Spywares on EBT

if you have anything to say about this forum, this is the place

Moderators: avij, Phaseolus, Fons

Post Reply
User avatar
alex77r
Euro-Master
Euro-Master
Posts: 2282
Joined: Mon Jul 05, 2004 5:24 pm
Location: London Heathrow (UK)
Contact:

Spywares on EBT

Post by alex77r »

I didn't know where post this topic, but :
I found those files with an application to track spywares.
Spywares are files which go on your computer and look on your file and what you do on internet. Everytime I go on EBT, I found those after.
They seem to be from Estats website.

ArchiveData(auto-quarantine- 2004-09-03 14-56-31.bckp)
Referencefile : SE1R6 30.08.2004
===============================================

CLARIA
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
obj[0]=Regkey : clsid\{21ffb6c0-0da1-11d5-a9d5-00500413153c}
obj[1]=Regkey : software\gator.com
obj[6]=Folder : C:\Program Files\PrecisionTime

TRACKING COOKIE
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
obj[2]=IECache Entry : Cookie:pascal@seeq.com/
obj[3]=IECache Entry : Cookie:pascal@estat.com/
obj[4]=IECache Entry : Cookie:pascal@ads.pointroll.com/
obj[5]=IECache Entry : C:\WINDOWS\Cookies\pascal@estat[1].txt
What do you think about those files ?
The Shortcodes List/Bilan des Codes-courts recensés - website on stand-by
User Control Panel>Board preferences>Edit global settings>(1) Sélectionnez le thème "Subsilver2" pour avoir une apparence ressemblant à l'ancien forum (2) Forum en français désormais possible!
User avatar
avij
Forum Moderator
Forum Moderator
Posts: 6122
Joined: Mon May 27, 2002 10:45 pm
Location: Helsinki Finland
Contact:

Re: Spywares on EBT

Post by avij »

If I were you I'd get rid of the Claria's Precision Time thing. It doesn't have anything to do with EBT, and it was not installed by the EBT website. Yes, Estat uses cookies for tracking your site usage but I wouldn't be too concerned about it. If you like, you can block cookies from estat.com from within your web browser. I don't know where those seeq.com and pointroll.com cookies come from, though.

The Estat statistics script used to do nasty things in the past, including spawning ad popups. When it was found out that estat had started this, the statistics script was "neutered" so that its ability to spawn popups was removed. It can still set cookies, though. This change was made in October 2003.
Money makes the world go round. We track how the money goes round the world.
User avatar
alex77r
Euro-Master
Euro-Master
Posts: 2282
Joined: Mon Jul 05, 2004 5:24 pm
Location: London Heathrow (UK)
Contact:

Post by alex77r »

Yes, I know
Thank you
The Shortcodes List/Bilan des Codes-courts recensés - website on stand-by
User Control Panel>Board preferences>Edit global settings>(1) Sélectionnez le thème "Subsilver2" pour avoir une apparence ressemblant à l'ancien forum (2) Forum en français désormais possible!
Guest

more unwelcome popups!

Post by Guest »

I also keep on getting those "spyware scare" boxes on my computer. Moreover, now I'm getting "matchmaking and online dating" stuff also! Needless to say, I don't want to get this rubbish on my computer when I log on EBT (in fact I don't want it at all, for that matter).

Can anything be done? I wouldn't like to stop using EBT...
User avatar
Dakkus
Euro-Master
Euro-Master
Posts: 4734
Joined: Tue Jun 24, 2003 3:59 pm
Location: No Helsinkiem, Somijas / Iš Helsinkio, Suomijos
Contact:

Re: more unwelcome popups!

Post by Dakkus »

Anonymous wrote:I also keep on getting those "spyware scare" boxes on my computer. Moreover, now I'm getting "matchmaking and online dating" stuff also! Needless to say, I don't want to get this rubbish on my computer when I log on EBT (in fact I don't want it at all, for that matter).

Can anything be done? I wouldn't like to stop using EBT...
Those things don't come from the EBT site. You may have installed some "free" and "handy" tool with Gator or something alike in it from the internet. Those programs hide theirselves in your computer and pop up stupid advertisements when you've got an internet browser on.
Such a program could also have come to your computer with some virus.
I suggest you get a virus scanner and a spyware removing program and find out what's wrong in your computer. And stop downloading those violet gorillas.
Ko saka āboliņš? Pēk pēk pēk!
User avatar
avij
Forum Moderator
Forum Moderator
Posts: 6122
Joined: Mon May 27, 2002 10:45 pm
Location: Helsinki Finland
Contact:

Post by avij »

Do you have any other websites open when you're browsing EBT?

There are absolutely NO popups or advertisements sent by EBT, so it must be something else that's causing those popups. I'd suggest downloading AdAware, it does a pretty good job of cleaning up your computer from spyware and other unneeded programs.
Money makes the world go round. We track how the money goes round the world.
Guest

Post by Guest »

avij wrote:Do you have any other websites open when you're browsing EBT?

There are absolutely NO popups or advertisements sent by EBT, so it must be something else that's causing those popups. I'd suggest downloading AdAware, it does a pretty good job of cleaning up your computer from spyware and other unneeded programs.

Actually I always use AdAware when I switch the computer on. The ads only appear when I go on to EBT. That kind of made me think there might be something funny hiding inside EBT rather than in my own computer, particularly as another user (see the first message in this thread) complained of similar "spyware" ads (which I guess would really just install spyware on one's computer rather than help you to get rid of it, hence I never click on any of those).

As to other sites open simultaneously - not usually, no. I tend to go straight from my phone operator's start page to EBT, possibly checking one or two big and reputable news pages (e.g. BBC) in before. I try to avoid any "funny" pages and regularly delete most cookies from my computer. Yet when I go on EBT, this happens. At least until now that is. I have now blocked cookies from some of the pages mentioned in this discussion. We'll see if that works.
User avatar
avij
Forum Moderator
Forum Moderator
Posts: 6122
Joined: Mon May 27, 2002 10:45 pm
Location: Helsinki Finland
Contact:

Post by avij »

I must say I'm a bit puzzled, I'd like to get this thing resolved one way or another. Personally I haven't seen any popups on EBT since the estat incident last year.

As far as I'm aware, it's not possible to open popups without using JavaScript. There aren't that many JavaScript scripts on the page. One obfuscates the EBT support email address, another is used for the advanced note entry form (which I suppose is as clean as it can get because it's been written by us) and the third is the modified estat script which is loaded from EBT (to make sure estat can't change the script without our knowledge). The script is reproduced below:

Code: Select all

/* modified from the estat script, the original spawned popups */
function _estat(_s, _p, _c){
 var _S="http://perso.estat.com/m/00/";
 var _M=_s+"?";
 _M+="n="+Math.round(Math.random()*1000000000);
 _M+="&c="+escape(_c);
 _M+="&p="+escape(_p);
 var _R;
 (typeof(top.location.href)=="string")?_R=escape(top.document.referrer):_R=escap
e(document.referrer);
 if (_R=="undefined"||_R=="") _R = "_bm_";
 _M+="&r="+_R;
 if(typeof(screen)=="object"){_M+="&scw="+screen.width;
    _M+="&sch="+screen.height;
    _M+="&scp="+screen.colorDepth};
 document.write('<a href="http://www.estat.com/getstats?serial='+_s+
 '" target="_blank"><img border="0" src="'+_S+_M+'"></a>')
}

_UJS=1;
As far as I'm aware, the above script can't spawn any popups. .. unless IE is so clever that it interprets the src data in img as code, and estat sends some javascript instead of image data. Well, MSIE does quite a lot of stupid things as well, so I guess it's possible after all.

I have now temporarily (perhaps permanently) disabled the estat stats completely, so it'd be nice if both of you could test out the site without any cookie blocking in place. If the change worked, I guess it's bye bye for estat.

If someone finds a place where EBT is causing popups one way or another, please let me know so I can fix the situation.

EDIT: If it's anything like it was back then, the ad is displayed only the first time the cookie is set. Thus, if you delete estat cookies from time to time, the ads will keep showing up. Of course even one ad is too much, so if it appears that estat is responsible for ads, estat will be permanently removed from EBT.
Money makes the world go round. We track how the money goes round the world.
User avatar
alex77r
Euro-Master
Euro-Master
Posts: 2282
Joined: Mon Jul 05, 2004 5:24 pm
Location: London Heathrow (UK)
Contact:

Post by alex77r »

I don't think that Estats' spywares are looking for personnal information, but just for EBT stats of the most view pages ...

For me, Its not that wich could stop my interest for EBT !!!! :roll: :)
The Shortcodes List/Bilan des Codes-courts recensés - website on stand-by
User Control Panel>Board preferences>Edit global settings>(1) Sélectionnez le thème "Subsilver2" pour avoir une apparence ressemblant à l'ancien forum (2) Forum en français désormais possible!
User avatar
avij
Forum Moderator
Forum Moderator
Posts: 6122
Joined: Mon May 27, 2002 10:45 pm
Location: Helsinki Finland
Contact:

Post by avij »

avij wrote:I have now temporarily (perhaps permanently) disabled the estat stats completely, so it'd be nice if both of you could test out the site without any cookie blocking in place. If the change worked, I guess it's bye bye for estat.
Did this help?
Money makes the world go round. We track how the money goes round the world.
User avatar
alex77r
Euro-Master
Euro-Master
Posts: 2282
Joined: Mon Jul 05, 2004 5:24 pm
Location: London Heathrow (UK)
Contact:

Post by alex77r »

avij wrote:
avij wrote:I have now temporarily (perhaps permanently) disabled the estat stats completely, so it'd be nice if both of you could test out the site without any cookie blocking in place. If the change worked, I guess it's bye bye for estat.
Did this help?
Ill have a look if there is some changes when Ill the time. But about you say for eStats, I think the website have just look for the EBT pages you visit, and not others pages...
The Shortcodes List/Bilan des Codes-courts recensés - website on stand-by
User Control Panel>Board preferences>Edit global settings>(1) Sélectionnez le thème "Subsilver2" pour avoir une apparence ressemblant à l'ancien forum (2) Forum en français désormais possible!
Guest

Post by Guest »

avij wrote: Did this help?
Seems to have worked.
Post Reply

Return to “Forum feedback”