AdultFriendFinder
money viewers
   AlmondNet / ProMarket    
money viewers
ZenoTecnico

Zeno Showing Unrequested AdultFriendFinder Popup
Spyware Showing Unrequested Sexually-Explicit Images - Ben Edelman

This page gives a screenshot and packet log reporting a ZenoTecnico ad display on May 25, 2006. Additional discussion.

Screenshot

The popup below appeared as I browsed Findromance.com (a window which I closed, along with various other unrequested popups, before I took the screenshot).

The screenshot has been edited to cover sexually-explicit areas.

Packet Log

Packet log analysis indicates that ZenoTecnico (spyware installed on my test PC) (yellow) observed that I was at the FindRomance site (green). Zeno instructed my test PC to display an ad (blue). If I clicked on the ad, my click would be counted by the pro-market ad system (pink), before I was sent on to the advertiser (AdultFriendFinder, red).

GET /engine?site=104872+page=$312$+space=7050+size=1x1+kw=FindRomance.com: Romance:Love:Couple:Passion+domain=www.findromance.com:www.google.com: net-offers.net+linktarget=$_top$+rnd=(20346) HTTP/1.1
Accept: image/gif, image/x-xbitmap, image/jpeg, image/pjpeg, application/x-shockwave-flash, */*
Accept-Language: en-us
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1; {B67536BD-C7AB-E94F-9C19-...})
Host: pbid.zenotecnico.com
Connection: Keep-Alive
Cookie: ...

HTTP/1.1 200 OK
Server: Microsoft-IIS/5.0
Date: Thu, 25 May 2006 05:40:21 GMT
ANServer: Q15
P3P: CP="NOI DSP COR NID CURa ADMo TAIa PSAo PSDo OUR SAMo BUS UNI PUR COM NAV INT DEM CNT STA PRE LOC"
Pragma: no-cache
Set-Cookie: ...
Cache-Control: no-cache
Cache-Control: no-cache="set-cookie,set-cookie2"
Connection: Keep-alive
Content-Type: text/html
Content-Length: 612
Expires: Mon, 1 Jan 1990 0:0:0 GMT

adType=6
HTMLSTART
<table width="720" height="100%" border="0" cellpadding="0" cellspacing="0">
<tr align="center">
<td colspan="2"><a href="http://pbid.pro-market.net/engine?site=104872+page=$312$+space=7050+link=$62800-53921-0-4=8z:1s=1$+goto=$http://www.adultfriendfinder.com/search/p255337.sub720x300_12114&show=f&age=$" target="_blank"><img src="http://ads.pro-market.net/ads/20/31/77_720x300_12114.jpg" width=720 height=300 border="0" alt=""></a></td>
</tr>
</table>
HTMLEND
WindowProps=width=720,height=300,top=30,left=30,resizable=no,scrollbars=no,status=no,toolbar=no,menubar=no
PopUnder=N
END