**What is Spyware? **
A technology that assists in gathering information about a person or organization without their knowledge. On the Internet, “spyware is programming that is put in someone’s computer to secretly gather information about the user and relay it to advertisers or other interested parties.” In some cases even after these programs have been removed from your system. As such, spyware and or Malware is cause for public concern about privacy on the Internet. These type applications also in many cases can cause unknown browser problems.
How it hits you?
When your Security settings are “soft” these sites take advantage of this and actually install software on your system without your knowledge or consent. In other cases downloaded software comes bundled with other “components” (spyware\adware) that you don’t realize exists until you start having problems or discover your browser has been hijacked.
------- x --------- x ------------
The GS members are advised to upgrade their Windows XP Systems (Gold/Original or SP1 Upgrades) to the latest Service Pack 2. This would help reduce the threats of Spyware Infection as the System and Internet Explorer Security is improved in this update. Here are some of the benefits of using SP2 with respect to Security and Privacy Issues.
Changes in Windows XP Service Pack 2 With respect to Security/AntiSpyware:
**Windows Firewall Update **
Updates and automatically turns on the powerful, built-in Windows Firewall (previously Internet Connection Firewall) to increase the security of your PC and reduce the risk of network and internet-based attacks.
**Windows Security Center **
The new Windows Security Center makes it easy to check security status and manage security resources by providing a single, unified view of key settings and tools.
**Windows Messenger Update **
Updates Windows Messenger with additional security features designed to help protect users’ privacy online.
**Outlook Express Anti-Spam Update **
Provides enhanced default security for a users’ e-mail by helping to prevent validation of an e-mail address by potential spammers.
**Data Execution Prevention **
Service Pack 2 reduces the risk of buffer overrun vulnerabilities by helping prevent certain types of malicious code from attacking and overwhelming a computer’s memory.
**Automatic Update (AU) enhancements **
Makes Automatic Updates simpler and easier to use with an improved dialogue box and new technology that helps narrow band customers download more efficiently.
**Service Changes to Remote Procedure Call (RPC) **
New security settings and registry key designed to ensure proper authentication and to protect users from potential exploits by limiting the RPC surface area that is exposed.
**Internet Explorer Information Bar **
Service Pack 2 provides better control over Internet Explorer downloads by installing a new toolbar that alerts end users to unsigned controls and downloads that could pose security risks.
**Internet Explorer Pop-Up Blocker **
Service Pack 2 installs a new, integrated Pop-Up Blocker for Internet Explorer that helps users take control and reduce unwanted ads and content.
**Internet Explorer Download Monitoring **
Service Pack 2 updates the Authenticode download dialog to provide better, more meaningful information about where code comes from and who wrote it to assist users in making informed decisions about whether or not to download and run code.
**Internet Explorer Security Improvements **
Service Pack 2 installs code-level changes in Internet Explorer that help protect against certain types of exploits. For example, it restricts script-initiated windows that can be used to hide or move Internet Explorer controls and conceal malicious activity.
**Internet Explorer Stronger Default Security Settings **
Service Pack 2 detracts from hackers’ abilities to attack a PC by restricting HTML in the local machine zone from running with elevated system privileges.
------- x --------- x ------------
For Users of Windows XP NOT USING SP2:
Recommended Minimal Internet Explorer Security Settings
Close all instances of Internet Explorer and Outlook Express
Open Internet Options from the Windows control panel and click the “Security” tab. Highlight the “Internet” icon and then click “Custom Level”. Choose “Medium” from the drop-down box at the bottom, then click the “Reset” button. Click ok, then click “Custom Level” again.
Set your options just as I have listed below:
.NET Framework-reliant components :
Run components not signed with Authenticode (Disable)
Run components signed with Authenticode (Prompt)
ActiveX controls and plug-ins :
Download signed ActiveX controls (Prompt)
Download unsigned ActiveX controls (Disable)
Initialize and script ActiveX controls not marked as safe (Disable)
Run ActiveX controls and plug-ins (Enabled) (This actually refers to Java and Flash, not ActiveX)
Script ActiveX controls marked safe for scripting (Prompt)
Miscellaneous :
Access data sources across domains (Disable)
Drag and drop or copy and paste files (Prompt)
Installation of desktop items (Prompt)
Launching programs and files in an IFRAME (Prompt)
Navigate sub-frames across different domains (Prompt)
Software channel permissions (High safety)
Userdata persistance (Disable)
Scripting :
Allow paste operations via script (Prompt)
Scripting of Java applets (Prompt)
General Recommendations (All Windows Versions)
How To: Prevent spyware from infecting your system?
- Install a firewall
- Install an Antivirus program
- Add a Startup Monitor (freeware) to protect your system ( e.g. Link )
- Improving the security of your computer (Microsoft )
How To: Safely removing these Parasites from your system
Beginners Users :-
Ad-Aware [freeware] http://www.lavasoftusa.com/
Once installed make sure to update via online before scanning!
Support Forum: http://www.lavasoftsupport.com/
Note: Lavasoft also has a HijackThis section at their Forum
*Experienced Users:- *
SpyBot [freeware] http://security.kolla.de/
Once installed make sure to update via online before scanning!
To double-check your system:-
Go to: http://www.spywareinfo.com/
Download “Hijack This!” [freeware] …
Direct link here
Since HijackThis does not (yet) come with a install routine, create a folder via Windows Explorer for HijackThis, then move the zip file to this folder. This way any backups created are saved in a legit folder. You should also make sure you are using the latest version each and every time you run HijackThis, as there are new detections added all the time.
Unzip, double-click “HijackThis.exe” and Press “Scan”.
When the scan is finished, the “Scan” button will change into a “Save Log” button.
Click: “Save Log” (generates: “hijackthis.log”) HijackThis Tutorial (recommended read http://www.spywareinfo.com/~merijn/htlogtutorial.html)
Next, go to: http://www.spywareinfo.com/forums/
Sign in, go to the “Spyware and Hijackware Removal” section.
Press “New Topic”, copy and paste hijackthis.log into your new message.
Visiting the SpywareInfo Forum or one of the other recommended Forums, to finish cleaning up your system is highly recommended. As neither Ad-Aware or SpyBot can no longer completely remove these pests. This is mainly due to new daily threats and the use of random generated filenames used by these parasites
Dealing with Coolwebsearch browser problem
There are now nearly 10,000 Coolwebsearch affiliates!
They do this as a “Pay-per-Click” scheme, basically getting a few cents for each user that gets hijacked to Coolwebsearch or one of it’s major affiliates. Nice guys huh? Most of these affiliates are Adult related, so be careful where you surf and practice Safe Hex!
One of the newer tricks Coolwebsearch uses is to block the infected user from accessing most major anti-spyware programs and sites. They are also suspected of the recent DOS attacks.
Remove tool Here
Removing Unwanted IE Menu Items
-
Scan your system with Ad-Aware or SpyBot (see above)
-
Run HijackThis! and remove items you want.
To manually remove from the Registry
Experienced Users Only !!!
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt]
Click open “+MenuExt” (left pane) Locate the desired Menu Extension (highlight)
Make a note of the corresponding (htm) file (right pane)
Right-click the desired key (Menu Extension) select: Delete
Note: always Export before editing the Registry.
Close Regedit, Open Windows Explorer
Locate and delete the “corresponding (htm) file” (if exists)
Repairing your Winsock Connection
If you have suddenly lost your Internet connection after removing spyware (such as NewDotNet, and Commonname) the following steps will help restore your connection.
