[Kellie aka Ms. B]

This has got to be the worse one I've put on my computer so far. Bare with me, this bugger does a bit of everything it seems.

A merchant has asked me to do some specific testing. For what I'm looking for, I needed to go beyond the incent BHO's. So I install Gator and I'm surfing around testing it. Somewhere along the way in visiting sites for my testing, a driveby download tries to install. Cool...actually what I needed for my testing. The install is for Traffic Syndicate. That's what is on the download screen. I go to their site from the download box and look things over. Looks like the typical popup ad stuff, so I install.

I start getting the pop up ads. Cool, it's what I wanted. Through ZA I see that this one is running itself under the name rundll32.exe which is actually a legitimate MS file. Then I also start noticing that when I mistype a URL, I get a windows alert dialogue with something along the lines of me being able to significantly increase my search times by installing some search assistant. If you click NO, you get an ActiveX prompt (guess they don't understand No means I don't want to install) and then to a 404 page. Then I start getting this box occassionally when the url is correct and I'm blocked from getting to whatever site I'm trying to get to. Kind of like install our software so you can surf.

Next I start experiencing problems with Outlook retrieving my email. Sparodically, my resources would max out when trying to retreive email and all I could do was reset the computer. I noticed that trying to retrieve PayPal notices of payment seemed more likely for this to happen. Then Outlook started crashing frequently on me and rebooting itself. Sometimes this would happen when it was minimized in the task bar inactive. In trying to figure out the email problem, I found that it wasn't Outlook sucking up my resources, but appeared to be a component of ZA. Then I noticed that my permissions through ZA weren't being held for certain of the pw programs. I set them to prompt to know what they are doing. After reboots, certain programs were being changed from prompt to full access. These included ebates and SAHS. Then odigo and yahoo pager (2 programs no longer on my computer but remain in ZA logs). I also see from my ZA logs that my email crashes seem to be occuring when incoming email is trying to received through port 12xx (the last 2 digits changing) instead of 110. Hmmm...the parasites many times communicate through these upper number unspecified ports.

I update Outlook and the problems still happen. I put down the $$ for the newest version of ZA today. During the install of ZA, I was briefly (couple of minutes) without a firewall when I uninstalled the old version and reinstalled the new one. During the install I was directed to ZA website. Well I guess rundll32 did it's thing then. Immediately rebooted following the ZA install (per ZA) and on reboot I had myself a brand new toolbar installed! Search Toolbar. Probably what those window alert boxes had been trying to install.

I wouldn't repeat here what I said. Start looking. It's full of affiliate links. I start trying to track down who Search Toolbar came from. No company name in any of the file properties. Nothing to indicate in the registry files. I run Spybot. Oops! Spybot is no longer able to access the files it needs to check for updates. But scan is still working and from that I see that Search Toolbar is Huntbar (or one of the parts of it). Now mind you, the original download was made to look like Traffic Syndicate.

By now I'm madder than a wet hen. So I come (or try to come) to ABW to ask H to open a HuntBar Forum. Takes forever (and I don't mean the slowness that some ppl are seeing on the boards). OH MY! All banner ads are now being blocked on ABW. Actually not just banners, but all images (don't want to miss a possible ad making it's way through I suppose). Just red x. Try to post. Forget it. Wind up having to boot up the Mac to make my request.

But I really got work I need to get done. I boot up my postage software to print out shipping labels (mind you sensitive information gets passed through this software). ARGH...it can't find an Internet connection. I try several times rebooting. Same thing. I run my sniffer program when I try to connect through Endicia. Hmmm...on my computers DNS query I get a response back from 2 IP, another one besides Endicia. I write the IP down. I go to a site to look up the IP address. Oops..I'm blocked from that site. I try another one..blocked again.

Next thing you know any site I try to go to, it's trying to install the toolbar again, even though it's already installed and I can't get to any site.

I removed all Huntbar and Search Toolbar from my computer with Spybot. Ok, the prompt to install a search toolbar is gone, but I can't access anything through my browser. Thankfully a reboot fixed that.

Now that I know what is causing specific problems, when I have the time I will reinstall I get the aff ID's. There are merchants here on the boards who I saw listed in their Search Toolbar.

The highlights:
1. Even though the program is initiated at boot, it does not list itself in startup programs when I went into msconfig. I suppose because it is operating under MS legit program names.
2. You do not see any references to Huntbar in Program files, etc. There is no sys tray icons, no prefs to be found to turn it off and on. In fact, it didn't even show in task manager under programs or components either.
3. I could block rundll32.exe from accessing the Internet through my firewall. That did stop the pop up ads. However it DID NOT stop it from hijacking my browser nor trying (and finally succeeding) in installing the Search Toolbar, which I definitely did not give it permission to do.
4. Affiliate links are assoicated with this software.
5. It appears to connect itself to certain other software on the computer which would be considered to handle sensitive data as well as the computers security software.
6. The end user can not turn the software on and off if they want.
7. There is no uninstall for Huntbar through Control Panel.
8. The initial download of the popup ad part of the software was through a driveby download, which I allowed to happen.
9. The networks obviously consider this type of software application an "innovative marketing tool" and "compliant" since these guys have affiliate ID's.

If I was a merchant, I would be all over my respective network raising holy cane! Do you really want your brand associated with this kind of software after the consumer has shelled out $$$ to Mr. Computer Repair man to fix their computer and find out what was causing all the problems? And that YOUR store was being served in those popup ads and in their ToolBar Directory????

So far since removing Huntbar and Search Toolbar from my computer, both my email program, postage software, and firewall seem to be performing as they should.

It's Your Money. You earned it. What are you going to do to make sure you get to keep it?

[Trust]

Damn, thats crazy, we gotta educate people and get all this crap off of everybodys computer.

"The successful man is the average man, focused."

[Allen Nance]

Mrs. B,

Your stamina with these piles of crap is beyond the call of duty.

With the sluthing capabilities you have, I bet you can get a reward for finding where they stuffed Jimmy Hoffa.

We need to prepare a letter, (Don't ask me, I can't speell good. )

This letter needs to be sent to every merchant program.

If someone drafts the letter, I will be more than happy to send it to a group or a network group of merchants.

Allen

[ecomcity]

Personally Ms.B, after experiencing this episode of the future renditions of persistant S/W affiliates (I got 2 HuntBar drive-bys last week from overseas news sites), you should take the documentation and shove it in the first network pie hole you see at an affiliate meeting. You can bet the thousands infected every week with this NETWORK monitized virus will install multiple Ad-blocking, cookie cutting, affiliate link hiding tools when their systems return from the repair shop.

These wanks, and their supporters, think effective advertising is putting a nipple on 10 lbs of cellulite.

Mike & Charlie ...

If they won't adopt and feed a bird ..flip them one! BBQ some Gator and remember to flush WhenU..

[Drewbert]

>Wind up having to boot up the Mac to make my request.

Hmmm. There's a moral to the story somewhere in that sentence. :^)

Jimmy James Inc. fan club membership # 3312

[happypoon]

Ms B your persitance and willingness to expose yourself to this crap is just wonderfull! LOL

It reminds me of when I reported a COC violation and was talking with one the network folks on the phone and he said....

What are you doing with that on your computer?

It's a firm example showing that the networks don't think we will load the crap they allow to be pushed on unsuspecting consumers on our machines. You perform an invaluable service here - I wish we had 10 more like you willing to do some sleuthing of their own.

I'd love to myself but with us still being relatively new in the game, our quest for own greediness always seems to take priority. This isn't necessarily right but at least I'm honest enough to admit it.

When we become independently wealthy and are not struggling you can count me in for more help! BTW: I never got that address.

Kudos and thanks!

===============================
PeePee merchants with PooPoo policies allow our earnings to be flushed down the crapper.

Why give parasites unlimited cookie durations and credit for sales where they divert our users and overwrite our cookies. PP merchants directly support what many consider unfair trade practices and thievery!
===============================

[Kellie aka Ms. B]

90% of this one was not intentional sluething believe me. I was just trying to get the frigging computer to work right so I could get some work done.

Further information on these guys.

The toolbar can be found here. From their about us page http://www.websearch.com/legal/about.aspx

I glanced at my logs and I'm seeing hits in my stats from websearch, so I know some of my visitors are infected.

WebSearch Whois:
Registrant:
IBIS Information Technologies (WEBSEARCH-DOM)
621 NW 53rd Street
Ste 240
Boca Raton, FL 33432
US

Domain Name: WEBSEARCH.COM

Administrative Contact:
IBIS Information Technologies (VCFNOHUMJO) info@websearch.com
621 NW 53rd Street
Ste 240
Boca Raton, FL 33432
US
917-603-7931
Technical Contact:
Network Solutions, Inc. (HOST-ORG) customerservice@networksolutions.com
21355 Ridgetop Circle
Dulles, VA 20166
US
1-888-642-9675 fax: 123 123 1234

Reverse IP on WebSearch shows 3 other sites:
1. http://www.crawler.com
Administrative Contact -
Dusan Senkypl - info@trafficsyndicate.com
IBIS, LLC
225 NE MIZNER BLVD STE 300
BOCA RATON, FL 33432
US
Phone - 561-417-9415
Fax - 561-892-5808
Technical Contact -
easyDNS Hostmaster - hostmaster@easydns.com
Paul Hassett
ste 331
Toronto, Ontario M6K3E3
CA
Phone - 416 535 8672
Fax - : 416 535 0237
2. http://www.huntbar.com
Administrative Contact-
Peter Calley: info@huntbar.com
Huntbar.com
5 Ashton Terrace
Caernarfon, North Wale LL55 LD
GB
Phone- 01286-676-151
Fax-
Technical Contact-
Peter Calley: info@huntbar.com
Huntbar.com
5 Ashton Terrace
Caernarfon, North Wale LL55 LD
GB
Phone- 01286-676-151
Fax-
Imagine that a non US address!
3. http://www.yippi.us
Registrant Name: First Cash Reserve, LLC
Registrant Organization: A Florida Limited Liability Co
Registrant Address1: 621 NW 53rd Street
Registrant City: Boca Raton
Registrant State/Province: FL
Registrant Postal Code: 33487
Registrant Country: United States
Registrant Country Code: US
Registrant Phone Number: +01.5614179415
Registrant Facsimile Number: +01.5618925808
Registrant Email: no_reply@yippi.us
Registrant Application Purpose: P1
Registrant Nexus Category: C21
Administrative Contact ID: RO149-BR
Administrative Contact Name: First Cash Reserve, LLC
Administrative Contact Organization: A Florida Limited Liability Co
Administrative Contact Address1: 621 NW 53rd Street
Administrative Contact City: Boca Raton
Administrative Contact State/Province: FL
Administrative Contact Postal Code: 33487
Administrative Contact Country: United States
Administrative Contact Country Code: US
Administrative Contact Phone Number: +1.5614179415
Administrative Contact Facsimile Number: +1.5618925808
Administrative Contact Email: no_reply@yippi.us


From WebSearch TOS, WebSearch.com is a dba for First Cash Reserve, LLC.

Whois info for TrafficSyndicate (who delivered the first driveby download):
Administrative Contact:
Dusan Senkypl info@trafficsyndicate.com
IBIS, LLC
225 NE MIZNER BLVD STE 300
Boca Raton, FL 33432
US
Phone: 561-417-9415
Fax: 561-892-5808
Technical Contact:
Technical Contact Below webmaster@trafficsyndicate.com
First Cash Reserve, LLC
621 N.W. 53rd Street Ste 240
Boca Raton, FL 33487-8291
US
Phone: 015614179415
Fax:
Reverse IP on TrafficSyndicate:
1. http://www.ibisit.com/ and http://www.ibisglobal.com/
IBIS Information Systems
Zdenek Valach
Dobrovskeho 4
Brno, 60200
CZ
Phone: ++420-5-41216830
Fax..: ++420-5-41216831
Email: dns@ibisbs.com
Oh...and they do application development under this business name! Lovely. And e-commerce.

Merchants, these guys could possibly be joined in your programs under any of these names!!

<BLOCKQUOTE class="ip-ubbcode-quote"><font size="-1">quote:</font><HR>you should take the documentation and shove it in the first network pie hole you see at an affiliate meeting <HR></BLOCKQUOTE>

Kind of hard to document the crashes, because well my computer was crashing. I want say where I want to shove some stuff and to whom right now amongst other things.

<BLOCKQUOTE class="ip-ubbcode-quote"><font size="-1">quote:</font><HR>When we become independently wealthy and are not struggling you can count me in for more help! BTW: I never got that address.
<HR></BLOCKQUOTE>

Well, the way this crap software has interfered with my ability to work over the last several days, I'll probably never be independently wealthy.

Ok, since I'm even more than I was before it you know what my computer, I'm back off to doing some work.

It's Your Money. You earned it. What are you going to do to make sure you get to keep it?

[Andy]

Good grief, Ms. B! Bet you'd love to find the people behind HuntBar make them stuff it where the sun don't shine!

One of these days, this cr@p will be shown in court, before a jury, who will see first hand how these software downloads take advantage of consumers.

That will be the beginning of the end...

My thanks to you, Ms. B, for putting yourself through all this for the betterment of the affiliate marketing industry. We'll all be better off for it in the future!

Andy

_______________
"If you were born to be shot, you'll never be hung." -Unknown

[Linda - 5starAffiliatePrograms]

Whoa B, what a nightmare! You need to find a way to get paid for dong this type of research!

Some of these names are familiar to me. I fact I think I have seen some of these names associated with other parasites in some other recent threads. I will check all my CJ merchants, and some thread I think are related
and let you know what I find out.

Sure would help to have a list of the merchants
and the aff IDs once you recover from all the lost time you just endured.

You are awesome! Thanks for all the hard work and filling us in!

Linda Buquet :: Affiliate Management Consultant :: Catalyst eMarketing.com
5 Star Affiliate Programs :: Top Paying/High-Integrity Merchants :: Visit ABW Forum
<FONT COLOR=red size="1">EveryTicket Sports/Concert Tickets :: Irv's Luggage Warehouse :: Executive Essentials Office & Gifts:
DentalPlans :: HealthPlans :: Avid Hosting :: IntelliContactPro :: zZounds Music :: Roadloans :: MORE!
</font>

[Linda - 5starAffiliatePrograms]

Just did some quick checking and can't find any of those names in Irvs or Dentalplans.

A quick check on Google gave me this:
http://www.lavasoftsupport.com/index.php?showtopic=7991

"IMPACT OF SERVICE ON YOUR BROWSER AND COMPUTER

By installing the Service you understand and agree that the following changes may automatically be made to your internet browser and that the following functions may be performed by the Service. If at anytime you wish to remove the Service, you can remove it by visiting us at http://www.TrafficSyndicate.com.com/toolbar/help.asp.

Additionally, the Service may:

Display links and ads of related websites based on the information you view and the websites you visit.

Store non-personally identifiable statistics of the websites you have visited.

Redirect certain URL's including your browser default 404-error page to or through the Service.

Automatically update the Service and install added features or functionality conveniently without your input or interaction.

Install Desktop icons, installation files and third-party software.
-----------------------

Which sound like a lot of what B went through.

Also found another site they seem to own.
DO NOT CLICK - you will most likely be infected.

From Google:

Side-Search.com
... First Cash Reserve, LLC, (doing business as and referred to herein as "Side-Search")
offers a browser toolbar product and service, the Side-Search Search ...
side-search.com/Legal/terms.asp

Linda Buquet :: Affiliate Management Consultant :: Catalyst eMarketing.com
5 Star Affiliate Programs :: Top Paying/High-Integrity Merchants :: Visit ABW Forum
<FONT COLOR=red size="1">EveryTicket Sports/Concert Tickets :: Irv's Luggage Warehouse :: Executive Essentials Office & Gifts:
DentalPlans :: HealthPlans :: Avid Hosting :: IntelliContactPro :: zZounds Music :: Roadloans :: MORE!
</font>

[Andy]

Good grief! Don't you just love those terms? You're basically giving them Carte Blanche to do whatever they want to do! I especially love the ones that say the software can be updated at any time, and without notice, and so can the terms. So, basically, they can do whatever they want to do to you, and by installing this cr@p you're agreeing to it!

If you continue to read the fine print, you'll also find:

- Your partner must be made available for "favors" when requested;

- Your first born must be given to them when so ordered;

- They can move into your home and boot your family out without notice.

People really should be more careful about what they install and agree to, but the software apps depend on people to NOT read or understand what they're agreeing to! Someday this type of @$!# will be illegal.

Andy

_______________
"If you were born to be shot, you'll never be hung." -Unknown

[ecomcity]

Tracing the whole troop of Ad Whores on this and other BHO's, and their 3rd world programming partners might be a task for the FBI or CIA. Ms.B is getting good at this and might some day claim a $25 Million dollar prize when the money trail leads to a cave in Pakiland with Bin Laden counting out the Mullah.

Mike & Charlie ...

If they won't adopt and feed a bird ..flip them one! BBQ some Gator and remember to flush WhenU..

[ecomcity]

Get some more scoop on this rogue affiliate and his various partnerships and I'll alert a certain Fla. States Attorney and his IRS & FBI drinking buddies. Since 9/11 and the Patriot Act, Boca Raton apartments and condos are much easier to monitor.

Mike & Charlie ...

If they won't adopt and feed a bird ..flip them one! BBQ some Gator and remember to flush WhenU..

[Linda - 5starAffiliatePrograms]

Andy said:

"People really should be more careful about what they install and agree to, but the software apps depend on people to NOT read or understand what they're agreeing to! Someday this type of @$!# will be illegal."

B didn't even agreee to anything. It was a drive-by download. How many other innocent victims have this crap and don't even know what's going on?

This is another quote from another search I did on Google about this company and their download:

------------------------

My Journal 6-24-2003

Today I discovered that a spy program was operating inside my computer. Every-time I went to a search engine a minimized window appeared that read, “test, provided by Internet Explorer Tools”. I could tell that resources were being used because the response time was slower than usual. (This means the computer was doing something, but what? )

When I typed in my search criteria there was a minimized window at the bottom of the screen. It said, “test”. The window produced a pop-up, then another, and another. The primary pop-up was hosted at ad-server, which I found is owned by First Cash Reserve LLC.
621 NW. 53rd. Street Boca Raton, Florida 33487.

The phone number there is 1-561-417-9415

I was not surprised to find that it was in Florida. Most penis-enlargement, pre-approved loans and Viagra spam is born in Florida, as do failing shifty Savings and Loans, mishandled voting rights, people that scam the elderly, telemarketing and junk-mail.

So I called the company to find out what they would say.

Robert sounded like a person who hasn't had a hug in a long time. He also sounded like he got a certain amount of joy and satisfaction though, from hearing directly from the consumer, that his annoying program is successful. Anyway he was not helpful at all, except when he suggested that I download a dos-based program from the First Cash Reserve website that would remove it.

“Yeah right”, I said. “I wouldn’t download a paragraph marker from your site.”

So I eventually hung up -knowing that I was on my own, and that the “Hunt Tool Bar, Power Search Toolbar bundled software is not defective at all. It behaves exactly the way it was meant to. It made me think of all the people who might not notice it, who would let that minimized window run, transmitting information back and forth to Florida.
-------------------------

Scary is all I can say! Why can't people just play fair? And why are so many scams from Florida?

Linda Buquet :: Affiliate Management Consultant :: Catalyst eMarketing.com
5 Star Affiliate Programs :: Top Paying/High-Integrity Merchants :: Visit ABW Forum
<FONT COLOR=red size="1">EveryTicket Sports/Concert Tickets :: Irv's Luggage Warehouse :: Executive Essentials Office & Gifts:
DentalPlans :: HealthPlans :: Avid Hosting :: IntelliContactPro :: zZounds Music :: Roadloans :: MORE!
</font>

[Kellie aka Ms. B]

And Saga Continues!

Well, just removing Huntbar didn't completely do the trick. I thought all was well when I posted yesterday, but started experiencing the same problems with my email as before and it got progressively worse. I could do 1 or 2 sends or receives before Outlook would hang up and crash. And forget being able to check all my POP accounts at once. I had to do one at a time.

Then this morning I started having problems with other Window features. Areas of Control Panel wouldn't work. I could use the Windows Search feature.

I had tried doing Outlook Repair feature last night to no avail. I tried reinstalling Outlook with no success.

So I finally wised up this morning after a some sleep and dug around for my XP CD. I haven't had to use it since I bought this computer over a year ago. I replaced the run32dll.exe file on my computer from the CD. Miracles of miracles!!!!! Wow things are working now. And not only that, but over I have faster computer speed. I didn't realize that things had gotten sluggish. Run32dll is a legitimate MS system file that is allows dll's to run as an application. Evidently, it's used by Windows for quite a few things and Huntbar tacking itself onto the file caused it to become corrupted or not function as it should.

Then I booted up Spybot again this am. Another miracle!!! I could now update the Spybot software. That done, I scanned. What's this...it detected 2 enteries it labeled as unknown. See pic below.

It's Your Money. You earned it. What are you going to do to make sure you get to keep it?

[Kellie aka Ms. B]

Sorry for skewing the thread with the pics and making you have to scroll.

So I go to the registry entry and what do we see?? WebSearch!!!! Either it was there all the time and Spybot didn't detect it because I couldn't update my definitions or those enteries were made after the removal.

Pic of first registry entry.

It's Your Money. You earned it. What are you going to do to make sure you get to keep it?

[Kellie aka Ms. B]

And second registry entery. So something is still there from Huntbar that Spybot feels should be cleaned.

I also noticed a trickler entry in my regsitry scrolling around that gave no indication of where it's from. Could be an old entery from Gator, but I'm not certain. I left the 2 websearch enteries just in case however to see if anymore mysteriously appear over time.

Another interesting thing is that Sypbot is not detecting igive, passport, boxtops, or SAHS at all. All it detected is ebates, whenu, and gator. And well Huntbar too.

It's Your Money. You earned it. What are you going to do to make sure you get to keep it?

[buy_online]

Mrs. B. First, thanks for all your work and documentation

You should have a copy of your registry somewhere (made before the events of yesterday), you'll need to replace the current version of the registry - it's obviously a mess.

You may have to re-install IE, and Outlook.

You may also need to repair your windows installation. These types of B*ttH*les like to overwrite dll's and other super-important windows files. Sometimes these files remain on users computers for years after the main application has been removed.

Sorry if you already know all this, just trying to help.

Fred

<font face=verdana size=1 color=43639C>You might just be a Parasite if..."You can't schedule a family reunion until after the parole board meets"</font>

[ecomcity]

Notice how we never get any comments from the networks on their incubated incent Ad Whores. Sure hope the same folks that write these rogue programs don't work on the tracking portion of the networks engine. Sure know these BHO's really know all the ways to piss off our customers.

Mike & Charlie ...

If they won't adopt and feed a bird ..flip them one! BBQ some Gator and remember to flush WhenU..

[Trust]

http://abw.infopop.cc/6/ubb.x?a=tpc&s=548608979&f=179600589&m=4906096624&r=2556036624#2556036624

might be related

"The successful man is the average man, focused."

[Kellie aka Ms. B]

Only related in the sense that IBIS aka trafficsyndicate aka huntbar is paying dictionary.com to run their pop under ads and will pay dictionary.com for each download. I got other parasite downloads in the ads when I went to dictionary.com such as weatherbug.

It's Your Money. You earned it. What are you going to do to make sure you get to keep it?

[DesignerWiz]

Did you notice if you go to the Huntbar uninstall instruction pages that the instruction pages are conviently 404.

Ray Thomas
DesignerWiz.com CEO
Development Resource & Javascript Public Archive Center
http://DesignerWiz.com
ABW Board: Category: Programming / Coding

[Kellie aka Ms. B]

LOL Ray. No, I didn't notice that. I never go to the parasite's uninstall page because I am suspect of them.

It's Your Money. You earned it. What are you going to do to make sure you get to keep it?

[ecomcity]

Bad enough the Ad Whores at TrafficSyndicate use their own fee driven driveby install Huntbar BHO, they also feed Ads to other drivebys like VX2. Got both from overseas ME news site popups/unders.

Mike & Charlie ...

If they won't adopt and feed a bird ..flip them one! BBQ some Gator and remember to flush WhenU..

[ganache_girl]

I'm jumping into this thread pretty late, but it sounds like the testing I'm trying to do is similar to Mrs. B. In a forum of people trying to avoid parasites, here I am attempting to get a Huntbar download so I can do some testing! In random browsing I haven't managed to stumble on the drive-by download so far. Can anyone recommend sites where they've seen the download so far?

Interestingly, I downloaded the websearch bar from their site and it doesn't seem to misbehave, at least for the things I'm testing. I wonder whether they have a legit version on their site and doctored versions elsewhere?

Any help would be appreciated!