Author Topic: Beware AIM Hidden Audio Spam/Spyware  (Read 9871 times)

0 Members and 1 Guest are viewing this topic.

techie101

  • Guest
Beware AIM Hidden Audio Spam/Spyware
« on: November 09, 2003, 08:08:12 PM »
Last week I though I was going crazy.  I started hearing voices from nowhere.
As it turned out, it came from my computer but I wasn't running any players.
I wrote it off to a freak.  This week my laptop did the same thing so I started internet research.

Apparently, AOL has started "hidding" and using flash objects to add audio ads through AIM without the user's knowledge.

See http://www.dslreports.com/forum/remark,8359415~root=security,1~mode=flat

I followed MOST of the suggestions except deleting Viewpoint player which I have had on my system for over a year without incident.

See my post in the above forum on blocking the offender sites (or at least the ones that seem to matter).

The reason I am posting it here, is because one of the files this audio spam uses is .js which can be blocked using Avast Pro.
Unfortunatley, I do not see any way of using Avast Home to block such files.

So, if you have been hearing little voices.....
The voices are real and your not nuts!  ;D

techie
« Last Edit: November 09, 2003, 08:10:02 PM by techie101 »

Offline igor

  • Avast team
  • Serious Graphoman
  • *
  • Posts: 11815
    • AVAST Software
Re:Beware AIM Hidden Audio Spam/Spyware
« Reply #1 on: November 09, 2003, 09:48:35 PM »
avast! Pro Script Blocker stops "infected" scripts - i.e. those identified as a virus. There is no way to configure avast! to block user-defined scripts - so I sort of doubt it would block the mentioned ones (unless they are added to the avast! virus database, of course).

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67241
Re:Beware AIM Hidden Audio Spam/Spyware
« Reply #2 on: November 09, 2003, 11:00:12 PM »
Apparently, AOL has started "hidding" and using flash objects to add audio ads through AIM without the user's knowledge.

The reason I am posting it here, is because one of the files this audio spam uses is .js which can be blocked using Avast Pro.
Unfortunatley, I do not see any way of using Avast Home to block such files.

So, if you have been hearing little voices.....
The voices are real and your not nuts!  ;D

techie

Thanks techie. Don't you use a Spyware blocker? SpyBot, SpywareBlaster, SpyGuard, Ad-aware (Lavasoft)? Let me send you to my favorite links page. See section Ad-aware and Trojans Tools...

That is another reason to have avast! Pro version and the residents running  ;D
The best things in life are free.

techie101

  • Guest
Re:Beware AIM Hidden Audio Spam/Spyware
« Reply #3 on: November 09, 2003, 11:40:04 PM »
Igor,
Yes, you are correct.  I didn't think of it in those terms.

Technical,
Of course I use blockers.  I have Spyblocker running resident, and have Adaware and Spybot S&D for manual scans.  None of them picked up the files mentioned.
Maybe they can't.  As Igor has stated, Avast Pro will not stop user defined scripts so I was mistaken in my reasoning.

I wanted to let everyone know because the ride in on aim hidden and undetectable.

techie
« Last Edit: November 09, 2003, 11:41:33 PM by techie101 »

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67241
Re:Beware AIM Hidden Audio Spam/Spyware
« Reply #4 on: November 10, 2003, 02:27:46 AM »
Unfortunatley, I do not see any way of using Avast Home to block such files.
techie

If the user puts the extension .js at Stardard Shield (run/access) scanning, won't it caught the virus (if any, as in this case the script is not a virus)?  :-\

Will you tell the develpers of ad-aware applications this behavior? Is there any advantage as the script is yours?  :-\

Do you update SpyBot? Do you found any trouble in last weeks? Some links are terrible poor...  :'(
The best things in life are free.

techie101

  • Guest
Re:Beware AIM Hidden Audio Spam/Spyware
« Reply #5 on: November 10, 2003, 07:26:16 AM »
Quote
Unfortunatley, I do not see any way of using Avast Home to block such files.
techie
Technical, I stand corrected.  It is definetly possible to block javascript in the Home edition by using the Standard Shield Customize tab.  Thank you for keeping me on my toes. Technical, I am however reluctant to stop all js file execution.


Quote
If the user puts the extension .js at Stardard Shield (run/access) scanning, won't it caught the virus (if any, as in this case the script is not a virus)?  
Not all js files are used to transfer viruses

Quote
Will you tell the develpers of ad-aware applications this behavior? Is there any advantage as the script is yours?  :-\
I will try to contact them but I do not think that it is a problem with Adaware. As for the scripts.  They are not mine at all.  The js files are embedded using flash script and piggybacked in on AIM.  Since deleting the files mentioned in the Broadband Reports article and changing the settings in IE and using the Pac File generator in Spybot functions similarly to a hosts file), I have not had any reoccurrence.

Quote
Do you update SpyBot? Do you found any trouble in last weeks? Some links are terrible poor...  :'(
I do update Spybot regularly and have not had any problems.  However, I have had some trouble with Adaware.  Lavasoft apparently is no longer supporting any builds of Adaware 6.0 less than build 181!!
I only found that out today and downloaded build 181.  Now the updates are working again


techie
« Last Edit: November 10, 2003, 07:49:31 AM by techie101 »

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67241
Re:Beware AIM Hidden Audio Spam/Spyware
« Reply #6 on: November 10, 2003, 04:00:15 PM »
Thanks techie for your time and quite compreensive explanations  ;)

You said: The js files are embedded using flash script and piggybacked in on AIM.  Since deleting the files mentioned in the Broadband Reports article and changing the settings in IE and using the Pac File generator in Spybot functions similarly to a hosts file). For me, it's almost imposible to reach the bottom... seems to complicated for my small knowleadge...

Anyway, sometimes I still have problems with SpyBot updates  :'(

The best things in life are free.

techie101

  • Guest
Re:Beware AIM Hidden Audio Spam/Spyware
« Reply #7 on: November 10, 2003, 08:31:55 PM »
Technical,

Ok...I'll put my bottom explanation at the top for you next time and you can read backwards.  :D

What type of problem are you having with Spybot???
Start a new topic under General and we can discuss it if you want.

Until next thread...
techie

Offline Lisandro

  • Avast team
  • Certainly Bot
  • *
  • Posts: 67241
Re:Beware AIM Hidden Audio Spam/Spyware
« Reply #8 on: November 10, 2003, 09:37:32 PM »
Technical,
What type of problem are you having with Spybot???
Start a new topic under General and we can discuss it if you want.
Until next thread...
techie

Thanks for your support. See here.
The best things in life are free.