iads.adroar.com

[Guest]

I blew it. After watching a CBS 60 minutes story on Grokster I installed it
to see the program for myself. My PC has not been the same since. Using
virtually every spy detection program available and rolling back to a
pre-install version of XP Professioanl I have finally calmed the PC down
some.

The problem I cannot find is related to IE6. Each time I visit a website IE
communicates with iads.adroar.com. It makes no difference which sites I
visit so the issue isn't site specific. Somehow these vile vermin at
Grokster and Adroar have set up IE6 to tickle adroar. The IP is
216.40.249.60. adroar forces pop up advertising on the desktop. Guard IE
didn't appear to kill the popups so I blocked the IP with McAfee Personal
Firewall. adroar tries to send their ads anyway by sending traffic to EVERY
port imaginable on my PC. Over 400 attempts in one hour.

Is anyone familiar with how adroar accomplishes this exploit and can it be
defeated?

 

[Frank Saunders, MS-MVP]

I blew it. After watching a CBS 60 minutes story on Grokster I
installed it to see the program for myself. My PC has not been the
same since. Using virtually every spy detection program available and
rolling back to a pre-install version of XP Professioanl I have
finally calmed the PC down some.

The problem I cannot find is related to IE6. Each time I visit a
website IE communicates with iads.adroar.com. It makes no difference
which sites I visit so the issue isn't site specific. Somehow these
vile vermin at Grokster and Adroar have set up IE6 to tickle adroar.
The IP is 216.40.249.60. adroar forces pop up advertising on the
desktop. Guard IE didn't appear to kill the popups so I blocked the
IP with McAfee Personal Firewall. adroar tries to send their ads
anyway by sending traffic to EVERY port imaginable on my PC. Over 400
attempts in one hour.

Is anyone familiar with how adroar accomplishes this exploit and can
it be defeated?

See
Dealing with Unwanted Spyware, Parasites, Toolbars and Search Engines
http://mvps.org/winhelp2002/unwanted.htm

 

[H Leboeuf]

spywareinfo.com just recently (Nov. 9) reported this.
A good resource to find the { CLSID I.D. } associated with these programs.
http://home01.wxs.nl/~kleyn080/BHO_list.html

{FAC6E0E1-5D45-4907-BC00-302D702DCC73}
Cpr.dll Adroar.com adware downloader
--

I would seek help from the expert on this forum to find out what is there is
to remove.

http://www.spywareinfo.com/downloads.php#det
Download "Hijack This!" [freeware] or download direct (below):
http://www.spywareinfo.com/~merijn/files/hijackthis.zip

If you get a 404 error or Access denied, try:
http://216.180.252.218/~spywareinfo.com/downloads/tools/hijackthis.zip

Unzip, double-click "HijackThis.exe" and Press "Scan".

When the scan is finished, the "Scan" button will change into a "Save Log"
button.
Click: "Save Log" (generates "hijackthis.log")

Next, HijackThis | Config [button] | Misc Tools [button]
Click: Generate StartupList log [button] (generates "startuplist.txt")

Next, go to the below location:
http://www.spywareinfo.com/forums/

Sign in, then copy and paste both files in your message.

HijackThis Quick Start Help
http://www.tomcoyote.org/hjt/
=======

Mike Burgess has a hosts file to block that site.

The best way is to block the server from tracking you in the first place
Blocking Ads with a Hosts File and AdShield. Under the Security Tab download
the hosts.zip file.
http://www.mvps.org/winhelp2002/hosts.htm

Henri Leboeuf
Web page: http://www.generation.net/~hleboeuf/index.htm

 

[Frank Saunders, MS-MVP]

spywareinfo.com just recently (Nov. 9) reported this.
A good resource to find the { CLSID I.D. } associated with these
programs. http://home01.wxs.nl/~kleyn080/BHO_list.html

Thanks.