2004 Spyware Mini Tut

Printable View

August 11th, 2004, 10:08 PM
StatiCoR3

2004 Spyware Mini Tut

Hello all, i used to be sk18 but got banned due to the same mistake memory made (sharing acc passwords), well im past that and this is my first tut on AO ever. I have to say that Ennis inspired me on this one, he wanted a tut on spyware so here it is, i just dont know if this is exactly what he expected?

XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
XXXXX00XXXXX00XXXXX00XXXX0XXX0XXXX
XXXX0XX0XXX0XX0XXX0XX0XXX0XXX0XXXX
XXXXXXX0XXX0XX0XXX0XX0XXX00000XXXX
XXXXXX0XXXX0XX0XXX0XX0XXXXXXX0XXXX
XXXX0000XXXX00XXXXX00XXXXXXXX0XXXX
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
------------------Spyware Mini Tutorial-------------------

----------------------------------
1. Introduction & Spyware Problems
2. Protection
3. Recover
4. Additional Information
----------------------------------

1. Introduction & Spyware Problems

What is Spyware?
Spyware is any software that collects ortransmits information about your computer use or other habits without your knowledge and/or consent.

How did I get spyware on my computer?
It is possible to get spyware from all of these: viruses, websites, shareware, freeware and even paid for commercial software. You can get spyware just by visiting a website or opening a file you downloaded from a p2p application such as kazaa. Best advice I can give you here is that if you are unsure of a file containing spyware and you lack the knowledge, then either 1. do some research on the file on a search engine or 2. stay away from the file.

How can I identify spyware?
It is relatively easily to identify spyware at some time. They can change your Homepage, install new toolbars in Internet Explorer, constant pop-up advertising, Unfunctional software or they might also block ports causing all kind of problems.

----------------------------------

2. Protection

You can never be spyware free or at least for a certain amount of time because new spyware is being released every week. What you can do is keep up with them and secure your system by downloading a anti-spyware software (I will have links to some freeware anti-spyware software in 'Additional Information' section) , and I recommend more than just one because many times an individual anti-spyware software will miss some spyware. Besides this we have to keep them updated and scan regulary, remember the more the better ;). Also dont forget to configure a firewall which drastically decreases the chance of catching spyware. Simply download one of the firewalls from the link at the bottom (List Of Firewalls) and install it.

----------------------------------

3. Recover

Recovering (deleting) spyware is relatively simple. All you have to do is download one of the anti-spyware softwares listed below and do a few scans, it will identify the spyware and it will either be quarantined or deleted. Remember it will NOT identify nor delete a spyware it doesn't recognize, so update the application before scanning and if you have a new spyware that just came out and your anti-spyware software doesnt idetify it, then go to a website like http://www.symantec.com or http://www.mcafee.com and check if they have anything on the spyware. Another possibility is if you know what spyware it is and its location but your application doesnt identify it, you can always boot up in safe mode and manually deleted it (the classic way :D). To do this restart the machine and just press F8 a few times and a list of boot modes will come such as normal or safe mode, i recommend the safe mode [no networking].

----------------------------------

4. Additional Information

To find more information on spyware and things related to spyware use the power of Google.

Freeware software
Spyware Search and Destroy
Ad-Aware
Spyware Blaster
Panda Downloads
List of Firewalls
August 11th, 2004, 10:21 PM
gore

Re: 2004 Spyware Mini Tut

[QUOTE] Originally posted here by StatiCoR3
[B]
------------------Spyware Mini Tutorial-------------------

----------------------------------
1. Introduction & Spyware Problems
2. Protection
3. Recover
4. Additional Information
----------------------------------

1. Introduction & Spyware Problems

What is Spyware?
Spyware is any software that collects ortransmits information about your computer use or other habits without your knowledge and/or consent.

[/quote

That's it?

Quote:

How did I get spyware on my computer?
It is possible to get spyware from all of these: viruses, websites, shareware, freeware and even paid for commercial software.

How?

[quote]
How can I identify spyware?
It is relatively easily to identify spyware at some time. They can change your Homepage, install new toolbars in Internet Explorer, constant pop-up advertising, Unfunctional software or they might also block ports causing all kind of problems.[/quote

Like?

Quote:

2. Protection

You can never be spyware free or at least for a certain amount of time because new spyware is being released every week. What you can do is keep up with them and secure your system by downloading a anti-spyware software (I will have links to some freeware anti-spyware software in 'Additional Information' section) , and I recommend more than just one because many times an individual anti-spyware software will miss some spyware. Besides this we have to keep them updated and scan regulary, remember the more the better ;). Also dont forget to configure a firewall which drastically decreases the chance of catching spyware.

How? you're not explaining anything.

So Linux and BSD get spyware a lot too? Where?

Quote:

you can always boot up in safe mode and manually deleted it (the classic way :D).

By doing what?
August 11th, 2004, 10:34 PM
Tiger Shark

Disclaimer: Nothing that follows is as a result of the "issues" that preceded this on AO as a whole. I never really noticed you that much and was never "bothered" by you.

That said....

Quote:

It is relatively easily to identify spyware at some time. They can change your Homepage, install new toolbars in Internet Explorer, constant pop-up advertising, Unfunctional software or they might also block ports causing all kind of problems.

That statement is most misleading. Much of the blatant Adware people pick up may display such symptoms. However, the "better" Adware/Spyware/Malware, (from here on known as ASMware), is much more subtle about it's activity. Set up a Snort box and go to www.bleedingsnort.com and d/l the malware rules alone. Fire up the browser and go for a wander round the "free" sites on the internet. Then take a look at the Snort alerts. Your computer will show you nothing.... But Snort will show you 100 alerts.

Quote:

Also dont forget to configure a firewall which drastically decreases the chance of catching spyware.

Sorry. Far from true.... ASMware doesn't go searching the internet for boxes it can exploit which a firewall might help you with..... That's called a worm. When you pick up ASMware it's because you request it from a site. Since you requested it anything but a high priced content filtering firewall will allow it..... And even some of those will let it through depending on the rules you set. OTOH, Personal Firewalls installed on the local machine that look at the application that initiates the connection do go a long way to helping find some of the ASMware.

Quote:

Another possibility is if you know what spyware it is and its location but your application doesnt identify it, you can always boot up in safe mode and manually deleted it (the classic way ).

You make this sound all rather simple.... It isn't.... just the other day i spent 2 1/2 hours trying to remove a single piece of ASMware. Tracking down the initiating process can often be an irritating process that requires a very good knowledge of determining what is running, when it runs, where it runs from and how to locate the keys that run it. Some ASMware will subvert valid programs making them appear "normal" transactions and deleting them could have deliterious effexts on your computer.

Finally.... You called it "mini". This tutorial really doesn't reach that level. ASMware is a huge subject and it gets bigger every day. To say that you skimmed the issue is an understatement beyond belief which leads me to belive you transgressed rule one in the sticky in the tutorials forum that says you shouldn't post tutorials to try to improve your AP status.......

For the benefit of your new identity I would suggest you delete it, work on it - hard - and re-post..... I look forward to the final version......
August 11th, 2004, 10:50 PM
Und3ertak3r

Quote:

quote:
Another possibility is if you know what spyware it is and its location but your application doesnt identify it, you can always boot up in safe mode and manually deleted it (the classic way ).

You make this sound all rather simple.... It isn't.... just the other day i spent 2 1/2 hours trying to remove a single piece of ASMware. Tracking down the initiating process can often be an irritating process that requires a very good knowledge of determining what is running, when it runs, where it runs from and how to locate the keys that run it. Some ASMware will subvert valid programs making them appear "normal" transactions and deleting them could have deliterious effexts on your computer.

Some of the ASMware will even load with explorer.exe meaning that it will run in safe mode.. aright royal pain in the Asembly Code

Cheers
August 12th, 2004, 12:11 AM
Nokia

Quote:

I have to say that Ennis inspired me on this one, he wanted a tut on spyware so here it is

I have to say, he must be over the moon, everything he ever wanted to know about spyware and all in one tutorial! Your just too kind, you shouldnt have put yourself through all the trouble it must have took!

Quote:

i just dont know if this is exactly what he expected

:rofl: :rofl: