Spyware Warrior

[webhelper]

Webhelper: AIM Buddy Icons Sites Update

On 22 Feb 2004 I wrote a piece called " The NetPal/Bundleware Aim Buddy Icon Connection.. Some are cute but there are some that are deadly!"

http://home.comcast.net/~webhelper/transponders/buddyicons.html

I have since been watching and gathering all sites that are linked together, owned by the same groups, and/ or have popup installations box's that try to confuse the user and can get the NetPal/AT-Games, or WildMedia adware installs. These sites are geared twords teens but some of their links go to buddy icon sites that are of an adult nature.

One of the latest scam methods is to:
1. Bring up the install agreement box. Clicking no will popup a windows message dialog box that states either they need to click yes to view the site or click yes to stop popup ads.
2. If clicking no on the second type, the scripts will popup the install box's and then the message box's one or more times. Some of the sites then popup an open save, or cancle box for the executable of the dll installer files from the cabs of the first screen.

These scripts are written by NetPalOffers or wildmedia and given to the sites to embed into their web sites code. So if you do not install the adware, you will get these box's for each page you click on in the sites:

AIM ICON BUDDY SITES
aimcrap.com
also opens psychics4free.com 216.130.197.250 (globalmediaresources.com 216.130.196.84)
aimking.com 69.93.59.122
Aimphuck.com 206.161.120.99 (Bundleware owned: OptInRealBig.com
aimtop100.com 207.44.236.27 (wildmedia)
animeiconz.com 207.44.236.27 (rotational ads by overpro.com)
aimprofileart.com 66.98.182.92 (Rotational Ads)
aimthings.com 66.98.182.92 (Rotational Ads)
aimunderground.com 66.98.182.92 (Rotational Ads)
buddydepot.com 207.44.236.27 (rotational ads by overpro.com)
celebbuddy.com 207.44.236.27 (adult related rotational ads from overpro.com)
creative-effort.com (Main menu to 4 icon sites)
desktopcity.com 69.6.2.164 owned: OptInRealBig.com
dollchick.com 66.98.158.30 (wildmedia)
dollfreak.com 67.15.36.16 (only links to bad sites no ads yet)
dollrock.com 63.99.224.77 (wildMedia)
dollsnow.com 67.15.16.17 (wildmedia)/(roings.com) (mediacharger.com)
dollspot.com 66.98.158.30 (NetPalOffers.com) Also opens desktopcity.com
dollzbuddy.com 207.44.236.27 (4/21/04 no ads)
language not allowed.com 207.44.236.27 (wildMedia)
iconfun.com 67.15.16.17 (wildmedia) /(roings.com)
iconkid.com 66.98.158.30 (wildmedia)
iconshack.com 66.98.182.92 (part of aimcrap.com)
Imbum.com 206.161.120.99 (NetPalOffers and Bundleware) owned: OptInRealBig.com
jensicons.com:207.44.136.24 (AT-Games) Beatty, Jennifer/John
Joketrade.com 206.161.120.99 (NetpalOffers) owned: OptInRealBig.com
monkeydoo.com 66.98.158.30
originalicons.com:207.44.130.128 (AT-Games) Beatty, Jennifer/John
punkaim.com 63.247.65.234 (AT-Games.com)
_________________
Wächter der Geschichten:
http://www.webhelper4u.com/thewatcher.html
Member of ASAP Since 2004

[wawadave]

scum ware scum ware. where ever i look we are surrounded by it. and this is only the surface of it!
_________________
RFID tags! SPYWARE
Tired of proprietary Cor-pirationware?
http://www.openoffice.org/
Installing Vista http://tinyurl.com/2l9qyd

[CalamityKen]

Added to my HOSTS file and sent to hpHOSTS file.
_________________
Install IE-SPYAD and SpywareBlaster updated regularly available in the following links .
How did I get infected? http://boards.cexx.org/viewtopic.php?t=957
Calendar Of Updates http://www.dozleng.com/updates/index.php?&act=calendar
member