Spyware Alert: PopupsNuker

Discussion in 'Malware Help - MG (A Specialist Will Reply)' started by Major Attitude, May 14, 2004.

  1. Major Attitude

    Major Attitude Co-Owner MajorGeeks.Com Staff Member

    As you know, MajorGeeks tests software before posting to our website for you to download and we know everyone loves a free popup blocker. We spotted a new free popup blocker appearing on websites this morning called PopupsNuker and installed it for consideration on MajorGeeks.com. An hour later, here is our findings:

    PopupsNuker has a professional looking website and is a professional looking program, but don't be fooled. After installation it wanted to reboot my computer so that set off my geek spidey senses. At this point, I immediately did a spyware scan before rebooting. After a reboot my firewall went off asking for EbatesMoeMoneyMaker, PopupsNuker and NHUpdater to access the internet, I denied, closed PopupsNuker and did an Ad-Aware scan again. 27 spyware items were found. Also, your computer will want to install the Sun Java 2 Runtime environment if not already installed. I then spent some time reading their website mainly looking for a privacy policy. I could not find one, nor could I find any information relating to a privacy policy on their website.

    At this point, I moved to my Spyware testing laptop, which was just imaged to a clean install last night. I proceeded directly to the PopupsNuker website and installed PopupsNuker. Ad-Aware found the same 27 items. A run of the latest Spybot also discovered 21 items. Sure enough, I could easily find registry entries and folders like C:\ProgramFiles\EbatesMoeMoneyMaker. Entries for MoeMoneyMaker and Navhelper are in add\remove programs. A reboot is required to remove dll files from NavHelper. Attempting to close the program warns you your internet connection may stop working.

    Needless to say, you will not find this program available for download on MajorGeeks.com. Theres a lot more I could say, but I think this posts speaks for itself. Remove this program by running Ad-Aware or Spybot, then uninstalling PopupsNuker from add\remove programs. You may need to reboot. You will need to delete the 3 empty folders, MoeMoneyMaker, NavHelper and PopupsNuker in your C:\ProgramFiles folder. A scan following these steps showed my computer clean of this program and its spyware and my internet was working fine. A couple of other screenshots follow this post to show you what I saw.
     

    Attached Files:

    Last edited: May 14, 2004
  2. Major Attitude

    Major Attitude Co-Owner MajorGeeks.Com Staff Member

    Spybot results:
     

    Attached Files:

  3. Major Attitude

    Major Attitude Co-Owner MajorGeeks.Com Staff Member

    Add\Remove programs:
     

    Attached Files:

  4. Vonnie

    Vonnie Sergeant

    Re: These guys are good........for nothing

    This is why I only download from MG.
    If it aint here I dont need it :)
     
  5. alanc

    alanc MajorGeek

    Great report MA, excellent catch :)
     
  6. Major Attitude

    Major Attitude Co-Owner MajorGeeks.Com Staff Member

    Thanks, glad to do it. We have had a few slip under the radar here and there, but simply because some removers call somethings spyware while others do not, but this one shocked me with not just the spyware installed, but how it was presented quite professionally. I will probably bump this in the news for tommorow in the hopes that we can save some people from the hassle.
     
  7. British TV Nut

    British TV Nut Corporal

    Considering I'm a download junkie for free things, this is a good thing that you do test software before endorsing it. I'm so glad that there is someone out there protecting us from the people who want to take advantage of other computer users. Thank you so much for the info! It's a big help which make me feel wonderful downloading from you guys. Hats off and great job!
     
  8. waxace

    waxace Private E-2

    I/We are so glad that you take the time to test some of the crap that is out there so that people do not have to go through the hassle of searching or removing spyware/adware from programs that at first glance look o.k.
    There are a lot of people out there who put "Good Looking" free programs out just for the trap of luring unsuspecting people into the Spyware/adware/trojan trap.:mad:

    Thanks again for the heads up!!

    That's why I'm here with other grateful folks!!:D

     
  9. Major Attitude

    Major Attitude Co-Owner MajorGeeks.Com Staff Member

    Thanks! Yup a lot of websites just post everything submitted, we reject 80%, of course we stick to a specific genre of software as well and get a lot of submissions for items that dont apply. Another trick is companies posting warnings that a software might install 3rd party bundled software. While a lot of us know what that means, the average joe does not, or does not read full descriptions.

     
  10. kman

    kman Private First Class

    Good job, we all appreciate it. :)
     
  11. webhelper

    webhelper Private E-2

    Ok, after reading about this after finding the link at SWI forum, I found that popupsnuker.com belongs to one of the groups that I have been monitoring for the past year and that is BulletProofsoft.com that sells the spyware remover that has been suspected of being hacked from both adaware and spybot older software.

    I went and tested all their sites and I find one that you download the various software is at download sites that they have been linked to since 2000 and 2 more that also installs the Navexcel and topmoxie's eBates Mo Money adware.

    This is something new for them and as such you will not know if any of their software has adware installs or not unless you run the installation to get the Install EULA which most users will click continue without reading down into the 20 somewhat pages to find out all their is to know.

    I have the sites that they own, the sites that has adware, and the names used as authors throughout the Internet as you will need to know the name of the site that matches the software or its author to stay away from it. As is my criteria I set forth on my site at webhelper4u.com, any site that installs adware, then all sites that it owns, its affiliates and partners will be listed as direct or indirect supporters of adware installations for profiting from users personal information.

    One part of the EULA is what really gets me. Here you install a popup blocker that could keep eBates ads from popping up and what a user is authorizing is to let eBates disable or delete any program that interfers with theirs.

    Quote:". In installing the Moe Money Maker Software, you authorize Ebates to disable, uninstall, or delete any application or software that might, in Ebates' opinion nullify its function and put you at risk of loosing the cash-back savings that Moe Money Maker Software is designed to earn you..."End of Quote.
     
  12. webhelper

    webhelper Private E-2

    Sorry found a limit to the number of lines:
    Here is the sites and names of authors:
    Ayman Elbanhawy
    Ahmad Elbanhawy
    Dr. Gamal Elbanhawy
    Naglaa Elbanhawy

    BPS Adware Installs:
    Popupsnuker.com
    pn.exe

    Zillsoft.ws (Installs navexcel and Topmoxie eBates Mo Money adware)
    Zilla cd dvd rip and burn zrnb20.exe
    Zilla Anonymous Surfer zas2501.exe

    spamnullifier.com 216.40.206.208
    spamnullifier (free version)
    hxxp://www.filehog.com/sn30.exe
    Installs navexcel
     

    Attached Files:

  13. Major Attitude

    Major Attitude Co-Owner MajorGeeks.Com Staff Member

    BPS submits here and is rejected on a regular basis. Some of their software is complete rip offs of other programs and most of it has spyware.

     
  14. jamesey

    jamesey Private E-2

    this is funny!

    im glad someone busted those sleazebags
     
  15. Major Attitude

    Major Attitude Co-Owner MajorGeeks.Com Staff Member

    Welcome aboard, dont be a stranger :)

     
  16. dabombk1

    dabombk1 Private First Class

    we salute you,ma
     
  17. wingnut

    wingnut Private E-2

    It's because of this diligence to excellence that I am finally, after months of watching, registering with this website (something I rarely do).

    MA, keep up the great work, you help keep us safe!!

    Thank You,
    Wingnut
     
  18. Major Attitude

    Major Attitude Co-Owner MajorGeeks.Com Staff Member

    Thats pretty cool, appreciate you registering, though lurking is ok too :)

     
  19. waxace

    waxace Private E-2

    Welcome Aboard!!

    Lots of good info here.

    Not everyone is perfect,

    but a lot of different opinions,

    You just got to sort 'em out.....
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds