Malware episode

["Pop" Stran]

Sure didn't expect to post to this board...

By now you've no doubt heard of malicious software (MALware) such as spyware,adware, keyloggers, and even heard a few horror stories...
The fact that this technology (and the delivery methods being employed by some) is a recent development makes all of us newbies in this field, myself included.

Spyware and adware are tiny programs that reside quietly on your system, and monitor your surfing-shopping-web use habits, and often report back to the host company in order to tailor your search results, and offer popups (sometimes endless) that the coders feel are targetd to your tastes.
Some adware even comes with it's own directory of popup pages which bombard you with constant pop-ads, and spyware/keyloggers have been directly linked to numerous cases of identity theft.

My recent experience (not my first of course, but by far the nastiest) involved a bundled bug.

Some so-called entrepreneurs are bundling a few spyware/adware progs into a very small download that lies dormant until ready to run.
For each of the bots you received, he is paid a few cents for "convincing you to download the advertiser's BHO".
(BrowserHelperObjects [BHOs] are mostly legitimate programs
"designed to enhance your online experience",
and distributed by paid affiliates.
Affiliates are expected to; Advertise, Offer the advertiser's download page, and hope for the best.

This expected method is a bit too passive for some hungry marketers, and their chosen methods of delivery are one of the primary reasons that malware has recently been under the microscope at the FTC.

My bundle came thru a startpage or autosurf service (some can come thru a banner), and consisted of a tiny file that got past my firewall and Norton.
It was not an apparent executable, and went quietly to the Temp folder...and therefore was ignored as harmless.

Upon the next day's reboot, this tiny trojan awoke, and installed 5 spyware/adware programs, some belonging to quite reputable companies such as Alexa, Gozilla,etc.
Once i went online, the system began to bog and I quickly discovered that these progs were all attempting to register and configure themselves...of course, i pulled the plug and rooted them all out immediately.

*Some adware comes with un-installers, but i have no more faith in a spyware-maker's uninstaller than i have in the kid who snuck the files into my pc in the first place.)

Further digging found the executable that made the installs, along with the tiny download that started the snowball rolling in the first place.

NOTE: In the Windows Explorer file pane (right side), you can click the upper titlebar "Modified" to list the files by date of install/modification. This will tell you what has been installed to that folder recently.

***DO NOT mass-delete in any folder!***

This particular bundle was delivered to the "Windows" folder, and the executables were created/unwrapped in the "Windows\Temp" folder. You can safely delete all folders in the "Temp" folder, especially if you don't recognize the file names within.
(The "\Temp\IEContent" files should be left alone, but they are backed-up elseware, and will be replaced if you accidentally erase them.

Once cleaned, I restarted my system...and the real fun began.

Along with the expected adware/spyware junk, a bug had been planted that not only remained invisible to this point, but contained a modified date that kept it from showing in a file-search by date.
*(Start, Find, Files&Folders, Advanced tab.)

This virus was aprt of the trojan bundle, and installed a simple "ini" file that effectively locked me out of my pc at startup...No Windows, no access.

A few simple DOS steps got me back in, but rooting out that bug took hours...The file was tiny, written in text format, and buried in 3 places!
(I found this out when, thinking it was done, it re-surfaced 2 days later.)

All told, I spent nearly a week getting every trace of the original malware cleaned from my system...and the prog likely took the deliverer no more than an hour to create and setup.

Needless to say, my whole system has been re-worked;
- IE settings are at "High Security", and for open connections I use an alternative browser.
(IE is the most popular target of coders)

- My firewall is on Hi-Alert for any activity not pre-authorized,
- and I run Spybot Search&Destroy religiously.

.....Prologue

Trust has always been a rare commodity in this current sociology, both hard-earned and carefully protected...and the Web is well behind the offline world in this respect.

Many new netizens apparently have a hard time getting along with people anywhere else...some can barely choose right from wrong...and this has extended to their online life as well.

The methods being employed by these few relate directly to domestic terrorism, and must be dealt with in similar and appropriate fashion.

Thanx for your time,
JB.

PS: The FTC has recently begun to put spyware makers under the microscope...a very promising development.
I will post the SitePro article that i read recently next, and urge you to read it...There are some useful links contained within.

["Pop" Stran]

The following article was published in the SitePro newsletter recently.
SitePro is published by the ExactSeek searchengine team.

Enjoy.
------------------------

Preventing Malicious Spyware
or Adware from Hijacking
Your Computer
By Steven Presar

The Federal Trade Commission (FTC) announced that it had used existing fair trade laws in asking a federal court to shut down some of the leading distributors of malicious "spyware" or "adware" software. This type of malicious software may be lumped with viruses, worms, and sp@m, and is all referred to as "malware" - short for malicious software.

What Are Spyware and Adware Software?

Spyware and adware are software that is installed on your computer, generally without your knowledge, that monitors or controls your computer's use. The software may send pop-up ads, redirect you to an un-requested website while you are on the Internet, monitor your Internet activity or record your keystrokes while you are online. This recording of keystrokes may lead to identity theft or credït card fraud.

The terms "spyware" and "adware" are essentially same type of software. They are software that you may not be aware of running on your computer.


The online marketers who distribute this type of software maintain that you have downloaded the software to help them better service your Internet marketing needs. They would also state that you received their software as part of another frëe software package that you downloaded and installed. Lastly, that during the download process, that you clicked on the "agree" button, where there was their statement that you would accept online pop-up ads for their advertised products.

This same software that has victimized individuals with a mysterious change in their opening Internet page, a new default search engine, an avalanche of pop-up ads while online, computer slow downs or a computer crash - know the software as spyware.

Any unsolïcited software that runs on your computer is malicious spyware software.

Spyware Distribution

Regardless of what it is called -- your computer is infected just the same.

Simply clicking on a banner ad can install spyware software. Worms, which are self-propagating viruses, can also carry spyware. They search for machines that don't have up-to-date security patches and install their crippling software. Spyware may also be distributed by email.

As stated before the biggest method of distributing spyware is to secretly bundle it with frëe software that you download from the Internet.

Sites that offer music sharing, videos, weather data, games, screen savers, a tool bar, or program that synchronizes your computer's clock often are paid to distribute this spyware as adware.

File sharing programs like Kazaa have adware bundled right in the package download.

Before these programs are installed, you must clïck a box saying you accept the contractual agreement. These agreements can be thousands of words long and people rarely read them. Upon closer examination, however, they find that accepting pop-up ad serving software is part of getting the package.

Another common method is a message saying you need to download ActiveX to view a website or email note. Don't do it! It's just another method to get you to clïck yes to their adware.

Sometimes the presentation is an outright counterfeit of a Microsoft agreement or some other recognizable document. A safe rule to follow: If you're not sure what it is, don't clïck yes. Cancel out of the program any way you can, even if it means rebooting your computer.

Unlike virus writers, who mainly want to infect as many computers as they can just so they can brag, spyware distribution firms have a financial incentive to have their software stay on your computer as long as possible. The more of their ads that they load onto your computer screen, the more likely that you will clïck on one of the ads.

Is Your Computer Infected

To eliminate spyware, you must track down every file and completely erase it. That can be tough since spyware hides inside your computer's operating system, making it difficult to find.

If you suspect that your computers is infected and want to search the Internet for an "anti-spyware" solution -- be careful...

A Google search will return over 1,500,000 results for "anti spyware software". You will get about 749,000 hits for the phrase "anti-spyware software". Some companies that offer anti-spyware software solutions also make spyware software. Who else would know how to remove spyware then the makers of spyware software? Their anti-spyware software may remove a version of spyware on your computer but discretely load a more current version of their spyware to be launched in a few days after you had thought that you had cleaned-up your spyware problem on your computer.

You may download three frëe spyware cleaning programs at:
www.lavasoftusa.com/
www.security.kolla.de/
www.intermute.com/spysubtract/cwshredder_download.html

Before you run any of these, use their automatic update feature to get the latest protection. Some users report better results when they make repeated passes with each of the three programs.

Cleaners can remove most of an infection, rendering it temporarily inactive. But components sometimes remain that download more files and re-infect your computer. Sometimes it helps to disconnect from the Internet, then reboot after you run the cleaner. If you know how to manage a fire wall like Zone Alarm, you may be able to use it to prevent persistent spyware from reconstituting itself.

If your computer is so bogged down with spyware, you may have trouble downloading the anti-spyware products before your computer crashes. In that case, you may have to obtain the programs from another computer with a CD burner, and then load the software onto your troubled computer using a CD.

Scan your hard drive at least once a week with two or more anti-spyware programs because each is likely to find files the other overlooks.

Ongoing Anti-Spyware Protection

To prevent future infections, don't clïck on any popup ads or the body of any sp@m emails. Try closing unwanted pop-up ads using Alt-F4 in Windows. The Alt-F4 is a keystroke combination that decreases the risk you'll clïck on a disguised button to close a window that will actually open another window.

Keep your computer up to date with the latest security patches. Microsoft offers frëe updates and frëe CDs can be ordered for users on slow-speed dial-up.

Windows recently announced the release of XP's Service Pack 2, which provides additional security measures such as a limited spyware blocker and a firewall.

Protection is an ongoing process since spyware makers are constantly creating new threats. You may download a good computer resources manager and security manager at
www.onlinesoftwareguide.com/wintask

Install a personal firewall. ZoneAlarm from Zone Labs has a frëe basic firewall for personal use. Symantec and McAfee sell popular personal firewall, anti-virus, anti-spyware software.

Next, set the computer's operating system for daily security updates.

Also set the Web browser to a medium or high-security level. For Windows, go to Microsoft's Web site for instructions. Windows XP users should install Service Pack 2, which makes it close to impossible for software to be downloaded without you being alerted. Consider switching to a browser less popular than Internet Explorer, such as Mozilla Firefox or Opera. They are less likely to be attacked.

If you have any problems implementing any of the above, be sure to contact your computer consultant.

Finally, practice safe surfing.
That means downloading only trustworthy software, reading licensing agreements, avoiding banner ads, and deleting all sp@m without opening.

Tips for Protecting You and Your Computer

:: Do not clïck "yes" when an Active X dialog box keeps popping up unless you know exactly what you're downloading.

:: Do not open, and delete, any suspicious email messages.

:: Do not fill out any web forms asking for your social security number, driver's license, email p@sswords, bank account information, or your mother's maiden name.

:: Do not download or install any software unless you know and trust the source 100%.

:: Do not give your email address to anyone you don't know.

:: Clear out cookies and other tracking data on your computer.

:: Try using disposable email accounts when filling out forms on the Internet.

:: Do not enter any sweepstakes or contests online. Most of them capture your personal information and sell it to third party vendors.

:: Install software to counter-attack Spyware, Adware, Sp@m and pop-up ads.

:: You can file a complaint about unsolïcited spyware software with the FTC at: www.ftc.gov. Clïck on "File a Complaint."