Forum Moderators: open

Message Too Old, No Replies

Do I have scumware or has Google added a feature?

Left hand column

         

glenv

4:02 pm on Apr 28, 2003 (gmt 0)

10+ Year Member



When I use Google now an annoying column pops up on the left hand side primarily with About.com links. It has a scrolling text saying ot is searching as well. Drives me nuts. Is this new or can it be deleted?

DrCool

4:04 pm on Apr 28, 2003 (gmt 0)

10+ Year Member



Without seeing it I would say it is scumware. Try running one of the AdAware or one of the other scum busting tools and see if it gets rid of it.

DaveN

4:06 pm on Apr 28, 2003 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



that's scumware alright.

DaveN

creative craig

4:18 pm on Apr 28, 2003 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



I was playing on my parents PC the other day, and they had the same thing, I ran AdAware and it got rid of it easily :)

Craig

glenv

4:18 pm on Apr 28, 2003 (gmt 0)

10+ Year Member



Yeah, it has a little x in the upper right hand corner of the
box and properties say "http://www.popunder.info"

I have adaware and it does not seem to find it. The little sucker keeps planting pop-ups and all sorts of garbage on my browser. Man I hate this stuff!

fiestagirl

4:22 pm on Apr 28, 2003 (gmt 0)

10+ Year Member



Try Search & Destroy. Sometimes it'll catch things that get away from Adaware. Also don't forget to update both frequently.

glenv

4:26 pm on Apr 28, 2003 (gmt 0)

10+ Year Member



Here is the source of the left hand column. It is a frams. Notice it generates Ah-Ha partner links off of a Google search!:

<div style="position: absolute; top: 2; left: 183; width: 19; background-color: transparent; height: 16">
<a href="../../close.html"><img border="0" src="../../close.jpg" width="13" height="13"></a>
</div><title>G</title>
<!-- To remove Search Results, please visit [207.44.176.11...] --><html>
<head>
<style>
body,td{
font-family : Verdana, Helvetica, sans-serif;
font-size: 12px;
}
A:link{
color:#0033CC;
}
A:hover{
color:#0033CC;
}
A:visited{
color:#660066;
}
P
{
line-height: 30px;
}
</style>
<!---<script>
var message="";
function clickIE() {if (document.all) {(message);return false;}}
document.oncontextmenu=clickIE;
document.oncontextmenu=new Function("return false")
</script>---></head>
<body topmargin="0" leftmargin="0" bgcolor="#FFFFFF" text="#000000" scroll="no">
<div align="left">
<div style="position: absolute; background-color: #3366CC; top: 93; left: -4; width: 217; height: 35">
</div>
</div>

<div style="position: absolute; top: 86; left: 44; width: 169; height: 20">
<p align="center">
<b><font face="Arial" size="2" color="#FFFFFF">Search
Results</font></b>
</div>

<div style="position: absolute; background-color: #EFEFEF; top: 93; left: -4; width: 64; height: 10">
<p align="center"><font face="Arial" size="2" color="#3333CC">New</font>
</div>

<div style="position: absolute; top: 104; left: 17; width: 180; height: 16">
<p align="center"><font face="Arial" size="2" color="#FFFFFF">Results <b>1- 5</b></font>
</div>
<DIV ID="loadLayer" STYLE="position:absolute; left:0px; top:113px; width:200px; height:30px; clip:rect(0px 200px 30px 0px); background-color:white; layer-background-color:white;">
<MARQUEE DIRECTION=Left BEHAVIOR=SCROLL SCROLLAMOUNT=12 SCROLLDELAY=200>
<font face="Arial" size="2" color="#3333CC">Loading Search Results for Cars</font>
</MARQUEE>
</DIV>
<div style="position: absolute; top: 135; left: 3; width: 231; height: 16">

<script language="Javascript">
function SendClick(cost, se, word){
var strUrl = 'http://www.popunder.info/cgi-bin/SSF/search.pl?search=' + word + '&se=' + se + '&cost=' + cost
parent.document.all.lyrResults.src=strUrl
return true;
}
</script>
<p><base target="_blank"><table border="0" cellpadding="5" cellspacing="0" width="195" height="1"><tr>
<td width=15 valign=top align=right height=21>1.</td><td width=176 valign=top height=21><A HREF="http://partner.ah-ha.com/Clickthroughs/redirect.aspx?cid=74445&sid=453&b=16661&bid=0.09&keyword=cars&nk=8460608&t=SP&r=1&x=174015118264210647" onClick="return SendClick('009','http://partner.ah-ha.com/','Cars');"><B>Cars</B> Free Palm Zire handheld organizer w/purchase of 4 new Michelin tires.</A></td>
</tr>
<tr>
<td width=15 valign=top align=right height=21>2.</td><td width=176 valign=top height=21><A HREF="http://partner.ah-ha.com/Clickthroughs/redirect.aspx?cid=74445&sid=453&b=86308&bid=0.08&keyword=cars&nk=18284051&t=S&r=2&x=174015118264210647" onClick="return SendClick('008','http://partner.ah-ha.com/','Cars');"><B>Cars</B>.com -- Find the Car that's Right for You</A></td>
</tr>
<tr>
<td width=15 valign=top align=right height=21>3.</td><td width=176 valign=top height=21><A HREF="http://partner.ah-ha.com/Clickthroughs/redirect.aspx?cid=74445&sid=453&b=1377&bid=0.065&keyword=cars&nk=8150656&t=SP&r=3&x=174015118264210647" onClick="return SendClick('007','http://partner.ah-ha.com/','Cars');"><B>Cars</B> Help Disabled Children-Car Donations-Free Pick-up</A></td>
</tr>
<tr>
<td width=15 valign=top align=right height=21>4.</td><td width=176 valign=top height=21><A HREF="http://partner.ah-ha.com/Clickthroughs/redirect.aspx?cid=74445&sid=453&b=1377&bid=0.06&keyword=cars&nk=8129222&t=SP&r=4&x=174015118264210647" onClick="return SendClick('006','http://partner.ah-ha.com/','Cars');"><B>Cars</B> Auto Loans Nationwide Approvals Today</A></td>
</tr>
<tr>
<td width=15 valign=top align=right height=21>5.</td><td width=176 valign=top height=21><A HREF="http://partner.ah-ha.com/Clickthroughs/redirect.aspx?cid=74445&sid=453&b=28122&bid=0.06&keyword=cars&nk=9328605&t=S&r=5&x=174015118264210647" onClick="return SendClick('006','http://partner.ah-ha.com/','Cars');"><B>Cars</B> Auto Leasing - Get The Best Lease By Comparing Quotes</A></td>
</tr>
</TABLE><iframe id="lyrResults" style="position:absolute; left:1px; top:333px; width:1px; height:1px; z-index:1; border: 1px none #000000" src="../../bytcost.html?"></iframe></p>

<form method="POST" action="--" name="d">
<input type="hidden" name="datDate" value="">
<input type="hidden" name="datOrd" value="">
</form>
<script language="JavaScript">
parent.document.all['loadLayer'].style.visibility = "hidden"
</SCRIPT><script src="http://216.93.172.116/cgi-bin/PPP/kpop.pl?search=%43%61%72%73"></script>
</div>
</body>

</html>

glenv

5:09 pm on Apr 28, 2003 (gmt 0)

10+ Year Member



I installed Search and Destroy and it did not find it.

I bought the latest version of AdAware 6 and got latest update, and it does not delete it.

Argh!

Alphawolf

5:15 pm on Apr 28, 2003 (gmt 0)

10+ Year Member



Is Search and Destroy same as SpyBot?

If not try SpyBot. If that doesn't work just reformat the drive. ;)

Joking. ;)

AW

glenv

5:19 pm on Apr 28, 2003 (gmt 0)

10+ Year Member



Same as Spybot....

I think it is installed in the IE Explorer. This is a gritty one. I see a new check mark on the toolbar with no text along side it. Now if I can figure out how to remove it from IE

DVDBurning

6:16 pm on Apr 28, 2003 (gmt 0)

10+ Year Member



Another useful tool is BHOdemon... do a Google search - it's a free download. It finds and helps you neutralize Browser Helper Objects.

I just had a home PC "infected" with some Gator program called "Precision Time". It caused all kinds of pop-ups and ads. What a pain. When you get those "do you want to install?" messages... generally the answer is no.

If you are comfortable with Regedit, check the following registry to see what might be starting up on your PC... HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

Or on Win XP, run msconfig and check under the startup tab.

GoogleGuy

6:39 pm on Apr 28, 2003 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



glenv, you have scumware. The BHO tool that someone mentioned should be helpful, or BHO Cop. Let me know if you find out what's doing it. This stuff is really irritating.

glenv

7:04 pm on Apr 28, 2003 (gmt 0)

10+ Year Member



Thanks everyone. BHOdemon did the trick. Wonder why AdAwre doesn't build a feature in to check this stuff.

GoogleGuy, can't you guys go after these scumware throwers?

Seems like it would be something you could sue over. I mean let's say I had a taxi in NYC with a plackard on it. If scumwear is legal, it would mean anyone can come up and put their sign over my plackard.. ( does that make sense?)

In any event, this type of thing really gets me would up. It is purely lazy and unethical.

glenv

7:10 pm on Apr 28, 2003 (gmt 0)

10+ Year Member



Forgot:

Google Guy give "Gap" a raise.

He's awesome support.

:-)

madweb

7:35 pm on Apr 28, 2003 (gmt 0)

10+ Year Member



Or on Win XP, run msconfig and check under the startup tab.

This also works on win98 and I assume all recent windows platrforms. To clarify, go:

start menu --> run --> type in 'msconfig' --> <enter>

Its very useful and often revealing...

Seems like it would be something you could sue over.

This is an issue which hasn't really been settled yet, but there is some interesting reading on the matter:

wired.com - Judge Takes a Bite Out of Gator [wired.com]
wshingtonpost.com - Publishers Sue Gator Over Web Ad Tactics [washingtonpost.com]
law.com - Search and Destroy [law.com]
forbes.com - How Not To Wrestle A Gator
[forbes.com]

Note: above are links to mainstream news organisations to which I am not affiliated in any way. Please remove if necessary.

DVDBurning

7:38 pm on Apr 28, 2003 (gmt 0)

10+ Year Member



msconfig works on Win 98, WinME, and WinXP, but not WinNT or Win2K. For NT / 2K you have to check your "services".

spinoza

7:58 pm on Apr 28, 2003 (gmt 0)

10+ Year Member



I think I have the same on my computer. Very annoying. A script at the doxdesk site says:

Your browser appears to have the "SubSearch/HighTraffic/A" parasite installed. This software can present you with unwanted advertising, and may compromise your computer's security. It might have been installed without your knowledge. Information and removal instructions.

But the removal process is a bit lengthy and I haven't found the time yet to do it.

chamade

7:20 am on Apr 29, 2003 (gmt 0)

10+ Year Member



Over on the newsgroups for M$ browsers they're full of pleas for help from users hit by this scumware.

Many, many problems with IE are caused by badly written scumware BHO's clashing with various DLL's that cause IE to bomb out.

Glenv it isn't up to google to remove the scumware sources as most of them come along with "free software" that you download.

Microsoft introduced BHO's to IE to allow third party developers to produce these wonderful Browser Help Object's to enhance the users web experience ;)

However like many of M$ ideas others have found gaping loopholes in the code and voila another easy way to get in to a innocent users machine and start grabbing anything from logging of paths to sites you've visited, to actively logging keystokes with the hope of getting your passwords and the like.

The google toolbar is itself a BHO (but most say of the good kind, rather than one of the baddies - but that debate lingers in other threads).

The script at doxdesk is probably the best place to start to check if you think you might have been hijacked. However it gives mostly manual instructions on how to remove the scumware, but in actual fact most of it can be removed automatically by programs mentioned before.

Ad-aware, SpyBot search & destroy, BHO Demon, or BHO cop are all good tools to have as in some case one won't catch the baddie but another might. They're all have freeware options.

If I'm allowed to I'll post the specific URL's to these great tools here, but if not sticky me and I'll send them to you.

Another very useful tool, but not for the feint hearted is to use a good HOSTS file that blocks your browser from all the bad boys in the first place. One guy, an MVSP, maintains an up-to-date list of known bad boys where you can download a copy to put in your own HOSTS file. The list not only blocks the very bad boys it also blocks a number of ad-tracking sites that use cookies to track your movements. Whilst this is a good thing for some it can be annoying, with little red 'X's appearing where adverts would normally be. But, hey if you don't want the adverts either it's wonderful.

Again if allowed I'll post the URL if not sticky me.

Moderators: Are specific URL's for useful scumware ridding tools allowed here or not?

GamblinTraveler

3:00 pm on Apr 29, 2003 (gmt 0)

10+ Year Member



If Google would release a googlebar for Netscape I would never have to use the lousy bug-ridden IE.

Does anyone know if there are any plans for one?

korkus2000

3:07 pm on Apr 29, 2003 (gmt 0)

WebmasterWorld Senior Member 10+ Year Member



GamblinTraveler, Matt Cutts from Google told us at the conference that they really didn't have any plans for moving the toolbar to any other platforms or browsers that he knew of.