| |
There are two sources of popup ads - usual web-sites
with popup advertisements and some programs stealthy
running on your computer. Such programs are secretly
installed by some free programs without your knowledge
and permission. There is excellent Mike Tuck's
review "Adware
and Under-Wear - The Definitive Guide"
about StealthWare.
AntiPopUp has internal StealthWare Detector. It is the
first and unique pop-up killer which not only stops
pop-up ads, but also prevents your computer from popup-generating
software. It is strongly recommended to clear your
computer from all suspicious programs if AntiPopUp
has detected StealthWare. You can use
Pest Patrol to remove such programs.
PestPatrol
is a powerful security and personal privacy tool that
detects and eliminates destructive pests like trojans,
spyware, adware and hacker tools. It complements your
anti-virus and firewall software, extending your protection
against non-viral malicious software that can evade
your existing security and invade your personal privacy.
Click
here to get more info about PestPatrol...
You will be shocked. It is the list of known StealthWare
from
CounterExploitation
- TSADBOT
(tsadbot.exe) AdGateway by TimeSink / Conducent
Technologies
- Aureate/Radiate
spyware DLL ADVERT.DLL by Aureate / Radiate
AdSoftware Network
- FluxPC
AdPipe
- DSSAGENT
(dssagent.exe) Brodcast by Broderbund (tags along
with some Mattel/Broderbund software)
- CyDoor
"Ads On Software (tm)" - Comes
with many ad-enabled products including KaZaA.
- Web3000
(MSBB.EXE) aka. N-Case - Dastardly advertising spyware
that overwrites your wsock32.dll system file, and
may transmit lists of URLs you visit. See Privacy
Power! Reference and Network
World Reference.
- Flyswat:
See Privacy
Power! Reference.
- TransCom's
BeeLine : see
Web3000.
- NewsUpd.exe
- "News Engine Update Application" - Creative
Labs advertising software installed with SoundBlaster
(tm) and perhaps other products.
- Codehammer
Message Mates
- BonziBuddy
- A talking gorilla/parrot/etc. "software companion"
targeting children. Silently Installed with some
other software, and difficult to remove. See Privacy
Power! Reference.
- OnFlow
- Installed by BearShare among others. The company
that makes this beastie describes
its purpose fairly well on its own :) It
is a browser plug-in designed specifically to display
advertising, usually of the large, loud and flashing
variety.
- SaveNow
(WhenUShop) - Installed by BearShare among others.
Put quickly, an advertising toolbar that monitors
what sites you visit and pops up sponsored "deals"
when products/shopping/etc. appears on those sites.
Microsoft provides removal
instructions.
- Gator
"Trickler" (fsg.exe / fsg-ag.exe), OfferCompanion
- installed by AudioGalaxy among others.
- PhoenixNet
- Spyware embedded in your system BIOS!
- WNAD.EXE
- secretly installed background task that goes online
to transmit personal information and display stealth
popup ads. Installed by the "Yo Mamma, Osama"
game from TwistedHumor.com, as well as the SwapNut
file sharing utility.
- Blackstone
Data Transponder a.k.a. VX2 / RespondMiter
/ Sputnik / NetPal / Aadcom.
This many-named piece of spyware is installed as
an IE Helper (BHO) by third-party software OR website
visits, and pops up ads continuously while you surf.
- FlashTrack
(FTAPP.DLL) - An advertising spyware module (BHO)
installed with the iMesh filesharing client. More
information and removal procedure are here.
Flagged
as a Trojan by McAffee.
- dlder.exe
- An advertising trojan that is installed by Grokster
(1.33), Bearshare (2.4.0b7), LimeWire (2.02), Net2Phone
(unspecified versions) and KaZaA (unspecified versions).
The spyware itself comes from ClickTillUWin.com.
Taking the torch from even the worst advertising
spyware to date, this one creates a fake Explorer
executable and process to hide its activities. More
information here. Some antivirus manufacturers
have listed this as a virus or trojan horse: TROJ_DLDER.A.
- ADP.EXE
- Another spyware, distributed with LimeWire(?)
and others. Appears to be an installer of Bargain
Buddy (below).
- BARGAINS.EXE
(Bargain Buddy) - Advertising spyware installed
with Net2Phone and some versions of LimeWire. Appears
related to ADP.EXE above. More info at www.doxdesk.com.
- bdeviewer.exe
(B3D / BrilliantDigital Projector) - A "3D
Web Animation" advertising-display plugin,
similar to Onflow, as well as distributed computing
client that will sell
your hard drive space, CPU cycles, and bandwidth.
Installed by KaZaA/Morpheus and probably others.
Additional story here.
Removal procedure here.
- EverAd
- No information currently available.
- Expedioware
- No information currently available.
- adshow.exe
- No information currently available.
- HelpExpress
/ Attune (HXIUL.EXE) - Appears to be advertising
spyware that displays sponsored ads, e.g. "Buy
toner"/etc. messages when you use your printer.
No additional information available at this time.
Remove by uninstalling "HelpExpress" and
"Attune" under Windows' Add/Remove Programs.
- Gator GAIN
(GMT.exe, CMESys.exe, GAIN_TRICKLER_*.EXE) - Pops
up advertising, apparently a new Gator
product. A security hole in some versions allows
Web sites to install arbitrary software
on your computer. This
URL will detect GAIN. Gator recommends on
its Web site to contact support(at)gator.com
for removal instructions. Gator software may be
quietly installed by drive-by
download.
- Wurld Media
/ Morpheus Shopping Club (bpboh.dll / mbho.dll /
MSCStat.exe) - Installed by Morpheus, the "no
spyware" (ya, we believe you) filesharing tool.
Sneakily redirects IE through advertisers' referral
links when certain sites are visited in your Web
browser. More details here
and here.
- NE.EXE
(Network Essentials / SmartPops) - Displays stealthy
popup ads while surfing the Web or using search
engines. Wow! To hear it from them, this is the
best
service on earth--boy are they helpful.
Remove by uninstalling "Network Essentials"
in Add/Remove Programs. I have seen reports of this
being installed simply by visiting certain Web sites.
- dw.exe,
Movie Network.exe (Downloadware / Mediacharger /
Movienetworks) - Displays lots of popup ads as you
surf; Mediacharger may also function as a dialer
for 1-900 #s for billing of adult movie
downloads. Check for removal entries in Add/Remove
Programs. Some removal instructions (may or may
not work?) are here.
I have had reports that the program will try to
deter uninstallation by telling you that doing so
will mess up your browser. It is, however, bluffing.
- ofrg.dll
(FavoriteMan) - Installed by unknown means, possibly
by NetPal spyware. More information here.
One of its co-bundled products may be a homepage
hijacker.
- ctbclick.exe
(ClickTheButton) - Installed by (NetPal),
Favoriteman
parasite, and some versions of KaZaA. More information
here.
- JavaRun.exe
(Etraffic / TopMoxie) - Marketing software installed
by products from "loyalty marketing partners",
that pops up ads and coupons when you visit certain
Web sites. TopMoxie description and info here.
According to this site, partner software must be
removed before an entry for TopMoxie will appear
in Add/Remove.
- Download_Plugin.exe
- SpywareInfo has
the scoop on this, it is an infector for
the infamous Lop.com portal-potty. It reportedly
modifies your browser preference settings to place
Lop.com as your start page, adds crap links to your
bookmarks, changes your desktop and adds a spyware
plugin ("Swish Browser Helper").
- openme.exe
(xww.de ?) / Fast Download / Full Downloader - Loads
at startup and pops up porn ads ("Live Chat
mit Cams!") after about 20 minutes, according
to this post
in the message boards. May also try to install a
dialer. To remove, find and delete openme.exe in
your Windows directory, and remove it from your
Registry's "shell=" line as well.
- Radlight
DivX Movie Player - The nature of the software itself
is unknown. However, it will intentionally
search out and delete AD-Aware from your
hard drive, then dump a number of malware products
on your system. This puts it on the level of a VIRUS
in my book; such a behaviour is completely unacceptable.
- NETBUIE.EXE
(Unknown) - Source unknown. Places itself in C:\windows\system
and adds a startup reference to the Registry. Continually
loads porn popups (www.sexysquirter.com et al) while
the machine is switched on.
- INetSpeak
- Bundled with the Music Magnet file-sharing tool,
installs a permanent ad banner into IE. Installs
as a Browser Helper Object. Remove using a BHO
remover, by disabling BHO42602.clslnetspeak
or similar. See write-up here.
- plg_ie0.dll
- More Lop.com crap, this one is a BHO that sends
your browser to their site for most any IE error
page (e.g. "The site cannot be found"
becomes instead a bunch of useless lop.com links).
See SpywareInfo's writeup
for details.
- Netbroadcaster(?)
- Related to Movienetworks (same registrar, IP block,
etc.). There is reported to be a malware product
by this name. No additional information available.
- Unknown
(ftp_back.exe, istabm.exe, bm_insta.exe, attnvg.exe,
createsw.exe, driverpg.exe) - Suspected ad/spyware
programs. Implicated here.
No additional information available.
- AdBreak
(kvnab.dll) - The name implies an advertising program,
but has not been observed in action. May be installed
by a trojan. Some info here.
- PAgent,
Vegas Palms Casino (MicroGaming), KFH, MediaLoads,
WinEME - sub-parasites installed by DownloadWare,
include casino gaming apps, ad programs and an unknown
email-sending background task. Info and removal
help here.
- HotBar
- an advertising toolbar that spies on sites visited
and the contents of forms you fill out. Installed
by IMesh. More info here.
- VLoading
/ Download class - A loader or "trickler"
that is used to download and execute arbitrary programs
on your PC. Used by some sites to install porn dialers.
Created by a company called Electronic
Billing Systems, who may be involved with
dialers. More info here.
- Firstlook
/ new.net - A portal potty and paid-placement
search engine operated by New.net.
Reportedly, software is slipped in by the New.net
client which directs the user to the firstlook.com
search engine. This functionality is reported to
be currently deactivated.
- Tgdc.exe
/ shopforgood.com - An affiliate link stealer similar
to Wurld Media. More info here.
- CnsMin
/ 3271.com - A Chinese keyword-lookup program, possibly
similar to QuickClick? Does not appear that harmful,
but is very difficult to remove and re-installs
itself even while you are still removing it. More
info here.
- Search-Explorer
- Another useless Browser Toolbar. Displays popup
ads and places some cookies on your machine. More
info here.
- WINSERVS
/ PurityScan / sear1.exe (winservs.exe,
winservn.exe, etc.) - On first running, scans your
IE cache/history/cookies for files with porn-words
in them and displays a list of any found. Also drops
in a background program (winservs.exe) that constantly
loads popup ads when the computer is running.
- SmartAd
(Cybersurf / www.cia.com) (file names unknown) -
Canadian advertising program that "enables
true one-to-one targeting of advertising messages
against audiences defined by demographics, psychographics,
lifestyle or location". The company boasts
that its software's ads "can never be covered
up, moved offscreen, or otherwise disabled."
This product appears targeted mainly toward Internet
kiosks and "free internet access" companies,
not end-users. The company also hypes an "ad
player" format similar to Onflow
- Permissioned
Media (friendgreetings.com
/ cool-downloads.com / WinSrv
Reg / OTMS.EXE / winservc.exe)
- Another company that hawks those infamous "online
greeting cards". The catch? To view the greeting
card, the site attempts to install a 1+ megabyte
application that will (unless you carefully read
the license agreements and click "NO!")
spam everybody in your Outlook address book with
phony greeting cards and ads for their service,
then place advertising spyware on your computer.
The spyware will collect your name, email address
and surfing habits, popping up ads and delivering
HTML spam to your email address. Removal instructions
here.
Possibly the first spyware program that lists "minimum
64MB memory" in its system requirements, and
attempts to restrict
you linking to their Web site. (Sue me, I dare ya.)
- Save
/ WhenUSave (SAVE.EXE) - Installed by some "free"
software including Radlight Media Player. A removal
reference is placed in Add/Remove Programs, but
warns that removal will also disable the program
(e.g. media player) that it was installed with.
Appears to be a rebranded version of the SaveNow
advertising parasite.
|
|
|