Spyware from diy not?

[Softus]

pagead2.googlesyndication.com

ads.adviva.com

questionmarket.com

Knock, knock, knocking on ZAP smoldering wall
cookies - scripts - ads

All pretty innocent aren't they? Old advertising garbage keeping the web afloat.... Not that I'd know, cowering behind ZAP, peering out from the Opera 8.5 cage.

I've just run a packet trace while refreshing this page of this topic - "ads.adviva.com" and "questionmarket.com" are notable by their absence.

I suggest that the problem you're reporting is limited to the behaviour of the software on your computer. Let me know if you want any help getting trid of it.

 

[paintycait]

[I've just run a packet trace while refreshing this page of this topic - "ads.adviva.com" and "questionmarket.com" are notable by their absence.

OK when I entered the site last night from my email link adviva was running but not trying to download. Tonight it's not even running, but try copying and pasting a link to this page and opening it up that way and two try to download. Same happened last night.
It's just dull......
Cait

 

[empip]

I would use a browser other than IE, unfortunately, as I've said many times before, they're not compatible with the internet! (note I didn't say the HTML standards, because as we all know the internet is often not entirely compliant)

If you worry about the spyware, you should also be worrying about all the hits you are getting off agencies spying to see if you are using P2P software. I don't, but after installing PeerGuardian I have felt insensed at getting pinged off bl**dy record companies. During one hour-long period I was getting hit about 10 times a second! Good to know that the price of my CDs and DVDs is partially to pay for them to barm up my internet connection!

I do run IE for M$ updates, Firefox and Opera browsers just for the hell of it !!
Not desperate about Opera and it's ability to do what I want.. I actually find the handy stuff outweighs the odd awkward stuff, few sites are a problem now and I can switch if necessary... nice to know that it does not run active-x, also has lots of bells and whistles to play with.
Opera has a neat right click context menu for BBcode ...
Strangely, the web page 'buttons' work fine on some sites but not, Not

Cheers softus, but I do not think I have a problem, merely mentioned the sites which ZAP blocked upon using DiyNot .. Just a scrap of the source code for this current page .. reported by Opera..

var ans_timestamp = (new Date()).getTime();
document.write("<scr" + "ipt language=\"JavaScript\" src=\"http://ads.adviva.net/serve/v=300;m=2;l=1018;ts=" + ans_timestamp + "\"></scr" + "ipt>");
.....................
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
............................
the properties of one advert image bottom of page.
http://pagead2.googlesyndication.com/pagead/imgad?id=CIKcnoyWpNTODhDYBRhaMgi9Vg4rnI-rjA

This is why I mentioned advertising ..... Are you saying something on my machine is adding the addresses as shown (above) in the source page?

I think I know Javascript is jumped by ZAP and it shows ..

<script language='javascript' src='http://127.0.0.1:1025/js.cgi?pcaw&r=5097'></script>
......That type of JavaScript insertion is what ZAP uses to enforce my Privacy settings

 

[Richardp]

I got no probs with spyware, I get dressed up in it every friday night for the misses.{miss moneypenny) rrrrrf !!

 

[Softus]

This is why I mentioned advertising ..... Are you saying something on my machine is adding the addresses as shown (above) in the source page?

I think I know Javascript is jumped by ZAP and it shows ..

<script language='javascript' src='http://127.0.0.1:1025/js.cgi?pcaw&r=5097'></script>
......That type of JavaScript insertion is what ZAP uses to enforce my Privacy settings

Clue: what computer do you think has IP address 127.0.0.1?

And have you run netstat to see what process is listening on port 1025?

 

[empip]

Clue: what computer do you think has IP address 127.0.0.1?

Could it be vaguely similar to 0.0.0.0 ? localHost.
What else should I be thinking ???

And have you run netstat to see what process is listening on port 1025?

No, but yes to TDImon
Why would I not have checked this... ?

When I turn off NAV email scanning ... No listening at port 1025.

But Zone Labs Pro firewall still pops that piece of code into the current page. 'That type of JavaScript insertion is what ZAP uses to enforce my Privacy settings ..'


[code:1]Prog local Remote
Msimn TCP:0.0.0.0:1887 217.12.12.xxx.yyy # M$ Outlook Exp.
Navapw32 TCP:127.0.0.1:1025 127.0.0.1:1887 # Norton Anti-Virus's background scanner

Courtesy of 'SamSpade'
217.12.xxx.yyy = [ ##.mail.v##.uk5.yahoo.com ] # My mail provider
[/code:1]

Which leaves us with

ar ans_timestamp = (new Date()).getTime();
document.write("<scr" + "ipt language=\"JavaScript\" src=\"http://ads.adviva.net/serve/v=300;m=2;l=1018;ts=" + ans_timestamp + "\"></scr" + "ipt>");
.....................
<script type="text/javascript"
src="http://pagead2.googlesyndication.com/pagead/show_ads.js">
</script>
............................
The properties of one advert image bottom of page. (if ads allowed at firewall)
http://pagead2.googlesyndication.com/pagead/imgad?id=CIKcnoyWpNTODhDYBRhaMgi9Vg4rnI-rjA
I guess that clears up any doubts on one address.

So ads.adviva.net remains.

Adviva is a leading provider of network online advertising.

I stick with plain old advert providers ...
BTW I get no Cookie s from any of them, don't know if they try to set any.... Firewall block is on and effective.

 

[Softus]

OK when I entered the site last night from my email link adviva was running but not trying to download. Tonight it's not even running, but try copying and pasting a link to this page and opening it up that way and two try to download. Same happened last night.
It's just dull......
Cait

I'm confused, which is nobody's fault but mine (see next posting by me).

paintycait - what I don't understand is why one day you started a topic suggesting that the forum web site was distributing spyware, and then later sign off saying that it's dull.

Are you no longer interested in this topic?

 

[Softus]

empip - I've made a mistake.

I thought, wrongly, that you had started the topic, whereas I now see that it was paintycait.

This is why I was offering help and starting to analyse the ZAP reports that you posted.

It's clear that you know what you're doing, so please accept my sincere apologies.

 

[empip]

Steady on .... a reasonable idea maybe, could be famous last words !!

Anyway here is a site with some belting free utility software, in fact tis the only one I have noticed which is recommended by M$ .. not that I would have noticed many !!
Employees of the monolith at some stage no doubt. http://www.sysinternals.com/NetworkingUtilities.html

Here is one reference from M$ .. under More Information http://support.microsoft.com/default.aspx?scid=kb;en-us;232830

Goodies:-
RegMon
FileMon
PortMon
TdiMon
Process Explorer
AutoRuns

 

[Moz]

empip
dont know if you been here but a wealth of good places for you to visit

http://www.lnkworld.com/security.shtml

 

[empip]

Just another magic ... Friday..

http://cdmediaworld.com/hardware/cdrom/cd.shtml

Another worldly place.. Cannot vouch for all the links ..
https://netfiles.uiuc.edu/ehowes/www/main-nf.htm
Cheers Mozza...

 

[Softus]

Anyway here is a site with some belting free utility software, in fact tis the only one I have noticed which is recommended by M$ .. not that I would have noticed many !!
Employees of the monolith at some stage no doubt. http://www.sysinternals.com/NetworkingUtilities.html

I concur - I use at least one of the Sysinternals utilities every day of the week, and have some clients running patch scripts entirely relying on them (when I've been pinned to the wall by a M$ server bug).