Is Spyware Getting Worse by the Minute or Am I?

[livius drusus]

I've had the worse time clearing up spyware infestations lately, and I've got all the tools and gizmos you can imagine, too (including, before any of you elitist nerds give me shit, Firefox.) I'm down to hand searching the Microsoft folders in the registry to hunt down the more persistent fuckers, and half the time there's still some little nasty hovering around.

What exactly are these things anyway? How do they get installed? I swear they don't need stray clicking on pop-ups anymore. What kind of prevention and cleaning tools do y'all use? Is it getting worse for y'all too or am I just a pathetic loser?

[Dingfod]

Is Spyware Getting Worse by the Minute or Am I?

Yes.

[Ymir's blood]

Originally Posted by livius drusus

Is Spyware Getting Worse by the Minute or Am I?

Well if given a choice between the two, I'd have to go with the former. You seem to be improving constantly.

I need to do something on my system. The antivirus I'm using now won't let Adaware work and I've kept putting off finding something that will or going back to the other AV program. I thought it sucked but it wasn't half as bad as the PoS that is installed now.

[freemonkey]

Originally Posted by livius drusus

I've had the worse time clearing up spyware infestations lately, and I've got all the tools and gizmos you can imagine, too (including, before any of you elitist nerds give me shit, Firefox.) I'm down to hand searching the Microsoft folders in the registry to hunt down the more persistent fuckers, and half the time there's still some little nasty hovering around.

What exactly are these things anyway? How do they get installed? I swear they don't need stray clicking on pop-ups anymore. What kind of prevention and cleaning tools do y'all use? Is it getting worse for y'all too or am I just a pathetic loser?

Are these things that keep coming back after you've cleaned them or new ones all the time?

I don't have a concrete answer for you, but I had some recurring stuff awhile back, so maybe just look into the following:

Check to make sure you've got rid of the Microsoft spyware, most notably something called Alexa, which will come back if you update MS products.

Check to see what cookies you accept. Before I blocked most cookies, it seemed as though my internet provider was providing cookies from third party ad trackers, which showed up when I ran AdAware.

I found & killed a bunch of stuff when I ran HijackThis, a registry cleaner or two and a utility that tells you what processes are running in the background.

This was all over a year ago, though so I can't tell you step by step what I did, or exactly what worked how and why, but I hope you find something useful in all this.

[viscousmemories]

I have no issues with spyware and never have. Which is to say I've run AdAware and it found and deleted things for me, but before and after I ran it I wasn't aware of spyware having any impact on my life.

[livius drusus]

Lucky bastard. I've seen IE pop-up flurries so intense that made internet browsing basically impossible. I've even seen pop-up ads just appear out of nowhere even with IE closed. I've seen dll errors on boot up and TCP/IP errors in Lotus Notes. I've seen enough slow-downs, freezes and crashes to kill a horse.

Thank you for the tips, freemonkey. Unfortunately, this shit is way beyond the Alexa toolbar and not on my pc but on other pcs I have to tech support. I've gotten a reputation (thanks solely to Google and my big mouth) for being good at cleaning spyware, so now I'm the unofficial spyware guru at my company and the virulence of these things is making my job very, um, challenging right now.

I've got AdAware, Spybot, Hijack This, SpyBlaster, No Adware, even the pay version of SpySweeper, and I know how to use them. Still, these insidious fuckers are like Obi Wan or something: every time you kill them, they come back more powerful than before.

[Goliath]

Originally Posted by liv

Is Spyware Getting Worse by the Minute or Am I?

l!vuus dRussus,

Click here for V!agra for a bigger pen!s to please your partner!

M1dgets and Horses! click here!

zqwxyu;rxt

[Scotty]

What MS OS version are you running?

Are you on the Internet without a firewall or router (blocks incoming requests, a router will do that, a firewall gives the option of letting specific stuff come through). If you are seeing this behavior in your office environment and don't have a router or firewall, get one. If you see this behavior and you have a firewall or router, I would really suspect somebody else in the office has a major virus or spyware that is just popping this stuff on your screen or reinfecting you from within the network (okay, I don't actually know if they do that, but it just struck me that somebody within the office is probably doing that unknowingly).

If the "Alerter" service is started, stop it. I _think_ that is the service that allows people to just send you messages arbitrarily on the network and just have things pop-up without you doing anything (if you don't have a firewall or router between you and the Internet).

I am pretty sure if that service is enabled you can disable it. If I have the service correctly, it is a HUGE problem.

The Spyware software gets away with what it does because they exploit the areas that are still totally open within I.E. and the MS OS because those companies have the ability to distribute the exploits all over the place on the Internet (unlike what most hackers can get away with for very long). So, they are scum, but MS is bigger SCUM for not fixing the problem.

I highly suggest never using I.E. ever again, for anything (except I suspect you have to run software updates with them, bastards)

As for getting rid of them, I highly suggest dropped MS as an operating system provider and getting a Mac.

Yes, they will integrate with MS garbage. Plus, you can replace a PDC with Samba, and run a VPN service on OS X server (or Linux) (( I had to put a bunch of TLA's in this sentence ))

The worst spyware tracking I have is cookies.

Also, re-install your machine from scratch, totally rebuild it. I suggest doing this once every 6 months, especially if you use the machine for much other than email.

-Scott

[viscousmemories]

Scotty she's talking about the PC's she hast to tech support at work. I kinda doubt she has any say in the building of the infrastructure, platform, OS or standard browser. I think she's pretty much stuck with trying to fight her way out of the M$ crap-a-thon.

[Scotty]

You feeling okay vm, that post seems to have spelling and grammar mistakes in it?

Yes, I was working both angles, work and home. I suspect that they have an infrastructure problem (i.e. a HOLE through the FIREWALL you could walk through) and this is just allowing too much garbage in, and somebody internal is infected horribly, requiring much antibiotics.

I was just giving the option of replacing all MS crap with something else, as it is all possible. If I could go around to companies and change out their entire infrastructure with something else, I would in a heartbeat.


-Scott

[livius drusus]

Yup. vm's right. I got a glimmer of hope this morning, though, from the latest version of Spybot's immunization feature. We shall see...

[viscousmemories]

Originally Posted by Scotty

You feeling okay vm, that post seems to have spelling and grammar mistakes in it?

Oh. I, um. It was for effect, see? I wanted to make an impression!

Yes, I was working both angles, work and home. I suspect that they have an infrastructure problem (i.e. a HOLE through the FIREWALL you could walk through) and this is just allowing too much garbage in, and somebody internal is infected horribly, requiring much antibiotics.

I was just giving the option of replacing all MS crap with something else, as it is all possible. If I could go around to companies and change out their entire infrastructure with something else, I would in a heartbeat.

Ah, groovy.

[freemonkey]

Originally Posted by livius drusus

Lucky bastard. I've seen IE pop-up flurries so intense that made internet browsing basically impossible. I've even seen pop-up ads just appear out of nowhere even with IE closed. I've seen dll errors on boot up and TCP/IP errors in Lotus Notes. I've seen enough slow-downs, freezes and crashes to kill a horse.

Thank you for the tips, freemonkey. Unfortunately, this shit is way beyond the Alexa toolbar and not on my pc but on other pcs I have to tech support. I've gotten a reputation (thanks solely to Google and my big mouth) for being good at cleaning spyware, so now I'm the unofficial spyware guru at my company and the virulence of these things is making my job very, um, challenging right now.

I've got AdAware, Spybot, Hijack This, SpyBlaster, No Adware, even the pay version of SpySweeper, and I know how to use them. Still, these insidious fuckers are like Obi Wan or something: every time you kill them, they come back more powerful than before.

Oh my, you do have a mess there. I second Scotty's suggestions -too bad you can't switch to Macs, but you can work on the firewall situation.

It probably won't do any good, but maybe a short class on basic internet security is on order for your co-workers.... go on a rampage, threaten to disconnect from the www, threaten to quit! Sorry, my emotiuons got the better of me.

Also, I think I was able to download MS updates with Firefox. Its just that one was a update that reinstalled that stupid Alexa thing, so then Explorer kept trying to get through the firewall.

[squian]

Just to add to the list of Anti-Spyware programs, you might try bazooka.

Scotty's suggestions are good for the corporate environment. I wonder if an HTTP proxy could help too. When I did IT for a small office, I set up squid on a Linux box to help cut down on crap coming through the web. With most proxies you can set up a blacklist of domains and IP addresses that should not be allowed in. Network users can see a performance gain from having popular sites cached and filtering out unwanted banner ads (although small, the bandwidth adds up). Vigilance is still important. You can only block a site once you discover it. However, you do cut down on the recurrences.

The simplest proxy configurations would require every browser to set the proxy address and port. However, if you already have a firewall, you can use a combination of port forwarding and an HTTP proxy to make a transparent proxy -- no browser configuration.

For individuals, you can also apply the proxy technique. My favorite site on the topic is Junkbusters. They have a very holistic view of junk including fax, mail, and email. It's refreshing to find people fighting the good fight.

[dave_a]

curiously after switching from IE to Firefox and setting the appropriate cookie settings my spyware issue has shrunk considerably. Someone here (Scotty?) suggested Firefox and I haven't turned back.

I run adaware, spybot and spysweeper. I think spybot is the best of the three, but all seem to find stuff the others don't.

After Firefox most of the time these find nothing.

Go figure

[Lauri D]

Originally Posted by dantonac

After Firefox most of the time these find nothing.

Go figure

Ditto. Since having this laptop running Firefox, I have had -0- issues, whereas my work 'puter (on the network) situation becomes more disturbing by the day. One part of me wants to tell my boss (since I work him directly as the Big Cheese of the co.) that our fulltime IT guy is obviously useless for not having figured out that there is a MAJOR FUCKING PROBLEM, but the other part of me is apathetic.

I run AdAware and Spybot every fucking day (sometimes more than once) but there is something seriously wrong and creepy with the whole network, and it kinda freaks me out sometimes.

As a sidenote, where do these people come from and why do they give a shit about the average person? It's not as though by accidentally opening an email titled "hey there" by a name that seems REMARKABLY SIMILAR enough to someone I actually know, I am going to be compelled to buy Viagra.

I swear though, when I see some of these emails (the ones I realize are spam but they piss me off because of the headers I realize there is some tracking going on) it makes me almost homicidal. I feel almost violated. WHAT THE FUCK DO YOU WANT? I.... DON'T... WANT.... VIAGRA. Or whatever. I seriously want to find these people and strangle them slowly with their own computer cords sometimes.

P.S. Not to reveal myself as a complete idiot, I have googled this to no avail, but wtf is with "DSO Exploit" and how can I fix it or is it not meaningful? It's bugging the shit out of me.

[JoeP]

Originally Posted by Lauri D

Ditto. Since having this laptop running Firefox, I have had -0- issues, whereas my work 'puter (on the network) situation becomes more disturbing by the day. One part of me wants to tell my boss (since I work him directly as the Big Cheese of the co.) that our fulltime IT guy is obviously useless...

You have a thing about cheese, power and worship. Accept it.

[Scotty]

DSO is dynamic shared object (IIRC), but anything on a MS machine is open for exploit, I swear.

As for the tracking software, most of that isn't in emails (although I suppose you could use it for that). You get most of it on install of software that you download, or on web-pages that exploit the problems with I.E. that won't go away (and I dont' think they can fix them because of the way the operating system works, if they fixed it, the machine would stop functioning, not that normal operation of MS Windows can be termed as functioning).

The tracking software is very good for business. If you can determine what people are doing, you can sell a lot more product, and really, it is a valid way of doing business - IF YOU TELL THE CUSTOMER -

I mean, I wouldn't be as adverse to all of this spyware if they asked, and if it didn't take up CPU time. Some of these things are written so poorly that they mangle your machine and crash it.

As for the stupid emails you get all of the time, the problem is, is that people DO respond to them. If people didn't, the emails would go away. If the SPAMMERS didn't get a specific ROI on the emails, they would be gone.

My email address for work is just pummeled. I get probably 1000 SPAM emails a week (at least), and that doesn't include the over 30,000 that get blocked on our servers every week (for everybody). We are actually a pretty big volume sender of email ourselves (all opt in) and I think people just get peaved at us, even though I try so hard to make it easy for them to unsubscribe. <sigh>

I mean, WE wouldn't send the emails if we didn't see a marked improvement in sales. We are even on SPAM blocker lists, ones you can't get removed from easily. <heavy sigh>

On a side note (wait, this whole post is a side note), I have put spamassassin on my incoming email the past few weeks, and it doesn't catch OUR emails as SPAM, which I think says a lot.

-Scott

[Maynard]

I installed SP2 for Windows XP. The new firewall is catching a lot of the stuff that I couldn't keep off with McAfee.

[livius drusus]

We're locked into W2K until corporate decides it's time to move on, and like with all big corporations, these kinds of decisions move at a snail's pace.

The good news is Spybot 1.3's immunization is working quite well for me. I have it set to alert every time a site tries to install something on the blocked list and it's been a fascinating voyage of discovery, let me tell you, to see which sites try to sneak one in. Slate, for instance, persistently tries to install Avenue A and Double-Click every time I read an article. The Warner Brothers forum does too.

I'm building a lovely little blacklist to add to this thread.

[Ymir's blood]

I just ditched the AV program that was installed and went with another. It seems to be much better designed. AdAware works again and found two objectionable items. (livius, is there anyway that this smilie or a similar one could use the :/ ? I just really like that expression.)

What anti-spyware programs are best? Should I use multiple ones, as some here do?

[livius drusus]

Hmm... Well, I could just change it to :/, but you'd have to edit your post to fix it and I'd have to edit any other post which used the old text. I don't think it has been used much, though.

I'll look around for another one, but I doubt I'll find one as cute as he is. Shall I make the change?

Oh, and Spybot 1.3 is key. I think it's better than AdAware in lots of ways, and they work well in tandem anyway.

[Ymir's blood]

Originally Posted by livius drusus

Hmm... Well, I could just change it to :/, but you'd have to edit your post to fix it and I'd have to edit any other post which used the old text. I don't think it has been used much, though.

I don't suppose there is anyway to have both shortcuts go to that image?

I'll look around for another one, but I doubt I'll find one as cute as he is. Shall I make the change?

I've got two saved off but you've probably seen both of them before.

[livius drusus]

The only way I can think of is to make a duplicate. Normally that would disturb my sense of rightness, but I think if I put it in another category I'll be okay.

Edit: done.

Edit 2: Revoked. See here for reason. Sorry, Ymir.

[reprise]

I run Opera (custom configured) on Win XP (SP2), AVG anti-virus, ZoneAlarm, AdAware SE, Spybot (with tea-timer enabled) and Spywareblaster. I haven't had a piece of spyware or other malware on my PC in 9 months (and I wouldn't have got that had my son not downloaded a key-gen).

I'm extremely disciplined about downloading and installing updates of my protection software as well as critical updates from MS, and if I'm unsure about accepting something (especially registry changes), I'll decline it.

Some malware removal programmes operate just fine with system restore enabled, but many do not. It's always worth disinfecting with system restore disabled and then re-enabling it once you're sure your system's clean if you're finding the same culprits returning again and again.