Archive: Spyware

Sometimes you see a malware implementation that you have to have respect for the cleverness/ingenuity of the design. These pests can be dastardly to get rid of, but essentially this pest was occasion…

These stories come up from time to time. A free giveaway of some sort and it turns out that there's spyware or a virus embedded, company gives a big "whoops" and fixes things by replacing them.... Mc…

Some time back I remember an article I had on vcodec not being a legitimate video codec. At the time there was some malware claiming to be vcodec and "required" to view some content.... well, posing …

Yes, it's another wolf in sheeps clothing. This time around Sunbelt is reporting on "Trust cleaner". Keep your eyes out for this one, among other things it plants an altered version of the Google pag…

Wolves in sheeps clothing are the label I give to those rogue antispyware, or antivirus programs that bring pests instead of protect against them, or are otherwise questionable in their tactics. Tita…

It went un-noticed by most people for a few years. After all, the ones that were affected were just those that were "asking for it". Where to start. Let's see, back in the day there were some that se…

ADTMAG.com has an interesting article talking of the convergance of spyware and more sophisticated phishing attacks. They talk about the convergance of viruses and spam engines that happened in 2003 …

Incidents.org had an entry in the last couple days on a malware infestation that was interesting and showed a couple things. 1) You can't bet on antivirus to keep you safe (the initial installer was …

Incidents.org has another interesting post about a spyware site. One of the handlers ran across it while doing a search for an educational institution. (They've used a wildcard in the dns record so t…

There is no doubt that spyware is a problem, but when a vendor of anti-spyware software claims 87% of pcs have on average 34 pieces of spyware per machine installed...... you do have to wonder. And w…

Sunbelt blog has the details on a spysherriff clone called pesttrap (distributed through pesttrap.com). I guess clone is not the best word as they're calling it a "variant" which suggests to me that …

There's a good post at Spyware Confidential about the removal of the SpyAxe and SpywareStrike pests that are circulating widely these days. There is a good CastleCops Wiki page with Malware removal i…

Strange AIM worm going around. It apparently includes an interesting combination of rootkits, a rootkit detector, spyware/adware, and a specialized bittorrent client. The machines can then be control…

Our "good friend" spyaxe, which is one of the "wolves in sheeps clothing" that masquerade as security software, but in actuality are delivered WITH spyware, has a new clone. Apparently SpywareStrike …

After my Windows 98 tests which failed to exploit the system with either the first or the second vulnerability, I started wondering how well the antivirus companies were doing in detecting this secon…

Ok, I wasn't quite satisfied with the results of the tests against the first version of the WMF (Windows Metafile) zero day exploit that's now up to 4 or 5 days or so... Windows 98 is listed as being…

I've spent some more effort on trying to infect Windows 98 SE in a virtual machine with some of the exploit samples I can find. The first attempt was at a website with the .wmf download. No luck infe…

Since there's been quite a bit of flux the last couple of days I thought I'd try to "reset" the situation and give a general overview of where we stand now with regards to the recent WMF zero-day exp…

This is going to be a rough start to the new year for IT staff and computer users.... There's coverage at Incidents.org, the sunbeltblog and f-secure of the latest twist in what will likely be a BIG …

Just when you thought we had a good understanding of the recent zero-day WMF (Windows metafile exploit) it's worse. Sans is reporting on a new variation on the exploit released today. They have gone …

There's a bit of controversy over the suggestion that Hardware DEP seemed to protect against the WMF zero day exploit. Sunbeltblog has responded to the controversy. George Ou in the first link above …

This is really the same zero-day wmf vulnerability, but there is a twist. It's been found that Lotus Notes v. 6.x and up are vulnerable to the Windows Meta File (WMF) exploit that's making the rounds…

I notice that the Sunbelt Blog has some instructions up for blocking the zero-day Windows Meta File (WMF) exploit with their newly acquired kerio firewall. (Free or full version.) Either version can …

Sorry, but to get into the guts of what I found in the wake of the WMF exploit, I did leave out another important step in the cleanup process. IF you are trying to clean up an infested machine one of…

I haven't checked to see if these are already on other block lists for the WMF exploit, but the following addresses are advised to be blocked (from f-secure).... toolbarbizbiz toolbarsitebiz toolbart…

One other note from the previous series on WMF exploit infestation cleanup. Among the multiple popups that came when launching internet explorer, most were directed at the site http://60.topnssearch.…

Can I say enough times that after a bad trojan infestation you should format and reinstall? I've cleaned up the infested image that I "sacrificed" to the WMF exploit and as I've said you're pestware …

Browser helper objects (BHO's) are listed in the registry and load with explorer when it runs (Internet Explorer/ File explorer are so closely tied it affects both.) I've used BHOdemon in the past to…

So, I've got most of the baddies cleaned out and I'm not getting popups anymore. No nags on boot, the boot process is quicker, but is it really clean? I found a few files (winlogon.exe, alg.exe in pa…

On the next boot I was greeted with the above message C:\windows\system32\kernels64.exe not found please make sure the path......correct.... blah blah blah. Back to msconfig. Everything there now loo…

At this point, I needed to rename or delete some files that windows would not let me touch. I had this winlogon.exe running from a suspect directory c:\windows\inet20001 and windows wouldn't let me k…

OK, so, I'm busy killing off running processes and fire up MSConfig to try to keep them from coming back on the next boot. To launch msconfig go to start, run... type in msconfig and click ok. The st…

After getting into Task Manager I saw a number of suspicious processes. There were a lot of things running as my user that I didn't recognize. kernels64.exe, vxgame6.exe, vxgame4.exe, mm4.exe, vxh8jk…

The first problem I ran into in cleaning up after my infested Windows XP image was this error message. One of the first things I do in cleaning an infested system is try to kill off running process t…

Spyware Confidential has the top 10 tips to keep that new pc spyware free. Some good tips here and these should be on the checklist when setting up a new pc any time of the year... Paraphrased here..…

There's a joke that many people bring out when new Windows viruses hit big.... it goes along the lines of, "download a fix here" and the link points to a knoppix linux livecd download, or a Mandriva …

All in all, what I've documented was a bit over three hours worth of attention to the machine (much more for the full scans, but I didn't have to stand and watch them.) I didn't document a sidetrip t…

Before I get things wrapped up, I like to scan rinse and repeat until the scans come up clean. So, this scan of AVG gives a chance to delete the archive entry I mentioned the first pass it took. And …

Ok - about 22 or 23 critical updates for Windows ME. I'm suspecting it's never visited the Windows update site. While it's going I make sure that the adware scanners and antivirus scanner get to pull…

There are so many "wolves in sheeps clothing" or maybe I should say wolves in sheepdogs clothing... Anyway, so many nasty malware's that pose as protective utilities. Spyaxe, spytrooper, spy sherriff…

All right, now it's time to give ad-aware a spin. I like being able to use several spyware scanners to get full coverage and cleaning. Ad-aware and spybot s&d are usually my first two choices. Realiz…

Things are going to be interesting. A lawsuit has been filed against the three listed above, everyone's favorites.... 180solutions, Direct Revenue, and eXact Advertising. This is coming from the Sunb…

You can tell we're in the last 10-12 days of the year when we start seeing all sorts of year end retrospectives, year's in review, countdowns of the top ___ of ___year ending___. Well, spyware has se…

Ok, another reboot after the BHO cleaning. Things are a good deal more responsive now, less disc swapping going on. (I suspect that those three missing BHO entries may have been causing the slow down…

The SecurityFix is reporting on a security breech at reevesnamepins.com a company that supplies (among others) law enforcement personnel. Apparently, CardCops (which monitors for possible stolen data…

(or for that matter, rogue or suspect antivirus.) What's fascinating about this category is most of these products either use security vulnerabilities to get into a system, or merely convince a perso…

Ok, it's BHOdemon time... installed from cd and on starting: BHOdemon bhotb-all.html not found, no web connection downloading on other machine. Finally get it to work copying from another machine. Bu…

OK, we're moving on to BHOdemon to take care of the browser helper objects. Unfortunately it looks like BHODemon is not being currently maintained, the developer has had a housefire. I am very sorry,…

So, AVG has been scanning away finding things we've really got a foothold on the system and the malware has a fight on it's hands. It's good to see progress. Up to this point we've had multiple Spool…

Picking up from last time... AVG was failing to install with a peculiar registry error. (Which I didn't see much reference to online.) OK, so here is another fruit of the online search (so many bugs …

Ok, the last post got a bit long with the hijackthis log, but I wanted to include the whole picture. I put a few comments in, but thought it might be useful to include the notes I took at the time. F…

Sunbelt has this warning about yet another fake security site. This one is laid out a bit different than the others we've seen in recent days. It's not quite the same spoof of the Windows Security Ce…

This is the first in a several part series documenting the cleaning of an infected PC. The only real noteworthy item is that it was a dial-up only connection and was rather infested for that. (On par…

Spyware Confidential is writing of complaints from Wrestling fans of several wrestling related sites that have become sources of unsolicited spyware and adware installs. Some of them are aware of the…

It's funny, in the last couple days 180solutions had a blog post that was somewhat... what's the term I'm looking for ? well they were quite defensive and concerned about "anti-spyware zealots" about…

An exploit for last weeks zero-day (0-day) javascript vulnerability in Microsoft's Internet Explorer is in the wild. I saw this post from Sunbelt a couple nights ago go up and disappear, at the time …

It's interesting some years ago when viruses on Windows machines were SOOOO plentiful it seemed like that's all I spent my time cleaning up, I thought... "you know, most viruses are prankster-ish pro…

TRUSTe has announced a program to certify software downloads. Among them are certifications for adware and "trackware" (spyware?). The bullet summary for the article claims this will bring an end to …

In spite of the FTC's raid of Enternet Media and charges against them for various details such as deceptive install practices, unfair installation of code, failure to disclose nature of bundled softw…

You might be cautious visiting the free sites at cjb.net according to the sunbelt blog many of them are unwittingly providing spyware downloads to users. The download is for a 180solutions pest. If y…

The bad news is that the spyware situation for home pc users can be murkier every day. I remember a particular user who once installed an antivirus program because a popup appeared claiming to have f…

A bit of good news on the spyware front, the FTC has announced that it's frozen the assets of a spyware ring. Apparently they spread spyware through a network of sites and blogs that pushed ringtones…

Sunbeltblog has a story about the "VideoC" video player... apparently they discovered this when visiting a site. A video starts to play and then abruptly stops and claims that "VideoC" player needs t…

OK - for starters, the keylogger that sunbelt talks about here is a legitimate piece of software for sale. Like anything though it could have illegit uses. Apparently retrocoder is upset that Sunbelt…

"It outta be illegal" is the first thing I usually hear as I start the long process of sanitizing a spyware infested windows machine. The fact is some parts of it ARE, some are just ethically questio…

Spyware Confidential has an article and there are more details at the spyware warrior. Of a particularly bad spyware infestation triggered by the visit to ONE web site. Apparently she was investigati…

Sunbelt has found another keylogger in the dumaru family and has updated their free tool to scan for it and clean it up. This is the same family of trojans/keyloggers that contributed to the large ID…

The sunbeltblog has uncovered a fairly interesting document. (Dated May 16 and originally in Russian) which appears to be the wishlist of a spyware criminal. (Slime was my own definition...) It's an …

Sunbelt blog is reporting on some of the countermeasures that some banks are starting to use to frustrate keyloggers. One trick is to request that your pin - number be entered in reverse or a specifi…

Surprise... what is surprising is how high it's infiltration is reported to be. Spyware confidential is reporting on a Webroot survey claiming that spyware in the enterprise is at 80% (does this mean…

US-CERT is addressing the issue of spyware. According to Spyware Confidential, they've released a document (pdf) on the matter, including techniques to guard against spyware. Education and awareness …

As if you needed another reason to not like SPAM ( no, not the hormel product, we're talking junk mail here.) A couple days ago I mentioned a post at the sans institute talking about an email that wa…

Since the massive id theft ring was uncovered, I've been reading the Sunbeltblog frequently. Today, they have an interesting post about the various explanations for spyware on peoples computers. They…

SecurityFix is talking about the computer security industry. Further, computer users spend $9 billion a year on computers repairs from spyware and antivirus. This reminds me of a recent story of a ma…

There another two fascinating posts in the saga of the massive identity theft that was reported in the Sunbelt blog. For starters they detail the beast here. It sounds truly devious, MAY still be rel…

Over at the Security Fix, Brian Krebs is talking about spyware and the fact that keeping up-to-date on patches, and running current antivirus with current definitions is not enough to protect your ma…

It's an older post, but I just discovered it.... July 21st... spware confidential reports on a virus masquerading as an itunes installer that actually brings along some adware (4 different applicatio…

Sunbeltblog has another update related to their earlier story about the massive identity theft ring. In this story they make clear that the keylogger was NOT directly related to coolwebsearch. It was…

Sunbelt blog, reports that they have uncovered a MASSIVE amount of personal data, ranging from usernames to passwords to banking information and much more while investigating spyware. They found keyl…

Well, things are shaping up a little better today on some fronts. My webhosting provider apologized for the offensive tone of the subject of their message to me. (Given that they provided the script …