Backdoors? AdWare? Worms?

[abuzant3d]

HI,

on my box, i have installed many proxy servers and filters that guarantees that i see nothing bu the things i want to see when surfing theweb, i block banners popups javascript and tons of other things that suck. A coupleof days ago i started digging into my logfiles and noticed many requests made by some software to strange URL's and accessing the web in a smart way without my permission for this, i will be here posting some of these URL's maybe somebody can help me identify them or help me with any information regarding this topic, take a look.....

http://ads8.speedbit.com/cgi-bin/ads...NR=3&SI=0&KA=1
[connects once each 15-20 minutes]

http://cb.icq.com/cb/icqsrp/545/srp....colc=4colerr=5
[connects every 30 seconds]

http://cb.icq.com/cb/icqsrp/545/srp....eon=1640flow=1
[every 30 seconds - 1 minute]

http://toolbar.google.com/version?dl...5.00.3502.1000
[two times in 24h]

http://www.siber.com/roboform/versio...ALNKKLBNKLHKKL
[Undefined Refresh Time, Appears 3-5 Times Weekly]

http://www.hit4hit.net/banner4.php4?...l=400x40&sub=1
[PS.. 404 error, no such domain, but returns 200 HTTP/1.0 code]

http://idn.verisign-grs.com/plug-in/...2003&encoded=0
[many times daily]

PS>>
i have update feature turned OFF in all software, so anyway these connections are made without my permission, is this legal, do they have the right to do so??

[meister]

http://cb.icq.com/cb/icqsrp/545/srp...6colc=4colerr=5 and http://cb.icq.com/cb/icqsrp/545/srp...40fl
something from icq (as the adress sais...). icq has to connect every minute to check if users are online, etc.

http://toolbar.google.com/version?d...=5.00.3502.1000
google sends an identifications string if you post a search request with the toolbar.

http://www.siber.com/roboform/versi... ALNKKLBNKLHKKL
roboform toolbar.completes forms in websites.seems to be only a version information for update

hit4hit.net seems to be a banner for websites

http://idn.verisign-grs.com/plug-in...02003&encoded=0
some software to translate webadresses into your language.
(see at: http://idn.verisign-grs.com/index.jsp)

if you turned update features of there should normally be no connection regarding the version info from the software. whether it is illegal or not i cannot say. you can't just say its spyware. it could also be that this information is used for statistics (i think google does this.)

[abuzant3d]

Hi again...
i of coure would say thanks for this, but i knew before posting the thread what each of them is, and here is a correction for the information you posted ....

Originally posted here by meister

http://cb.icq.com/cb/icqsrp/545/srp...6colc=4colerr=5 and http://cb.icq.com/cb/icqsrp/545/srp...40fl

something from icq (as the adress sais...). icq has to connect every minute to check if users are online, etc.

Nope, ICQ do NOT use HTTP to check online users status.

http://toolbar.google.com/version?d...=5.00.3502.1000
google sends an identifications string if you post a search request with the toolbar.

Nope, that is a different one, the identification string looks like this...
http://216.239.57.104/search?client=...hread%2Ephp%3F



http://www.siber.com/roboform/versi... ALNKKLBNKLHKKL
roboform toolbar.completes forms in websites.seems to be only a version information for update

hit4hit.net seems to be a banner for websites

this is right, but i am interested what program software is it attched to on my PC, maybe a SpyWare or an AdWare ?

http://idn.verisign-grs.com/plug-in...02003&encoded=0
some software to translate webadresses into your language.
(see at: http://idn.verisign-grs.com/index.jsp)

The Same As Above...

if you turned update features of there should normally be no connection regarding the version info from the software. whether it is illegal or not i cannot say. you can't just say its spyware. it could also be that this information is used for statistics (i think google does this.)


------
Andonemore important thing, is this action by service providers or vendors considered legal ?
Thanks In Advance...

[meister]

o.k. thanks for the correction and sorry for the false information
i got curious and did a research for the icq thing.
on this site they propose to put cb.icq.com in the host file. (see here: http://www.cexx.org/icq.htm)
the hit4hit adress seems only to be a pay per click banner site. i didn't find any information refering to an software.
the last one verisign is a plugin for internet explorer. verisign should not promote spyware, but if you don't need it uninstall it. (see under 5) : http://www.idnnow.com/faqs.jsp)

[abuzant3d]

yes of course, thanx...
i also am working on this for a couple of hours already, and i discovered what the verisign one was...

it is a russian domain name translator, try this nice looking link
www.êèåâñòÃ*ð.com

the mentioned plugin translated this name to www.bq--aq5dqnjsifbdaqa.mltbd.com and serves the request....