 10-08-2007, 12:55 AM

Haha. Someone running on a CPanel machine? More likely than not it was someone who was using one of the cheap virtualhost accounts, or even more so, a mismanaged system where they made one for themselves.

All of the points raised in here are kind of moot. All Zango has to do is stop modifying the User-Agent, and there's no explicit way to track without an invasive Active-X control that searches the system's GUIDs.

So basically, yeah, it's kind of pointless - all you can do now is scoff and redirect. In the future, probably not even that.

**qxm** · 10-08-2007, 01:10 AM

So wut u r sayin is bend over and take it in the ass?...that doesn't seem much of an option 2 me!

**GrouchyAdmin** · 10-08-2007, 01:31 AM

Originally posted by qxm

So wut u r sayin is bend over and take it in the ass?...that doesn't seem much of an option 2 me!

What I'm saying is "Even if you make a tiny impact, they'll change their tactics."

To wit: Do whatever you feel like doing, it likely isn't going to change much. For as many people that hit your site that get redirected to "OMG U HAVE SPYWARE," there's another 500 installing BearShare.

Right now, you can test them by a User Agent. If they change that, you've got basically nothing that you can do. You have no control over the surfer, unless you want to just blindly turn them away. That's simple. I've provided information on how to do that.

There's far too much money in sales to those who running the Zango ads. They don't care if you don't sell their product; someone else will.

**babydred** · 10-08-2007, 05:07 AM

Originally posted by onlytease

anyone like to share some htacess code to redirect zango installs?? please

here ya go

Code:

<IfModule mod_rewrite.c>
RewriteEngine  On
RewriteCond %{HTTP_USER_AGENT} zango|seekmo|hbtools|hotbar [NC]
RewriteRule .* http://adwaresucks.com/zango [R=302,L]
</IfModule>

D · 10-08-2007, 05:10 AM

Encourage peeps to format their hdd once a year as part of standard maintenance.

Makes a very small impact, but there's not a lot of second-guessing involved.

**Quickdraw** · 10-08-2007, 05:10 AM

Originally posted by Mutt

it's an Apache default page instead of the standard Webair placeholder page.

i will keep an eye out to see what shows up there.

thanks

That ip is on this DNS-- jctwebhosting.net (around 48 domains all pretty much same owner)
These domains are on the ip
Bestaudiocodes.com
Bestaudiocodes.net
Bestvideoringtones.com
Flashvideocodes.com
Friendshangout.com
Grabvideocodes.com
Makemyvideo.com
Myimagelinks.com
Mymusichangout.com
Mystarlinks.com
Myvideolinks.com
Series-of-articles.com
Toolbarvideos.com -- I downloaded the exe on this page and Prevx1 calls it a "Suspicious Self Modifying File"
Toolsforfriendster.com
Toolsformyspace.com
Toolsforyourprofile.com
Youtube-video-codes.com

**sumphatpimp** · 10-08-2007, 06:57 AM

What can we do to slow down Spyware programs?

stay away from porn sites.
thats where they have all that stuff.

**Zester** · 10-10-2007, 03:50 AM

hmmmmmm....... a press release about how to remove shit like Zango from your computer ?
as long as the surfer actually reads it.

or maybe building our own little software that removes Zango ?
this Zango removing software should be installed the same way/method Zango was installed.
if the surfer was tricked to install Zango maybe he will be tricked to install this software which removes it. (by promising porn or whatever...)

**Klen** · 10-10-2007, 04:29 AM

Dont forget is more important to PREVENT then to HEAL.So you can add link to your site prevent yourself from spyware.You just need to explain how to add code into .hosts file (in windows it's on windows/system32/drivers/etc)
So surfer need to put into .hosts file some ip adress and www.zango.com and zango.com ,so then automaticly anything with zango will automaticly redirect to ip adress.

What can we do to slow down Spyware programs?

What can we do to slow down Spyware programs?

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment

Comment