New generation of spyware / trojans / virii

primesuspectprimesuspect Beepin n' BoopinDetroit, MI Icrontian
edited January 2004 in Science & Tech
Lately I've gotten a few computers on the bench or at customer sites that are just DRIPPING with spyware and trojans. I mean, terrible infestations.

As some of you know, I have a personal mission to eradicate spyware and trojans. I can't stand the buggers. It drives me nuts.

I have developed quite a knack for removing spyware and their ilk, and I have a little routine that involves a cocktail of NAV, Spybot S&D, AdAware, regedit, msconfig, etc.

But lately, no matter what, there are some trojans that escape my tirade. I have been pulling drives, dropping them into a new computer, doing full manual virus scans, manually deleting fishy .exe and .dll files, etc. When I'm done, and I put the drive back in the computer, it's STILL infected... I don't get it.

One thing I've been noticing is these pervasive BHOs that just WON'T go away. I'll reset all IE settings to default, blitz out the HOSTS file, change security levels back to defult, reset all web settings, etc. and then DNS will be broken. I can't figure this out for the life of me.

Thoughts on these new generation of BHO's, hijacks, spyware, trojans, etc. ?
«1

Comments

  • KwitkoKwitko Sheriff of Banning (Retired) By the thing near the stuff Icrontian
    edited January 2004
    The virii writers are getting much more sinister with their attacks. Now they try to write trojans and virii that look to destroy the anti-spyware/anti-trojan/anti-virus programs.

    I know CoolWebSearch is a particularly nasty SOB. You might want to add CWShredder and HijackThis! to your arsenal. HT is good for removing BHOs, and of course CWS is a single-purpose removal tool, but effective nonetheless.

    The war is going to continue, and it's going to get harder and harder to remove these things.
  • DanGDanG I AM CANADIAN Icrontian
    edited January 2004
    I used to run into that all the time, and for some of them, the only thing I could do if NAV, S&D or adaware didn't pick up would be to get the name of the dll or exe and pray something has been documented somewhere on the internet. With trojans if it's a windows 9x machine, I did have particularly good luck with the DOS version of Fprot. Free to download(www.f-prot.com), and you can just throw it on a bootable cd and keep updating the def files that they release frequently.
  • DogSoldierDogSoldier The heart of radical Amish country..
    edited January 2004
    Prime, I can understand your frustration. I wasted about 3 hours this morning getting rid of coolwebsearch.ws (At least I think that's what it was) on my office workstation. I have no idea how it was installed. Anyways, it was linked to Xplugin.dll in C:Windows/System32/ Hijackthis would delete the new reg keys but they'd come back after the browser was opened once or twice. Attempts to delete it manually were uneffective. Symantic AV claimed to be able to detect and delete Xplugin.dll, so I updated the definitions and ran a scan, no dice.. Symantic said I had a clean computer.

    I so did a Click Start > Run.
    Type: regsvr32 /u [path to XPlugin.dll]and click OK.
    And that worked.
  • PowerMDPowerMD OR room #3
    edited January 2004
    I've gotten a couple emails to my hotmail accounts (junk email box) saying I've downloaded pirated material blah blah blah, and it has some weird file attached - I'm guessing a virus. It's some bizarre email address ending with .f, and it's kinda funny stating the IP it logged - which is not my ip - and that the mail address has been disabled to prevent mail bombs. some real nutjobs out there
  • TBonZTBonZ Ottawa, ON Icrontian
    edited January 2004
    I know what you're talking about prime, lately, 75% of the computers I have dropped off to me are infected big time whereas even a few months ago the percentage was more like 25-20%. It also seems that each computer all have the same garbage installed, it's uncanny. :wtf:

    I am seriously thinking about holding a workshop for all these people and their kids on how to safely surf the web. Although it would be taking money out of my pocket in the long run, I just hate to see the same people bringing their machine back to me because their kids (or so they say) re-infested the system.

    It's definitely getting bad and it will only get worse. :sad2:
  • DanGDanG I AM CANADIAN Icrontian
    edited January 2004
    TBonZ, one thing you can do is if you install Spybot is to use the immunize function. Automatically blocks 500ish things from installing.
  • TBonZTBonZ Ottawa, ON Icrontian
    edited January 2004
    Thanks Dan, I actually didn't catch that option at first but have discovered it since, very helpful indeed. :)
  • croc_croc_ New
    edited January 2004
    I am so fed up with this crap, I let my GF use my computer for 30 mins, I SWEAR, 30 MINS, and I had a milllion of the buggers. I am going to disconnect my computer form the lan and play only single player games and listen to music. ....im fed up.
  • primesuspectprimesuspect Beepin n' Boopin Detroit, MI Icrontian
    edited January 2004
    I guess I'd like to find out more of the places that windows runs stuff at bootup. So far:

    startup folder for all users
    startup folder for each user
    win.ini
    HKLM/Software/Microsoft/CurrentVersion/Run
    HKLM/Software/Microsoft/CurrentVersion/RunServices
    HKLM/Software/Microsoft/CurrentVersion/RunOnce
    HKCU/Software/Microsoft/CurrentVersion/Run
    HKCU/Software/Microsoft/CurrentVersion/RunServices
    HKCU/Software/Microsoft/CurrentVersion/RunOnce

    Services management console

    Any other suggestions of known startup folders?
  • Straight_ManStraight_Man Geeky, in my own way Naples, FL Icrontian
    edited January 2004
    Prime.

    Unfortunately in the last 4-6 montsh, we have gotten hit with hybrids, some of them multithread on XP and down. And the mimail removers, well, there are THREE that I know of, mimail.j is now hitting big time and it is a multithreading HYBRID, trojan plus three worm threads and not JUST a single worm thread that is initially active. If you get Blaster hit with removers run, restart, rerun remover, chances are you will find things that were not detected being found, and possibly for Mimail.c and Mimail.j also, as examples.

    Look up, on Symantec's site, Xado for instance... It comes with um, questionable games and happily, when gem is installed and um "registered (NOT)" installs a Xado along with the install. There are IRC bot worms and trojan packs now, also. AND one update that turned off RPC for XP (on WindowsUpdate) also turned off virus intake.

    Turn off RPC, do not use Kazaa, Morpheus, IMesh, adn do not IRC and do not use MSN Messenger if you want to be safe. Second, if restoring a box, get and install NAV and update it first. Here's why:

    Last time I reloaded this box I proceeded to turn off RPC and update. update hung, box lock.
    Reboot, serious error recovery. In about 2 min on the web, I got 2 Welchias and one Blaster. I found this out when I updated Norton and did an immediate scan, looked in logs, found Norton could not delete the Welchias as Windows was protecting the files (one was DLLHOST), and had killed the Blaster with an autokill delete. So, I manually killed the Welchia. Rebooted\restarted, and proceeded to get a serious error recovery. Rescan, ZIP. No virus, which I confirmed with another product. BUT, windows had restored its needed files.

    Welchia and Blaster both register as system processes, and 98 SE and up can protect and restore system files. I now have my NAV 2003 (2002 is compromised, virus writers know how to disable it) set as follows:

    Aggressive Heuristics.
    In behavior for asuspicious files, I have it set to try to delete and if not to quarantine. The Blaster got quarantined and what else I did(see below) deleted it in quarantine.
    Last, in scan, automatic is not enough. ALL FILES is enough, because then it delves into archives.

    Next if you pick up email on these boxes, clear the email cacxhe and the IE cache when recovering, I have had many viruses hide in Temp Internet Files. When you bring up IE, some of them can launch from the CACHE as it polls it. Ditto,unfortunately, email cache. Scan every file on HD, is lesson, as in all files mode, if you tell NAV to scan archives also, NAV will find how the virus came in and kill the archive also by deleting it.

    This mess started 2-3 years ago, and picks up whenever Microsoft is seen to go after Open Source, and the instance of both Open Source and Microsoft software targetting viruses go up in that time as some misguided idiots in boht camps attack users of opposing distributor's software just to make a point of the holes in it-- from both sides. This has happened again and again....

    August was the worst month in the worst single year for virus hits on boxes, if the defs on a box are earlier than September, that box has at least one virus that will run on program run of the program it vectors into, and some of them copy worms three times and register them three times simply to be able to restore themselves. In fact, it has gotten so boxes that self-virus get zero-packed HDs and a full restore from CD and then get Norton 2003 put on first thing, stuck in a full aggressive mode,and then I WindowsUpdate.

    Ever seen an XP with no MSN Messenger, with every service I can dep trace to NETBIOS off, and NETBIOS ports blocked at router (with ZERO violations of those port blocks logged for 3 days running now).... My XP is sans the services NETBIOS uses, as some of the new viruses are bot installs that seek NETBIOS responses for targetting. My latest XP has been up with no virus hits at all since December 12. Linux has intercepted zero email hits, and it scans for both Windows and the Unix O\S families of viruses, since about 4 weeks ago when Comcast had to fully reload their local email servers and cut their OVERALL traffic load to 2\3 by now scanning email as it comes into the servers (NETWORK WIDE).

    Earthlink is riddled with this junk, and I get more Earthlink routed email en blank with headers only and a virus removal note in header than on any othr ISP. I hate to say it, but until more ISPs start scanning their email servers or also switch to non-Widnwos email servers, folks using those ISPs are gonna get a real self-replicating mess unless they have their virus scanners in very aggressive mode and turn on NAVAP, and update IE and OE completely to 6.0 SP1 and onward if Microsoft releases patches for that generation. So, I use Open Source to surf 90% of the time and Open Source O\Ss to pick up all email-- zero hits on XP, but XP can surf and get remote info for CDs from Windows Media Player 9.0(which has a security pack fix or three in it also).

    Folks need to stop autoinstalling stuff from anywhere other than non-Windows FTP whic they know they can trust, or scan it before install. In other words, do not OPEN files in IE except for those from Microsoft's Windows Update site. Save, then scan and THEN install if you must, but do not be surprised to see hits on "questionable" game archives, PLEASE. Some "questionable source" games install a nice little remote-run, 2-WAY FTP SERVER plus a trojan and\or worms on your computer these days!

    If you folks think this is scary, defense is to be VERY WARY these days of what you do with your web access.

    John.
  • Geeky1Geeky1 University of the Pacific (Stockton, CA, USA)
    edited January 2004
    I don't know what people do on their computers. I've got AVG installed on mine, and I haven't had a problem with viruses since. Spybot takes care of all the spyware I've ever had the misfortune of getting, so I've had no problems.
  • BlackHawkBlackHawk Bible music connoisseur There's no place like 127.0.0.1 Icrontian
    edited January 2004
    What ya'll need to do is stop visiting those damn cheap pr0n sites ;D
  • primesuspectprimesuspect Beepin n' Boopin Detroit, MI Icrontian
    edited January 2004
    Geeky: I know what you mean, I haven't had a virus or spyware ever. But it's not MY computer that's the problem.. I get these beasts in the shop that have "home computer syndrome".

    Rule #A1: Don't use internet explorer.
  • croc_croc_ New
    edited January 2004
    primesuspect wrote:
    Rule #A1: Don't use internet explorer.

    I use mozilla. When my GF used the comp, she didn't know, so she clicked the IE button. BAM instant death.
  • LeonardoLeonardo Wake up and smell the glaciers Eagle River, Alaska Icrontian
    edited January 2004
    Geeky1 wrote:
    I don't know what people do on their computers. I've got AVG installed on mine, and I haven't had a problem with viruses since. Spybot takes care of all the spyware I've ever had the misfortune of getting, so I've had no problems.

    As said in earlier post - use the Immunize function. If your router has a firewall, enable it. Run Spybot, AdAware, your AV, and HijackThis religiously; and update them at least weekly. I am in no way an expert in this arena, but have had no persistent problems when using the above regimen. Also, when using Kazaa (DON'T! Use Kazaa Lite), run Spybot and AdAware as you download.

    The worst source of spyware and it's ilk for my systems has not been chat or P2P, but Google! In a 20-minute session the other night, I managed to collect 67 nasty bugs. Watch out for entries whose URLs (listed at the bottom of each entry) don't seem to match what you're looking for.
  • Geeky1Geeky1 University of the Pacific (Stockton, CA, USA)
    edited January 2004
    I like ie.
  • DanGDanG I AM CANADIAN Icrontian
    edited January 2004
    Geeky1 wrote:
    I like ie.


    Me too, I guess we're a dying breed.
  • RADARADA Apple Valley, CA Member
    edited January 2004
    OK, got 1 for you Prime, and anybody else that might know if this is a XP Pro bug, or if I have a virus/trojan.

    I'm using XP Pro / Outlook 2003 with all available updates. When I log in (no PW, just click on my name, home machine, no need) to the right of my name it says "1 unread e-mail message". But when I go into Outlook, nothing, no unread messages. I tried selecting all and hit "mark as read". Still says "1 unread...."

    Have any of you guys(or gals) seen this before?

    Thanks,

    RADA
  • PreacherPreacher Potomac, MD Icrontian
    edited January 2004
    The other features of Spybot such as the bad download blocker and ability to lock the hosts file, IE start page, and control panel work well additionally. These features are all on the same page as immunize.

    The worst source of spyware for me is the family and all the little games they install. With AVG, Spybot, and AD-Aware though, I haven't had any problems.
  • primesuspectprimesuspect Beepin n' Boopin Detroit, MI Icrontian
    edited January 2004
    When I get a home computer, it's always the same:

    pr0n dialers
    "free" "fun" "save" things - games, coupon offers, weatherbug, precision time (duh! windows XP has this built in!), savings, "memory checkers", "performance enhancers", "spyware killers" "popup killers"

    the problem is that your average home computer user does NOT know what's legit and what's not. So some popup comes up and says "hate popups? Click this blue activeX control and be sure to say "yes!"!!" -- boom, floodgates are open.
  • PreacherPreacher Potomac, MD Icrontian
    edited January 2004
    My wife is the master of opening up the spyware floodgates BIGTIME.
  • GobdGobd Seattle, WA
    edited January 2004
    I almost never get spyware, probably thanks to SpyBot's immunization feature and also Spyware Blaster which blocks spyware from installing. I really love Crazy Browser (IE) but I'm getting used to Firebird now after spending a an hour or so installing extensions and editing/hacking some of the configuration files. Firebird now looks and acts almost exactly like Crazy Browser plus it has better ad blocking and lots of other cool features.
  • drasnordrasnor Starship Operator Hawthorne, CA Icrontian
    edited January 2004
    croc_ wrote:
    I use mozilla. When my GF used the comp, she didn't know, so she clicked the IE button. BAM instant death.

    Next time you install XP, do an unattended install.

    winnt.sif:
    [Components]
    IEAccess=Off

    Note:
    Installs visible entry points (shortcuts) to Internet Explorer.

    This entry does not remove any Windows code, including any Internet Explorer code, other than these shortcuts. Various Windows components and third-party applications rely upon Internet Explorer code.

    IEAccess has no effect on Internet Explorer branding or the configuration of Internet settings.

    Then install Avant Browser or whatever floats your boat.

    -drasnor :fold:
  • LeonardoLeonardo Wake up and smell the glaciers Eagle River, Alaska Icrontian
    edited January 2004
    Anyone tried this ?
  • MachineGunKellyMachineGunKelly The STICKS, Illinois
    edited January 2004
    I've got 82 reported hits for 'BackWeb lite' with Spybot as registry entries. They all seem to stem from either my Logitech keyboard or mouse drivers as a file named 'backWeb-8876480.exe. Can I delete them all without fubaring something?
  • drasnordrasnor Starship Operator Hawthorne, CA Icrontian
    edited January 2004
    Yeah, that's just auto-update (and spyware).

    -drasnor :fold:
  • gtghmgtghm New
    edited January 2004
    DanG wrote:
    Me too, I guess we're a dying breed.

    I'm an IE guy too, Mozilla is good but not supported by all web sites.

    I think that non-geeks just don't understand or care about trojans, spyware and stuff until they get one. You can look at it this way, job security... lol

    "g"
  • MachineGunKellyMachineGunKelly The STICKS, Illinois
    edited January 2004
    Thanks Dras. Just installed Spyware blaster as well. Thanks Leo, looks like another great app!
  • DanGDanG I AM CANADIAN Icrontian
    edited January 2004
    Isn't spywareblaster an app that you can install as part of spybot s&d? Another one of the options on the immunize screen IIRC.
  • McBainMcBain San Clemente, CA New
    edited January 2004
    lol, i have a home computer I built for a client....two young teenage girls....I'm honestly fixing that damn thing twice a month. Spyware, trojans, hijacks....EVERYTHING. I don't know how the **** they do it, but they do. It gets pretty rediculous, and its not like I like charging them over and over (makes me feel inferior because they keep having problems) but its honestly not my fault. Trainging/talking to them does nothing, they have NO clue how to click NO or use Mozilla. I've got their mom using only Opera, and she oddly, never has problems. They are just addicted to clicking that STUPID blue e instead of the pretty flames of firebird.
Sign In or Register to comment.