Ok, I know I already posted this on the RTT, but a separate topic wouldn't hurt...

So, what is Spyware?

How can I prevent Spyware from entering my system?
- First and foremost, know where you are surfing on the net...There's always danger when going to unknown territories, but then what's the use of cyberspace if you can't explore it, so I would recommend arming yourself with protective gear instead (see below)... :;

- Install and configure a software-based personal firewall...
ex. Sygate, Tiny Personal Firewall, ZoneAlarm
- Install Spyware Blaster, this neat app will secure your IE browser from spyware, without having to stay resident in memory...It also supports Mozilla Firefox...

How do I detect/remove Spyware from my system?
- There are various tools available for this task, but one of the most popular and very effective is definitely Ad-Aware...I just love this software, it runs smoothly and it even provides informative logs after each sweep...

* If there are peeps out there with more tips, post 'em here...Its always nice when everyone contributes collectively, more brains --> more knowledge...

Good thread dude. :ok: I'll be checking in on this regularly.

Are some Spyware also keyloggers?

Yes. I would consider any program which logs keystrokes, takes screenshots of user acitvity, or keeps a record of sites visited as spyware.

Some keyloggers are sold commercially while some are installed on your system without warning, but make no mistake the purpose of keyloggers is to spy on you.

Besides Ad-Aware 2 other good spyware programs you can download are "spybot search and destroy" and "spy sweeper" If you run all three then you will 99% of the time get rid of the spyware on your system. If you only run one of the three then sometimes spyware might slip through. As a last ditch effort you can try a program called Hi-jack this that will let you manually remove attachments to Internet Explorer. It is possible to mess up your system with Hi-Jack this so be careful. All of these programs can be found on download.com by doing a search.

I'd just like to add that not all Spyware can be received from the Net. Sometimes, we invite them ourselves by installing programs that have Spyware bundled in them (e.g. Gator, Gain). Unfortunately, some of these are auto-installed so check your program installers before you install and as much as possible, use custom install.

Learned this lesson the hard way. :p

That's true MP, as an example, try to download and install the latest divx codec (divx 5.2)...After the installation, sweep your system with Ad-Aware, there should be about 5 spyware entries detected in your system and one of them is an active process...So if you're going to install freeware, run a sweep of your system afterwards...

Also if you are looking for spyware eliminators do you your research. There are bogus companies out there that set you up.

A few months ago my system was plagued with spyware, still don't know how it even got there. But it took over my IE and kept changing my home page and plagued me with pop-ups. The pop-ups and website that usurped my home page were to a spyware eliminator web-site (now isn't that just a little too convienient?)

Not even spybot or ad-aware could get rid of it. So i looked into the spyware remover that these pop-ups kept advertising. My system was already screwed, it couldn't get any worse. But i wisely didn't installed anything, but instead looked at other sites like C-Net to get backround on their spyware removing product. Everyone who reviewed it said it sucked. Not only did it not remove the spyware it claimed to be able to remove, but many reviewers claimed it actually ADDED spyware. It also had no customer support. A reacuring theme in most reviews about the product said the same thing. They would try to contact the makers for support and get no response what so ever. One guy even said he was going to report the company to the FCC.

The best theory I read was one reviewer said that these guys probably created the spyware that plagued his system just to get people to come to their web-site so they would by their bogus spy-ware remover. Now if that isn't the lowest of low, I don't know what is.

So when looking for a good product, make sure you do your research and get tried and tested products. Spy-bot and Ad-Aware are both good and have free versions that work well. But there are assholes out there looking to screw you over, so be careful.

Regarding Spybot are there compatiblity issues with WinXP. I installed it some time ago, it succesfully ran the first time. After a few weeks I tried running it again but nothing happened. I did notice that the program was executing then closing really fast you dont see the program interface, I only noticed cause the screen kind of "blinked". After trying several times, I just uninstalled it.

Check out adaware for free spyware deleting... also use browsers like Firefox that block spyware... I like to keep my compu spyware free... :)

I'm posting this to address ninjapeps' problem with Spybot flagging "DSO Exploit" on his machine.

Strictly speaking this isn't spyware or an actual intrusion on your system. What Spybot is referring to is actually a Microsoft vulnerability known as the Data Source Object Exploit.

This bug allows a smart and crafty hacker to run whatever they want on your PC. Yeah someone like Ichi. :tongue:

If you are properly patched there is no real problem as Microsoft released a fix for this quite some time ago. However if you find it irritating that this always turns up
there are two ways to solve this. One is quite simple while the other is a bit complicated.

Let's try the simple way first.

Open Spybot and set it to Advanced mode. Go to Settings then Ignore Products. Click on the tab that says "Security". There should be a checkbox labeled DSO Exploit there. Checking this will set Spybot to skip the check for this vulnerability and it won't turn up again.

If like me you aren't satisfied with this and you really wanna correct the issue you can try the complicated fix. This involves editing the registry and I wouldn't recommend it if you aren't that comfortable playing around in there.

Go to the Start menu and click "Run". Type "regedit" and press enter. This opens the Windows Registry Editor. A very dangerous program in the wrong hands. Mwahahaha!

In the left pane of the Reg editor you'll have to navigate to the keys flagged by Spybot. The first being:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0


In the right pane, change the value of "1004" (DWORD) to 3. You change the value by right-clicking it and going to "Modify". But there's more. You have to make sure that "1004" is a DWORD and not Reg_SZ. If it's Reg_SZ you have to make it a DWORD.

First thing is delete the "1004" Reg_SZ then go to Edit --> New --> DWORD Value. This new value you created will be named something like "New Value #1". Rename it to "1004". Once you've renamed it you can right-click and modify the value to 3 as explained earlier.

Repeat this process for the other 4 keys flagged by Spybot and you're done. :clap:

Not so hard right? :sweatface:

Again I have to stress that messing with the registry is risky and be careful not to delete anything else coz there's no undo button there. :ok:

Just something to add to SC's post above, before you make any changes to the windows registry via "regedit", perform an export first (file -->export registry file), that way if you mess up you can import your previous settings again (file-->import registry file)...

Instead of building a better mouse trap they decided to breed tougher mice. :rofl:

It's a marketing strategy but as you said it is low. I wonder how those crooks sleep at night. :rolleyes:

I encounter stuff like this all the time. Did this by any chance change your homepage to secure.html? That is one nasty hijacker. :buck:

A useful tip:
If anyone of you is using Windows XP, Service Pack 2 is out. It features new Security tools. Windows now has its own "TRUE" firewall that works like ZoneAlarm. Internet Explorer has also finally integrated a pop-up blocker. If you do choose do download the updates, the whole Service Pack 2 file is around 260 MB. But you can just use automatic windows updates instead since it will just download needed files (around 40 - 100 MB).

But be warned! Backup your data first because there has been some known issues when installing SP 2. Some PC's lost all the hardware drier settings, others crashed, others had startup problems and others lost some programs after the service pack was installed. I've installed this on my system and everything is working great. I noticed that windows was a bit faster and the security options are great! The only thing that Windows needs its own anti-virus software and its set! >_<

I haven't tested SP2 myself but there are reports of security flaws and interference with other programs.

http://story.news.yahoo.com/news?tmpl=stor...rosoft_software

Whoa ... my brother, the spy(ware)catcher. :buck: :ok:

thanks for the info. will consider trying out the complicated fix some other time, though. :D

I personally use Spy-bot, and I'm happy to say it's been good to me so far... Maybe I should try ad-aware too...

Yeah, I just used FireFox today, and I haven't got a single pop up....Except the ones I want. And it's fast, too. I'm not sure if I got any spyware, though. I'll have to check mine out.

I don't get many popups, and any intrusions are stopped by "Zonealarm" firewall.

To stop all pop-ups, Stop going on t3h pr0n!!

pr0n sites aren't the only ones with pop-ups, you know. of course... their pop-ups are the most annoying ones.

to stop more pop-ups, don't go to Yahoo. :p

Firefox is pretty secure. Besides the people who design spyware, particularly browser hijackers, tailor make them for IE.

For some strange reason, the YM in my office (WAVE, I mean.) is fuzzy. Whenever I chat with someone, at random intervals, my YM will generate links that seem to come from me, which lures my poor chatmate to click into a porn site. I warn people beforehand to ignore such links when chatting with me, but I never managed to find the source for this thing...

I've already run Stinger and AdAware on this comp. Still there...