Spyware from PPRuNe

[Chaffers]

Have the cookies been altered at all? Just today I'm finding that the thread updated type efforts aint working. As in read thread, use link to return to forum, posts waiting indicator still lit.

I do proon from several different PCs but I've never had a problem today. Clicked the update thread dooberies link on the main page but it didn't solve nowt.

[Timothy]

Well, the powers that be have clearly strutted their stuff.

I am pleased to report that I no longer get the warning from Spybot that Avenue A is trying to sneak in.

Thank you, guys...as ever your help and dedication are appreciated!!

W

[PPRuNe Towers]

Cheers,

But it is all everchanging and we don't kid ourselves. The competition to get information is utterly ruthless big business. We appreciate you keeping us updated whenever you find something fishy.

Before writing though please take the time to check with a fresh, uncookied browser and navigate directly to PPRuNe - we end up wasting a lot of time on folks who've visited other sites first and blame their little secret visitors on us


Rob

[Timothy]

Sure, but SpyBot tells me about them as they arrive, so I can identify the culprit every time!

W

[PPRuNe Towers]

Oooop, apologies - Didn't make it clear that it was generic advice to all rather than directed at your good self

Regards
Rob

[stickyb]

They are back with a vengance!
Have just had 6 warnings in 10 minutes that Avenue A has been blocked, again coming from a Pprune advert

[Timothy]

At 7.30 I posted:

Nothing seen here in London...presumably this is again a regional issue, centred on Asia this time?

and now, at 0800 I must eat my words and say...yup, confirmed sighting here in London as well.

W

[phnuff]

Have just lifted this bit of code from pprune forum index page. If I read this correctly (and I am more than happy to be proved wrong), it looks like a bit of code which displays a slightly different screen if the valueadd cookie is detected. Clearly whoever wrote has the expectation that a cookie may be there.

<SCRIPT LANGUAGE=JavaScript><!--
// ValueParameters
ValueHost = "hs0182282";
ValueLoaded = false;
ValueID = "valueid";
ValueVersion = "1.1";
ValueWidth = 120;
ValueHeight = 60;
//--></SCRIPT> <SCRIPT LANGUAGE=Javascript src="http://oz.valueclick.com/jsmaster"></SCRIPT>
<SCRIPT LANGUAGE=JavaScript><!--
if (ValueLoaded) ValueShowAd();
//--></SCRIPT> <NOSCRIPT> <A HREF="http://oz.valueclick.com/redirect?host=hs0182282&size=120x60&b=forums2&v=0" TARGET="_top"><IMG SRC="http://oz.valueclick.com/cycle?host=hs0182282&amp;size=120x60&amp;b=forums2&amp;noscr ipt=1" ALT="Click here to visit our sponsor" WIDTH=120 HEIGHT=60 BORDER=0 ALIGN=bottom></A>
</NOSCRIPT> <!-- vc active --></P>
</TD>
</TR>

[sqk0612]

I've installed Spyware Blaster, available via Spybot- Immunize, which permanently blocks all spyware.

[Golden Runways]

mr sqk0612 sir, can't agree more. new version just out. installed it on TCS/fobotcso recommendation. blocks an oz.valueclick every time on pprune.

you can add your own blocks in IE6.0 via tools, internet options, privacy, edit, then input the name of the offender, eg 'valueclick.com'.

if you open up the cookies in notepad, you can copy and paste the offending address.

also from that earlier thread on hidden data mining, ozpax mentioned how much info was taken from website visitors. what i couldn't get him to expand upon can be found here

http://www.privacy.net , make sure you visit these bits, http://www.privacy.net/logfile/ and http://www.privacy.net/track/ . fascinating stuff.

that pprune take a proper interest in their advertisers, and methods, is much to their credit.

[Blacksheep]

Introduce the Death Penalty for Computer Intruders

Each day in the office I receive up to fifty or sixty SPAM messages, the majority of which are clearly based upon scans of my internet traffic to determine my interests. These unwanted messages are duplicated into each of my two personal mail boxes. I just deleted 70 SPAM messages from one mail box alone and I guess that half of the computer users in Nigeria have already been in touch with me.

I know that the internet has to be paid for in some way, but advertising based on spying and intrusions has become ridiculous. E-mail is such a mess these days that it is useless for normal communications and I have reverted to using Fax for essential messaging at the office.

Unless something is done about SPAM, and intrusions that use legal services like cookies in an unacceptable way, the internet is in danger of grinding to a halt. I for one would be willing to pay for a secured internet message transmission service incorporating uncrackable code to make it immune to Spamming.

Then of course there's the illegal stuff - in the past forty five minutes BlackIce blocked no less than three SQL_SSRP_StackBo DNS probes and another dozen less threatening probes from strange computers.

**************************
Through difficulties to the cinema

[phnuff]

I have just spoken to a friend who is one of the UK's Data Protection guru's and apparently he believes that some spyware may contravene UK DP law to the extent that he is looking to put together a paper on the subject for publication. If his initial assessment is right, then any spyware/trackers which are downloaded from, or, pass through any UK based servers could result in the owners of those servers finding themselves in court. The key thing here is the pass through, so all those UK based ISP's are potential targets for the knock on the door.

Of course, for the ISP's etc., all they have to do is include a statement of 'you will be tracked' in their T's & C's and make a positive opt in part of the process and they are in the clear. , , and if we all bothered to read the registration T's & C's, then we would at least know who is assisting the spammer.

[Say again s l o w l y]

I'm still getting messages to say that Spybot has blocked 'Avenue A' when I'm on Pprune. I thought this had been sorted out?

[Say again s l o w l y]

It only seems to come up when the Ad for some Casino comes up, if that is any use....

[fobotcso]

It certainly is bad this morning. I'm getting the "Avenue A Inc" warning from Spybot just about every time I change the page.

[Sensible]

Yup, I'm getting the warning about Avenue A from logging into the PPRuNe Homepage and on several other pages as well!

I'm no expert but the problem seems to be with the Debt Buster ad on the Home page and The Tele West ad on the forums page to name but two!

[Timothy]

I agree...every single change of page, apparently regardless of advert.

Doesn't happen in Opera.

W

[PPRuNe Towers]

Well, I suspected that it wouldn't be an end to our problems in my previous post.

As you've collectively discovered, the scumbags went straight at it again with barely a pause. Therefore yesterday we pulled the rug on valueclick. Got another set of wheedling promises just like the incidents with pop ups and audio ads but we told them exactly where to go. Gives us some short term financial problems but nothing we haven't faced before.

As ever, our thanks to you all for keeping us on the ball - I'm off to see if I can get a paper round now and Danny's working as security man on a Glasgow book signing tomorrow night

Regards
Rob

[phnuff]

I have been using Opera on one machine and rarely get any uninvited guests on my machine. On another, I use IE6 and it full of the blighters.

I have stuck CookieWall, a freebie from AnalogX (www.analogx.com), on the IE6 machine with a 1 minute testing interval and lo and behold, it regularly finds stuff, and gives the option to accept, delete or do a temporarly accept - even finds the nasty DoubleClick test cookie

[sqk0612]

I've downloaded Cookiewall

What happens now if I remove all my cookies, and, say, want to log in to Pprune again- Would I have to give all my details over again?

Pardon my ignorance!