"drive cleaner" ads

[geller]

I just downloaded the new 4.9.9. Whenever the ad for "Drive Cleaner"

http://i106.photobucket.com/albums/m275/quake_03/Idrivecleaneradcut.jpg

appears in the upper right hand corner of the BBO screen in the BBO advertising rectangle, a series of annoying popups (here's the first one) simultaneously seems to spontaneously appear (without my having clicked on the "Drive Cleaner" ad).

 

Here's the first of the popups.

http://i106.photobucket.com/albums/m275/quake_03/popupcropped.jpg

For those of you who don't read Japanese it says that the user's job and marriage and credit card information could be at grave risk unless he downloads and installs "drive cleaner" immediately....

 

I don't know anything about this product, but at least one site says the following

Description of Drive Cleaner 2006

Drive Cleaner 2006 is a suspect security application that is known to be dropped by malware. It uses deceptive and aggressive language about detected items, which may goad users into purchasing the application.

 

Recommendation for Drive Cleaner 2006

It is recommended that your remove this software from your computer to secure your system from suspected applications that might threaten system security.

 

I personally wish this product wouldn't be advertised (at least not in this way) on BBO. Has anyone else had this kind of popup appear on their screen recently while using BBO?

[uday]

We manually approve ads; sometimes disagreeable ads slide by. If this is from our advertiser, we'll get rid of it.

[pigpenz]

yes i find all the ads annoying, sometimes I am watching TV and my screen catches my eye and usually it is a flash from some of the pop advertisemnts as they change. I dont mind the ads on the initial log in page or main room but after awhile they get annoying.....maybe that should be one of the rewards of playing in a $$$ game, you dont have to have them run in background while you are playing in a pay game :D

[csdenmark]

I think it now is about 2 years ago I last had a pop-up. I have pop-up blocker in Internet Explorer turned on and I can see I have 255 pups blocked by Google pop-up blocker. Those pop-ups which need Active-X support I deny that option.

 

I will not accept such stuff. Decent commercials I can accept but I am interested in none of them. What I am interested of I search for myself.

 

Maybe this example might be a support for my plea for a premium service option!

[hrothgar]

I think it now is about 2 years ago I last had a pop-up. I have pop-up blocker in Internet Explorer turned on and I can see I have 255 pups blocked by Google pop-up blocker. Those pop-ups which need Active-X support I deny that option.

 

I will not accept such stuff. Decent commercials I can accept but I am interested in none of them. What I am interested of I search for myself.

 

Maybe this example might be a support for my plea for a premium service option!

Silly question Claus:

 

Last time I was on your bridge site, you were selling FD files... Personally, I couldn't care less if you do so. However, it seems incredibly hypocritical for you to be complaining about BBO adding ads to their client while posting large graphics on the BBO forums advertising your own commercial site.

[geller]

I think it now is about 2 years ago I last had a pop-up. I have pop-up blocker in Internet Explorer turned on and I can see I have 255 pups blocked by Google pop-up blocker. Those pop-ups which need Active-X support I deny that option.

I also use a pop-up blocker and normally I never have any problems, but somehow the popups that appear to have been generated by the BBO ad (the various popups urging the user to download Drive Cleaner) weren't blocked by the pop-up blocker.

 

Have other BBO users also had the DriveCleaner popups displayed on their systems?

[jw_nl]

I got an agressive popup with the same text but in english. A Microsoft IE window contained a copy of my normal BBO window, which could be dragged a little.

After rejecting the warning this window vanished and a DriveCleaner window appeared, again with threatening text.

I did send Uday a screendump of the last window.

[uday]

So far, two of us have reported the aggressive popup from Drivecleaner.

 

Our ad supplier says it isnt them. So we're trying to figure out where this came from. is it possible that both the reporters were infected with similar malware prior to this beta? That our ad supplier is mistaken, or is being misleading ? That a third party (program, proxy, isp ) is intercepting and replacing the ads?

 

Anyway, please let us know if this happens again, while we check this out.

[geller]

uday Nov 16 2006, 08:13 PM

So far, two of us have reported the aggressive popup from Drivecleaner.

 

Our ad supplier says it isnt them. So we're trying to figure out where this came from. is it possible that both the reporters were infected with similar malware prior to this beta?

Anything is possible, but I just ran Windows Defender

http://i106.photobucket.com/albums/m275/quake_03/windowsdefenderscancropped.jpg

and AdAware

http://i106.photobucket.com/albums/m275/quake_03/adawarescancropped.jpg

scans, and they both say my machine is clean. So if my machine were somehow pre-infected with adware for Drive Cleaner it would have to be some form of infection that both AdAware and Microsoft Defender were unable to find.

 

uday Nov 16 2006, 08:13 PM

That our ad supplier is mistaken, or is being misleading ? That a third party (program, proxy, isp ) is intercepting and replacing the ads?

Well, the DriveCleaner ad popups appeared on my machine just when the ad appeared in the BBO window, and I'd never gotten any such popups before. A highly unlikely coincidence, if there wasn't a causal relation.

 

I don't know much about their product, but the link I cited up-thread suggests that they might not be the type of advertiser with whom one should want to be associated......

[geller]

I just logged onto BBO again and immediately got the same sequence of popups.

here is the second one (below).

http://i106.photobucket.com/albums/m275/quake_03/popupagain2.jpg

Note that this spurious "warning message" identifies itself as a security warning (this part is in Japanese) coming from BBO. Sorry, but I think I'll stay off BBO for a few days till the problem is identified and solve.

 

In the event I get this message (or similar ones) when I'm not logged onto BBO I'll immediately post that here.

[geller]

A question for jw_nl: Are you also using 4.9.9?

 

It might be the case that for some reason this problem only occurs on 4.9.9 and not on earlier versions of the BBO client....

[jw_nl]

Yes, using 4.9.9

Like you I checked my PC after what happened. AdAware showed only a few cookies, E Trust AV told me my PC was free of viruses and RegistryMechanic didnt find anything wrong too.

[jw_nl]

Trying to stop DriveCleaner now for several hours.

 

Every time after BBO-login Drivecleaner popup windows are showing up again and today it changed the language to dutch.

I have seen new aggressive tries to let me download and install DriveCleaner. Sometimes after a few minutes, sometimes after half an hour.

 

During periods without connection to BBO NOTHING HAPPENED.

 

After reading a lot about DriveCleaner and running several times programs like eTrust AntiVirus, AdAware, RegistryMechanic, regedit I have to conclude for now that DriveCleaner isn't installed on my PC. I can't find any files/maps mentioned at sites like Symantec.

 

It seems to me that the DriveCleaner messages aren't invoked on my computer but seem to have the source on BBO. This might be wrong, but we'll see.

 

I will not connect to BBO with my computer with 4.9.9 installed for a few hours and wait for a new appearance of the DriveCleaner messages.

 

After that period I will connect to BBO and wait for the next surprise.

 

This isn't funny anymore !

[geller]

There's a program called "Hijack This" that prints out a log of one's system that can be used by a pro to find hidden spyware or adware. I made a Hijack This log of my system and sent it to Uday, just so he could eliminate the remote probability of pre-infection of my system.

 

I'd say BBO has a big problem. Hope you guys can find it and eliminate it right away.

[csdenmark]

I tried to log in to see if I was to provoke anything to come up. I may have high security settings because even this BBO Forum WEB-site I needed to allow manually for script.

 

I received these 2 screenshots:

 

http://bridgefiles.net/Picture/popup.1.jpg

http://bridgefiles.net/Picture/popup.2.jpg

In script error Adgang nægtet is danish meaning access denied.

 

I accepted to continue in both cases - and then nothing more happened. ACBL commercial on BBO to be seen

[sceptic]

Just in case anyone is interested, drivecleaner is a major pain in the butt and it can get on from a huge number of sources

[uday]

Claus, do you normally use Internet Explorer as your browser?

 

I disabled ads for your username (actually, for all 3 affected usernames; geller, jw_nl,csdenmark) - might be worth checking to see if simply using IE triggers the popup.

[geller]

might be worth checking to see if simply using IE triggers the popup.

I use IE as my normal browser (how lowbrow, I know, I know). Since I last logged off BBO 5 or 6 hrs ago I have been using IE extensively with no popups of any sort, either for DriveCleaner or any other product.

 

-Bob

[csdenmark]

Claus, do you normally use Internet Explorer as your browser?

 

I disabled ads for your username (actually, for all 3 affected usernames; geller, jw_nl,csdenmark)  - might be worth checking to see if  simply using IE triggers the popup.

YES - it is default browser. I use Internet Explorer 7 downloaded 3 weeks ago from original Microsoft web-site.

 

The other part of your comment I don't understand else I would gladly help with a test. You mean Adds-on? Phising Filter? Popup-Blocker?

 

I have tried to see if I had drivecleaner anywhere as enabled/disabled but looks not so.

 

As I still have Google pop-up blocker on 255 it must have been IE which has blocked.

[Walddk]

Claus, must we really see the enormous ad for your web site every time you post? This is the third time in this thread. There is probably no law against it, but I am with Richard on this topic. Bad taste is the term I would use .... unless you pay for the advertisement, of course.

 

Roland

[uday]

Jan, Robert, Claus

 

I've turned off ads on your usernames. But I'd still like to know where they came from.

 

 

Our ad network guy says "Not us" (valueclick)

We know it is not "us" (bbo)

Your spyware checkers say "not us" (your pc)

 

What I'd like to do, if you don't mind, is run some tests

 

This is the URL that we embed when showing ads in the lobby

http://online.bridgebase.com/prod/ads/location1.html

 

It shows an ad from valueclick, sleeps 2 minutes, then does it again.

 

Would you mind running that URL in an IE instance and seeing if the obnoxious popup happens again when it is just IE and the ad working together?

 

We know that the popup seems to target non-english (or perhaps non-us) pcs.

 

BTW, this is only an obnoxious popup. As with all random popups from ads, you shouldn't accept/download/install. The problem we're trying to solve is how to find the source of the popups.

 

 

My current guesses as to popup source

 

1. ad network is delivering popup (inadvertently bec. they say they arent doing it on purpose, or, rather unlikely, maliciously)

2. something is replacing the ad network ads with these ads. could be malicious software on the PC or at the ISP or a proxy server.

 

But we'll see.

[inquiry]

I have never seen this ad.. I clicked the link in udays post 58 times on three seperate trials and never got one.. When I get 59 IE windows open, it will not open a 60th one (dicovery doing this test). Don't know if that helps any, but I am in the US... and it seems uday knows we don't get the ad....

[csdenmark]

Jan, Robert, Claus

 

I've turned off ads on your usernames. But I'd still like to know where they came from.

 

 

Our ad network guy says "Not us"  (valueclick)

We know it is not "us" (bbo)

Your spyware checkers say "not us" (your pc)

 

What I'd like to do, if you don't mind, is run some tests

 

This is the URL that we embed when showing ads in the lobby

http://online.bridgebase.com/prod/ads/location1.html

 

It shows an ad from valueclick, sleeps 2 minutes, then does it again.

 

Would you mind running that URL in an IE instance and seeing if the obnoxious popup happens again when it is just IE and the ad working together?

 

We know that the popup seems to target non-english (or perhaps non-us) pcs.

 

BTW, this is only an obnoxious popup. As with all random popups from ads, you shouldn't accept/download/install.  The problem we're trying to solve is how to find the source of the popups.

 

 

My current guesses as to popup source

 

1. ad network is delivering popup (inadvertently bec. they say they arent doing it on purpose, or, rather unlikely, maliciously)

2. something is replacing the ad network ads with these ads. could be malicious software on the PC or at the ISP or a proxy server.

 

But we'll see.

Uday you dont need to do anything special to my used ID. I care very little about commercials and I think I have fairly good proctection levels.

 

I clicked your link. It opened in a new window, not in a tab-window. There were some text from World Bridge - 15 seconds or so - then text came again. After 3-4 times it changed to ACBL text.

 

Oh - if it is targetting non-english I may not be good for testing as I use IE7 downloaded in USA and english version. I have just read today that it will take approx. 3 months until all local versions of IE7 will be aut. distributed.

 

From what I read from help-topic about pop-up blockers it ought to display a message bar if a site has been blocked. I think it is therefore likely that nothing has tried to pop-up by me here.

 

Nothing else happened.

[uday]

Could you try this URL in IE and see if it produces ads ?

 

 

http://online.bridgebase.com/prod/ads/location2.html

 

This is something I wrote, and all it does is cycle between a couple of BBO ads.

 

if running *this* one in IE produces a popup for that weird product, then would be very interesting data (since this one doesnt involve the ad network at all)

 

This other URL DOES use the ad network

 

http://online.bridgebase.com/prod/ads/location1.html

 

What i'd love to know is how each one behaves, independent of the other

 

Thanks for the help ..

 

U

[geller]

BINGO! I ran both of them at the same time. One of them (it seems to be Location 1) produces the obnoxious popups for DriveCleaner (basically the same ones as before). I just killed it. I'll let location 2 run for a few more min to confirm it's OK (i.e., no popups), then I'll kill it and run location 1 only to confirm that location 1 is the culprit.