Gator download pop-up - Page 2

Rasbelin · August 20, 2003, 15:53

Duh, use something else than MSIE. Less whining at least.

Maniac · August 20, 2003, 16:25

Quote:

Originally posted by Asmodean
I don't get you guys. All of you write I got it, I got it, but none of you seem willing to provide any of the information that Dan requests.
If you don't want to help remedy the situation, then don't complain that the situation exists

Let me clarify the situation so you might "get" us guys.. As DanQ said:

Quote:

It is likely bundled with an ad (i.e. it loads alongside with an ad that then generates it), making it even more difficult to track down.

That's what happens with me. A seperate ad pop-up shows up on my taskbar, and generates the security warning you can see on my screenshot. However after a few seconds the ad that causes the security warning automatically seems to disappear, before I have any chance to check out what it is. So as far as I know, it's impossible for me to find out the origin of the Gator problem, even though I would like help.

Asmodean · August 21, 2003, 04:51

Hmmm...wouldn't it be possible to clear your internet cache, and your internet history, so that your machine contains no record whatsoever of your recent internet activity. After that, when the pop-up comes back, it should be fairly easy to locate it in your internet history window.

Asmodean

Lefty Scaevola · August 21, 2003, 09:31

As long as your ad companies allow 'third (actually more like fourth) party ' ads, where the ad server only has a rediredt address, and the third party runs the ad on their server, you will get this. Many site have barred their ad server from using these, requiring them to only use ad where the code is carried on their own (eg UGO's) server, rather than some other server. Ad groups like UGO can madate this no such downloads all day long, but if they do not run the ad code on their own server they can not control it, and they get this over and over.

DanQ · August 21, 2003, 22:49

Quote:

Originally posted by Lefty Scaevola
As long as your ad companies allow 'third (actually more like fourth) party ' ads, where the ad server only has a rediredt address, and the third party runs the ad on their server, you will get this. Many site have barred their ad server from using these, requiring them to only use ad where the code is carried on their own (eg UGO's) server, rather than some other server. Ad groups like UGO can madate this no such downloads all day long, but if they do not run the ad code on their own server they can not control it, and they get this over and over.

This is true. At the same time, these (a) by far are providing the largest source of advertisers for us at present and (b) abuse such as is being described here has been quite limited; in fact, this thread raises the first ad-related complaint I have read in many months. Nonetheless, it is more than justified in this instance.

That said, I am not attempting to provide a justification for the practices of some advertisers to include 'add-ons' with their ads, especially "the likes" of Gator. I too disagree with the practice. If/when more information on the source of the Gator installation attempt here in question presents itself, I will investigate further and take action as need.

---------
Dan; Apolyton CS

SpencerH · August 21, 2003, 23:00

I've just been having waves of the damn things tonight (pop-ups), everty time I went from page to page, but when the gator installation thingie came I had forgotten about this thread and just dismissed it.

geeslaka · August 22, 2003, 00:42

Quote:

this thread raises the first ad-related complaint I have read in many months

Does that mean you didn't read these threads?
http://apolyton.net/forums/showthrea...threadid=89730
http://apolyton.net/forums/showthrea...threadid=88671
Both less than 75 days old.

Asmodean · August 22, 2003, 05:36

Okay Dan. I did some research on this. Basically, I disabled my firewall, allowing all kinds of evil things to enter my system. Then I set about browsing Apolyton. What I got was.....GATOR. Now how does this happen. You click a link (for instance the link to a thread). The thread then opens, as does another window. That window displays nothing. Then, a few seconds later, the security warning appears, asking if you would like to install Gator.

So what ad service is the culprit, then?? My guess is mircx. Why? Well take a look at these links, which I got from my internet history window:

http://ads.mircx.com/scripts/pop/gator.cgi?cert

Look how the word Gator appears in this link.

http://pop.mircx.com/pop/cjb/pop/106153929590553

This is another one from mircx. What it does, I'm not sure.

And then there's Gator:

http://webpdp.gator.com/v3/webpdp_v3...yic=HIC_CJBOLD
http://webpdp.gator.com/4/message/22...JEa0FBQmNCUFo0
http://webpdp.gator.com/v3/webpdp_v3...=HIC_RydiumINT
http://webpdp.gator.com/4/message/22...JEa0FBRDRsdXk4

I'll see if I can post some screenshots.

Asmodean

SpencerH · August 22, 2003, 06:29

I've had gator twice in the last 30 min.

These are the ad histories

http://content.ad-flow.com/5/OF-INT.html
http://media.popuptraffic.com/pops/npaCash.html
http://media.popuptraffic.com/pops/Pusexyath.html
http://webpdp.gator.com/v3/webpdp_v3...=HIC_RydiumINT
http://webpdp.gator.com/v3/webpdp_v3...=HIC_RydiumINT

http://z1.adserver.com/w/cp.x;rid=65;tid=2;ev=1;dt=3;ac=7;p=1;mid=1685 (which pop-ed up whan I first came to poly)

DanQ · August 22, 2003, 21:58

Quote:

Originally posted by geeslaka

Quote:

this thread raises the first ad-related complaint I have read in many months

Does that mean you didn't read these threads?
http://apolyton.net/forums/showthrea...threadid=89730
http://apolyton.net/forums/showthrea...threadid=88671
Both less than 75 days old.

I honestly missed the threads you have referred to above. I'm only human...

* gasp *

---------
Dan; Apolyton CS

DanQ · August 22, 2003, 22:07

Asmodean,

I would not be surprised if that based on the data you have provided the agent with the Gator ad is apart of the Commission Junction (CJ) network (I'm referring specifically to a "/cjb" directory within one of the addresses you have listed). This is not a slight on CJ but rather a reflection of (a) how large their network is, i.e. no system their size can be perfect and (b) how extensively we are running CJ ads at present. Unfortunately, the additional information you have provided does not narrow down the specific advertiser within CJ -- we have not signed up with any mIRCX affiatiln program, so that does not narrow things down further. Appreciate your efforts!

SpencerH,
Hmmm -- based on your an Asmodean's reports, it may be that there is more than one advertiser on ACS running Gator ads but I cannot be certain still at this point. You have referred to PopUpTraffic in some of the addresses you have reported on -- I will look into this some more.

----------
Dan; Apolyton CS

Sarxis · August 22, 2003, 23:58

Quote:

Originally posted by DanQ
I would not be surprised if that based on the data you have provided the agent with the Gator ad is apart of the Commission Junction (CJ) network (I'm referring specifically to a "/cjb" directory within one of the addresses you have listed). This is not a slight on CJ but rather a reflection of (a) how large their network is, i.e. no system their size can be perfect

I see CJ spyware cookies all the time I clean out my stuff. Evil people with no souls must work for them.

TCO · August 23, 2003, 00:10

why do you feel the need to track it down, Dan? Just hold the guy who pays you for ads responsible.

Oerdin · August 23, 2003, 00:46

I've also seen it but I don't have the info DAn asked for.

DanQ · August 23, 2003, 11:26

Quote:

Originally posted by TCO
why do you feel the need to track it down, Dan? Just hold the guy who pays you for ads responsible.

So that the offending ad(s) can be removed from our advertising rotation. If this means terminating an agreement between ourselves and one of Commission Junction's (CJ) advertisers completely then so be it. Any monies we receive from CJ from running ads from their system are from any monies paid to CJ by their advertising clients (i.e those clients whose ads we carry).

-----------
Dan; Apolyton CS

TCO · August 23, 2003, 12:14

Quote:

Originally posted by DanQ

So that the offending ad(s) can be removed from our advertising rotation. If this means terminating an agreement between ourselves and one of Commission Junction's (CJ) advertisers completely then so be it. Any monies we receive from CJ from running ads from their system are from any monies paid to CJ by their advertising clients (i.e those clients whose ads we carry).

-----------
Dan; Apolyton CS

You should hold the person accountable who you have the financial relationship with. If the drywall in my house isn't installed right, I don't go to the Mexican drywall installer. I hold the general contractor responsible.

TCO · August 23, 2003, 12:16

Dan, just tell us if subscription would work. How many active users are there? How much revenue do the ads draw in. Then see if we could get enough from subscription to make it work. Maybe you could make it no-ad for the subscribers or something. You might be surprised and find you can make way more money by subscription.

Jamski · August 23, 2003, 12:24

The url flashed up just for a second. It was adserver then a load of gibberish with numbers, symbols etc.

-Jam

Jamski · August 23, 2003, 12:38

I found the cookie, if THAT's of any use to anyone. Bloody Gator makes me spit.

-Jam

Jamski · August 23, 2003, 12:43

Sorry to keep posting over and over...

http://webpdp.gator.com/v3/webpdp_v3...=HIC_RydiumINT

http://content.ad-flow.com/5/OF-INT.html

http://media.popuptraffic.com/pops/npaCash.html

http://z1.adserver.com/w/cp.x;rid=65;tid=2;ev=1;dt=3;ac=7;p=1;mid=2132

http://z1.adserver.com/w/cp.x;rid=203;tid=2;ev=1;dt=3;ac=7;c=421;

The last two were the adverts associated with the Gator pop ups. The other two are just there for completeness. Apart from 'poly itsself, this is it for me today, therefore one or more of the above urls is responsible.

Dan.... you asked for it, and you got it.

-Jam

Wittlich · August 23, 2003, 12:51

I concur with Jamski, I just got the Gator popup again, and the window that was only open for a few seconds prior to the Gator download promt was in fact:

z1.adserver.com!!!

Dan, I believe that "z1.adserver.com" is the culprit.

FlameFlash · August 23, 2003, 15:16

At home I'm on my mac, however at work, if any more help in this hunt is needed I'll happily jump in (got the gater add there last week).

Wittlich · August 23, 2003, 15:37

I was finally able to capture the mysterious disappearing window using "print screen" - talk about camping out over a key!

Here it is:

Wittlich · August 23, 2003, 15:41

Hopefully this is the info you need Dan - because if it's not, then I guess we're all screwed.

Now to go clean off my system with SpyBot for the umpteenth time this week...

flash9286 · August 23, 2003, 20:48

just a helpful suggestion i put i just dl the new google toolbar which added a popup blocker and i havent got it yet

Frozzy · August 23, 2003, 22:45

Trouble is, that may not be the original source, but pop-ups given out to your infected computer.

Dan knows who advertises Apolyton though. If anyone can tell us, he can.

Panag · August 24, 2003, 13:24

Quote:

Originally posted by Verto
I use Ad-Aware to scan for adware/spyware etc. It seems to get most of the garbage.

hi ,

try www.networkactive.com/sniffer for that that gets left behind , ........

www.panicware.com is also intresting , .......

with a good firewall one should keep gator out before it loads !

www.finjan.com is good at this and free

have a nice day

geeslaka · August 24, 2003, 13:56

You know what I'm using and what I was using up until a few days ago, and I haven't seen this PU at all.

Panag · August 24, 2003, 14:02

Quote:

Originally posted by geeslaka
You know what I'm using and what I was using up until a few days ago, and I haven't seen this PU at all.

hi ,

care to share it with us , .......

btw , there are plenty of online scanners for bugs and pop'ups

have a nice day

Wittlich · August 26, 2003, 08:36

So, do we know if Dan was able to locate the offending advertiser?

The reason I ask is because it has been over 24 hours since I've gotten the Gator download warning...