Help Short-Media fight the menace of spyware!

Daniel Pass 13 Feb, 2005 at 3:47pm ET Article published in Tech

This is a call to you. Yes you!

Did you have spyware? Do you know someone who had it before you waved your technological magic? Did you clean out and refresh a PC that was buckling under the load of evil, unwanted malware gremlins?

Help us help those less fortunate than us! Wanna know how? Read on…

Over the last few months, Short-Media has proudly helped over 300+ cases of PCs infected with the spyware meance. Our dedicated team of SVT (spyware, virus & trojan) hunters have worked tirelessly to help others armed with a cry for help and a Hi-Jack This! log. Work never ceases. Our volunteers put countless hours in our specially created Spyware Discussion form. But they need more help. WE need more help. We NEED YOU!

Can you spare some time a few times a week to help out those who need help & guidance? It’s not always pretty and there’s no pot of money at the end of the rainbow but respect from your peers, respect from those you help and a sense of pride in helping us rid the world of another spyware infection.

This is a call, will you answer it? Will you step into the breach to help fallen ones?

Comments

13 Feb 2005 ~ 3:53pm entropy If I knew more about HJT and how to identify junk, I would.

At least I know what SVT means, now...
13 Feb 2005 ~ 4:12pm profdlp

entropy wrote:

If I knew more about HJT and how to identify junk, I would...

Read through a few of the threads where people have been successfully disinfected. You'll probably pick up the basic process from that. I wanted to hone my anti-spyware skills so I lurked there for a week or two. Now I try to help out on at least a couple threads a week.

The simple way is to copy the HJT log to a text document, then delete every line which you know is harmless. It may not be the most elegant way to do it, but I just google the rest. Oftentimes this shows the item in question to be part of a "good" program. If Google returns no hits on an entry it's a good sign that it is rotten. If someone has a running process named "dwcxmxyikqt.dll" which Google has never heard of it ought to tip you off. Some of them are quite easy. When you see a line with "MyWebSearch" in it you can be sure it's not there to make their scanner work.

The guys at the SVT Forum are doing a great job. If you want to strike a personal blow against the scum who foist these things on the unsuspecting, volunteering to help would be a great way to do it.
13 Feb 2005 ~ 5:30pm Thrax

entropy wrote:

At least I know what SVT means, now...

If the EXE/DLL is pure ****ing gibberish, it shouldn't be there. There are a few exceptions to this rule, but that's a really good rule of thumb. If you're not sure, plug the name of the file in between quotes in google.

That's really all there is to it.

Also, take an HJT log of a freshly-installed computer. It looks something like this:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://198.64.189.142/forum
O2 - BHO: Response Class - {81A99149-F047-4090-8AAD-D11FF4EFB734} - C:\WINNT\system32\dae.dll
O2 - BHO: IeCatch2 Class - {A5366673-E8CA-11D3-9CD9-0090271D075B} - H:\Programs\FlashGet\jccatch.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: FlashGet Bar - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - H:\Programs\FlashGet\fgiebar.dll
O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
O4 - HKLM\..\Run: [SymTray - Norton SystemWorks] C:\Program Files\Common Files\Symantec Shared\Symtray.exe SetReg
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [SmcService] H:\Programs\SYGATE~1\smc.exe -startgui
O4 - HKLM\..\Run: [RemoteControl] C:\WINNT\system32\rmctrl.exe
O4 - HKLM\..\RunOnce: [SymTray - Norton SystemWorks] C:\Program Files\Common Files\Symantec Shared\Symtrdr.exe
O4 - HKCU\..\Run: [AIM] H:\Programs\aim\aim.exe -cnetwait.odl
O8 - Extra context menu item: Download All by FlashGet - H:\Programs\FlashGet\jc_all.htm
O8 - Extra context menu item: Download using FlashGet - H:\Programs\FlashGet\jc_link.htm
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - H:\Programs\aim\aim.exe
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - H:\Programs\FlashGet\flashget.exe
O9 - Extra 'Tools' menuitem: &FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - H:\Programs\FlashGet\flashget.exe

I know what purpose every single entry serves. And it's small.
13 Feb 2005 ~ 7:55pm Trogan I'm willing to help.

I got help from Dexter and others when I joined for the first time. So, it'd be an honour to help where I can. It's the least I could do for the best forum i've ever joined
14 Feb 2005 ~ 10:03am Straight_Man I'll be around from time to time, but cannot schedule appearing here anymore.
14 Feb 2005 ~ 11:42am slips
Yes ...... I'm another who's been rescued from the throes of Omegasearch by Dexter and Co' and I too believe it's payback time, both to the Web Warriors here but also to those Malware Miscreants who turn surfing the web into a feeling of wading through their effluence and slurry
14 Feb 2005 ~ 1:21pm RADA I help when i can, would love to do more, but work, school, and everything else life throws at us all, keep me pretty busy. I'll try to see if I can pop in a bit more often.
26 Sep 2005 ~ 1:26pm Shorty Bump!
26 Sep 2005 ~ 2:04pm Trogan I'l try and help out where I can.

I just want to know what Ewido and Killbox are and what they are used for?
27 Sep 2005 ~ 5:11pm Linc We're not asking for an hour every day. If you can work on one thread a week, it would be a big help.
27 Sep 2005 ~ 5:56pm profdlp

Trogan_1000 wrote:

I'l try and help out where I can.

I just want to know what Ewido and Killbox are and what they are used for?

Ewido is a program to scan for "Trojans, Worms, Dialers, Hijackers, Spyware and Keyloggers." They have a free online scan which can be very helpful in finding that sort of junk.

Killbox is a useful tool which allows you to remove files which are otherwise difficult (or impossible) to delete. Many Spyware programs drop crap all over your drive, then set the file permissions such that it is hard to get rid of them.

I'm sure that if you volunteer for the S-M SVT Team you'll get all the training you need to use all of the tools in the SVT arsenal. Besides doing a lot of good in helping keep the Net a safer place and helping the poor folks who have fallen prey to this nonsense, you'll also become quite an expert in the field. That's a nice reward for helping out here and there.
27 Sep 2005 ~ 6:06pm Trogan Thanks prof. I'm going to downloaded both Ewido and Killbox for the first time as a test purpose

I'm up for being an SM SVT volunteer and get the training to help out as much as possible. I just need to know how to identify the different type(s) of infections and what tools to use for them.

Now, who's house the training in?
27 Sep 2005 ~ 7:17pm mmonnin With the add, threads dont even start until half way down my screen at 1680*1200. People at 800*600 have to scroll a whole page to even see a post.
29 Sep 2005 ~ 9:48pm Qeldroma

Shorty wrote:

This is a call to you. Yes you!

I don't actually have any support experience in this area and I have some issues that still baffle me, but clue me in on the course and what's involved to train. This stuff is getting nastier all the time, banging everyone in the family and there's nothin' like knowing it.

Also, if it gets folders in ....

Still, let me know if there are any qualifications you wish satisfied.

Thanks
30 Sep 2005 ~ 9:28am lemonlime Count me in

I will contribute to the SVT forum in any way I can..

I've always had a personal gripe with spyware, and I spend far too much time in the hardware forums anyhow I used to work in a support role, and have some experience with HJT, and other removal apps.
22 Oct 2005 ~ 9:49am chiaz

Shorty wrote:

This is a call to you. Yes you!

Did you have spyware? Do you know someone who had it before you waved your technological magic? Did you clean out and refresh a PC that was buckling under the load of evil, unwanted malware gremlins?

Help us help those less fortunate than us! Wanna know how? Read on...

Over the last few months, Short-Media has proudly helped over 300+ cases of PCs infected with the spyware meance. Our dedicated team of SVT (spyware, virus & trojan) hunters have worked tirelessly to help others armed with a cry for help and a Hi-Jack This! log. Work never ceases. Our volunteers put countless hours in our specially created <a href="http://www.short-media.com/forum/forumdisplay.php?f=57">Spyware Discussion</a> form. But they need more help. WE need more help. We NEED YOU!

Can you spare some time a few times a week to help out those who need help & guidance? It's not always pretty and there's no pot of money at the end of the rainbow but respect from your peers, respect from those you help and a sense of pride in helping us rid the world of another spyware infection.

This is a call, will you answer it? Will you step into the breach to help fallen ones?

Would like to join.
A few months ago I came here with bad advice and everything.
But after I went to a few classrooms, I learnt quite a lot.