[Trust]

This kind of ties in to my post in the Search Engine forum, a coupon site i was checking had a PR8 with thousands of backlinks from dictionary.com. I noticed they have a toolbar you can download. While checking the backlinks on the page there is a link that says Get the Top 10 Most Popular Site for "keyword" i click that and get a pop up sometimes and this is what i got

WinTools for Internet Explorer, ad-supported software with enhanced search toolbar, etc? Click here to review the license agreement;click Yes to accept and install
IBIS, LLC

Still checking things out.

"The successful man is the average man, focused."

[Trust]

Again when going to dictionary.com
when you get to page click Top Ten results and i'm getting pops got another one:

Do you want to install and run "Free Browser Plugin? Clicking Yes certifies that you have read and agree to the terms as given through this link. This file has been"signed on 8/27/2003 1:29 AM and distributed by: CPM Media, Ltd.

[This message was edited by TrustNo1® on September 14, 2003 at 02:20 PM.]

[Trust]

also got this when i closed out browser.
http://www.huntfly.com/stc-exit.html
Saw this when huntfly was loading:
spyblast.com/quickinstall


Don't know who's doing what but when you click Top Ten sites from dictionary.com it goes to AskJeeves/Direct Hit and i keep getting a pop to dl a toolbar.

[Trust]

Just go to http://www.dictionary.com and do a search and then click Top 10 Most Popular Site for "keyword" and i'm getting pop, don't know if it's parasitic or not but when i see pops from 2 different companies an exit pop huntfly, huntbar related? and see spyblast.com/quickinstall i wonder.

"The successful man is the average man, focused."

[Trust]

got some more:

Do you want to install and run "IE PLUGIN - Browser Add-on Lycos Side Pane and Bargain Buddy add-on and do you agree to all terms in the license agreements for those products? If you do, click the Yes button below or press the Y button on your keyboard. If you wish to read the terms of the licence agreements for those products click this text." signed on 8/16/2003 12:05 and distributed by:

IE PLUGIN LTD

I'm getting different pops
go to dictionary.com
type in a search phrase, goes to another page
click Top Ten Sites
goes to directhit/AskJeeves
wait a few seconds and pop
Probably not anything but they misspelled license above


In my first post when i said "I noticed they have a toolbar you can download." i was referring to dictionary.com, whose toolbar is probably different from all the other toolbars being offered to me via various pops.

[This message was edited by TrustNo1® on September 14, 2003 at 02:41 PM.]

[Linda - 5starAffiliatePrograms]

Trust - sounds like you partially got hit by the same thing B has been researching in the thread below.

IBIS is connected to trafficsyndicate.com
and huntbar.com

See B's thread here:

Parasite from Hell!!!
http://abw.infopop.cc/6/ubb.x?a=tpc&s=548608979&f=2336071524&m=6326033524

Plus it seems a lot of parasites and BHO's are reselling service to each other and/or private labeling each other so I think it's possible some toolbars are the same as others, just advertised with different names. Not sure, just guessing.

You may want to repost the info you just found down in B's thread to add to the investigation.

Linda Buquet :: Affiliate Management Consultant :: Catalyst eMarketing.com
5 Star Affiliate Programs :: Top Paying/High-Integrity Merchants :: Visit ABW Forum
EveryTicket Sports/Concert Tickets :: Irv's Luggage Warehouse :: Executive Essentials Office & Gifts:
DentalPlans :: HealthPlans :: Avid Hosting :: IntelliContactPro :: zZounds Music :: Roadloans :: MORE!

[Trust]

Ok, will post this thread to thread below. So who's doing this? I only get these pop's when go to dictionary.com which then goes to directhit/askjeeves, just trying to find out exactly who's doing this. My computer is clean and i never dl any crap and didn't like seeing all those pops, i want to find out exactly where this is coming from.

"The successful man is the average man, focused."

[Kellie aka Ms. B]

IBIS is huntbar. See here. They have several business names they go under.

This is the type of toolbar activity I was referring to in this thread. Their toolbar was made by the type of software I was talking about. But toolbars aren't a threat right?? No one is going to download it.

The pops you are getting when clicking on "Top Ten" are just ad serves. I got weatherbug. They are maximizing their pop unders because they get paid per download. When end users have downloaded the dictionary.com toolbar and use it, they will be returned to dictionary.com for their results giving another chance to serve the ads for parasites. I haven't installed the dictionary.com toolbar to see if or what else it may do.

The Ask Jeeves are just their version of the ppc search affiliate program. Dictionary.com is getting paid per click for those listings.

Dictionary.com is maximizing it's traffic in ad revenue for the high traffic volume they get. The parasite companies pay for those downloads. May even run a cpm deal on the ads also.

Moving this topic to suspicious activity.

It's Your Money. You earned it. What are you going to do to make sure you get to keep it?

[Linda - 5starAffiliatePrograms]

Trust did a Goolge search on CPM Media, Ltd.
and found a listing at Pest Patrol say they disribute a KE LOGGER

Release Date: 1/4/2003 (estimated)
Group: CPM Media, Ltd

Category: Key Logger.
(Keystroke Logger). A program that runs in the background, recording all the keystrokes. Once keystrokes are logged, they are hidden in the machine for later retrieval, or shipped raw to the attacker. The attacker then peruses them carefully in the hopes of either finding passwords, or possibly other useful information that could be used to compromise the system or be used in a social engineering attack. For example, a key logger will reveal the contents of all e-mail composed by the user. Keylog programs are commonly included in rootkits and RATs (remote administration trojans).

Description: From the doc: 'Click on the Scratch Cards button to scratch cards and win cash! A new card will be available every 5 minutes that you're actively surfing.' Also happens to capture keystrokes and update itself in stealth mode.

http://www.pestpatrol.com/PestInfo/db/f/free_scratch_and_win.asp

Linda Buquet :: Affiliate Management Consultant :: Catalyst eMarketing.com
5 Star Affiliate Programs :: Top Paying/High-Integrity Merchants :: Visit ABW Forum
EveryTicket Sports/Concert Tickets :: Irv's Luggage Warehouse :: Executive Essentials Office & Gifts:
DentalPlans :: HealthPlans :: Avid Hosting :: IntelliContactPro :: zZounds Music :: Roadloans :: MORE!

[Trust]

wow, just playing see how many toolbar dl requests i can get and see what other ads are popping

KazaaPlatinum

huntfly.com related too spyblast.com? seems to be CPM Media, Ltd.

but spyblast is supposed to be Internet Security software??

"The successful man is the average man, focused."

[Kellie aka Ms. B]

Trust I doubt dictionary.com really cares what downloads are in those pops. Probably just running the ads which have the highest $$ amount to them in installs and/or cpm's.

The couple clicks I did at least didn't elicit a driveby install through the ad. Though I'm not saying that may or may not happen with the ads they are running. I just didn't see any off a couple of clicks

It's Your Money. You earned it. What are you going to do to make sure you get to keep it?

[ellen-s4y]

From alexa's "movers and shakers", Huntfly down 54%, however, xzoomy is up 960% - it has a huge huntfly.com banner. All links seem to go through searcheffect.com, and appears to be the same multiple dns as xzoomy and their apparent leader cpm-media.com (which has the exact same page as xzoomy).

I didn't get an auto download. I do see a download to uninstall the software. Reviews on Alexa for xzoomy warn it's spyware.