Does anyone use the Excite.com startpage portal?

polonus · 2015-04-02T17:30:34.000Z

Hi laksrool,

You do not have to use Google Chrome. Same extensions also work on the Sleipnir6 browser.
When you use Sleipnir (the top Japanese browser) in your part of the world,
you have less exposure as malcreants are more familiar with Google Chrome.
Just a suggestion.

On the other hand I always use Google Chrome inside sandboxie and
after 5 days I cleanse to start a fresh sandbox install from exported bookmarks and settings.
Works fine for me and is quite quite secure.
The remainder of the laptop is cleansed with CCleaner once in a while.
Cannot remember an issue here.

pol

lakrsrool · 2015-04-02T17:32:44.000Z

bob3160 post:11:

Why would you remove chrome when a website you use has a security risk ???

The removal tool is to scan for problems with the browser and remove them if there are any, not remove the Chrome browser itself.

polonus · 2015-04-02T17:44:27.000Z

But just at this point the Google removal tool won’t help you. That is modern marketing policy for you.
That is the respect they pay to the end user and his privacy. It is non-existent and that is why what you do using their browser is still free!
You live in the days of everybody wanting to earn on those ad-bundling dollars, and jumping that band-waggon.
Not fifteen years ago.
This is the new legit and illegit industry and Google has turned a blind eye there.
Money is money whatever the clicks that generate it.
Be it benign adclicks or adclicks that will ruin the computer settings of the end-user.
That is the acctual factual situation we live in and you yourself have to bring the tools into position to block the developers and marketeers that want to score cheap money on unaware user clicks from doing what you do not want.
Come on, we aren’t Ripp van Winkles that been sleeping under a stone.

polonus

lakrsrool · 2015-04-02T17:53:57.000Z

polonus, so if my results using the “software removal tool” you suggested for me to use is “no programs found” then I should NOT have any concerns about what you referred to previously regarding a “sneaky browser hijacker” (a pop-up ads virus downloader)" as reported by the Zulu Zscaler scan report: -ak.imgfarm.com pop-up ads, RIGHT?

So then I’m “clean” in that regard?

Your more knowledgeable in the area of computer security than I’d ever even dream of knowing even if I had another entire lifetime a lot of which I have no idea what your talking about unfortunately, but I certainly do appreciate the help concerning what doesn’t go right over my head.

There is so much on computer security it is overwhelming for me as to what is the best way to go. Maybe I’ll try the “uMatrix” extension as it’s got good reviews.

lakrsrool · 2015-04-02T18:01:18.000Z

WOWEE, AM I A HAPPY CAMPER!!!

The Excite.com portal is BACK UP!!

Presumably their “server issues” they said the were having in a limited area has finally been solved. YAY!!

I am so glad it’s not an infection issue, but then I couldn’t see how it could have been impacting the Excite startpage for all of our 4 household computers all at once most of which we don’t hardly use at all.

I’m good again. ;D

bob3160 · 2015-04-02T18:11:45.000Z

Sorry, but some folks just seem perfectly happy wearing their blinders even if
the dangers have been pointed out to them.
Good luck and enjoy your homepage.

lakrsrool · 2015-04-02T18:21:47.000Z

bob3160, in case you’re interested because you were kind enough to refer me to another startpage option.

Attached is just a very small fraction of my ExciteStartpage which amounts to far less than just 10% of the entire page. The page includes daily reminders, as I said literally 100’s of bookmarks, news literally from any source you can imagine, quotes of the day, on this day, emails, dictionaries, words of the day and on and on like this, along with weather from as many locations as you want from anywhere around the world as well as searches, cartoons, games, news paper links from any where around the world, top box office, favorite columnists, movie listings from anywhere you set it up for, TV program reminders, entire TV schedule for any area you want that can extend for the next three weeks or more and on and on… The startpage seems virtually limitless in size and what can be included.

Like I said this attachment represents less than 10% of the entire page, but gives you a taste as to what you can do.

Addendum: I decided to add a second attachment just showing part of the TV listing that can be searched for the 3+ weeks.

lakrsrool · 2015-04-02T18:28:33.000Z

bob3160 post:26:

Sorry, but some folks just seem perfectly happy wearing their blinders even if
the dangers have been pointed out to them.
Good luck and enjoy your homepage.

I’ve been using this startpage since 1995 like I said (20 years now) and I’ve never had an infection due to it, not even now as it turns out it WAS a “server issue” obviously.

I’ll go with 20 years of no problems considering the efficacy of the start page. I suppose there are so many ways to get infected, I’m just going to be as careful as possible and use as safety measures such as Disconnect, NoScript, APB along with Avast, windows defender and Spywareblaster and hope for the best.

I’ve learned a lot as to what I can add to the Chrome browser (even though I rarely us it) because with all of the discussion here it became a concern for me.

But as it turns out, no infection, just a “server down” is all I’ve had problems with for now 20 years using the startpage, not a bad record if you ask me.

Considering I don’t likely have another 20 years, I’m good.

bob3160 · 2015-04-02T18:29:45.000Z

I can get all of that with the website I posted but it doesn’t have any security warnings.
I don’t use it as my home page because I don’t have the time to wait for all that stuff to load.

lakrsrool · 2015-04-02T18:44:55.000Z

bob3160 post:29:

I can get all of that with the website I posted but it doesn’t have any security warnings.
I don’t use it as my home page because I don’t have the time to wait for all that stuff to load.

Mine loads completely in 10 seconds, tried it twice just now in FF both times the same. I can live with waiting 10 seconds for the advantages of having everything I need at my fingertips.

Like as said, however, I do appreciate your recommendation. You ought to try the one you recommended Hubbley or something like that.

As to the risk with my page, I block everything with NoScript except the domain name itself, so for what it’s worth I presume I’m safe. Besides that I posted a number of security check web sites on the first page that all say my start page is SAFE. While maybe they are all wrong, I think just using the startpage every time I go on line for 20 years and without any issues is a record that sort of speaks for itself.

You’d probably be the first to say you can never be sure, you might try Hubbley and get infected in some way the first day, who can be sure?

All I can say is that while I’m sure there are risks with almost any thing you do on the web including my startpage, the 20 year record of not having any problems as a result of the startpage at least helps relieve me a little of all the anxiety you have raised in me with your well intended warnings (of which I do appreciate).

bob3160 · 2015-04-02T18:56:03.000Z

The actual warnings didn’t come from by but through others pointing you to links that showed the dangers of using
what you seem to want to promote.
I think you’ve gotten all the answers and warnings. Heading them is up to you. It is your computer.
I’m finished with this topic which has gone way beyond it’s needed length.

polonus · 2015-04-02T19:14:57.000Z

Hi bob3160 and laksrool,

Going into denial mode won’t work here as there is now another malicious external link detected via the latest realtime Zulu Zscaler scan: htxp://imgfarm.com/ex/excite.ico link Malicious
Two detections here: https://www.virustotal.com/nl/url/fac24ba63f394f55a623b8bc4e1a3c138501b35dde24aa3b399a231b3d23a12e/analysis/
Weight Watchers tracking going on.
WOT flags this with two reds: https://www.mywot.com/en/scorecard/imgfarm.com?utm_source=addon&utm_content=popup
Listed at Malware patrol.
Phishing and Scams galore!
This one has not been cleansed yet: htxp://ak.imgfarm.com/images/anx/anemone-1.2.7.js script Malicious

Verdict the website staff at Excite dot com should clean up their act and protect their visitors from clicking such external links period.

@bob3160 - what more arguments do we need to find to warn to shun that site until the scan reports come up crystal clear?

@laksrool - do not defend these actors on your favorite start page but abuse mail them that there are malicious external links detected on their website. One of the website they link to carries the risk of infection with viruses/‘driveby’ downloads/Trojans/backdoor bots, rogue programs (PUP’s) :o If their website was attacked and hacked, it is their responsbility to mitigate that threat.

polonus

lakrsrool · 2015-04-02T20:11:22.000Z

polonus - I’ve added Umatrix to Chrome, which I frankly don’t understand at all how to use it and what it’s doing is disabling all useful icons and illustrative images on my page.

I’m no different than the next guy and of course by all means want to stay safe, but if it means disabling a website to the point meaningful icons and other images that are frankly inherently necessary to the web page, then there must be a better way.

I always had “NoScript” block “imgfarm.com” in FF (since adding Noscript about 8-10 months ago) and I have a useful load of the page with all necessary icons and images loading just fine.

The way the page looks in Chrome using Umatrix, while undoubtedly safe it frankly looks like crap and much of the page cannot even be used appropriately by the user.

I tried the “Scriptblock” Chrome extension and it’s even worse seems like it’s either all or nothing, block the entire website or don’t block anything at all. As to “Scriptsafe”, the reviews weren’t that good many of which complained that it’s not nearly as effective or workable as the FF “NoScript” that apparently is an extension that Chrome offered at one time but now no longer offers.

If I could figure out how to have all of my icons and images load using Umatrix, then I’d go with that extension, but I can’t see a way to accomplish this using this extension.

I’ve enabled it because you’ve got me so paranoid (even though, I’ve never had any infections using the page for 20 years now).

At least, the fact that I usually only use FF helps since it works well with “NoScript”.

lakrsrool · 2015-04-02T20:57:32.000Z

OK, looking into it further, it is the “ak.imgfarm.com” site that Umatrix has to allow for the web page to be reasonably useful. So I see the problem. What is interesting is that “NoScript” is blocking “imgfarm.com” but apparently must be allowing “ak.imgfarm.com” because all the necessary icons and images do display in FF using “NoScript” and we find that “NoScript” doesn’t even provide a way to block “ak.imgfarm.com” apparently as this is not listed.

What I also find very curious is that when checking Excite.com using ScamAdviser Excite.com comes up 100% SAFE yet when you check individual elements of Excite.com i.e. “ak.imgfarm.com” using ScamAdvisor it comes up the exact opposite 0% SAFE

So I have a question, what is the method that this “malware” infects ones computer?

Thanks to polonus providing valuable information we find out that “http://imgfarm.com/ex/excite.ico” is rated as “malware” on the Virus Total when checking this site.

So what would mean is that I’ve been using a startpage that is essentially a product of “malware” because these images have been a part of that webpage since it’s inception. So based on this every time I’ve been on the Internet I’ve at all times always had a “malware” site on my computer the entire time I’ve used the web (and on the web probably 8-10+ hours a day).

So then since I’ve never been infected, or at least I see no ill-effects and the “software Removal Tool” for Chrome found nothing, how is this possible?

Or are we talking about a “potential” risk via an attacker that can exploit this “malware” website so it’s just a matter of luck.

I ask because I’ve always thought in terms that a “malware” site is something designed to inherently attach the computer as this the the purpose of the “malware site”.

But if it’s instead a risk of a hacker exploiting the site because it is easily hacked then can’t security applications prevent this from occurring i.e. AV applications and/or Firewalls etc?

Bottom line, I’ve never considered myself very lucky in the least, and if I’ve been using a website that amounts to essentially “malware” for 20 years now it frankly seems odd that I’ve never had a problem all of this time.

polonus · 2015-04-02T22:52:31.000Z

@all reading this thread,

About the use of Umatrix. The issues that should be blocked are blocked as by default in the extension. Sometimes you should unblock certain red marked default items to get full functionality of a particular page (consider the risk involved and jump when you think you can leap) - the great thing about the extension is you can additionally block items on the website after you have made a decision what should be additionally blocked. Just like with NoScript you should know where and how to grant access (allow). For advanced users you get almost complete security control that way - as all scripts are also being blocked by ScriptSafe by default (allow what you need for functionality on a known potentially secure page). When in doubt report here in the forums and we will find ways to give you some full report on what security/insecurity status a page has (at that moment) to the best of our knowledge from third party cold reconnaissance scanning results. For this Avast forum page where I add this posting in this very thread unblocked is forum.avast.com with 1 cookie, 1 css, 43 images, 2 scripts (green).

Blocked by Default is the tracking from google on google-analytics dot com and 1 script from www.google-analytics.com (a script you may allow as avast uses the info for user protection info purposes, while on the other hand google sits on that very data heap).

You want facts about in-browser security and how to bring that forward, we try to give you these facts from our years of experience as a volunteer website security analyst (with profound thanks to all here that help me achieving this, and those that do know who I mean here).

polonus

lakrsrool · 2015-04-03T02:15:47.000Z

Absolutely correct that just about any website on the net will need a good portion of adjustments made using various script blockers just to get the site to even work at all.

A good example involves just the simple website “mapquest” which if using “Umatrix” will need 9 scripts enabled just so the website works that are blocked by default using “Umatrix” and of course unless you want to always have to enable these 9 scripts every time you use “mapquest” when you find it’s not working at all you’ll want to “lock” this “temporary” setting in for that site (scope) so next time the site works up front. Obviously it can be very time consuming surfing the web just to try and be safe and to be honest far to daunting for the “casual” user, but that’s the way of it unfortunately. There is frankly a lot of trial and error just to find out what needs to be enabled and what doesn’t need to be enabled as far as all the blocked items.

After awhile you get to the point you want to just enable them all for the time being to just get done what you want done at the time. This is to some degree the advantage using the FF “NoScript” which allows the user to either “temporarily” enable specific items but more importantly as risky as it might be when sites have literally dozens upon dozens of blocked sites the user can “temporarily” enable “all this page” with just one click which of course is not necessarily very SAFE and as such probably not advisable but at times I find myself doing this now and then just to accomplish something I need quickly in the knowledge that the setting is just “temporary” and will revert back later. Of course on can enable all the sites in “Umatrix” but it’s more time consuming because each needs to be enable individually in groups, which in some ways maybe arguably better because it conceivably forces the user to be more safe with less global automation at their fingertips. The Chrome “Umatrix” does have a nice feel about it as well however. I also find that “Umatrix” will default a lot as enabled so in some cases websites will be more functional than other script blockers that block everything from the start by default, but then safety is the trade off I suppose. All this security frankly takes a lot of fun out of surfing the web for the “casual” user which clearly makes these script blockers seem annoying to these these type of users not to mention totally confusing in many respects as well.

I would add one last thing that’s nice about the FF “NoScript” and that is the user can “middle click” any blocked site and get 6 different security reports on that site which can then be “enabled” or not on that page which is a helpful feature provided by the FF “NoScript”. Also even if you want to Allow “all scripts globally” (not at all advised), or your just Allowing “all this page” for the time being “NoScript” still retains several areas of security anyway like in the case of Anti-XSS protection, HTTPS enforcement, Clickjacking protection and ABE which are all still in effect regardless which is another helpful feature of the FF “NoScript”.

polonus · 2015-04-03T09:02:02.000Z

First and foremost, script blockers are good instruments in the hands of those that know what sites to block or rather keep blocked and NOT use the full functionality there. The rule should be leave all blocked until proven to be secure to unblock or known to be safe.
And how would one know where one could toggle and where not. There are many indicators as where to not venture out. I see a site alerted by Google Safebrowsing and/or Yandex blacklisted, I am interested to know why (that is why I do what I do), but I decide to not go there directly or circumvent the Google blocking, also when Google says my connection is not private and attackers try to intervene, I won’t go out there and nicely keep such sites blocked. ScriptSafe red, Umatrix enabled. Lift third party links only if you know these sites to be clean, curiosity killed many a cat.
Now sometimes with a clean site we have to allow some additional functionality to make that site function. At urlquery net for instance you have to allow google-analytics.com else you will not get the scan results. This Norse scan site may have issues as I find: HTTP Server: Apache HTTP Server 2.2.22 (Outdated)
Operating System: Ubuntu 12.10 (Quantal Quetzal) (Unsupported)
PHP Version: 5.4.6-1ubuntu1.8 (Outdated)
This indication does not need to be the final word as some website admins put out an outdated server version to mislead eventual attackers. But on all instances it is a better server policy just to make the server header version and other extensive info is not spread globally and to hackers, and whenever a website or server admin knows what he is doing he knows how to adjust his server configuration. Alas many do not, are incompetent securitywise and this means a threat to the website visitors and themselves. There is more to this than one would think. Whenever I see a warning for a website because of malware, scam, fraud, phishing from WOT and very much when there is a user report from someone who knows what he/she is reporting or from third party listing (malware resources) I won’t even consider visiting such a site. Red ball from Bitdefender, don’t even try to go there, DrWeb URL link checker detections, a big no-no. Sites on their malicious website list, do not venture out there.
And the Avast block when malscripts are detected has not been equalled by none, it is very accurate. Blocked do not go there.
When you want to know why - ask in the virus and worms section and some of us may know.
There is a remote chance of FPs but as a rule I only visit and allow non-flagged websites. And always remember the clean site of one minute ago can be the malicious site of the next minute. There are much more aspects to this, but the above is a good thumbrule for many that are advanced users and want to use script blocking and request blocking.

polonus

polonus · 2015-04-03T10:10:22.000Z

Just a difference I have found with uMatrix and HTTP Switchboard is that uMatrix won’t any longer block Google Analytics on certain sites. The same issues why I would prefer uBlock over ABP adblocker. Some developers agree to Google tracking circumvention in order not to be confronted with Google disabling their extension, banning them from their store because they interfere with their main income frame. My tip use both extensions HTTP switchboard next to uMatrix.

On androids Google even went so far as to disble ABP apps completely, as they felt they had enough monopoly to enforce such a protective measure.

Again the install of uMatrix is only a suggestion. Not a lot savvy users would consider to re-think where this suggestion stems from. This is also the reason that NoScript could never come to Google Chrome as google would not allow the developer enough access to make it function on Google Chrome (api-layer access that is). Protecting your privacy and take anti-tracking measures gets harder and harder to perform and the average user has long lost that battle. Who, like I do, is blocking canvas fingerprinting on youtube sites? Yes, Google performs sneaky canvas fingerprinting there, which is not very accurate but combined with other tracking, ad-tracking and widget tracking is quite effective. There is an extension to block this, but I guess not a lot of users have it installed. So the going gets narrow, folks.

polonus

bob3160 · 2015-04-03T12:08:16.000Z

Why are we getting totally off topic ???

polonus · 2015-04-03T13:26:50.000Z

Hi bob3160,

We are not totally off topic as we explain what are the security risks involved with visiting the Excite dot com portal and what extensions we can use to be fully aware of those risks and block the links we want to exclude. First we established that the excite com start page has issues and third party links that we should block, then we explain to the readers of this thread how to protect themselves from inside their browsers and that needs some explanation to do. Those that aren’t advanced enough to use script blocking and request policy toggling should leave this thread for what it is.

polonus

Announcements