More on the hijacking popups here

[Nutty]

Absolutely not possible. No way in hell.
And for the hundredth time, no "infection" targets only one site (this one) and only randomly at that.

Get a clue. Simple as that.

Well I have no virus scanner, no software firewall, and no spyware systems running. I surf pretty much bareback ;) And not a single problem here.
The fact you're the only one getting it is clue enuff that the problem is your end. Simple as that.

[nrs421]

it's probably that virus that installs on the computer the moment its connected to the internet....i got infected with that once a while back.....the ip address of infected computers are recorded and once it detects the computer is online it automatically reinstalls the virus if it has been removed......i solved it by making sure the computer wasnt online after doing a fresh install, installed a firewall and then only connected to the internet....it's an old virus but it was a big deal awhile back if anyone remembers

[Elvin Presler]

OK, now you guys are just repeating stuff I already answered or commented on.

I said about 3 times I clear my cache and it stops. I even ID'ed the bad java script files in the cache first (iframe2.js). My IE was set clear cache every time it's closed and save pages 0 days as well.

I did the totally offline install bit with firewall about 6 times. About 3 times my first url visited immediately after plugging the cable back in was nvnews and I got the popups...other time nothing, til a day or 2 later.

I said I am using Firefox now + several blocking methods. I block Java script completely. No popups anymore.

I'm not here to complain about popups anymore, just answering questions people asked. I know how they start. Intellitxt, or pricegrabber (or one of the banners they fetch) is loading some bad java scripts. I can't tell you exactly which or how because I don't know much about java.

[Clay]

Java and Javascript are not the same thing. It may sound like nitpicking but you're either talking about compiled code (Java, in the form of Java applets, etc) or you're talking about interpreted/scripted code (Javascript). If nvnews.net is the cause/source of this problem as you seem to be claiming...then why isn't nvnews.net causing it for everyone?

[Elvin Presler]

I don't know which java I'm talking about. iframe2.js (java script?) was in my temporary internet folder and had a boatload of references to zedo.com (where some of the popups came from). When I come to this site, my NoScript Firefox Extension begins blocking and "informing" me of all these domains trying to run...java? java scripts? If I don't let them, I get no popups. nvnews java begets pricegrabber java. If I block nvnews, pricegrabber doesn't even show up. Who knows what pricegrabber will beget, or the intellitxt one.

I put 2 and 2 together and figure those java things are the source. I could be wrong, and I sure don't know exactly how it works, but I'm pretty sure that's where they come from. I offered my entire cache and cookies copied during and "episode" for examination a while back and to MikeC in a PM, no one responded.

More on the *.js files, from memory now, so not real acurate. I saw suspicious parts something like "position or size=absolute" and "directx9 opacity=100%". Full screen, invisible Flash link (the hijacking)? Stuff like that. Most of it was mumbo jumbo to me though so I couln't pin it down.

[Clay]

yes, files ending with .js are Javascript files.

I'm looking through our files on the server now for any signs of or references to the zedo.com domain.

[Elvin Presler]

I only got those once the popups started and they were in iframe2.js. I lost my copies of them now or I'd offer to upload them to you. Should I start using IE again and wait for the popups, then copy all that for you? May take a few days.

[Clay]

I only got those once the popups started and they were in iframe2.js. I lost my copies of them now or I'd offer to upload them to you. Should I start using IE again and wait for the popups, then copy all that for you? May take a few days.We have no file named iframe2.js on the nV News server, nor do we have any mention of zedo.com in any of our Javascript libraries or html files.

I wouldn't suggest that you reinfect yourself just yet but I would suggest that you contact pricegrabber about your issue/concerns. You can do so here:

http://www.pricegrabber.com/info_popupfree.php

Please keep us posted on what you find out.

[Elvin Presler]

Oh I didn't think the iframe/zedo stuff came from here at all...I figure a random bad banner from pricegrabber or intellitxt or something loads it. It seems like java begets more java begets more java etc. from all different domains. Who knows which one is doing it.

I don't get "infected" anyway....I just get popups until I nuke my temp internet cache. It's not a big deal, just an annoyance, which is why I gave up and started using Firefox again. It's not something that goes on forever or anything like adware....just a java script (I assume) that behaves like adware until nuked.

PS: Thanks for taking the time to check it out though.

[AthlonXP1800]

I know how they start. Intellitxt, or pricegrabber (or one of the banners they fetch) is loading some bad java scripts. I can't tell you exactly which or how because I don't know much about java.

Java Control Panel have debugging tracing and logging features, I think it worth a try enable both and it could reveal the source of the problem.

[AthlonXP1800]

Oh... that very interesting, I just checked my Norton Internet Security 2006 Log Viewer, here are all activities in NvNews were logged.

Here some entries:

Private Data:
Date Time: 17/12/2005 04:50:32
User:
Action: Blocked
Type: Referer
URL: http://itxt2.us.intellitxt.com/al.asp?ipid=1882&di=383752,463679,64643,383785,463928&syid=0,0,11339,14197,0&adid=5080,14828,10194,23858,14797&cc=uk&hk=1&ts=20051217045007&so=0&mh=2d6e45e15b4b010bbec8d36b8bdb4e71
Data: http://www.nvnews.net/vbulletin/showthread.php?p=772428&posted=1#post772428

Private Data:
Date Time: 17/12/2005 04:50:30
User:
Action: Blocked
Type: Referer
URL: http://itxt2.us.intellitxt.com/v3/spit.jsp?ipid=1882&ts=20051217045007&cc=uk&cn=11&cf=3&mk=5&lcid=0&sid=2d6e45e15b4b010bbec8d36b8bdb4e71&si=1&sv=-1&rdtm=100000000&rrm=100000000&rcpcm=100000&ripsm=1000000&rorm=1000&wpsm=75&wpim=50&dfc=0&rp=0&so=0&nbc=0&adi=0&a
Data: http://www.nvnews.net/vbulletin/showthread.php?p=772428&posted=1#post772428

Private Data:
Date Time: 17/12/2005 04:50:28
User:
Action: Blocked
Type: Referer
URL: http://ah.pricegrabber.com/export_feeds.php?pid=eibaiec&document_type=html&topcat_id=single&category=topcat:single&col_priceret=1&masterid=14639983&limit=1&style_type=tex&font_type=ver&stype=M&banner_size=65x25&iframe=1
Data: http://www.nvnews.net/vbulletin/showthread.php?p=772428&posted=1#post772428

Private Data:
Date Time: 17/12/2005 04:50:28
User:
Action: Blocked
Type: Referer
URL: http://ah.pricegrabber.com/export_feeds.php?pid=eibaiec&document_type=html&topcat_id=single&category=topcat:single&col_priceret=1&masterid=9751944&limit=1&style_type=tex&font_type=ver&stype=M&banner_size=65x25&iframe=1
Data: http://www.nvnews.net/vbulletin/showthread.php?p=772428&posted=1#post772428

The log are too long to post so I attached a text file.

[retsam]

i looked at your log and there really isnt much out of the ordinary. i have used many versions of IE and firefox on this site and have come up with zero popups. i think elvin has deeper problems that none here are going to be able to fix.

[Sazar]

i looked at your log and there really isnt much out of the ordinary. i have used many versions of IE and firefox on this site and have come up with zero popups. i think elvin has deeper problems that none here are going to be able to fix.

He's not the only one :)

I am reformatting my system over the weekend but I have been relatively pop-up free from this site for a while :cool:

[Son Goku]

Well see how a reformat goes; but for anyone who continues to see them, try this if any of you don't want to switch from IE

http://www.proxomitron.info/files/index.html

It's been out of development since June 1993, so some of the newer stuff it won't be further developed to detect anymore. The main thing it wasn't blocking for me (and reason I went searching elsewhere) was flash ads. Popups of different varieties it was still getting...

[AthlonXP1800]

i looked at your log and there really isnt much out of the ordinary. i have used many versions of IE and firefox on this site and have come up with zero popups. i think elvin has deeper problems that none here are going to be able to fix.

Yep, I didnt find any popups at NvNews and I disabled both NIS2006 and IE Popup Blocker, still have no popup from the main page and forum. So I did received a Jamster popup from Rage3D main page, I cleared IE Cookies and files, turned on IE Blocker and it blocked the popup when Rage3D main page showed up.

[Sazar]

When I was getting pop-ups from nvn, it was not because it was the only site open usually.

A few times it happened when I had navigated to a different website in a separate browser. Each time though, it was a different site in the other browser, but the constant was that NVN was always open.

[Son Goku]

Using the prog I mentioned, I haven't seen any popups in several years. It's been good at stopping popups still, and doesn't necessitate any changes to the browser (except one needs to set it to use a proxy at 127.0.0.1 on the port it runs on). If popups are one's main concern, it will work there...

[vampireuk]

I browsed several animal sex sites and downloaded numerous porn.exe files, nV News stop sending me popups!

[rewt]

You have sex with animals?

:p

[AthlonXP1800]

Probably with a dog or frog.