Major Spyware Problem!

Post Reply New Topic

I just thought to look up this:
https://launchpad.net/clamav-livecd
and through from there to:
http://www.volatileminds.net/projects/clamav/

It sounds such a handy thing to have, I've just download and burnt it!

You could just get something like the Knoppix Live CD. Then of course virus scan and do whatever else under that.

I just suffered through a reformat. Unfortunately, I had only made backups a few days before, so I can’t trust the integrity with a lot of these. I thought about that sort of a CD, but I have a dialup connection and it would be difficult. I think everything is settled down now, though I had a few traces earlier of an unrelated infection (perhaps from something I restored from a backup?)

For those running Vista, the free Comodo Firewall is a good alternative to ZoneAlarm to consider. Spybot, Ad Aware, and Avast are all excellent programs.

Hi
Using good antivirus is the second part. be prepared always. Back up all your important files in the first place.
I personally recommend avira. Doesnt keep your system clogged atleast. Norton is good protection. but literally eats up your resources.
Regards

Try using an OS that doesn't require virus protection for the most part. Like Ubuntu. It doesn't run Windows applications, but there are alternatives and it supports nearly everything.

Other than that, for Windows, I suggest downloading Firefox, installing it, installing Adblock Plus for it as an add-on and NoScript as it for an add-on. Install Spybot S&D and AVG. All of those can get you some security, but I think that you should be aware that Microsoft, who owns and maintains Windows, don't really care about fixing exploits in their OS.

Actually they do, which is why you can run Windows on a US DoD computer but not Ubuntu. I'd get into details, but suffice it to say Windows is more secure than 95% of everything else out there when a single machine or network is under a directed attack.

Since it has over an 80% market share on the desktop though, it is targeted as the OS of choice by most malcontents looking to write malware.

On any OS, the most important line of defense is the person sitting in front of it. Most operating systems are sufficiently secure that they must have your permission to actually install the malware (including Windows). Secondly comes a good set of backups. The ideal solution is a daily or hourly to an external HDD (or CD/DVD if the data doesn't change much), and an online backup such as Carbonite or Mozy. Third is AV - I usually run Microsoft Security Essentials on any machine I don't care much about, and pick up some cheap commercial AV if I do. Fourth and lastly is a software firewall: and let's face it, you really should just get a router with SPI, they're pretty cheap now, and the Windows firewall from the NT6 family and on (Vista and later) is actually plenty secure.

For future reference though, assuming it wasn't a tssd infection or similar, it could have been removed with HijackThis from this website: http://free.antivirus.com/hijackthis/

Keep in mine, when in doubt, post a log and I can analyze it for nasties on the list for you.

http://www.theregister.co.uk/2010/01/22 ... wn_months/
http://www.computerworld.com/s/article/ ... ast_August
http://www.betanews.com/article/Eightye ... 1196785539

http://www.reuters.com/article/idUS422768175520100825
http://www.pcmag.com/article2/0,2817,2368066,00.asp
http://threatpost.com/en_us/blogs/resea ... ure-090210
http://www.itworld.com/security/84556/c ... 008-r2-smb
http://www.theregister.co.uk/2009/11/12 ... l_crasher/

Also, HijackThis! is an awesome tool and a swiss army knife of Windows protection.

I had a similar problem with one of the beta versions of Ubuntu - on a brand-new install, Firefox would simply replace the page I was viewing with a poorly designed ecommerce page (tony.com and fscstore.com were 2 of them), but mostly a "link not found" message. I have no idea how a browser-hijack (if that is what it was) got into a brand new install, but someone sent me this link to a similar issue: http://support.mozilla.com/en-US/questi ... adId745211

Re-installing Ubuntu eliminated the problem, which implies that it was not either bad DNS or router-related - and no other machine using the same router experienced the same problem.

Since I read those articles when they first came out, I'm well aware of them, and every OS has them. Wasn't it just 4 months ago that Sun/Oracle patched a bug in Trusted Solaris its known about for years as well? As I said, there's a difference between one machine/network being targeted to retrieve the information on it and your average home computer.

Also, HJT is a remediation tool, not a protection tool.

That's just Solaris. It's a much smaller problem in GNU/Linux than Windows, but the problem is that Microsoft owns the biggest OS and still they fail to patch bugs on time.

They have the largest installed user base, but not the biggest OS (zOS anybody?).

The patching problem is the reason they've decoupled all mail clients from the OS and are now only supporting Windows Live Mail, which is cross OS, and continue to decouple more and more programs from the OS - fewer lines of code to support.

Also, it's a *MUCH* bigger deal in Trusted Solaris than in Windows to have even one bug, since that's used in life safety systems.

All software has bugs.

Yes, but to have a known but go unpatched for years in something trusted to life safety is very bad.

I would run a scan with Spybot Search & Destroy and if that doesn't get rid of it I'd do a clean install.