New badass piece of ad/spyware.

Recently a friend of my in class had a fresh install of win xp pro. We needed if for setting up a apache/php/mysql machine for our classes programming and database.

He surfs to the site www.phazeddl.com (warez)

naturaly pics up some ad/spyware.


Only this was a nasty kind of breed. Most prominant was changing the desktop to some item telling him the computer was infected (really ??)

No name was given. A link led to a site telling him to pay money for a spyware/adware remover.

Spybot S&D, Lavasoft Ad-aware Se, CWShredder. were defensless. (updated and all)

running them in safe mode or normal mode didn't make a difference. But unlike normally even though we dind't surf at all. We seemed to be picking up more stuff.

Spybot and ad-aware were removing stuff and when whe ran them again there were new things installed.


We decided to go and do a LOW level format(okay maybe thats a bit of overkill). Then reinstalled windows.
===

This bit of adware interesst me because its so agressive.

I'm setting up a virtual pc and see if i can get it in there to see what the damn thing is doing. Lets see what it turns up.

Anybody else getting very agresive peices of spyware and adware ?

-Take care...

HiJackThis might have helped before the format.... You can take the box back to practically zero with it if you like and then start bringing things back to find the offender if you so chose.....

Question: Why on earth did you feel the need to go to that site to get those apps???????

Quote:

---

Question: Why on earth did you feel the need to go to that site to get those apps???????

---

All those apps are free from the sites anyway!! So I am with TigerShark on this one.

- MilitantEidolon

Personally think this domain needs to get pulled from the owner
for (if proven) violating existing US laws and the domain is in San Francisco Calf.

I think the hosting company needs to get notified of this problem.
Any legit Hosting Company, co-lo or ISP would not put up with this problem.

As a note: I did go to this site and no Ad-Aware was present...
My WinXP Pro w/sp2 did not get infected.. and Norton Did not Ring any alarm.
I also noted that there were plenty of available wares that
could be used by the Feds as a reason to shut it down and
charge the domain owner, and the BSA for copyrite violations.

Quote:

---

I did go to this site and no Ad-Aware was present...

---

But you didn't d/l any of those nice "free" things and install them, did you? ;)

Moonwolf,


I just went there as well, with xp. No bells or whistles going off either. I did exactly what you said you did. Either it was a one time event or someone must have done a few other things you failed to mention as Tiger Shark suggested:

Quote:

---

But you didn't d/l any of those nice "free" things and install them, did you?

---

cheers

It could be I was at fault in my first post.

I have no idea why he went to that site.(or why he did it with IE). Noted should be that the box at that moment wasn't updated in any way and using IE. (he was probebly loooking for a cracked opera)

We tried to use hijackthis and some less know anti spyware and other apps but none made a difference. (our teacher was at a loss on this too)

In trying to recreate the event... I failed it was impossible to get anything remotly interesting from the site.

But the site loads other sites with the downloads in frames so it could be from one of those. And i dont plan to click each and everyone of them downloads.

Anyway the other question. Is anybody seeing a development with more agressive spyware(poseble even spyware downloading and installing more spyware). Leaving normal defensive programs defensless.

How about you tell us what adaware and spybot are catching, that way we can tell you if there are any removal tools or special plug in's for adaware.

I'd like to tell you. But i can't

We never wrote the stuff down. We wanted to get rid of it.

I was planning get to know more in a secure place, but since i can't pick the thing up again so thats to bad.

I can say this. The things it was installing were mostly toolbars and the likes. Getting rid of them was no problem the program getting them on the box was.

Also the thing also send out net send advertisments across the network every so minutes. (part of the reason we wanted to get rid of the damn infection)

We even supsect it of cross spreading to another windows install on that hd.(so the low level hard disk format to get it OFF of the disk)

Nasty thing hope i won't have to see it again.

Quote:

---

Originally posted here by MoonWolf
Only this was a nasty kind of breed. Most prominant was changing the desktop to some item telling him the computer was infected (really ??)

No name was given. A link led to a site telling him to pay money for a spyware/adware remover.

---

If the desktop read "you're in danger" then this is a hijack we started seeing at SFDC in early June. There is an uninstaller located at http://www.smart-security.info/removal.html

Just FYI in case anyone else runs into it.

:)

Yes is did.


Mistery solved.

I believe I dealt with the same spyware you are talking about. Nothing I could do would get rid of it. I ran every spyware and adware removal tool I could find with no luck. For me it was a popup that only came up when I was online. It would open up multiple popups as well. So for curiosity I got online and waited till the popup came and ran netsta /a from the command line and noticed I had around 3 connections connected to abetterinternet.com (if I remember correctly that was the address). When I closed the popup and ran netstat /a the connections were gone. I tested this multiple times and got the same result. The scary part was that if you didn't notice it the popups would just stack up and the connections would increase as well. I tried going to the site listed in the connection under netstat but got a 404 error (go figure). I eventually had to wipe and reload the PC cause it was extremely frustrating. Thanks for the link to the removal tool. I'll make sure I use it at work on customers computers with the same problem.

This site is in fact relatively safe if you are behind a firewall, and use something such as SpyHunter to protect your computer from malicious code. Also I would recommend using another browser besides IE to search the internet with. Perhaps, Mozilla.

Spybot should be used on a regular basis if you find the need or curiousity to visit these types of sites. A firewall and anti-virus program should also be ran continuously throughout your endevor as many websites that provide illegal/copyrighted content for free protect themselves from people that shouldn't be there by embedding a virus/malicious script on the web site. For example, if you go to www.warez.com and type something in the search engine, once you hit SEARCH you are hit with a virus. If you ware seeking a hacked/cracked program, you may be surprised to find that most real hacker websites, are not at all what they seem, unless you know exactly how to get to the good stuff. I'd give some examples, but seeing how you are all discussing the possibly of having the government shut down the website, I chose not to disclose any such info.

By the way, phazedll, is not a reliable source for what you are looking for, but you are headed in the right direction. Read the website carefully.

CrrrAzzy1

Well... that's what you get for going to a warez site!

Greetings:

Quote:

---

Originally posted here by malefact0r
Well... that's what you get for going to a warez site!

---

You know, this is a very good point.

Why on EARTH anyone trusts any of these warez sites is above and beyond me. You're talking about a group of people who spend their time helping others rip off software companies. How ethical would you expect these people to be, and why would you trust them to deliver what they say they are delivering to you?

Yes, companies like Microsoft have some responsibility in helping to curve the malware/adware/spyware problem. BUT, people also need to take some of the responsibility too, and acknowledge that if they're engaged in illegal activities with the help of organized crime (which most of these warez sites are shown to be run by), they shouldn't expect to have a safe and secure computing experience while doing it.

Sure, innocent people doing innocent things get infected, and that needs to stop. Although, I would be willing to place a pretty hefty bet that the vast majority of these types of infections are received by people trying to do things they shouldn't be trying to do anyway......