Spyware Warrior

Harry Letterman · Posted: Wed Jul 14, 2004 7:20 pm Post subject: Is STOPzilla Evil?

I've been noticing popup ads recently from STOPzilla http://download.stopzilla.com/image...s/720x300_g.gif at one of my very favourite forum sites, WirelessAdvisor.com. They also are using NoAdware.net popups which I know are potentially bad and I have informed them of this. My Google Toolbar blocks both popups so it's not a huge concern to me but I am curious about STOPzilla as the Rogue/Suspect list here does not mention them.

TIA and thanks for looking!

Nick · Posted: Wed Jul 14, 2004 10:39 pm Post subject:

Stopzilla was a good and trusted program at one time, but their practices of late have become more questionable as you have already seen. The stopzilla.com domain is now in IE Spyad's list of restricted sites.
_________________
Nick's Security Ticker

eburger68 · Posted: Wed Jul 14, 2004 11:40 pm Post subject:

Hi:

StopZilla was added to IE-SPYAD as a precautionary measure. I have encountered StopZilla in people's HijackThis! logs in various help forums. What is interesting about these HJT log entries (which are 016 - DPF entries, from automated online installations) is that the download source is not only stopzilla.com, but playminigolf.com in some instances.

My interest in adding StopZilla to IE-SPYAD has only been to ensure that IE-SPYAD users who encountered pages that automatically install StopZilla were truly getting what they wanted -- those automated installations won't work with the two domains listed above in the Restricted sites zone. Users who want to install StopZilla can either remove the appropriate domains from the Restricted sites zone, or they can download the full setup executable from the StopZilla home page.

I have been looking into the StopZilla/playminigolf.com connection over the past few days, but I don't know that I've gotten to the bottom of it. PlayMiniGolf.com offers a "free" game. In clicking around their site, I couldn't find any obvious front door to the StopZilla installer. Here's what we usually see in HJT logs:

O16 - DPF: {9FEFFBDE-FE2F-4756-B4A7-90D976255F9B} (StopZilla Class) - hxxp://www.playminigolf.com/Stopzilla.cab

So I decided to download and try out the "free" game. Of course it's loaded with spyware/adware (WhenU/ClockSync, WhenUsearch bar, KeenValue/Incredifind, eUniverse) -- which makes you wonder why StopZilla would have any connection with PlayMiniGolf.com (owned by WildMedia LLC) at all, esp. given that some of the spyware/adware installed by PlayMiniGolf is decidedly unfriendly, providing no uninstallers and remaining behind even after the uninstallation of the game itself (Inredifind/KeenValue, eUniverse).

Also of tangential interest: out of curiosity I decided to play around with the WhenUSearch bar that had been dropped on my desktop. I tried the term "spyware" from:

hxxp://www.whenusearch.com/searchbar/?partner=STAT1203&cc=US

You guessed it. In the search results were all the usual suspects: eblocs, SpywareNuker, NoAdware, Stop-Sign, XoftSpy, PAL Spyware Remover, SpywareKiller, etc. -- and StopZilla. (Why would purported anti-spyware apps be advertising through WhenU?)

I still don't know what the exact connection is bewteen PlayMiniGolf.com and StopZilla, but what I've seen so far is not encouraging. At the very least I'd like to see the context for the StopZilla installation from PlayMiniGolf.com.

Best,

Eric L. Howes
Edited out http to hxxp to guard against adware installations: webhelper 7/14/2004

webhelper · Posted: Thu Jul 15, 2004 8:54 am Post subject:

eburger68 · Posted: Thu Jul 15, 2004 2:27 pm Post subject:

Webhelper:

You wrote:

Harry Letterman · Posted: Thu Jul 15, 2004 4:39 pm Post subject:

eburger68 · Posted: Thu Jul 15, 2004 5:16 pm Post subject:

Harry:

You can find IE-SPYAD here:

https://netfiles.uiuc.edu/ehowes/www/resource.htm#IESPYAD

Basically, it's a Restricted sites list for Internet Explorer.

As for the pop-up advertising you mention, if you trust the web site to be honest that it doesn't use pop-ups, then it would be a good idea to scan your computer with some anti-spyware tools. Those pop-ups just might be generated byspyware/adware such as Gator/Claria, WhenU, Lop, 180/n-case, or one of the many other unwanted advertising applications that exist out there.

I'd recommend downloading, installing, and running these two free anti-spyware scanners for starters:

Ad-aware
http://www.lavasoft.de/

Spybot Search & Destroy
http://spybot.safer-networking.de/

Let us know what the results are.

Best,

Eric L. Howes

Harry Letterman · Posted: Thu Jul 15, 2004 5:52 pm Post subject:

Harry Letterman · Posted: Thu Jul 15, 2004 6:11 pm Post subject:

Harry Letterman · Posted: Thu Jul 15, 2004 6:17 pm Post subject:

Dammit - I just got the NoAdware popup again, this time when I was here at Spyware Warrior. I DID, however, have my Yahoo! Toolbar popup blocker disabled (I was testing what happened at WirelessAdvisor). Although, the Google Toolbar popup blocker was active - I wonder if there is an update for it - ?

I also got the same NoAdware popup at WA about an hour ago and BOTH toolbar blockers were enabled.

Harry Letterman · Posted: Thu Jul 15, 2004 6:41 pm Post subject:

3162 · Posted: Thu Jul 15, 2004 6:44 pm Post subject:

Harry, why don't you just get with the program, join the rest of us, and not use IE except for updates?

Instead of using Internet Explorer for your day-to-day browsing, try one of these free browsers instead:
Opera. Features include tabbed browsing, built-in pop-up stopper
Mozilla, Firefox, Camino. Linux based.
Slim Browser. IE without the bells and whistles.

For email, I find Thunderbird has all the feel of OE but without the Security Compromises.

Mailwasher. To safely preview and delete email, amongst other uses.
_________________
Proud member of the Chest Zipper Club!

Harry Letterman · Posted: Thu Jul 15, 2004 6:56 pm Post subject:

eburger68 · Posted: Thu Jul 15, 2004 6:58 pm Post subject:

Harry:

You misunderstand what IE-SPYAD does. It does not restrict the use of cookies, ActiveX controls, scripts, and the like by ALL sites, just those that are known to be advertisers, marketers, or adware/spyware distributors. The thinking is that most users would never want cookies or ActiveX controls from sites and companies like Doubleclick, Claria, WhenU, 180Solutions and the like. Thus, we can put restrictions on the sites and domains associated with those companies, while leaving the vast majority of sites alone.

In fact, IE-SPYAD is designed to allow your surfing to be flexible -- to impose restrictions on some sites/domains, but not all of them.

Even if you do encounter a site that is in IE-SPYAD's Restricted sites list but which you want to allow to use cookies and active content, you can remove that site from the Restricted sites zone. You always remain in full control of your browsing and what's restricted, what's not.

Hope that explanation helps clarify things.

Eric L. Howes

Harry Letterman · Posted: Thu Jul 15, 2004 7:10 pm Post subject:

Harry Letterman · Posted: Thu Jul 15, 2004 7:13 pm Post subject:

Curious: Why am I not allowed to edit a post in this forum?

Harry Letterman · Posted: Thu Jul 15, 2004 7:17 pm Post subject:

I now see that I should have posted in the Spyware Removal forum. Forgive me, but I posted after spending 6+ hours in front of my computer and I apparently overlooked it. Maybe someone could move the thread (which might allow me to edit a post - ?)?

Thank you.

suzi · Posted: Thu Jul 15, 2004 7:46 pm Post subject:

Harry Letterman · Posted: Thu Jul 15, 2004 8:49 pm Post subject:

suzi · Posted: Thu Jul 15, 2004 8:55 pm Post subject:

Harry Letterman · Posted: Thu Jul 15, 2004 10:52 pm Post subject:

wawadave · Posted: Thu Jul 15, 2004 11:22 pm Post subject:

yes goto the site and d/l it!
_________________
RFID tags! SPYWARE
Tired of proprietary Cor-pirationware?
http://www.openoffice.org/
Installing Vista http://tinyurl.com/2l9qyd

eburger68 · Posted: Fri Jul 16, 2004 12:35 am Post subject:

Harry:

You asked:

Harry Letterman · Posted: Fri Jul 16, 2004 11:12 am Post subject:

Thanks Eric! I will try and d/l IE-SPYAD today. BTW, are you affiliated with IE-SPYAD in any way (as a designer, etc.)?

eburger68 · Posted: Fri Jul 16, 2004 10:16 pm Post subject:

Harry:

Yes, I'm the guy responsible for IE-SPYAD.

Best,

Eric L. Howes