CastleCops, Internet Crime Fighters
Need help? Click here to register for free! Absolutely zero advertisements on this site!

$9736.22 of $21422.68
left sidedonated so farneed $11686.46 donated to reach our goalright side, our goal
Help CastleCops serve the community on new servers, Donate Here to reach our goal.

Donation/Premium
spacer
block bottom
Security Central
spacer
· Home
· PIRT/Fried Phish
· MIRT
· SIRT
· Deutsch
· Wiki
· Newsletter
· O16/ActiveX
· CLSID List
· Contest2007
· Downloads
· Feedback (send)
· Forums
· HijackThis
· Hijacktrend
· LSPs
· My Downloads
· O18
· O20
· O21
· O22
· O23
· O9
· Premium
· Private Messages
· Proxomitron
· Reviews
· Search
· StartupList
· Stories Archive
· Submit News
· WsIRT
· Your Account
· Acceptable Use Policy
block bottom
Survey
spacer
Was 2007 a good year?

Yes it was a wonderful year
Yes, but there is always room for improvement
Status quo
It was a challenge
Other (leave comment)



Results
Polls

Votes: 934
Comments: 25
block bottom
spacer spacer

Live Trojan (Zlob + Dnschanger) hosting sites takedown
Goto page Previous  1, 2, 3, 4, 5, 6  Next
 
Post new topic   Reply to topic       All -> FavForums -> Web Malware Links [del.icio.us!] [digg it!] [reddit!]
View previous topic :: View next topic  
Author Message
AnthW

Trooper
Trooper


Joined: Jul 10, 2007
Posts: 16
Location: USA

PostPosted: Wed Jul 18, 2007 2:42 pm    Post subject:
Reply with quote

paperghost, I used Zango as an example. Just because we referred to that FTC document.
I have recently downloaded and installed Yahoo toolbar. They have all cehckboxes pre-checked and all you have to do is just click 'Next' (or Continue) button. So I think that Yahoo is more than a good example of 'some others' using pre-checked 'I Agree' checkbox.

As for hackers and affiliates who brake our rules, we have our own 'anti-cheat' tactics and checkbox is not something that may stop them. I know what I am talking about.

We have launched website that will help users to install/uninstall software. It also has online copy of EULA and contact email. URL is http://www.activexobj.com/
This will be included in our EULA in the next update.

Back to top
View users profile Send private message
paperghost

Security Expert


Joined: Dec 08, 2004
Posts: 180

MIRT MVP Security Experts

PostPosted: Thu Jul 19, 2007 4:57 am    Post subject:
Reply with quote

AnthW wrote:
paperghost, I used Zango as an example. Just because we referred to that FTC document.
I have recently downloaded and installed Yahoo toolbar. They have all cehckboxes pre-checked and all you have to do is just click 'Next' (or Continue) button. So I think that Yahoo is more than a good example of 'some others' using pre-checked 'I Agree' checkbox.


yahoo? whatever. i'm not impressed by pre-ticked boxes just because the big boys do it. anybody that pre-ticks a checkbox is acting in a way I'd deem irresponsible by assuming the user wants your software by default given the inherent risks from such a tactic, be it sendkeys, clicker trojans, or throwing it in a large bundle so the software is accidentally installed while the user frantically clicks the desktop to get rid of the popup explosion on their PC.

pre-ticked checkbox = big plate of suck.


_________________
Vitalsecurity.org
Back to top
View users profile Send private message Visit posters website
Regular-Joe-Guy

Guest
IP: 24.151.*.*






PostPosted: Thu Jul 19, 2007 5:37 am    Post subject:
Reply with quote

AnthW, I have a question. Why do you make a product that is not needed? Zlob is not a needed, nor is it a legit codec. Basically, your "product" would render itself useless without deceptiveness, am I right? Yes, I am. Do not try to say that it is not deceptive, for it is. You only offer your "codec" Zlob through porn video sites, and sites that have nicknames for Zlob, am I correct? Yes, I am again. I do not know why you don't go advertise Zlob on big well-known sites if Zlob is so legit. Tell me, AnthW, and don't lie: Do you accept that Zlob is a malicious program that only destroys computers?

Back to top
Nemesis6

Corporal
Corporal


Joined: Mar 18, 2004
Posts: 55
Location: Denmark

PostPosted: Thu Jul 19, 2007 6:26 am    Post subject:
Reply with quote

AnthW, can I ask you one thing? - Why is your website, activexobj.com, hosted in the Ukraine? Another thing, why is your site shows as blacklisted here - http://whois.domaintools.com/activexobj.com

I can also present another question: Why is what seems to be the majority of your websites hidden in the Ukraine behind a proxy registrar?

You can debate ethics about child porn all you want with the more knowledgeable guys here, but I think it'll help to present the basic knowledge about your software:

#1 - Your software does only harm.

#2 - Your software is referred to as malware, and is detected as such by virtually all anti-malware/virus/spyware products.

#3 - Your software is deceptively referred to as a codec. It's in no way a "codec".

#4 - The main reason for your installs is that users are fooled into thinking that they actually need your software to browse erotic content, and if they refuse, well, they simply can't refuse; they don't have the option of closing the dialogs that keep popping up if they say no. In other words, you engage in "aggressive, deceptive advertising"
It doesn't matter if it's technically not you who's doing it or not; Either way, it's your responsibility.

#5(Not a basic one): You behind a proxy registrar, and use servers in the Ukraine to host your websites.

These all alarm me, technicalities of your "software" be damned. You simply can't give this malware a shine, it's been way too pernicious in its spread.

Back to top
View users profile Send private message
mechBgon

Lieutenant
Lieutenant


Joined: May 13, 2007
Posts: 216

MVP

PostPosted: Thu Jul 19, 2007 2:25 pm    Post subject:
Reply with quote

And remember the core issue here: unlike possibly-legal adware such as Zango, Zlob doesn't install adware that serves ads for legitimate products and services. Its only purpose is to sell fraudware (some of which it actually installs, e.g. VirusProtectPro and its clones), and furthermore it uses deceptive tactics to do so, as I satirically lampooned earlier in the thread.

Since the entire fraud scheme is fundamentally indefensible, I don't see a need to debate the finer points of pre-ticked checkboxes, etc. That's like asking a mugger to prove that his handgun is properly licensed.


_________________
Vista x64 · non-Admin account + Software Restriction Policy · Kaspersky AntiVirus 7 · Windows Firewall · full hardware DEP · 64-bit IE7 PM
Back to top
View users profile Send private message
Nemesis6

Corporal
Corporal


Joined: Mar 18, 2004
Posts: 55
Location: Denmark

PostPosted: Fri Jul 20, 2007 12:26 pm    Post subject:
Reply with quote

I hadn't even researched the Zlob thing. I assumed that his attempt at debate here was the ordinary "no no no my software is not spyware" that I've seen a few times on security forums, but if Mech is right, there's simply nothing to discuss, and I wholly informing the relevant authorities as to any details regarding his identity. The admins can pull his IP from whatever logs exist on the server, right? This should be done! Forgive my very lacking knowledge of the U.S judicial system, but wouldn't the proper authorities in this case be the FTC?


_________________
Hasta la victoria siempre! -Che Guevara, talking about adware, spyware, and malware. Smile
Back to top
View users profile Send private message
Budfred

Security Expert
SIRT Handler

Joined: Jun 21, 2005
Posts: 441

Security Experts

PostPosted: Sun Jul 29, 2007 10:22 pm    Post subject:
Reply with quote

AnthW,

I just want to say how much I appreciate your willingness to come here and parade the workings of the criminal mind for all to see... The more we understand how you think and justify yourself, the more effectively we can fight you... While we may not be successful at shutting you down yet, we believe we have reduced your ill-gotten gains and hope to do even more so in the future... If the international community ever gets it together to realize that criminals like you are threatening the existence of the internet and all of the positive things that it offers, I hope they give you a cozy cell to live out your days since your postings here will be helpful in bringing down your whole network of criminals... Please do continue...

Back to top
View users profile Send private message
Nemesis6

Corporal
Corporal


Joined: Mar 18, 2004
Posts: 55
Location: Denmark

PostPosted: Tue Jul 31, 2007 2:23 pm    Post subject:
Reply with quote

As much as I hope he's going down, I see your post as little more than rhetoric. I mean, shouldn't you guys be handing any identifiable information over to the relevant authorities by now? I'm not an expert on tracking criminals down, but I think this should be pretty easy at this point unless he used a proxy or something.

By the way, found one: http://great-ticket.net/


_________________
Hasta la victoria siempre! -Che Guevara, talking about adware, spyware, and malware. Smile
Back to top
View users profile Send private message
JeanInMontana

Sergeant
Sergeant
Premium Member

Joined: Jun 20, 2005
Posts: 148

Premium

PostPosted: Tue Jul 31, 2007 6:48 pm    Post subject:
Reply with quote

Nemesis6 wrote:
As much as I hope he's going down, I see your post as little more than rhetoric. I mean, shouldn't you guys be handing any identifiable information over to the relevant authorities by now? I'm not an expert on tracking criminals down, but I think this should be pretty easy at this point unless he used a proxy or something.

By the way, found one: hxxp://great-ticket.net/


What do you think you found? Posting live links to a suspected bad site is totally irresponsible. All that is needed is the domain name.
Site Owner: PrivacyProtect.org
IP Address: 64.28.184.206
Country: NETHERLANDS (NL)

Country: UNITED STATES (US)

Notice the site owner? Who would the authorities go after? That is how scum like this all hide. They don't use real information because their activities are illegal. It's not as easy as sicking some officials on to them or it would be a done deal.


_________________
MontanaMenagerie
Back to top
View users profile Send private message Visit posters website
Nemesis6

Corporal
Corporal


Joined: Mar 18, 2004
Posts: 55
Location: Denmark

PostPosted: Tue Jul 31, 2007 8:20 pm    Post subject:
Reply with quote

Sorry if I didn't elaborate. We were posting sites hosting DNSchanger, right? I just posted one. Sorry I forgot to obfuscate it.

Anyway, I was in fact referring to AnthW when I talked about contacting the relevant authorities(I'm getting tired of that sentence). I mean, there might just be a chance he's not behind a proxy when posting here. That would be a pretty sweet deal, nailing a malware author like that.

Back to top
View users profile Send private message
JeanInMontana

Sergeant
Sergeant
Premium Member

Joined: Jun 20, 2005
Posts: 148

Premium

PostPosted: Tue Jul 31, 2007 9:39 pm    Post subject:
Reply with quote

Nemesis6 wrote:
Sorry if I didn't elaborate. We were posting sites hosting DNSchanger, right? I just posted one. Sorry I forgot to obfuscate it.

Anyway, I was in fact referring to AnthW when I talked about contacting the relevant authorities(I'm getting tired of that sentence). I mean, there might just be a chance he's not behind a proxy when posting here. That would be a pretty sweet deal, nailing a malware author like that.


I would bet his IP is not "him". All of the sites he admits to owning are hidden behind Privacy Protect just like the one you posted. I should have been more clear about that. They are also hosted in the Czech Republic so the FTC has no authority. I highly doubt any of that is an accident. Wink


_________________
MontanaMenagerie
Back to top
View users profile Send private message Visit posters website
Budfred

Security Expert
SIRT Handler

Joined: Jun 21, 2005
Posts: 441

Security Experts

PostPosted: Tue Jul 31, 2007 11:57 pm    Post subject:
Reply with quote

Nemesis6,

If you really think the people that are fighting these malware criminals haven't thought about tracking this person and his whole gang down and putting them away, you really must think we are idiots... If it was that easy, most of the internet would be safe today and there wouldn't be millions of infected systems out there... Please don't insult us by suggesting we are not aware of the obvious...

Back to top
View users profile Send private message
Nemesis6

Corporal
Corporal


Joined: Mar 18, 2004
Posts: 55
Location: Denmark

PostPosted: Wed Aug 01, 2007 8:01 pm    Post subject:
Reply with quote

Yeah, I guess I'm a little naive hoping he would make an error like that, but when rare opportunities like this arise, you have to make sure you exhaust all options. I mean, the guy actually posts here trying to plead his case, chances are that... Well, you see where I'm going with this.


_________________
Hasta la victoria siempre! -Che Guevara, talking about adware, spyware, and malware. Smile
Back to top
View users profile Send private message
419Eniac

Cadet
Cadet


Joined: Sep 12, 2007
Posts: 7
Location: Germany

PostPosted: Thu Sep 13, 2007 9:05 pm    Post subject:
Reply with quote

http://forum.escrow-fraud.com/ just got spammend (Topless Paris Hilton), offending URL is
http:||about-adult.net|kingston|1125932160|1|player.php?m=bW92NC53bXY&id=1237&tpl=8

This forwards to http:||www.codec-club.com|download|videosaccess1000.exe

Both sites are registered by VERY cooperative registrar Estdomains.com and will die tomorrow.


Eniac

Back to top
View users profile Send private message
JeanInMontana

Sergeant
Sergeant
Premium Member

Joined: Jun 20, 2005
Posts: 148

Premium

PostPosted: Thu Sep 13, 2007 9:25 pm    Post subject:
Reply with quote

419Eniac wrote:
http://forum.escrow-fraud.com/ just got spammend (Topless Paris Hilton), offending URL is
http:||about-adult.net|kingston|1125932160|1|player.php?m=bW92NC53bXY&id=1237&tpl=8

This forwards to http:||www.codec-club.com|download|videosaccess1000.exe

Both sites are registered by VERY cooperative registrar Estdomains.com and will die tomorrow.


Eniac


I am curious as to how they will die? EST won't do anything in most cases, that is why these miscreants choose to host there.

I hope your right, but what do you know the rest of us don't is what I mean. How are they going to get taken down?

You need to get rid of the links in your newest members profile most likely they are malicious besides offensive. hxxp://forum.escrow-fraud.com/profile.php?mode=viewprofile&u=784&sid=5d9f3736cce1b5224e9711a043aaaa83


_________________
MontanaMenagerie
Back to top
View users profile Send private message Visit posters website
Display posts from previous:   
Post new topic   Reply to topic       All -> FavForums -> Web Malware Links All times are GMT
Goto page Previous  1, 2, 3, 4, 5, 6  Next
Page 5 of 6

 
Quick Reply:
Username: 

Quote the last message
Attach signature (signatures can be changed in profile)
 
You can post new topics in this forum
You can reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You cannot download files in this forum


Powered by phpBB © 2001 phpBB Group
spacer spacer