Help - Search - Members - Calendar
Full Version: BLUETACK ANTI-SPYWARE GUIDE
B.I.S.S. Forums > Internet Security Forum > B.I.S.S. Security Guides
Moore
###################################################################

This guide needs an update , sorry.. biggrin.gif

###################################################################


This guide is to TRY and provide helpful information to help people with any virus /trojan and spyware removal problems.

please post in this section of the forum for further help :
http://www.bluetack.co.uk/forums/index.php?showforum=83


###################################################################

Dont put up with being hacked by Internet Terrorists any longer:

###################################################################

Top Anti-Spyware support sites:

http://forums.spywareinfo.com/
http://www.spywarewarrior.com/
http://www.gladiator-antivirus.com/
http://forums.net-integration.net/index.php


WEBHELPER'S NO:1 SPYWARE REMOVAL SUPPORT HELP PAGE LINKS
http://www.webhelper4u.com/techsupport/tec...portforums.html


Bluetack Firewall IP blocklists for spyware
http://www.spywarewarrior.com/viewtopic.php?t=3741

-----------------------------------------------------------

[quote]What do you think about this?

If you hack into a bank's computer systems and you get caught, you go to jail.

If you write a worm or virus and spread it around, if you get caught, yes that's right, you go to jail.

If you write a program that spreads a spyware agent on everyone's computer system (without their permission) and steals their private information (without their permission) and manipulates their Internet experience (without their permission), and you use other people's web sites to show your advertising (without their permission) and you make lots of money from their work in the process (without their permission) and if you get caught, guess what, you don't go to jail,
you may get rich instead. [/quote]


==============================================================


Bottom Line -- If a personal firewall is the sheriff, a posse is needed to help the sheriff capture the pests sent out by Internet outlaws like spyware, browser hijackers, viruses, Trojan horses, worms, phishing, spam and hybrids thereof.

A layered approach is best to protect your security and privacy:

First line of defense -- Choose an Internet service provider (ISP), an email service and/or a website hosting service that offers online virus, spam and content filters.

Second line of defense -- Install a hardware router with a built in firewall between your modem and your computer or network.

Third line of defense -- Use personal firewall, anti-virus, anti-Trojan, anti-spyware, anti-spam and privacy software on your desktop computer and every computer on your network.

Important Tips -- After installing any security software, immediately check for updates at the vendor's website.

After installing a firewall, use an online testing service to make sure that it is working correctly.

http://firewallguide.com/


========================


IMPORTANT : NEVER JUST CLICK OK !!

ALWAYS READ THE "EULA" BEFORE INSTALLING ANY PROGRAM !!!

"END USER LICENCE AGREEMENT" - eg: the extremely long and confusing fine print !!

==========================
ANTI - Malware/Spyware Help Links
==========================

Online Spyware Scans :

Doxdesk: Online Browser Spyware Scan -
http://www.doxdesk.com/parasite/

Spywareinfo Online Scan:
http://www.spywareinfo.com/xscan.php

GFI Trojanscan:
http://www.trojanscan.com/trojanscan/

Kaspersky online Virus File Checker:
http://www.kaspersky.com/remoteviruschk.html


----------------------------------------------------------------------------


eEye Vulnerability Research:
http://www.eeye.com/html/Research/Advisori...ries/index.html

================================================
:: Spyware Infested Programs ::
================================================

:: ERIC HOWES/SPYWARE WARRIOR - ROGUE SPYWARE LIST ::
- http://www.spywarewarrior.com/rogue_anti-spyware.htm

http://www.netrn.net/archives2/000550.html

http://www.webhelper4u.com/thewatcherlist.html

http://www.spywareguide.com/product_list_full.php


================================================
Helpful Guides:
================================================

Spyware and Adware Removal
http://www.pcreview.co.uk/article-7086.php

GREAT !! Guide to preventing Hijacks and other Internet Terrorist attacks or
How to Stop Hijackers & Spyware Infections, And other malware too!
http://forum.gladiator-antivirus.com/index...?showtopic=9857

[quote]A frequently heard question is  "how on earth did I get infected with all that spyware in the first place?"

Well, you usually get infected because your security settings are too low.

Here are a number of recommendations that will help tighten them, and which will contribute to making you a less likely victim:[/quote]

How did i get infected in the first place: mad.gif
http://forums.net-integration.net/index.ph...?showtopic=3051

what to do when you get hijacked:
http://www.spywareinfo.com/articles/hijacked/#removal

HOW TO SHOW HIDDEN FILES:
http://www.xtra.co.nz/help/0,,4155-1916458,00.html

HOW TO BOOT INTO SAFE MODE:
http://www.microsoft.com/resources/documen...t_failsafe.mspx

DISABLING SYSTEM RESTORE:
http://www.pchell.com/virus/systemrestore.shtml

Antivirus and System restore:
http://support.microsoft.com/default.aspx?...p;Product=winxp

Antivirus Tools Cannot Clean Infected Files in the _Restore Folder
http://support.microsoft.com/default.aspx?kbid=263455

Disable /Enable System restore
http://service1.symantec.com/SUPPORT/tsgen...001111912274039

Disabling System Restore on Windows ME and XP:
http://www.vet.com.au/html/zoo/system_restore.htm

Uninstalling the MS Java VM
http://209.133.47.200/~merijn/uninstmsjava.html

Remove msn messenger : tongue.gif
http://forum.gladiator-antivirus.com/index...?showtopic=7373

Remove windows messenger: biggrin.gif
http://www.spywareinfo.com/forums/index.ph...?showtopic=1677

Messenger PLUS!:
http://www.wilderssecurity.com/showthread.php?p=170026

================================================
- - - - - - - - - :: SELF HELP INFORMATION :: - - - - - - - - - - - - - -
================================================

---------------------------------------------------
:: SPYWARE WARRIOR GUIDES ::
---------------------------------------------------

Self Help Resources Forurm:
- http://www.spywarewarrior.com/viewforum.php?f=26

Malware Removal Tools and Programs forum:
- http://www.spywarewarrior.com/viewforum.php?f=27

Malware Tools and Removal Programs page
- http://www.spywarewarrior.com/viewtopic.php?t=2958

Protection Prevention Detection Program Page
- http://www.spywarewarrior.com/viewtopic.php?t=2961

HijackThis Tutorial- How to Analyse your own log:
- http://www.spywarewarrior.com/viewtopic.php?t=3624

----------------------------------------------------------------------------

PC Hell -Anti-Spyware Information:
http://www.pchell.com/support/spyware.shtml

Start up list ;
http://www.rockymountain.com/ref_startup.htm

CLSID - BHO List - Toolbar List
http://computercops.biz/CLSID.html

Parasites: Cookies, Dialers, Keyloggers, Trackers
Some are Good others are Bad :
http://www.generation.net/~hleboeuf/bhoindex.htm
http://www.generation.net/~hleboeuf/bho_a_d.htm

http://sysinfo.org/bhoinfo.php
http://www.sysinfo.org/bholist.php

http://www.spywareinfo.com/bhos/

http://www.liutilities.com/products/wintas...library/system/

Necessary Startup Programs:
http://www.allsecpros.com/startuplist.html

Start-Up Applications - All
http://members.shaw.ca/austin.powers/

Startup Items List
http://www.3feetunder.com/krick/startup/list.html

Windows Startup Database:
http://www.windowsstartup.com/wso/search.php

click the panel on the left for the good stuff ;
http://inetexplorer.mvps.org/Darnit.htm

Kephyr/Bazooka spyware database :
http://www.kephyr.com/filedb/index/all.html
http://www.kephyr.com/spywarescanner/index.html

Winpatrol Free Stats:
http://www.winpatrol.com/stats.html

Index of English Pest Descriptions:
http://www.pestpatrol.com/PestInfo/default.asp

Wawadave Posted this list :
http://spywarewarrior.com/viewtopic.php?t=1921
http://www.fcenter.ru/Software/Miscellaneo...spywarelist.txt

P2P spyware - slightly old :
http://www.staff.uiuc.edu/~ehowes/soft23a.htm#Infested

pretty old lists but you never know whats still lurking out there 8)
http://home.tvd.be/ws36178/security/spylist.html
http://www.tom-cat.com/links/links-i.shtml#Cleanup

http://xforce.iss.net/xforce/search.php

http://www.sophos.com/virusinfo/analyses/i...ex_dialler.html

http://simplythebest.net/info/spyware.html
http://www.theinfomaniac.net/infomaniac/co...rsSpyware.shtml

http://www.thiefware.com/links/

Missing System Files:
http://www.snapfiles.com/help/missingfiles.html

missing .dll files ? :
dll world
http://dll.yaroslavl.ru/index.php3?lng=&in_char=C

=======================
- HELP SITES -
=======================

Keep up to date with all the current Spyware on the move with this great Blog by Suzi , Admin of Spyware Warrior forum:

http://www.netrn.net/spywareblog/

Everyone needs help sooner or later , these are the best Help sites i know of :

- NO;1 SUPPORT HELP LIST PAGE -
http://www.webhelper4u.com/techsupport/tec...portforums.html

- WEBHELPERS SITE -
http://www.webhelper4u.com/index.html

http://www.spywareinfo.com/
http://forum.gladiator-antivirus.com/index.php
http://www.wilders.org/
http://www.lavasoftsupport.com/index.php
http://www.net-integration.net/
http://forums.net-integration.net/index.php?
http://www.computercops.biz/
http://forums.tomcoyote.com/
http://aumha.org/a/parasite.htm

Mickey the Man`s security forum:
http://pages.infinit.net/carbo1/

KILL SPYWARE FORUM !: http://www.subratam.org/index.php?
http://www.cexx.org/adware.htm

http://www.thespykiller.co.uk/
http://www.freedomlist.com/forum/index.php

Freedom lists free tools page
http://home.villagephotos.com/2003-7/14838...tyFreeTools.htm

http://www.bleepingcomputer.com/forums/index.php?

A² Trojan Scanner/malware detection support forum:
http://forum.emsisoft.com/index.php

=======================================
Internet Terrorist Anti-Spyware Detection / Removal
=======================================

Good sensible advice by HUNTER [gladiator-antivirus admin]

[quote] FIRST CHECK THE OBVIOUS  !!

Whether you have used some of these anti-spyware programs and tools for the first time or a thousand..do yourself a favor and First look at your add/remove program and see if you can uninstall what seems to be a problem that way.
It is the easiest way to solve your problem if you find it there to remove...And while you are there..write down all the programs that are in there as a bench mark so that the next time you feel you have been hijacked by an unwanted download you will know at least what should be in there.[/quote]


#######################################################################

Use a HOSTS file to protect yourself from scumbags:


HOSTS FILE GUIDE:
http://www.bluetack.co.uk/forums/index.php?showtopic=3996

HOSTS File information and download at Bluetack :
http://bluetack.co.uk/hosts.html
http://www.bluetack.co.uk/forums/index.php...p?showtopic=812


========================================
--------------------------------------------
Spyware / Adware Removal Tools / Programs :
--------------------------------------------
========================================

- ALWAYS REMEMBER TO KEEP YOUR TOOLS UPDATED !

Subratams Links Pages:
http://www.subratam.org/?page=removal
http://www.subratam.org/?page=software

Recommended Downloads:
http://www.spywareinfo.com/downloads.php
http://www.allsecpros.com/#specials
http://forum.gladiator-antivirus.com/index...showtopic=10547
http://www.blue.net/helpdesk/tools.html


ADAWARE :


Adaware - http://www.lavasoftusa.com/

[quote]AdAware is a privacy tool, that scans your memory, registry, hard, removable and optical drives for known data-mining, aggressive advertising, and tracking components. It then lists the results and offers to remove or quarantine the components. The program detects a wide range of adware/spyware related issues and can be updated with the latest signatures via the built-in update utility. Please be advised that removing certain components may impact the functionality of effected software applications. You should fully read the included Ad-aware documentation before removing any files! [/quote]

:: Great Ad-Aware Help Links ::
http://www.freedomlist.com/forum/viewtopic.php?t=16060


SPYBOT SEARCH AND DESTROY


Spybot Search & Destroy -
http://www.safer-networking.org/

[quote]SpyBot-S&D is an adware and spyware detection and removal tool. This includes removal of certain advertising components, that may gather statistics as well as detection of various keylogging and other spy utilities. In addition, it also securely removes PC and Internet usage tracks, including browser history, temporary pages, cookies (with option to keep selected) and more[/quote]


HIJACK THIS


Hijack This - http://www.tomcoyote.org/hjt/

Hijack This Tutorial :
http://www.spywareinfo.com/%7Emerijn/htlog...ogtutorial.html

[quote]This tool is an additional one to SpybotSD and/or AdAware to clean up leftover problems not detected and removed by those or other anti-spyware programs.

This tool is widely used across the internet now by many help forums to determine problems with a user's internet browsing experience from a wide range of problems stemming from a hijacked browser to sex dialers and spyware that has not even been added to any anti-spyware program.[/quote]


[ post your hijack this log in this forum section or any other security forums listed in this post for help if you dont know what to do. ]


CWS SHREDDER

Specific CWS TROJAN infections usually need to be removed with a specialised tool called the CWS Shredder:

CWS Shredder - http://www.spywareinfo.com/~merijn/

Can't reach the page from a CWS infected computer?
Try using http://209.133.47.200/~merijn/index.html

Windows file replacements:
http://209.133.47.200/~merijn/winfiles.html

FAQ;
http://www.merijn.org/faq.html

CWS trojan Information:
http://www.spywareinfo.com/%7Emerijn/cwsch...chronicles.html
http://www.bluetack.co.uk/forums/index.php...?showtopic=1878

The CoolWebSearch Chronicles
[quote]The latest and greatest nuisance on the Internet, the browser hijacker that won't stop, the trojan from hell... name it what you want, but fact is that a company naming itself 'Coolwebsearch' (CWS) is producing a quickly growing strain of trojans that exploit a hole in the Microsoft Java VM, and change your homepage.

And by changing your homepage, I mean lodge itself onto your system in almost two dozen different ways, change your start page, search page, search assistant, redirecting you to porn sites from other porn sites or even search engines, popping up porn ads and sometimes even carrying a payload.[/quote]

Merijn's CWS Chronicles - http://www.spywareinfo.com/~merijn/cwschronicles.html

Additional variants - http://www.wilderssecurity.com/showthread.php?t=28658

And the indispensible domains list http://www.merijn.org/junk/cws_domains.txt

It is updated very frequently.
An easy way to see and search it is to run cwshredder /debug.
Make a shortcut for your CWShredder, right-click on it, add the " /debug" in Properties.

Anothr great Cws Domain list kept updated by Unzy from wilders.org:
http://users.skynet.be/bk136527/CWS/CWSdomains.htm


===================
-----------------------------
~ Prevention/Detection ~
-----------------------------
===================

Winpatrol - http://www.winpatrol.com
[quote]WinPatrol will help sniff out Worms, Adware, Spyware, Cookies, Trojan horses and other virus type, malicious, nasty "mysteryware" that may attack your computer. WinPatrol puts you back in control of your computer with no need for constant updates.
WinPatrol is free and fully functional with the exception of full access to our PLUS online database. The free version continues to be both; a utility to help you safely clean up sensitive areas on your system and a system monitor that will alert you to changes that occur to those sensitive areas and resources.[/quote]


SPYWARE BLASTER - http://www.javacoolsoftware.com/sbdownload.html
[quote]SpywareBlaster doesn`t scan and clean for so-called spyware, but prevents it from being installed in the first place. It achieves this by disabling the CLSIDs of popular spyware ActiveX controls, and also prevents the installation of any of them via a webpage. This allows you to run Internet Explorer with Active-X enabled, but it will never download or even prompt you for any of the known ActiveX controls. All other Active-X controls or plug-ins will work fine.
Compatible with Windows 95, 98, ME, NT 4, 2000, XP. [/quote]

Alternate Download links:
http://www.net-integration.net/tools/spywa...areblaster.html
http://www.wilderssecurity.net/spywareblaster.html


SCRIPT DEFENDER:
http://www.analogx.com/contents/download/system/sdefend.htm


BHO DEMON - http://definitivesolutions.com/
[quote] "Think of BHODemon as a guardian for your Internet browser: it protects you from unknown Browser Helper Objects (BHOs), by letting you enable/disable them individually. BHODemon is free, runs in the system tray area, and works on Windows 95 or later operating systems.
"BHODemon scans your Registry for BHOs, and presents any it finds in a list. By highlighting a BHO in this list, and clicking the 'Details' button, you can see information about this BHO, and even disable it if you wish. BHOs are disabled by simply renaming the DLL that houses them. By renaming the DLL, instead of deleting it, you have the option of enabling it later if you wish. Why would you want to do that? Because the program that installed the BHO will not run if it can't find the DLL: Go!Zilla, for example, won't run if you remove its BHOs."[/quote]


TOOLBARCOP:
http://www.mvps.org/sramesh2k/toolbarcop.htm

Active XCavator v2.0 - http://www.cognitronix.com/
Faber Toys - www.faberbox.com/fabertoys.asp
Belarc Advisor - http://www.belarc.com/free_download.html

Process Info - http://www.gomiller.com/downloads/procinfo.html
[quote]Process Info is designed to give you a quick overview of all the processes that are running in your system.
It searches the web for information about the process and help you identified them, distinguishing system processes from spyware, Trojans and other viruses.[/quote]

startup control panel:
http://www.mlin.net/StartupCPL.shtml



Registrar Lite:

http://www.resplendence.com/reglite

[quote]Registrar Lite is a powerful and flexible freeware registry editor. It offers an explorer style interface which supports the clipboard and allows you to drag and drop registry keys and values.

It offers background search and replace, a bookmark editor which allows you to add descriptions to registry keys as well as advanced registry value data editors which support all existing registry data types.

An addressbar allows you to access registry keys and values quicly.

Registrar Lite offers registry key import and export functionality which supports all native registry file types.

When running on Windows XP,2000 or NT, all security features are supported by offering editors which allow you to set registry key&nbps;permissions, auditing and ownership.

Registrar Lite is the freeware edition of the advanced registry manager called Resplendent Registrar.[/quote]


Total Uninstall

http://www.snapfiles.com/get/totaluninstall.html

Track and undo system changes:
Total Uninstall can help you to monitor any changes that were made to your system during installation of a new software product and allow you to perform a complete uninstall without having to rely on the supplied uninstall program (which may leave files or changes behind).

To use it, you simply launch the installation program from the Total Uninstall interface and select the system areas to be monitored. The program will then create a snapshot of your system before it installs the new software and an additional snapshot after install completes. it then compares the two snapshots and displays all changes n a nice, graphical tree view, marking all values and/or files that have been added or changed as well as some before/after details.

Total Uninstall will save these changes and if you decide to uninstall the application, it will reverse all changes to the previous state

Registry Crawler :
Registry Crawler enables system administrators, developers and other power users to quickly find and configure Registry settings. The software provides a powerful search engine that allows you to find Registry information based on a search criterion.
http://www.4developers.com/regc/index.htm


----------------------------------------------------------------------------------------------------------------------------------

WinSock XP Fix "WinsockXPFix.exe" by shaw.ca
On an XP machine, after uninstalling a personal firewall product (such as McAfee Personal Firewall) and having your network settings destroyed there is a nifty little application to fix the winsock settings. You can download it at from http://members.shaw.ca/techcd/WinsockXPFix.exe to replace the registry settings that are causing the problem. It even backs up your registry before it performs the fix.

http://tntmax.com/Download/Software/WinsockXPFix.exe/view


===================================================================

links to guides:
http://www.mjc1.com/id17.htm
http://www.mjc1.com/avpaget.htm

peper trojan removal guide :
http://www.mjc1.com/files/peperpage/

tutorials :
http://www.computing.net/howto/advanced
http://www.computing.net/howto/


Kill2Me may still work on old versions of the parasite, but not on the newer versions.
Fortunately, Option^Explicit has done a fine job of providing tools that work on the newer versions.

Here's the thread for Look2Me in Win 2000 and XP:

http://forums.spywareinfo.com/index.php?showtopic=61

And for Win 98 and ME:

http://forums.spywareinfo.com/index.php?showtopic=62

---------------------------------------------------------------------------------

BROWSER HELPER OBJECTS ( BHO'S )

---------------------------------------------------------------------------------

A BHO is a COM.DLL that allows developers to customize and control internet explorer. When it starts it reads the registry to locate installed bho's and then creates them.

The API's for building BHO's are very cool but the potential for abuse is high. BHO's give give developers almost complete control over internet explorer. However, because BHO's don't necessarely have a user interface, it's possible that there are BHO's running on your system that you don't know about.

BHO LIST download:
http://www.spywareinfo.com/~merijn/files/bholist.zip

what is a bHO by tony KLein :
http://computercops.info/postitle7736-0-0-.html

http://www.generation.net/~hleboeuf/bho_a_d.htm

Tony Kleins Online BHO Database:
http://sysinfo.org/bhoinfo.php
http://pages.infinit.net/carbo1/bho.html

A comprehensive look at BHO'S:
http://msdn.microsoft.com/library/default....se/html/bho.asp




=======================
Report suspected threats :
=======================

Ad-Aware Submissions:
http://www.lavasoftsupport.com/index.php?showtopic=8303

Spybot Search and Destroy Submissions:
http://forums.net-integration.net/index.php?showforum=36

Diamondcs / TDS-3 Submissions:
submit@diamondcs.com.au to submit all your trojans

=======================
SECURITY TESTING SITES:
=======================

http://www.jasons-toolbox.com/BrowserSecurity/

BROWSER SPY
DOXDESK


=======================
Bluetack Security Tools Section:
=======================

http://www.bluetack.co.uk/forums/index.php...hp?showforum=75

#############################################################
bluetack
more good work!

SpywareInfo is a great site, and i see it at the top of your spyware site picks. I especially like this quote:

QUOTE
I think such methods of generating revenue are disgusting. The spyware companies treat users like livestock to be branded with tracking devices and monitored as they conduct their personal business. They are parasites on the body of the internet, and my web site and others like it are dedicated to putting them out of business.
Moore
#########################################

Part 2 :

#########################################


QUOTE
Spyware is software or hardware installed on a computer without the user's knowledge which gathers information about that user for later retrieval by whomever controls the spyware.

Spyware can be broken down into two different categories, surveillance spyware and advertising spyware.

Surveillance software includes key loggers, screen capture devices, and trojans.

These would be used by corporations, private detectives, law enforcement, intelligence agencies, suspicious spouses, etc.

advertising spyware is software that is installed alongside other software or via activex controls on the internet, often without the user's knowledge, or without full disclosure that it will be used for gathering personal information and/or showing the user ads.

advertising spyware logs information about the user, possibly including passwords, email addresses, web browsing history, online buying habits, the computer's hardware and software configuration, the name, age, sex, etc of the user.

As with spam, advertising spyware uses the CPU, RAM, and resources of the user's computer, making the user pay for the costs associated with operating it.
It then makes use of the user's bandwidth to connect to the internet and upload whatever personal information it has gathered, and to download advertisements which it will present to the user, either by way of pop up windows, or with the ad banners of ad-supported software.

All of this can be considered theft in the cases of advertising spyware that installs without disclosure.



Spyware , Trojans and viruses can all be delivered through Web browser attacks such as these:

QUOTE
Most modern web browsers have a series of security loopholes.
Typical software vulnerabilities like format string and buffer overflow attacks are also found in http clients (such as Internet Explorer and Netscape).

Active Content such as JavaScript, Java, ActiveX and HTML itself can also pose a security risk.

HTTP headers can be used to exploit bugs because some fields are passed to functions that expect only certain information.
A well-known exploit for IE consists of encapsulating HTTP headers within an EML file and launching an executable embedded within the EML file.

HTML can be often exploited through buffer overflows. Internet Explorer 6 as well as previous versions of IE and Netscape were found to be vulnerable to these kind of attacks using different HTML tags with long strings as attributes.

JavaScript is well known to be the prime cause of security loopholes within web browsers. Likewise with VBScript and any other type of active scripting. These functions are generally run in a sandbox environment, however from time to time hackers find out new ways to escape the sandbox environment and execute code, read sensitive files etc.

Frames and iframes are many times used in conjunction with Active Scripting (JavaScript, ActiveX, Vbscript) exploits. However they are sometimes also used as a social engineering exploit to fake legitimate sites.

Java was built with a strong security model by making use of the sandbox technology. However third parties have implemented their own versions which can introduce bugs and flaws. Normal Java applets have no access to the local system, but sometimes they would be more useful if they did have local access. Thus, the implementations of "trust" models that can more easily be hacked.

ActiveX is even more dangerous than Java as it works purely from a trust model and runs native code. The trust model consists of either allowing the ActiveX application to run on the client machine, or not.

Unlike Java, the ActiveX model has no way to limit the application certain functions only. As a security precaution ActiveX components generally have to be digitally signed. The sign assures the customer that the producer of the ActiveX component is legitimate but not that the ActiveX component is safe to install.


How to Detect Spies:

QUOTE
Make no doubt about it, online spying is becoming more prevalent and more sophisticated.

It is important to understand that there are different levels of spying. For example, Alexa, popular software owned by Amazon.com, would be called a “BackDoor Santa” it doesn’t actually log your keystrokes or take system snapshots but it does record some surfing activity.

However, programs like Spector are very skilled at stealthily gathering information including passwords, surfing history, and even chat logs and e-mails, also everything that is recorded is sent back to the Spectorsoft server database.

So who do you know if you are being spied upon?
10 key points below on how to monitor your system and check for the signs of spy software.

1) Work Environment:
Assume you are being monitored. Most workplaces have the right to do this so by default get used to the fact that someone is monitoring you. There are several ways employers can monitor employees. Some use activity logging software to see what programs are being accessed and for how long. Naturally many will use spy software programs also known as “snoop ware” or a key-logger to take snapshots and log all keystrokes. An employer may actually monitor internet traffic as it moves across an intranet.

2) Anti-Spy Programs:
A popular way to find out if someone is spying on you. Anti-Spy programs look for signatures or traces that are specific to certain spy software.
Some simply do text string scanning to find them, and others actually extract and attempt to remove the spyware. Be careful of the ones that use only text string scanning. Text string scanning can give false positives and in some cases it actually it can accidentally target anti-spy software! You can try a free online scanner right on this site, just click here.

Of course Anti-Spy software can be a double-edged sword! Many spies will actually buy anti-spy software to scan and check to make sure their spyware is not being detected. There is a hidden arms race that rages between spyware vendors and anti-spy companies.

3) System Resources:
Poorly written spy software will almost always put a drag on system resources. Watch out for poor system resources, running out of memory, lots of hard disk activity or a screen that “flickers”. This is caused by some spy software programs as they take snapshots of the computer screen that requires system resources.

4) Machine Access:
Watch for people trying to gain access to your machine. Many software programs that are designed for spying require physical access to the target machine.

5) Installation Monitors:
Currently on the market are software programs that will log every installation that occurs on your machine. It is best to leave these hidden on the system. It is possible to catch the installation of many spies in this way.

6) Anti-Virus:
Many anti-virus programs can catch prolific spy software because they are often classified as “Trojan Horses”. Keep spy software up to date and make sure it is running in the background.
This might not protect you against from some spy software but it will let you know if any repurposed Trojan horses are installed. Keep in mind that Trojans (see below) like NetBus or DeepBO are also classified as spy software because they open up a system to outside connections. Don’t be lulled into a false sense of security because you have one installed. They are helpful but there is no such thing as 100% foolproof protection.

7) Personal Firewall:
In today’s treacherous Internet it is very helpful to also run a personal firewall. Firewalls will alert you to both inbound and outbound activity. You can control what is allowed in and out of your system. Watch for suspicious programs you do not recognize trying to send data out of your system.

8) Downloading Smarts: Simply put use common sense when downloading and avoid sources you cannot trust.
If you are someone who frequents “warez” or crack sites you will more than likely encounter a Trojan or virus.  :idea:

9) Common Sense: Be careful about what you install on your system. Don’t run e-mail attachments and read the EULA (end user license agreement). Keep an up to date anti-spy package on your machine.

10) Spy Software:
Ironically you can monitor for spy software by installing spy software on your system first! Since spy software can record all keystrokes it can monitor and record the installation of another spy software.

Again this turns into a virtual arms race, but keep in mind that many spy programs are vulnerable to anti-spy attacks.



---------------------------------------------------------------------------------------


:: Beware ::

"While many people in the anti-spyware sector are doing this mostly because they are dedicated to security and privacy, there are always a few black sheep trying to make quick money using the fear of many users."

Two such black sheeps are BulletProof software with their Spyware and Adware Remover and TrekBlue with their SpywareNuker.

Both products are based on a hacked version of the Spybot-S&D database.
Evidence for this is very clear as the Spyot-S&D contains quite some entries to determine such theft.

These entries are wrong entries, some detecting things that do not really exist, some detecting minor threats under the wrong name, etc..

These tricks are absolutely harmless to the normal user of Spybot-S&D, but do clearly identify a stolen version of the Spybot-S&D database.

Both products mentioned above detect exactly the same 'mistakes' the Spybot-S&D database contains.

http://www.safer-networking.org/en/news/2003-02-12.html


---------------------------------------------------------------------------------------


Two common examples of known spyware:

QUOTE
WinWhatWhere Investigator runs in the background, hides itself from the user, logs keystrokes, takes periodic screenshots of user activity,
sends out logs by email, connects to the internet by itself, and allows remote users to connect to your PC.

Spectorsoft's eBlaster record emails, chats, instant messages, web sites visited and keystrokes typed and then automatically sends this recorded information to the email address of the person spying.
The spy gets an activity report of latest chats, instant messages, keystrokes and web sites visited, plus a summary of all emails.
You can install it normally, or you can send it to a target machine as an email attachment the same as any other virus or trojan.


The information gathered by the program is, as a matter of routine, sent via SpectorSoft's computers. Not only is the spy seeing all the IDs, passwords, messages and credit card information that's being typed into your computer, but so is SpectorSoft.


-------------------------------------------------------------------------------------------------

The line between "spyware" and "trojan" blurs

Advertising parasites continue to become more and more invasive as various lowlife script kiddies come up with new ways to generate income by hijacking your computer. If you have any doubt of that, look up xupiter or lop.com on google.

Without a doubt, those are the two most infamous of all advertising parasites,
mainly because their techniques are so clever and because they both go to such great lengths to resist detection and removal.
However, as difficult as it is to imagine, there are worse things out there.

A new trojan dubbed LinkReplacer by Andrew Clover started making the rounds a couple of weeks ago.
LinkReplacer consists of a BHO which adds a script to the top of every page viewed in an infected copy of Internet Explorer.
This script reads your cookies and sends them to a server located at wcft.net.
This enables the attacker to steal passwords and other account information; any information stored in your cookies.

The attacker could also remotely instruct your browser to download and execute any software they choose.
In practice, this is used to install updates to itself automatically.
In theory, it could be used to download and install any number of keyloggers, trojans, or other surveillance software.

Another recent arrival to the parasite scene is Clientman.
I honestly don't know what it does, but Clientman came to my attention after it was added to the detection database of Spybot S&D.
This program defeats the protection of older versions of ZoneAlarm firewall.
When it tries to contact its maker's server, it will set off firewall alerts.
If the firewall is ZoneAlarm, Clientman will automatically "press" the "allow" button, after "checking" the box which makes the decision permanent.
Newer versions of ZoneAlarm have protection against this sort of exploit, but it is an optional setting which is not enabled by default.

Both Spybot S&D and Ad-aware target these two parasites.

http://www.spywareinfo.com/newsletter/arch...pril-2003/9.php

################################################

WEBBUGS nasty little critters that are invisible undetected and just as nosey as spyware;

A Web bug is a graphic on a Web page or in an Email message that is designed to monitor who is reading the Web page or Email message.
Web bugs are often invisible because they are typically only 1-by-1 pixel in size.
They are represented as HTML IMG tags.

What information is sent to a server when a Web bug is viewed?

The IP address of the computer that fetched the Web bug
The URL of the page that the Web bug is located on
The URL of the Web bug image
The time the Web bug was viewed
The type of browser that fetched the Web bug image
A previously set cookie value

http://www.privacyfoundation.org/resources/webbug.asp


The free programs , Proxomitron & WEBWASHER classic will filter webbugs , and bugnosis is a program that will detect most webbugs but cannot stop them...

other good shareware progs include Admuncher , Spyblocker and various other ad blocking filtereing software..

If you have a firewall with the function to block images by size then this may be enough to prevent them...or if your lucky your firewall will block them for you.
http://www.webwasher.com/client/home/index...html?lang=de_EN


WEBWASHER Guides:
- http://www.pacificnet.net/~bbruce/workshop.htm


More on webbugs:
http://www.bluetack.co.uk/forums/index.php?showtopic=2093

http://www.securityspace.com/s_survey/data...102/webbug.html
http://www.eff.org/Privacy/Marketing/web_bug.html
http://www.spywareinfo.com/articles/webbugs/


############################################


In the US you can take further action against these Spyware Terrorists:

http://simplythebest.net/info/spyware.html

You may want to take action against any of the above or another.
The Federal Trade Commission (FTC) handles complaints about deceptive or unfair business practices.
To file a complaint, go to the FTC web site, call 1-877-FTC-HELP, or write to: Federal Trade Commission, CRC-240, Washington, D.C. 20580.

Several senators have been trying to get several new privacy laws passed. These laws will not get passed unless the American public strongly supports these legislations. Complain to your congressman! Find and contact your Congressman: http://www.house.gov/writerep/.

Currently the FTC has stricter regulations for deceptive advertising than they do for privacy issues. Where an advertisement must be fully qualified as to claims of what a product can and cannot do, the FTC only "encourages" a business to have a privacy policy and there are no regulations as to qualifying what information can be gathered or what its purpose or use will be. Only recently have they begun to address the issue of privacy statements. Businesses are not regulated as to what information they can or can not gather nor what they do with the information. Information about consumers are considered assets that can be sold, transferred or acquired at will.

If your complaint is against a company outside the US, file your complaint at http://www.econsumer.gov/.

do it now !


#################################################
This is a "lo-fi" version of our main content. To view the full version with more information, formatting and images, please click here.
Invision Power Board © 2001-2012 Invision Power Services, Inc.