Security

Ask something
Discussion Locked

Spyware

0 helpful
140 replies

by pctech 2 views

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

This is page 2 of the discussion. Read the opening post

140 replies

by jrats_revenge

You, my friend don't seem to have any direction whatsoever in your posts. From your participation in the previous posts above, I should have known better than to expect something of clarity come from you. Instead of knocking AOL, Christianity, Goverment, and MS IE, why not try a novel approach and make additional comments about this discussion that make a contribution. In my opinion you are just another holier-than-thou DLU.

by bhunsinger

Great to see an answer that does not involve the answer that only mechanics should wash cars and change CDs. We have a lot of that comming into the shop now also. Three months ago, we were advising customers that NAV 03 was adequate, now we offer Norton AV 04. It may not remove them all, but it does a good job of finding them.
Also, I have a seperate issue with AdAware; it seem to ad its ownere spyware when installed-that 180 thing. Comments? I especially liked the comment about Kazaa and other programs not being free while using shareware like spybot and adaware!
Finally, whatever you use, I have discovered that running it in safemode greatly enhances the programs ability to find and remove this stuff. I now routinely set IE to delete temporary intternet files when closing and install the google toolbar to stop popups. Deleting cookies can help as well.

by jcp

offersmoo, I think your response, if it was to my comment that Education was necessary (as it's title implies) is not really following what I said.

I did not imply that users need to be trained to to become responsible for fixing, or trouble-shooting their computers.

All I said was that there is more education necassary, partly because the primary OS that is used (Windows in it's various versions) needs more Training/Education than most users have.

I also said that Microsoft could be a little more helpful in making life easier for ordinary users when it comes to keeping spyware, and virues, off their desktop computers.

Please do not put words in my mouth as you submit your comments.

Thank you.
John.

by rdondelinger

known spyware entities. Immunize feature stops re-infections. But as was mentioned earlier, stopping KNOWN spyware is only part of the battle.

We are starting to incorporate the Google Toolbar as well to prevent pop-ups. All this on top of Symantec Antivirus Corporate Edition.

And yet, there are those few PCs I have to re-image to eradicate some really nasty spyware that I've come across.

- Ron

by howards

There is a way to stop spyware from being a problem. Have you ever considered that spyware like viruses generate income? If you want to know how to help this situation feel free to email me directly.

hcohen

by jagibbo

Lavasoft is currently developing an enterprise version of AdAware that will allow IT to remotely control and protect PC's from spyware, much like Symantec's System Center Console. Lavasoft estimated that this product will be available by late 3rd/early 4th quarter of next year.

by kaldanzia

This would be awesome. I know that approach has worked around here with an issue we were having with our state Department of Transportation a couple of years ago. The workers at one of the road construction areas were putting up roadblocks during rush hours, and causing all sorts of traffic problems due to lack of common sense.

The mayor got really mad and put up a huge sign (right where everyone sitting in the jams during rush hour could see it and call on their cell phones) with the state DOT commissioner's personal phone numbers (including cell) to call for complaints (the mayor had tried everything else to get the problem solved). It was absolutely amazing how quickly things straightened up.

Maybe he should be in charge of the war on spyware?

by bmacleod

Ok, ok, so some spyware technically tells the user what it is going to do, buried deep within the EULA. Bottom line is it is rare to find someone who would really install this stuff if they really knew what it was going to do. Since this is code that is doing something that it wasn't "supposed" to do, it is malicious code in my book. As such, I pay huge amounts of money to Trend to stop viruses. Lately, they only tell me about some of the spyware without successfully keeping it off the system. HEY AV COMPANIES! Do your job and keep unwanted code off of my boxes as promised. And don't even think you can charge more for a different module or program to accomplish this task. If your software was doing what it was supposed to do, the spyware shouldn't have been able to be installed. In this regard, I think spyware may be the downfall of the non-progressive AV companies.

by noorman

I am using 'Spybot Search & Destroy" for a long while now. Very recently I came accross this one though 'PAL Spyware Remover' (www.palsol.com) that seems to find Spyware that others don't: f.e. a 'Cydoor Adware' in a version of CD_CLINT.DLL (KazaaLite) that wasn't reported before and a 'LimeWire Spyware' in a USERDATA.DLL of another program.
It even detected a 'LimeWire Spyware' in the popup.exe of Popup-Stopper ...
In total 13 items on my main rig after all other programs had done their thing !

It only isn't 'FREE', like the formentioned 'Spybot' and others.

by g.m.bakker (cne, self employed)

I'd prefer to hackem to death, attack their service and services. And when you do get in, clean the disk and rewrite the pasword, even worse start a task that will destroy the machine. Preferably after office hours, just before the weekend so you have plenty of time to take the gut out of the machine....I tell you, this does work. Another thing that works is getting something on their system to gain continuous access to wipe out incoming mail instantly. Just Hack'em to death!

by nixon_public

There is NO keystroke that cannot be programmed in. WinVNC & Symantec PCanywhere both have "soft" CTRL-ALT-DEL available on the remote menus to access the host PC taskman.

by g.m.bakker (cne, self employed)

Sure it generates cash, but it's not the way to come about. I am sure some customers complain, since they didn't know what hit them. I try to keep it simple and help them for a special fee if they bought from me, however I still feel like someone broke into my house. I'd rather shoot the criminal than have to replace the locks every week, and believe me it will get worse and worse if we don't kill their business, which is less effort! There's nothing better than a dead spammer on the BarBQ

by g.m.bakker (cne, self employed)

Yeah almost the same stuff, add winsockfix just for repairing the IP stack after some malicious code screwed thad up. I also have a usb stick with a write lock, just because som virus caught me there and washed it clean (infected every executable) I still think we should try and hack their sites just to piss 'm off. Earning money this way is like running a funeral arrangement, it's not fair!

by g.m.bakker (cne, self employed)

Yeah almost the same stuff, add winsockfix just for repairing the IP stack after some malicious code screwed thad up. I also have a usb stick with a write lock, just because som virus caught me there and washed it clean (infected every executable) I still think we should try and hack their sites just to piss 'm off. Earning money this way is like running a funeral arrangement, it's not fair!

by paymeister

Why bother? The post I was replying to made a remark about government intervention in the spyware problem. My post was using a religious and political situation to illustrate how heavy-handed even a probably well-intentioned intervention can be. If this is what happens at AOL, government involvement would surely be worse.

Sorry for wasting your time, for wasting it reading THIS post (though I DID label it), and for appearing stupid or (worse) as though I really WAS trying to start an off-topic thread. I'm fairly new to these discussion groups, and have been flamed badly for poorly-written but well-intentioned posts.

by paymeister

Bots? I'm afraid I don't know the term. I assume that you're calling me a robot that mechanically dumps out various versions of prior religious programming.
1) Please see the "Defense" post, above.
2) Please re-read your own post - did it contribute more or less than mine did to this sub-thread regarding legislative involvement?
3) Consider your own response in terms of the "bot" definition above - sounds like you're at least as robotic in your desire to dump on me.
4) How 'bout re-reading my post? I really WAS trying to make a point about intervention, and I really WAS trying to avoid creating a religious discussion. (Frankly, I'm sick of BOTH sides of the shallow religious rants on these forums.)
5) Sure, my world-view comes out - that's who I am. I expect you to voice your world view, too - it's who YOU are. But I won't post without there being some credible link to the discussion at hand. Anything else is discourteous and, in case you are interested in some religious support for your flames, a violation of the Ninth Commandment (false witness), in that I would be falsely implying that my comments have something to do with the technical issue at hand.

Bottom line? Sorry I stepped on your toes. I'm doing my best not to, and thought I covered myself better than I really did. My fault. -Tim

by head-tech

I don't know what is so hard about having an internet browser that just runs within itself and doesn't touch your working machine. A browser is for surfing web sites and if you need to download something use FTP.

Personally I've given up on trying to fix my system so I installed a clean copy of XP and I then installed virtual PC and then installed a clean standalone copy of Windows 98se as a session. I use the latest updated version of IE6.01 and Outlook express as well as NAV. When I want to cruse the internet I start a virtual session and go for it. When I finish I just close the session without saving it and the next time I start up its back the way it was when I configured it. Anything that I want to save goes to my CDRW. Since this session is on a seperate network than the rest of my local network it has no way of interfering with it.

By the way having an old Win98se system around allows me to play some of the old games that are still fun to play.

by krogelr

I also employee this method. VMWare is about a $200 download. It started out as a way of keeping a lab of servers from heating my house but works very well for a security tool. Most users can't afford this but under some circumstances this is the best method to use bar none. Even if the virtual machine does get trashed it is easy to have a static backup running in minutes.

by kimscomputing

While I too am tired of viruses and spyware. It must be a big chunk of the technology economy. Nobody buys much software any more but everyone buys anti-virus software. Removing it is a good part of my business. It is sad that it has come to this but right now spyware and viruses are big $.

by eriksblues

It is interesting to read all these comments as XPSP2 is downloading. I presently work in graphics and we use 4 whole computers (essentially a home network setup). Access to the internet is a must...and with it comes spyware, malware, viruses, and whatever else. Desktop Publishing software is expensive, along with the mandatory Microsoft Office (clients use it). With every operating system upgrade it has gotten more and more expensive and the so-called "free" adware/spyware/virus removal programs don't cut it (even in safe mode). Because of compatiablity issues(client needs) one machine has to run Windows 98SE, the others XP. This makes for fun. I used to work for a company that built laptops and would rather deal with the issues of simply building systems than keeping them operating (budget restraints lol). It is great to hear Lan Adminstrators express their knowledge. But small operators and home users are also being hit hard and they do not have the knowledge base that administrators do.

by mustang221

The number one method to avoid spyware packaged with "free" software is to read the fine print, also know as the EULA. You can't read assume that it's the same old verbage of "we're not responible for any damage..." I see the EULA when going to some web pages on the dialog for Active X controls. If you get tired of it, stop going to that web page.

by rrandor

I know nothing about the technology involved but wouldnt a server solution be a better approach than relying on thousands of individual users? In other words have the servers scan their internet traffic for viruses, spyware, etc. It would slow down traffic but the savings in time for each individual who doesnt have to clean their machine, would be tremendous. Users could pay a little more for their ISP handling the problem for them.

by smartstuff

I too have had problems in the past with Adware, mainly. But also Spyware. I think it got onto my computer when I installed Kazaa.

After using a Spyware Remover (from http://noadwares.1found.com) the problems along with the Spyware and Adware were gone!

AND I'm still running Kazaa.

by shawn_wood

I only use firefox at home and I do not get any pop up windows! I have even gone a step further at home and use a smoothwall firewall with an adzap mod that kills a very large percentage of adds at the firewall so even if I used IE, I would not get many ad's and pop ups. The combination of this mod for smoothwall and firefox, I have yet to get spyware! I scan once a week and the only thing I ever find are cookies. I have also started editing the host file for some of my more "internet happy" users and that seems to help a bit. I am trying to get a company wide rollout of Firefox.

by tutor4pc

Game over - the PC is a waste of time and a danger to companies. That is the view of an old hacker - involved in microcomputers since they exist and in mainframes befor that and parallel to the PC craze. Forget this darn internet and create safe networks. Don't patch the current mess: It's useless. Rethink the best approach. Employees in general are not loyal and look for their own satisfaction. Give them a finger and ..... Only a tightly controlled environment will do. That can also repel terrorists threats.

Just listen to an old guru - you won't regret it.

Jo

by black_eyed_pea

Spyware Removal Checklist

1. Boot into Safe Mode with Networking (some spyware can only be removed in Safe Mode).
2. Open Add/Remove programs and remove any application that both you and the principal user do

not recognize or deem to be spyware.
3. Launch HijackThis and click the Scan button. (WARNING: Reference the HijackThis tutorial

at www.spywareinfo.com/~merijn/htlogtutorial.html before removing anything.)
4. Install Spybot Search & Destroy, update it, and run it on the infected system.
5. Install Ad-Aware, update it, and run it on the infected system.
6. Reboot and run both Ad-Aware and Spybot again until the system is clean.
7. Launch Internet Explorer and browse the Web to verify Winsock was not broken while removing

spyware. If you cannot browse the Web, run the WinSockFix utility and perform another Web

test.

Spyware Prevention Checklist

Consider using Firefox for all web browsing unless functionality of business critical web

applications require Internet Explorer. If you can use Firefox exclusively, then steps 2, 3,

5-9, & 11-15 still apply.

1. Open Internet Explorer, click Internet Options, click the Security tab, and click Default

Level on each Security Zone.
2. Install all Windows Critical Updates.
3. Install Spyware Blaster and click the link to Enable All Protection.
4. Install a recognized popup blocker such as the Google Toolbar.
5. Either manually disable the Messenger service or run GRC's Shoot the Messenger applet.
6. Either manually disable the Universal Plug & Play service or run GRC's Unplug & Pray applet

(Windows XP Only).
7. Run GRC's DCOMbobulator, click the DCOMbobulate Me! tab and then click the Disable DCOM

button.
8. Execute DSOStop2 and click the Protect Internet Explorer button.
9. Execute HTAStop and click the Protect Internet Explorer button (Windows XP Only).
10. Install IE-Spyad.
11. Run GRC's SocketLock utility.
12. Test browse the Web.
13. Rename the default Windows Hosts file located at %windir%\system32\drivers\etc and place

the Gorilla Design Hosts file in the same directory.
14. Test browse the Web. If it is significantly slower than the first test, do not use the

Gorilla Design Hosts file.
15. Educate the principal user on Internet best practices.

Ad-Aware - http://www.lavasoftusa.com
CWShredder - http://www.spywareinfo.com/~merijn/downloads.html
DSOstop2 - http://www.wilders.org/downloads.htm
Firefox - http://www.mozilla.org/products/firefox/
Google Toolbar - http://www.google.com/options/index.html
Hosts File - http://accs-net.com/hosts/get_hosts.html
HTAStop - http://www.wilders.org/downloads.htm
IE-Spyad - http://www.pcworld.com/downloads/file_download.asp?fid=23332&fileidx=1
Shoot The Messenger - http://www.grc.com/freepopular.htm
SocketLock - http://www.grc.com/freepopular.htm
Spybot Search & Destroy - http://www.safer-networking.org/en/download/
Spyware Blaster - http://www.javacoolsoftware.com/spywareblaster.html
Unplug & Pray - http://www.grc.com/freepopular.htm
WinSockFix - http://www.spychecker.com/program/winsockxpfix.html

by jsandvick

A tool that I didn't see listed is Webroot's Spy Sweeper. It has a "Shields" section kind of like Spybot's Immunize. It seems to find alot of stuff that the others don't find. So far, we take a layered approach here in running multiple tools.

I think Spyware guard and Spyware blaster are both made by the same company if I remember correctly. I think it is javacool.

I also use AvantBrowser just to be able to control all of my browser activities like pop-ups, scripts, etc. from one place. Even though it is basically just IE with some toys added, it is pretty good. It(the browser) seems to hang once in awhile but it comes back within 30 seconds or so.

MajorGeeks is a good tools site.

by black_eyed_pea

They don't regularly update it or at least they don't release the updates very quickly. The last release was in February of 2003.

I have customized and added host entries myself whenever I browse the web and see an advertisement come through.

by black_eyed_pea

Ronald,

I included a list of tools within my post yesterday. If you haven't looked it over, you might want to now.

I agree there needs to be one highly-reliable, enterprise tools for malware prevention and removal. Until then, we have to brainstorm with one another and improvise.

by psx

Purchasing a corporate filtering software such as Websense will help you restrict access and, with the latest versions, block certain network protocols from being used by certain clients and/or sections of your network.

I do use Spybot for my home and company network but deploying and maintaining this software on a corporate network is such a pain. Hopefully AdAware Corporate edition will help once it comes out.

by joeandre1

Maybe I'm Crazy here but I've read of Crazier souls out there. I'm running XP Home with NO Updates of any kind, Panda AV, built-in XP firewall, Spybot to initially destroy spyware, and Spywareblaster to completely keep them out since Spybot doesn't keep Anything out. Without Spywareblaster just 24 hours after getting rid of them they're all back in full force. As far as I'm concerned Spywareblaster is the most effective tool out there in this war.
In 3 months time only (1) has gotten by but it's never been back. And concerning Updates I re-installed XP 3 months ago to get rid of all the garbage we seem to collect over time, and have never installed even one of them, and my computer has never run better.
Personally I think the biggest breach of our personal privacy and security, is the fact that untold numbers of people out there know your name, address, s.s.#, yearly income, and All has been led to believe that they can safely do business over the internet using their credit cards. Sure their numbers may be somewhat safe being delivered over the web, but how safe is it once it gets there. You might not trust your kids with it but here you are blindly trusting a total stranger with the keys to your bank account.
And doesn't anyone ever wonder why these online companies absolutely insist on you using one or you don't get what they have to sell. For instance, I don't and won't use credit cards for many, many reasons and last month I tried to purchase access to an online radio station. Can you beleive that they actually refused me even after offering them a full years payment , in advance with a Cashiers Check ? I don't know about everyone else but it really makes me wonder what they are really selling here. Think about it. Joe

by parisok1

The problem especially on a large network is when the offending hand and the problem users are all way above you in the food chain. Without support from the top the problem can never go away due to inability to enforce the rules.

by ssaady

As effective as hosts files are with ads, they seem a little less effective at blocking spyware, because SW is a more dynamic field.
It seems DNS was invented to streamline hosts files. I just downloaded Gorilla Design Hosts file. The thing is over 500k.

It seems to that any software that does not have a very noticeable and voluntary installation and privacy notification should have it's own DNS domain. I know that may sound radical ...

by ghlbeyerlein

I've used Ad-Aware and Spybot with a lot of success, as many others have. I use Spybot's IE Tweaks & Teatimer to lock down the Internet Options window and to check to see when a new program is installed.

At work, our OCIO does a pretty good job at keeping the machines free of viruses and ad/spy/mal-ware, but as was mentioned in another reply, the laptop users could bring a lot of snasties in.

Most frustrating part to me is that I can clean a system on Monday and by Friday, it's loaded again. Even with setting the Pop-up and Ad-blockers in Firefox and Avant, they still manage to get through. The Yahoo, Google & Alta-Vista toolbars do a nice job too for those users who won't use anything but IE (not an SP2 shop yet).

Anyone know if there is a way to set Ad-Aware & Spybot as regular tasks in Windows? Probably looking right passed it (feel free to bonk me upside the head and point to the big red button - Set as regular task). Might be easier to keep the boxes clean if the two run at regular intervals.... Then again, that may just scan for the snasties, not clean them out......

Thanks for the Discussion topic Mike. It's been a big issue with my family's computers and my colleagues' home computers.

Not to advertise another forum, but CastleCops.biz (formerly ComputerCops.biz) may be another good place to look for discussions on ad/mal/spyware: http://castlecops.com/.

- Greg

This discussion is closed to new replies.