Spyware in Audio Galaxy 373
LintMan and a zillion other people wrote in about the story on Portal of Evil discussing spyware bundled with Audio Galaxy that seems to be even more nasty than usual. Others have written about it as well - there's Counterexploitation and Wired stories. Frankly, we're kind of bored by all these spyware/shareware stories (don't people learn?) so we let it sit around in the submissions bin for a few days, until, say, a slow Saturday night.
No Problem (Score:2, Insightful)
Re:No Problem (Score:5, Insightful)
Sometimes I sit there and tell myself, "Good thing your company puts all its products in a folder named after your company, that way I can easily manage the multitude of apps that you guys provide." After a while, my Program files looks like a freaking billboard
I HATE software that does this. Especially when 90% of windows applications believe that they deserve and absolutely must have an icon in the system tray. Even better is when they don't put the icon in the startup folder, so you have to go Registry hunting. Anything by Real does this. "By closing MemoryLeakLauncher Plus, you could lose some of the great features of the Real Player." Fuck off and die Real.
The Linux desktop may not have some of the "great applications" that you see in windows, but I have yet to see a linux app that maximizes its install, hiding my taskbar with that dumb blue screen, and insisting on stealing focus. This is the desktop that people think we should emulate? No thanks.
Good thing my Windows bozen have ad-aware.
It's just because... (Score:3, Insightful)
...No one gives a shit about linux on the desktop.
If linux on the desktop held as many users as say, Windows, I can guarantee there would be just as many spyware and generally rude apps.
The only thing linux is relatively immune from (assuming you're not a dumbass that always runs as root) is viruses.
Linux is just as vulnerable to spies and trojans, it's just there are so few desktop linux users that it's not even worth it for someone to write them.
You're only immune because no one has targeted you.
C-X C-S
Re:It's just because... (Score:2)
On yours maybe, not on mine.
Rude apps can be niced.
Re:It's just because... (Score:3, Insightful)
Actually, Linux is intrinsicly less friendly to spyware. The simple reason is that because it is op0en source, if spyware becomes a problem someone (probably several someones) will come up with a kernel patch that provides a complete audit trail for all created files and network accesses. There'll be no buying them off because the patches will be released under GPL.
Even without such a patch, Linux is less friendly to spyware. One reason that spyware gets away with it is that Windows by design hides system activities and data from the user. Since most software quietly adds to the registry without asking or informing the user, nobody notices when spyware does the same. To my knowledge, Windows doesn't ship with anything like strace (Which could be used as a userspace auditing tool for installers).
It is true that the millions of AOLers using Linux wouldn't likely know how to use any of those features, but they would know how to read the reports from other users who do know how to use the tools.
Look honestly at the differences between a proprietary OS vs. Linux. Who would be more likely to add a stealth API to the kernel in exchange for cash from a spyware vendor, MS, or the Linux kernel developers? Which OS would be most likely to carry around such an API without anyone finding out about it?
Now, ask which OS would be more likely to get features designed specifically to defeat spyware, written by people who are concerned more about the moral and ethical issues, as well as the users control of the system than they are about the bottom line.
Re:No Problem (Score:2)
No, they put it in
Granted, there are definite advantages (as well as disadvantages!) to the organization of the Linux (et al) filesystem heierarchy, but do you really want to go back to the DOS scheme of every company putting their software in some random directory of their choice so you can never find it?
Furthermore, I don't know many installers that "insist" on installing to C:\Program Files\. Usually, it's a changeable default. Now, gripe about installers not giving you a (useful) option for placing start menu icons, and I'll agree wholeheartedly.
This is certainly annoying, but your "90%" figure is a wild exaggeration. Running Windows, I typically have in my system tray: the Task Scheduler and Volume icons (both OS level annoyances, not applications), Mozilla (optional during the installation), and sometimes AIM (You can turn off automatic startup, but I'll concede that it's a pain that it doesn't exit when you logoff.) Considering that I've probably installed over a hundred windows programs since I got this PC, and only had to go out of my way to clean up a couple of them, I think that's a tolerable (if not great) ratio.
Agreed. Real sucks big rocks in this regard.
Re:No Problem (Score:2)
Well it is a changeable default in theory, but there are a LOT of programmers out there who are either stupid or lazy and simply hardcode "C:\\Program Files\\..." in their routines. You'd be well advised to NOT change the default install directory to avoid bugs, or you might be surprised when the uninstaller doesn't work.
Re:No Problem (Score:2)
I guess that is why I don't install my OS in the C:/ drive. I think that you would have to be mad to ignore the OS calls as that drive might not even exist (under NT/2K/XP).
I don't do this to screw up spyware, just to have separate partitions for data and programs.
Michael.
Re:No Problem (Score:2, Informative)
StarOffice/OpenOffice install program.
Not that it's a big deal, but you did say you've not seen any so here are two examples, if you're interested.
Re:No Problem (Score:2)
But, if the linux desktop ever achieves the level of integration that the sheeple want, and get, with windows.... then the same spyware will happen in linux. it's not immune.
Obviously, when all the software we use is written by us, for us, rather than by corporations to make money, it's not going to be spyware.
Re:No Problem (Score:2)
Re:No Problem (Score:2, Informative)
It allows logging of IP traffic in either TCP, UDP or ICMP protocols, over any ethernet or PPP link on your system. It also allows the use of custom filter programs, of the same syntax as that used by tcpdump, which allows you to specify a ruleset for determining which network packets are passed from the kernel into Sniffles for analysis.
Nice to find a slick app like this freeware for OSX.
Just to be on the safe side (Score:2)
License? (Score:3, Interesting)
Re:License? (Score:3, Informative)
It says that it is mentioned at the end of the EULA, but only vaguely. In any case, do you actually read all those EULAs before clicking "I Accept"?
No surprise to me... (Score:3, Insightful)
Re:No surprise to me... (Score:2)
Re:No surprise to me... (Score:2, Informative)
Re:No surprise to me... (Score:2)
On the topic of bitrates, I rip all my CDs at 320kbps. Now that's quality :)
Yet not all audio is out there. Ever tried searching for Bass 6 [cdnow.com]'s "I Am Bass" or DJ Billy-E [cdnow.com]'s "Generator"? Heck, try finding any of Bass 6's or DJ Billy-E's songs on Morpheus or Audiogalaxy. The simple fact is, no one has them. This is where P2P fails.
Re:No surprise to me... (Score:2, Informative)
If by 'quality' you mean 'inaudible waste of space'
VX2 - Devious (Score:2, Informative)
AudioGalaxy's [audiogalaxy.com] [audiogalaxy.com] software unfortunately now installs VX2 by default. We didn't know this when we installed AG, and were subject to a pop-up ad so frequently, it was unbelievable. At first, I suspected the sites we were visiting, but they were even coming up on Google!
The big throw was that the ads that were being served up always seemed to come from different places. One day, I decided to look into it, and discovered that all the ads were being downloaded from VX2 [vx2.cc] [vx2.cc].
VX2 is a very devious piece of sofwtare, logging every one of the sites you visit, and then popping an ad every once in a while. If you surf quickly, throttles itself; surf slowly, and it pops for every site. Quite devious, really.
Not all versions of AG, it seems. (Score:2)
Remove it easily (Score:5, Informative)
The VX2 software is a single program file in the system directory called VX2.dll.
To remove VX2:
1) From the Control Panel select ADD/REMOVE programs. Select "VX2 RespondMiter" and "Remove".
If VX2 RespondMiter is not present:
2) Close all internet explorer browsers.
3) Search your "C" drive for VX2.dll
4) Delete VX2.dll
If the system does not permit the file to be deleted proceed as follows.
5) Select "Start" and then "Run" and type "regedit"
6) Find the and delete the entry named "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Explorer\Browser Helper Objects\{00000000-5eb9-11d5-9d45-009027c14662}".
7) delete the {00000000-5eb9-11d5-9d45-009027c14662}entry.
8) Reboot computer.
9) Search your "C" drive for VX2.dll
10) Delete VX2.dll
It seems to just plug itself in IE, so as usualy Netscapers are pretty safe from this one....for now.
Support lavasoft! (Score:3, Informative)
Lavasoft is helping you wage your war against the marketing droids. Support them! Let them, and the rest of the world, know that you won't stand for these kinds of privacy intrusions.
Support lavasoft in their mission, buy their stuff [lsfileserv.com]!!
[Disclaimer: I do not work for them, I just like my rights granted by being human.]
Re:Remove it easily (Score:2, Informative)
Re:Remove it easily (Score:2, Informative)
so I proceeded to follow the registry key deletion outlined above but couldn't find such an entry at the given path.
So, an easier way for everyone, would be to search for "00000000-5eb9-11d5-9d45-009027c14662" and delete the result.
That's what I did and then deleting VX2.dll was possible.
Just letting those of you stumped know
Re:Remove it easily (Score:2)
The newest sig file is 005-16.01.2002. That file will allow AdAware to detect and remove VX2 and all of its variants.
Isn't it interesting . . . (Score:5, Insightful)
but
when a barely legitimate distributor of file sharing apps produces a "product" with these same attributes, there doesn't seem to be a great presence of Federal law enforcement at its place of business?
Re:Isn't it interesting . . . (Score:5, Funny)
Consider this: Write an Outlook worm that disguises itself as some useful app and sends itself to your entire addres book. Enclose a EULA in microscopic letters, pointing to a privacy policy on your website. Now you're 100% covered.
You can write:
YourCompanyName will not be responsible of any billings made using your credit card number collected by our software
Free money!
Re:Isn't it interesting . . . (Score:2)
An EULA is under even tighter scrutiny since it's an attempt to get the benefits of a contract without the hassles of actually giving the other party any opportunity to negotiate. (Since most stores will not accept opened software for refund, you're forced to pay for the software whether you use it or not.) Courts have generally refused to enforce most terms in EULAs for a number of such reasons - that's why it literally takes a law changing the ground rules (UCITA) to make them enforceable.
Of course, if you want to be a test case....
Re:Isn't it interesting . . . (Score:3, Funny)
:)
A bit late on the story (Score:5, Informative)
Re:A bit late on the story (Score:2)
That's the problem with sitting on news for days as Michael interestingly acknowledges. Why is he always so hostile?
It was removed because of unpaid bills (Score:3, Interesting)
Well according to the Wired story given above [wired.com], AudioGalaxy stopped including it due to unpaid bills of Onflow Corporation [onflow.com], who were including it in their third party add-in to AG Satellite. It wasn't removed because of any complaints, although perhaps there wasn't much opportunity to react to complaints anyway.
If this is true then I guess it could mean that AudioGalaxy didn't know what they were including at the time, which I don't personally think is an acceptable excuse but it might explain why the installation opt-out screen allowed opting out of other third party spyware but didn't even mention this one.
Luckily the story's not completely past its use-by date, since there are lots of people out there who still have vx2.dll installed. I found it on my windows partition the other day when I saw the story on k5 [kuro5hin.org].
Re:A bit late on the story (Score:3, Insightful)
Begging pardon, but the issue hasn't been resolved until (a) there are no longer people whose form submissions and other data silently leeching off to an unknown 3rd party, and (b) the legal ramifications of what's been going on are tested in court. Judging by the number of Code Red hits I'm still getting on a daily basis, I'd say Joe Windows User will obliviously exist with this illegal spyware for some time to come.
And don't say that nobody's broken any laws here. Minors aren't held responsible for for small type warranties and disclaimers in the United States. All that's needed to take this to court is proof that one minor ended up installing something that sent his daddy's VISA number to a spyware company, or proof that personal information about a kid under 13 was sent as a result of the spyware, even if the kid knew exactly what he or she was installing.
Other coverage not mentioned in story precis (Score:3, Informative)
OK,
- B
This is an excellent case for free software (Score:5, Insightful)
A system based on software libre (free speech software), on the other hand, is much less likely to have spyware. First of all, since there are "more eyeballs" looking at the source code, people who make libre software are less likely to add features to the software which the end user may not like. Second of all, the mindset behind making libre software is different than the mindset behind gratis software; there is more desire to give people features they want and less desire to make software which has undesirable features to increase one's bottom line.
While I do feel that propritary software works better than libre software for many things, such as video games, I am glad that I have a system that is over 90% libre software; this minimizes the chances that there is undesirable spyware on my system.
This may be why the editors are reluctant to post spyware stories; people using software libre instead of proprietary software do not need to worry about this kind of thing.
- Sam
Re:This is an excellent case for free software (Score:4, Informative)
And as all good cooking show viewers will know, here [ractive.ch]'s one prepared earlier... I hope you find this useful.
Re:This is an excellent case for free software (Score:5, Informative)
Re:This is an excellent case for free software (Score:2)
one more reason why open source is a good thing. (Score:3, Interesting)
A staid and steadfast comment. (Score:2)
I'm almost sick of hearing about all the "spyware", "policeware" and other [insert bad connotation here]-wares making their ways into consumer products. This can only lead to one thing, in my view, and that's eventually having all of our own belongings spy on us and rat us out. Why?
I strongly believe that the stronger "they" push for more control over our lives, the worst things will get in terms of "their" profits or whatever, because people will want to work around. It's like the parent telling their kid what not to do, so the kid does it just to be a rebel.
Re:A staid and steadfast comment. (Score:2)
Absolute majority of computer users (probably 99.99% at home and 99% at work) don't know, don't want to know and don't care about software or computers in general: It is flashy? Good! I like flashy thingies! When I tell them about spyware the universal response is I don't care, I don't do anything bad and Let them have it if they want it, as long as I am getting my free whatever...
Some people (/., for example) will indeed not want to use this software... unless they are forced to, or convinced to. But even if every single computer scientist on the planet rebels against this very foggy threat, nobody will listen to them anyway. Majority rarely listens to minority - "might makes right", and we see examples of that just everywhere.
So if 0.5% of population refuses to run spyware-laden apps, who cares? Majority of people just want to get some work done, they don't want to know what's going on inside their computers. As long as spyware-infected app works and does what the user wants, the app and the parasites will be successful.
Well hmmm (Score:5, Insightful)
perhaps Slashdot should put up a bi-weekly "security update" in order to address these issues which do not warrent a full post.
Re:Well hmmm (Score:2, Funny)
since you will be the only person to read this.... (Score:3, Interesting)
i checked my machine, but wasn't infected. i figured as much since i run ad-aware occasionally.
i forwarded the info to my buddies (mostly non-tech guys, music lovers, etc.): guess what - 3 out of 5 of them were infected and had no clue what "spyware" was.
"Stuff that matters" can be interpreted many ways, not so narrowly to "matter" only to people who understand root and have a linux box.
the elitism on this site sometimes gets real, real old. thanks Palaptine for your post. you are correct and the rest of these people are trolls.
kinda sad, huh?
spyware/shareware? (Score:5, Insightful)
spyware/shareware
Spyware has nothing to do with shareware. You may not like the shareware business model but please do not associate it with spyware. Spyware can be distributed under all business models. Yes. Spyware could even be distributed as Open Source on a mass-market Linux distro since many users never recompile. If Linux is ever mass-marketed on the desktop by AOL, I expect to see such things happen. It will work because most users don't read security journals and won't bother to recompile.
Re:spyware/shareware? (Score:2)
What was that about "quickly" again?
typical (Score:2, Insightful)
Did you even read the Portal of Evil post? Apparently not. If you had, you'd realize this particular brand of spyware is installed without the users' consent. "When will people learn?"?!? When will Slashdot editors learn to read articles first, and cast their pompus, overbearing comments later? Like a lot later. Like maybe never.
This software affects Windows users, and therefore, not the sort of user that goes around compiling his or her own kernels on a daily basis. I believe this, and this alone, is the reason it upsets you so much. You're the kind of guy that will scoff at an everyday Windows user who accidentally opens a virus attachment, then goes on to pay his mechanic $500 dollars for what should have been a routine $50 repair without batting an eyelid. In short, you're a dick.
Comments like yours are typical of the smug, unbearable technodweeb -- the kind doomed to spend the rest of his life relegated to the back room with his precious computers, far away from those people who actually use them.
Do me a favor from now on. Post the damn story, and shut up.
Regards;
DaC
And to get vx2 to disassociate your personal data (Score:3, Interesting)
This thing was really nasty with how much it spies on a user's everyday activities, and I was surprised that slashdot didn't report it sooner. There's the word of a very dubious company's word that they'll purge any bank account numbers that they accidently collect from keylogging your online forms to get them before you submit over an SSL connection, but they might as well be storing and mining all of the email you write to people.
Re:And to get vx2 to disassociate your personal da (Score:2, Interesting)
*Whistle* Pretty bad...
Trusting someone else (Score:3, Insightful)
It's not so much the fraud possibility that concerns me, since I think it's at least reasonable to assume that most companies won't go out of their way to break the law so obviously.
I'm more worried about the fact that they might be storing it at all. Whenever another company stores personal information about me, it means that I'm required to trust someone else to look after it properly. For every other entity who has personal information about someone, there's another entity that it can be stolen from.
VX2 has been trying hard to go unnoticed but even if they hadn't, why should anyone have to assume that the security on their system won't be cracked? Even if it does seem that they're taking reasonable precautions, nobody should feel obligated to trust them.
All it takes is for one wrong person to get bulk personal information and do a little data mining, and five years from now your name, address and estimated income could be on a regionally sorted list being sold on the black market.
Re:And to get vx2 to disassociate your personal da (Score:2)
Any volunteers? By the look of it, I don't think I'll personally be filling in that form anytime soon. :)
Why not fill it out many times? As John J. Smith, George Bush, etc. That database might taste a bit better with some salt after all.
Re:And to get vx2 to disassociate your personal da (Score:2)
<form METHOD="post" ACTION="mailto:vx2org@hotmail.com? subject=delete page" ENCTYPE="text/plain">
Somehow sending all these requests through a Hotmail account, of all places, isn't very reassuring.
Shouldn't this be illegal? (Score:4, Insightful)
I mean, would anyone put up with someone putting little "Buy Hood(tm) milk" ads in their refrigerator all the time? Or how about little spycams hidden away on your bookshelf? This case isn't much different.
Re:Shouldn't this be illegal? (Score:2)
Re: (Score:2)
Who's behind "VX2 Corporation" (Score:5, Informative)
Looking up "Maurice O'Bannon" in Google, we find that name associated with a major Internet fraud case [ftc.gov] in Nevada and California involving $37 million of phony credit card charges which resulted in jail time [keytlaw.com] for some of the participants.
Uh oh. Spyware from people involved with credit card fraud is big trouble. This needs to be followed up with law enforcement.
Re:Who's behind "VX2 Corporation" (Score:5, Informative)
The spyware doesn't even stop collecting data when you're on a secure (SSL) site -- they'll just encrpt the data they collect. (Is their no end to VX2's thoughtfulness?) We're told to look for the "secure" icon before giving away personal information, and to deal only with reputable companies... but what good does that do when a very popular software program has installed a trojan which may or may not be sending credit card numbers to someone who may or may not be a convicted criminal?
Adding popups to any random site you visit is along the lines of those programs that replace ad banners with their own, hijacking the site's revenue stream and making it appear that the site owner supports an advertiser they have no relationship with.
To top it all off, they have the right to update their software in the background, and possibly install third-party applications without the user being aware. Does accepting this licence agreement mean I accept the licence agreements of any third-party software that may be installed at a later time?
Re:Who's behind "VX2 Corporation" (Score:2, Informative)
I doubt if O'Bannon has any base of operations out of Vegas at all.
Re:Who's behind "VX2 Corporation" (Score:2)
Looking up "Maurice O'Bannon" in Google, we find that name associated with a major Internet fraud case [ftc.gov] in Nevada and California involving $37 million of phony credit card charges which resulted in jail time [keytlaw.com] for some of the participants.
Uh oh. Spyware from people involved with credit card fraud is big trouble. This needs to be followed up with law enforcement.
important after all, so micheal, what do you have to say to that? just another spyware story?
they better put this in slashback...
Slashdot says to michael stfu (Score:3, Insightful)
I recently rant into a nice little spyware program called winad (wnad.exe) which somehow ended up on the machine (nothing has been installed on the system in eight months) and would hook into IE and launch pop under windows at random when IE was sitting idle viewing a web page. My only guess is some ActiveX program loaded it onto the system from a website somewhere. This program disturbed me a bit because it got onto the system and though didn't do any damage it had the potential to. For elitist Linux users who think they're hot shit, the same thing can be done (though limited to a user's access privileges). It would annoy the piss out of alot of people to have $HOME rm -rf'ed. The whole invasion of privacy in the name of advertising crap is a blow to the whole freedom to roam thing the web is all about. Thinking you're a badass because you can compile a kernel doesn't mean you're somehow better than somebody else who doesn't compile their kernel. It gets real old real fast.
Re:Slashdot says to michael stfu (Score:2)
Alot of these shareware/spyware schemes are complete asshole tactics and could affect Linux users too if anyone gave a shit about them.
Bah you're talking out of your fucking ass. The fact is, there is no virus and no spyware on Linux. Now you can hypothesize all you want, it's NOT THERE NOW.
And you know why it's not going to happen anytime soon? Should a real virus happen, counter measures would likely be introduced in new distros or even kernel if needed, instead of relying on costly third party schemes.
Huh? (Score:2)
Also, there have been a few viruses [vnunet.com] on Linux, to say otherwise is the height of idiocy. Just do a damn google search.
As far as spyware goes? Yeh, there is none (that we know off...) But that doesn't mean that there won't be in the future. There's no technical reason why it couldn't be there.
Re:Slashdot says to michael stfu (Score:2)
In the days pre-Internet, it didn't make sense to send out fucked-up shareware. There was no way for you to receive any benefits from it, since the computer it would be installed upon was not part of a network, couldn't communicate back to you. That dynamic has now changed, and it isn't going to change back. Most binaries available for download used to be non-dangerous, with only a few dangerous ones. Now most are dangerous (at least judging by the number of installs - all of the "most-installed" shareware either is, or will become dangerous), and only a few are non-dangerous. Because the owner of the program can expect to have the dangerous program communicate back, sending information (=money) back up the wire.
This fact is operating system independent. Right now, Windows(tm) is far more affected than any other operating system, because most of the dangerous software is written for the dominant operating system. But there's no reason that has to remain true in the future.
Re:Slashdot says to michael stfu (Score:2)
Re:Slashdot says to michael stfu (Score:2)
The guy doesn't know how to do a whois lookup... (Score:3, Informative)
Registrant:
vx2 (VX52-DOM)
po box 27103
Las Vegas, NV 89126
US
Domain Name: VX2.CC
Administrative Contact, Technical Contact, Billing Contact:
vx2 (D25000-OR) vx2org@hotmail.com
vx2
po box 27103
Las Vegas, NV 89126
US
212 255 1008 fax: 123 123 1234
Record last updated on 05-Oct-2001.
Record expires on 31-Jul-2003.
Record created on 31-Jul-2001.
Database last updated on 26-Jan-2002 12:04:00 EST.
Domain servers in listed order:
NS1.VX2.CC207.246.124.6
NS2.VX2.CC207.246.124.7
Re:The guy doesn't know how to do a whois lookup.. (Score:3, Interesting)
I've got a plan (HELLO LAWYERS) (Score:4, Interesting)
Okay, I was just chatting with my teenage cousin on Kazaa, and that got me thinking. Her father is a lawyer (a defense attorney). She doesn't have Audio Galaxy, but I bet some lawyer, somewhere, has a kid who installed Audio Galaxy on their home machine; and I bet they sent work related web-based E-mail.
If I'm right and if this person can be found, surely you can subpoena Mindset to get logs of what they did with the information. IANAL myself, could you do anything else to them? The guy at www.cexx.org evidently spraypainted Blackstone's entire server pink - is that evidence that your legal communications could have been compromised? Is this stuff that cexx found utterly inadmissable?
Failing that, there are lawyers here. Set up a scheme to make Mindset/whoever they actually are defend themselves in court - if 100,000+ people really installed this software, they have to have something they're not remotely supposed to have.
Anyway - read the last bottom of the cexx story - it has the missing pieces of the story on HellPortal.
onflow (Score:4, Informative)
Onflow is the worst company I have ever dealt with.
Our company (which shall remain nameless) used onflow technologies in our product for about 2 years. They paid us for the first few months of operation, but when they owed us a total of about $30,000, we received a letter claiming they had lost overseas investments, and they couldn't pay us.
Funny enough, it look like they are still in business.......
Re:onflow (Score:2)
So how did they stall you for the other 21 months?
Those bill-avoidance tactics might come in handy next time I'm short on cash.
-Legion
vx2org@hotmail.com (Score:2, Interesting)
compose an html email containing an image on a
server whose logs you can read. You'll be able
grab the client IP address from his browser when
the image is displayed.
b
here's the slime. (Score:3, Informative)
"contact" page at vx2.cc. This is the whois
from vx2.org. coincidence? I think not.
go get him
Registrant:
Abram, Joshua (VX54-DOM)
444 east 57th street
New York, NY 10022
US
Domain Name: VX2.ORG
Administrative Contact, Billing Contact:
Abram, Joshua (FSQYHRRZLI) joshua@abram.com
444 east 57th street
New York, NY 10022
US
212 255 1008
Boring? (Score:3)
Spyware that transmits anything you put into a form (web-based e-mail, credit card information, address information) back to its parent company, as well as the usual tricks of recording every webpage you visit and adding banner ads to webpages you visit bores you?
I would've thought that a program attached to a major P2P program that records your credit card data and sends it to a shady company that no one knows anything about would be sort of important. If it were a group of self-described crackers that did this, it would probably be really big news. But because it's a corporation, just like all the others, it gets passed over?
Every small Microsoft security hole that no one has even exploited yet is big news, but corporations stealing credit card numbers and reading every bit of a person's e-mail apparently does not mean much. It wasn't even mentioned in the /. blurb.
The worst is yet to come... (Score:2, Interesting)
What worries me is that this is the beginning of new trend where all this adware will start this. I'm sure all the rest of the marketing departments in these scum factories will start to do this now.
Ya know, I really wouldn't mind PAYING money for some of these clients (if it was reasonable), but to force someone to run sketchy software reporting back to god knows who with god knows what information is complete bullshit. As far as I'm concerned, all these companies that put spyware in their software are even worse than the RIAA/MPAA/etc. This revenue model is fucked, and I hope that if their is even the slightest hope for humanity that these companies go out of business with the quickness.
BTW, I found out somebody put out a "crack" for Kazza to allow it to run without spyware. That makes me giggle. These companies get what they deserve.
Slipped past the guys at AG, but understandable (Score:3, Informative)
Its bundling goes against their views of making all bundled software opt-in, meaning the user must check a little box to opt-in otherwise the default setting is to not install bundled stuff.
After reading the wired article, I think its pretty understandable how this slipped past the guys at Audiogalaxy. The spyware mentioned is just one little file vx2.dll. Since it came with onflows advertising software, To the guys at AG it must of looked like it was a dll that onflow dynamically linked their code to. It just goes to show you how sneaky companies like vx2 are. I bet spyware companys just try and sumberse themselves further like the parasite they are, and just go tag their BS onto legit dll's.
Knowing how the folks at AG are they'll be taking a fine comb thorough their bundleware to maintain that opt-in philosophy.
Negligence at AG, not understandable (Score:4, Interesting)
So how is that relevant? If I drive my car into someone and kill them, but I was asleep at the wheel, does that mean that I am therefor innocent of any wrongdoing? Nope.
After reading the wired article, I think its pretty understandable how this slipped past the guys at Audiogalaxy.
I say judge them by their deeds not thier intensions - Audiogalaxy is in the business of distibuting software. How the crap can they not know what they are distributing? And if that is truly the case, it is thier problem.
Re:Negligence at AG, understandable (Score:2)
But. A policy of including stuff in your product when you Don't know what it does is just wrong and exposes you to liability.
Norton will have to extend its product line (Score:3, Insightful)
and I'm just glad that I don't seem to have caught
anything.
This kind of spyware is at least as dangerous as
any worm or virus I've heard about. I think Norton
and McAffe will have to extend their products /
product lines.
My ad hell (Score:5, Informative)
I, like Chet & Eric of the linked article do support programs having internal ads to support themselves as free software. However, monitoring users behavoirs is another story -- that's your computer and most contracts (as I have heard from a lawyer friend) cannot "sign" that away; for example your landlord cannot include a clause stating he has the right to monitor your mail, who you talk to, etc. and by living in the property he owns, you forfeit those rights, and if you do not agree with them you cannot live there. Well, folks, this is exactly what most of these programs are having you agree to. The fact is, they're illegal contracts. You cannot gather personally identifiable information (it's identifiable because they are able to deliver targeted advertisement thus they must have a system to know who you are) if you signed the rights away or not.
I have accepted that companies do this and there really isn't a way of getting around it (heck, I don't really care what they do with the info, I'm not going to buy something from any ads they use and that'll be my contribution). So I have tolerated these commercial bombardments. That is until something strange happened.
All of a sudden while I would be at my desk in the same room (this is at work mind you), I would notice activity on the monitor. Going over to look at it, I would notice an ad window had mysteriously popped up, when no programs were running and I hadn't been using the computer for hours. In the morning I typically had several windows to close after the nights ad-popping fun.
Thinking it was a web site which some how introduced a popup delay, I dismised it at first. But it got worse. It was impossible to work on a Word document without having an ad popup and steal focus from my document. I also came to the realization when you close a browser window, its process ends and thus a delay javascript wouldn't work.
I finally decided that it must be some program launching these ad windows. Searching the running process list, I noticed an interesting program happily running. Savenow was the culprit. This program was actually popping up windows on my personal desktop, on my computer (yes, I do own it) and collecting web browsing data in the background, even when its associated product wasn't running! Deleting the savenow executable, I was free of the ads yet outraged of how this company violated my privacy and my computer, and also comprimised the security of my employer. What if they could learn something about our project based upon my web browsing habits and sell that to another company?
After that incident, I went in with a resource editor on every single ad-supported program on my computer and removed the ad resources. I also installed ad-blocking software. Still though, I do occassionaly get ads and various brandings. I have since persuaded my boss to let me put my Linux box on the network, but still, how long until we see these ads and tactics on Linux? How long until these ad programs start embedding ads in your paid for software, or interfacing with your printer driver to print a banner ad out on every page?
The point I'm trying to make is I am all for advertising and realize it does support free products quite nicely, but when it invades my privacy and makes me sign illegal contracts, I get angry. Anyone would. And something should be done about it. I don't have the resources, I can only not buy the products they force on me and put a dent in their success rate thus no ads. But someone with the resources and time should go after these bastards.
Re:My ad hell (Score:4, Insightful)
No, you don't.
Get that fact through your head and you'll understand everything much more clearly.
Computers are not like oil or steel or cotton. Computers have loyalty. A comupter is owned by whoever wrote the software making it run. You can only trust a computer as far as you can trust the person (or people) who wrote the software that runs on it.
This is one of the reasons why allowing a single, for profit corporation to own a monopoly on proprietary software is orders of magnitude worse than allowing a single, for profit corporation to own a monopoly on something like oil or steel.
You purchased the hardware, you pay for the electricity to run it, you provide the real estate where it sits, you pay for the air conditioning to keep it cool, and you pay the parts and labor when it breaks. But as soon as it starts running someone elses software, it will start doing what that other person want it to do. There's no reason for them to respect your wishes once they own your computer.
So ask yourself: Who wrote this software? What was their motivation for writing it? Was it about money? And where is that money coming from? What is their cause? And do you want to contribute to their cause?
Then choose your friends carefully.
Someone PLEASE... (Score:3, Insightful)
It's defined as someone who:
Knowingly intercepts, endeavors to intercept, or procures any other person to intercept or endeavor to intercept, any wire communication
Since the information they are aquiring is information which is sent out over the web, (I.E. a URL, albeit represented in a slightly different form) this kind of suit should stick.
This kind of behaviour sticks of wiretapping to me. Please sue.
-me
Just say no!! (Score:2, Interesting)
Private, Encrypted? (Score:2, Insightful)
I wonder, since they admit that it is possible to send private data to them, is the stream to their server encrypted (SSL or something)? I mean, even if I DID trust them, I am not sure I trust EVERYONE along the way to their server.
Good thing the AG/Linux does not spyware, I hope....
quality (Score:5, Insightful)
Now THAT'S quality journalism.
I like Gator! (Score:2, Informative)
1 Uninstall "Offer Companion" from Control panel
2 Open Regedit and go to HKEY_LOCAL_MACHINE\SOFTWARE\Gator.com\Gator\dyn
3 Change servers URLs to 127.0.0.1
After this I never see a banner.
Downside:
1 Gator runs two memory-hungry processes
2 I don't know if their encryption for my data is any good
You can start throwing rocks at me now.
Ad-aware must be nice - if it works (Score:2)
Re:Ad-aware must be nice - if it works (Score:2)
I hate to say I told you so... (Score:2)
Pay attention people! You there, in the back, is that gum in your mouth?
No surprise, as long as windows is the way it is.. (Score:3, Interesting)
I want to control what directories it can act on (I.e. limit them to C:\Program Files\, limit their registry options (deny takeover of extensions, allow changing other programs' editions) etc etc., if it can steal focus, talk to other programs, go fullscreen, how it can talk to other machines on the net (ok the winxp firewall might be a start). And I mean in real-time, not having to set up all in advance and have the program crash on me if it's not enough. And this doesn't have to be default or anything, I just wish that us powerusers could assist windows in not getting fucked up.
Kjella
how long has this been part of AG? (Score:2)
AG: "We didn't know!" (Score:3, Interesting)
-Legion
KazAa is even worse ! (Score:2)
The worst part is the newdotnet thing.
Just do a "kazaa spyware" search on google and read.
VX2 Corporation Info followup (Score:5, Informative)
The Nevada Secretary of State Corporation Search [state.nv.us] gives us.
- President:MAURICE O'BANNON
Checking "vx2.cc" with Network Solutions WHOIS: [netsol.com]Address: PO BOX 27103
LAS VEGAS NV 89126
- vx2 (VX52-DOM)
The post office box addresses match, so the Nevada VX2 Corporation is the correct business.po box 27103
Las Vegas, NV 89126
US
Domain Name: VX2.CC
212 255 1008 fax: 123 123 1234
"Maurice O'Bannon" is mentioned in several legal documents related to the J.K. Publications [ftc.gov] scam. In that case, O'Bannon was on paper an officer or director of several dummy Nevada corporations which were fronting for a multimillion dollar phony credit card billing scam operated by Kenneth Taves of Malibu, CA. (Mr. Taves is currently Inmate #12289-112 [bop.gov] at the Los Angeles Metropolitan Detention Center). O'Bannon, though, appears to be some guy in Nevada who just signed whatever was put in front of him. In the judge's words [ftc.gov] [large .PDF] "Maurice O'Bannon had an informal agreement with Nevada Corporate Headquarters, Inc., an incorporator, to act as a nominee for their client-corporations and sign whatever documents Nevada Corp wanted him to sign."
The judge was bothered by O'Bannon's actions, but the FTC didn't have enough evidence that he had control of or profited from the scam to put him away.
The J.K. publications scam [ecommercetimes.com] involved obtaining a database of 3.6 million valid credit card numbers and charging them small amounts each, supposedly for use of a porno site. The mess involved offshore bank accounts in the Cayman Islands and Vanatu [robbevans.com], but much of the money has been recovered. Company names involved were JK Publications, Inc., MJD Service Corp., Netfill, N-Bill, Webtel, Billing On Line, Fun On Line, and Discreet Bill.
We're not at the bottom of this yet, but it looks very suspicious.
AGstreme (Score:4, Informative)
http://www.ractive.ch/gpl/AGStreme.html
Re: (Score:2)
Les vulnerable to viruses, not more (Score:2)
Re:NOT an issue here... (Score:2)
There's an obvious reason for this: (Score:3, Insightful)
I don't mean what do you think should control 90% of the market but what actually controls it? Like it or not Windows is out there. The average Windows user doesn't understand what is running on their machine.
Also, following the purchase of a MS product (!!!), it is far easier to develop for Windows than other platforms like Linux and Beos. If you disagree then build a full Visual Basic program from scratch on Windows and the same program on Beos/Linux etc... If you think it's easier on other platforms then you have never built a reliable and properly bugtested program using VB. I'm not trolling - it's very much the truth - Microsoft have done some great things with their API and in my opinion its very very sharp HOWEVER I am not ofcourse dismissing the shortcomings that are inherent in an MS operating system.
MS have very useful features available for Spyware programs. Every part of the PC, be it data, configuration or otherwise is easily accessable (which would be forbidden in the case Linux's more stringent - and more mature - permissions system - this is a GOOD thing!!).
You have to think like a competitor - if you aim to target the majority of your user base who are you going to develop your spyware for? Linux users? Beos? MacOS? Be realisitic. You are trying to MAKE money. I'm not saying that money can't be made out of the others but Windows HAS a large established user base - which ofcourse is why they are scared of any alternatives. If you are a major contender in the OS business then sure - Linux support is important - but if you are a services provider etc.. where is YOUR market?
This is some food for thought - think about why Windows has more spyware... think about operating as a true commercial entity. Again - I'm not trolling - I'm being realisitic. If I direct my company to make software for large distribution my choices are clear and simple - PostgreSQL/MySQL Linux backend OR comparable other product/OS and VB Client frontend - there is no way my frontend at this moment will be written in anything else (except maybe Java - but that depends on the user base).
User base is virtually EVERYTHING if you are trying to EAT.