Fighting Malware
I've spent the last two days trying to recover what should be mine to begin with, my web browser and its settings, my system and how it acts, my bandwidth and how it's used. I have yet to find the source of where it all began, but little problems kept creeping in day after day. At first I could ignore them, like when I rebooted my homepage was reset to www.searchnet.net even though I set it to google.com through IE (Internet Explorer) options, and on top of that, I regedited it and it still reset. The next day out of nowhere a couple porn windows popped up out of nowhere and kept doing so over the course of the week. Then, one day when my system was running slow, I looked @ my processes list and noticed there were a few browsers open that I hadn't opened. They didn't appear on my taskbar and they used the minimal amount of memory IE could. (a little under 9k) From there I had had enough...and went to fix my system (for all you 1337 people out there, of course I shouldn't be surfing with IE, and the easy fix was to surf with a different browser, which I will, after I fix IE, it's a challenge now)
Let's get moving to what you're wasting your time reading this for, what to do to keep your machine from having the same problems. First of all let me clarify the differences in today's 'malware'. Malware is an all encompassing term, the combination of the words 'malicious software' and ranges from web bugs to full fledged trojan horses. In this brief tutorial I'll be concerning myself with adware and spyware.
Adware:
Adware is again the combination of two words, 'advertising software'. Normally adware comes bundled with legit freeware programs. The price you pay for the program is seemingly nothing, that's why it's called freeware. The way the creator of the program generates revenue for himself is with the adware. Adware will install with the freeware program, and if you try to uninstall the adware the program may cease to work. Adware will normally install components on your machine and transmit marketing information whenever you are online. If you find the banners annoying, there's usually an option to *upgrade* to the non-freeware version whcih along with some other minor changes, will rid you of all the adware. The main difference between adware and spyware is that adware contains a disclosure telling you that they will be using your information. If you're worried about such things, which you should be, some of the most downloaded programs, such as kazaa (or any p2p for that matter) tend to contain the largest amount of adware/spyware.
Spyware:
Spyware essentially is the same thing as adware in the sense that it collects information from your computer, but spyware does it without the end user's prior knowledge. In the beginning this wasn't too big of a deal, all that it kept track of was benign marketing information, what you buy and where you buy it, but lately lately this form of malware has grown to target what music ads it forces in your face, what web pages it links you to without your consent, even to the extreme, installing programs, however small, without your consent. Spyware does not respect your privacy in any way, shape, or form. There is nothing in the terms of agreement or EULA that would have warned you of the spyware you were installing, and sometimes spyware is installed simply by visiting a web site. You don't have to download anything (I should clarify, you may download something, but you didn't agree to it, you went to a site to browse, and some malicious code was executed and before you know it, you begin having the little quirky problems I did and it's a pain in the arse to get rid of) Another problem I have with spyware isn't the transmitting of my person data, I couldn't care less, but it is illegal in the United States to gather information, benign or not, without parent's consent, of children under thirteen years of age. There is no way for the program to know who is surfing, and when a naked midget chained up to another naked midget chained up to Iggy Pop on steroids pops up for all to see, it makes for some angry parents.
Some common habits of spyware:
- Collects information from your computer without your knowledge and/or consent
Transmits a unique code to identify you (for tracking purposes) without your knowledge and/or consent
Collects/transmits information about your computer use or other habits without your knowledge and/or consent
Installs itself on your computer without your knowledge and/or consent
Keeps reinstalling itself, no matter how many times you remove it
Performs other unwholesome duties without your knowledge and/or consent
Keeping your machine malware free:
Thanks in a good part to Steve Gibson of www.grc.com and his OptOut program (which is no longer available for download, but he does have an up and coming program, labeled the GRC NetFilter, which looks to combine features of firewalls, adware/spyware destroyers, anti-virus and more into one program -- if everything turns out right, it will be quite impressive) we have over the years come a long way. He was one of the first to create a program to search out the adware and from there our good friends at lavasoft, http://www.lavasoft.de, took up where he left off and created a great program to detect and take care of adware, properly dubbed Ad-aware . For the direct download go here (as of 11/10/03). This is a straightforward program, install it, have it scan your entire system, and you might be amazed how many web tracking bugs, cookies, and 'attempted browser hijacking devices' are detected depending on how clean you keep your system.
Adware is the first step, a good program, but doesn't do anything overly exciting in my opinion. (as it is aimed more at adware than spyware) The latest and greatest of programs I like is called Spybot Search & Destroy . Spybot S&D, http://www.safer-networking.org, is used to detect and remove all sorts of spyware from your system. The direct download for the latest version can be found here . Another straightforward program with a nice interface and you take a few minutes to read what it offers it is an enormous help.
The last program I'm going to link you to takes a little more knowledge to know what to do with the results. It's called hijackthis and can be found for download here Hijackthis examines key areas of the registry and hard drives and lists their content for you to review. It is then left up to you to decide what to do with the results so be careful, if you don't know what you're doing don't remove it, you could end up removing things that legitimate programs need to run. I suggest posting your results on a computer secutiry forum for help if you don't know what to do. http://www.phorce.co.uk/forums/ will be sure to take care of you ;o) (tell them I sent you, you'll get a real special welcoming I'm sure)
I'm going to end it right there, there's a lot more to go into, such as scumware, trojanware, and yes, something called 'drug dealer ware'. That's enough to take care of probably 95-99% of the problems currently caused by adware/spyware. If you still are having problems, again, post on your favorite computer security site. Also, and maybe I will revise this tutorial after some feedback is given, programs such as tcpview (http://www.softpedia.com/public/cat/10/7/10-7-12.shtml) or procview32 (http://www.freedownloadscenter.com/U...rocView32.html) can also be used in combination with knowledge and other programs as a powerful way to fight off unwanted malware. Lastly, http://www.cexx.org/ looks like it might be an interesting site to check in on if malware concerns you, other than that, google it.
Star****ers|Inc
