Pat's Pulpit. ; -) Today's topic: "Spybot - Search & Destroy": A solution to (some) browsing woes...



(BCC'd to a lot of friends and to some lists that I run, since most of
you use Windows, and we all suffer the effects of poor security.)


				  (Snip snip)
------------------------------------------------------------------------------
An Introduction to Spyware, and Why You Should Be Concerned
by Patrick G. Salsbury (salsbury at sculptors dot com)
November 4, 2003
Doc URL: http://reality.sculptors.com/~salsbury/Articles/spyware-intro.txt


Have you seen "Spybot - Search & Destroy" yet? It's WAY cool... 

This started out as a quick note to just a couple of friends, but I realized
while writing it (and while scanning my own machine) that it is useful info
for many folks who might not think about security, (or even know where to
start!) so I've fleshed it out a bit. I've tried to give some more generally
useful info, since most people currently on the Net use Windows, and we all
suffer the effects of poor security.  (...Most often, from other people's
infected computers!) The most recent version will always be available at the
Doc URL listed above.

The other day, I was helping a friend (who's not usually very proactive
when it comes to security) debug his computer from all the freaky
ad popups and cruft that was making his XP machine act (to me) extremely
bizarrely: It was slow, especially when trying to change configuration
settings, even though it's a relatively new computer (last year) that's
probably 4-6 times faster than just about any computer I own. You
could also hear the disk grinding away most of the time, even though he had
lots of disk space and lots of RAM, and a fast DSL connection. His browser
(IE) home page was pointing somewhere he didn't want, and changing it
didn't stick. It kept returning to that same page after I rebooted the
system.

Perhaps the MOST bizarre (and frustrating) thing were all the pop-up
windows. You could literally NOT TOUCH A SINGLE THING and just watch new
windows open themselves up every 10-20 seconds, with lots of annoying
flashy ads for online gaming, adult sites, and scary-sounding warnings
about how his system might contain "spyware", coupled with offers for
programs to detect said spyware.

I had warned him that some of the ads for anti-spyware software were often
themselves spyware, but I hadn't really done much spyware research, other
than reading a few news stories, so I didn't have much more advice than
that. I'm much more educated now, and learning more as I go. For example,
many of those anti-spyware ads really *ARE* spyware, which detect and
remove some spyware on your system while simultaneously installing their
*own* monitor programs on your machine! Some of them even go so far as to
detect and disable REAL anti-spyware software, so that they won't be
discovered!

He said "I don't have anything to hide. They can look at my computer if
they want." (Ominous sounding, right? Like "famous last words" perhaps?
Read on...) If you know me, you can imagine my response. :-) I told him how
they could use cookies to track his browsing, report info about him or in
files on his machine to unknown sites/people on the Net, and even install
"key-loggers" to grab his passwords or other private info. He said that he
didn't even *have* a credit card, and that if they *really* wanted to know
what porn sites he went to, they were welcome to that info. :-)

While I applauded his "no fear, no shame" attitude, I also felt that some
of it was a bit naive and that perhaps he just didn't fully understand the
possible ramifications. I pointed out that since he had a nice, fast DSL
connection, and a fast computer, he made a good target. Even if he didn't
think his personal activities were valuable, his *resources* are extremely
valuable to system-crackers, who employ machines by the thousands to
conduct massive attacks or to send out millions of pieces of spam. 

People often make this mistake. They think that their desktop PC, often
used only for email/browsing/games/etc., - coupled with their own lack of
knowledge about computers - somehow makes them uninteresting to crackers,
when just the opposite is often true: A modern, fast machine sitting on a
fat DSL or cable pipe is a juicy target. *Especially* if the owner doesn't
know a lot about security, or just doesn't care.  They might secretly make
his machine into a node on one or more "stealth" peer-to-peer networks and
use his machine and fast link without his knowledge or permission. Your
machine becomes a  great vector for launching further attacks on more
valuable targets, or to send out lots of spam without being held
accountable/traceable, to launch "Distributed Denial-Of-Service" (DDOS)
attacks on other sites, to swap illegal files (yes, perhaps even the
dreaded child pornography!), etc. 

Aside from the the system-cracker aspect, any marketing people who would
choose to use something like spyware to track your movements and habits, or
to serve you ever more (and tastier!) ads are obviously not looking out for
your best interests. I don't fully grok this almost-fetishistic tracking of
complete strangers, but it's quite prevalent. (Then again, I don't grok why
so many strangers Out There want to enlarge my penis, but there seem to be
a lot of *them*, too! ...Weirdos. ;^)  )

Anyway, since I didn't then know much about spyware, I figured this was
just a simple browser config problem. I re-installed the Guidescope ad- and
cookie-blocking software (which I also highly recommend, see
http://guidescope.com/), which I had set up for him before, but it was lost
during a system-crash and restore to an earlier state. But even with
Guidescope running and merrily blocking ads and cookies, we still saw the
popups. More research showed me how to turn off the Active X and Active
Scripting things in IE, but we *still* saw them. 

I also installed the Mozilla (http://mozilla.org/) browser for him, as 
another alternative to IE, should he want to use it. Aside from cool
features like tabbed browsing, it also has better control over pop-ups,
although even this didn't get rid of all of them.

By now, many hours had passed.

Using up-to-date data files, we performed a full virus scan of his system.
We found 6 trojan-horse programs (which are known for installing other
programs and opening ports on your computer to allow further infections),
but even after those were fixed up, we still saw the popups, his browser
home page was being changed back after reboots, etc. 

I also installed/configured a personal firewall package that had come with
his PC, but which he hadn't set up. That quickly identified things on his
PC that were trying to get out, as well as showed all the things out on the
Net that were trying to contact his machine. Some of these were valid, some
weren't...  However, it pointed me in the right direction, revealing a
bunch of unknown *.exe programs running on his task list. Many of these
didn't show up in the start-up menu, so I wasn't sure what they were. A
quick Google search on a few of their names showed me that some were
standard Windows system files...and some were spyware. :-(

By now we were heading toward dawn, and he had sacked out. I had thought that
with the virus scan, firewall, etc., that I might be nearing completion and
could go home. No such luck. And after finding out that his machine was
infected with spyware, I would have felt bad just leaving it in that state.
It'd be like telling a friend with the Flu that you *wouldn't* go to the
store for them to get some medicine, and they were just going to have to
suffer.

So...back to the web for another 3-4 hours of research... Google is great
for this, because I could find not only the names of lots of allegedly
anti-spyware programs, but could also cross-reference what others were
saying about it, not just relying on the website's ad copy. (There were
MANY different sites claiming to be anti-spyware. They all claimed to be
the best one, most updated, most thorough, yada-yada...) However, doing a
Google search for the program name plus the words "spyware" and "warning"
often turned up a whole different set of pages where people had posted
warnings about the program in question, revealing that it was also spyware,
and detailing how it worked to invade your privacy. 

Eventually, this cross-referencing technique (and several hours pouring
through dozens of sites with lots of educational info) gave me three good
candidates that (according to general consensus) didn't seem to contain
spyware in them and didn't charge money for the apparent "privilege" of
getting control of the computer back by removing any infections. Many of
the programs that turned out to be "wolves in sheep's clothing", as well as
some legitimate anti-spyware tools would offer "free trials" and "free
scans" of your machine, but would eventually hit you up with a
"registration/activation/subscription fee" or a "Pro/Commercial/Full
Version" that would actually remove (some of) the spyware that was
detected. Classic bait-and-switch behavior. Very crappy. 

As it turns out, I went with "Spybot - Search & Destroy" and was so
impressed with it that I never even tried the other two programs I had
installed. However, Spybot detected the other detectors and helpfully
warned me about possible conflicts with them. (Since Spybot backs up
infected files before fixing your system, the other programs may detect the
original spyware in those backup files, and may then raise a false alarm
for spyware that's actually already in quarantine.) Spybot - S&D is
completely free, and there's a place where you can make donations if you
feel his work is Helpful and Good(tm). 

I first had Spybot update its data files, and it jumped from ~5800 known
problems to scan for up to more than 10,400 known problems! I then ran a
scan on his system and it found *288* different files scattered across the
drive with known spyware, adware, hijackers, trojans, etc. 

All of these were missed by the up-to-date Virus scanner program. (Which is
very good, but apparently virus scanners are NOT the proper tools for
detecting spyware at this time.)

Some of the detected programs were disguised as useful little apps to do
things you might actually want, like time-sync your computer precisely with
the Atomic Clock, add useful search bars and tools to IE or your desktop,
give you some sort of cute little animated "helper" character on your
desktop that tells jokes, dances, strips naked, or whatever thing it is
that they use to hook you and get you to install it. Some apps will fetch
you current info about weather, movies and events in your local area.  Yet
while they were performing these useful or entertaining functions on my
friend's computer, they were also secretly installing other programs,
reporting his computer usage out to who-knows-where, and all sorts of other
computer security nightmares. 

The initial scan found 288 known problems, including descriptions of what
they were, where to find more info, and even the Privacy Statements from
the websites of many of the spyware authors, (and what's vague or seemingly
wrong with the wording which allows them to sneak around it while *seeming*
like they're concerned about protecting your privacy). It was able to
quickly fix them, making backups along the way in case you later found
something that went wrong and needed to recover the spyware file, for some
reason. 

After that initial scan, I turned on scanning for things like user-tracking
wares, cookies, registry anomalies, etc., and it brought another 116 things
to my attention. It has functions to immunize against future attempts by
known problems, and even has a listing of all the programs that will get
started by your system at boot, regardless of whether (or not) they show up
in the start-up menus, System Tray, or whatever.

I just installed it today on our Win98 machine, (which I don't use for
email, and have disabled Outlook Express so that it doesn't even KNOW about
servers to connect to, just in case it ever gets infected in the future)
and it just found 49 problems. (Eek!) Which prompted a lot more research on
my part and the writing of this essay. Some of the problems Spybot - S&D
found included usage-tracking cookies, the "Brilliant Digital" software,
which apparently made my computer into a node in their stealth P2P network
(although since I'm behind a slow dialup line and a firewall, I suspect
that was not terribly useful to them), and even an old security hole in IE
from Feb, 2002 that allows a properly crafted web page to run arbitrary
commands on the Windows system *without* Active Scripting or ActiveX.
Apparently, this has never been fixed by Microsoft, since I keep the
machine current with "Windows Update" (and just checked again today).
(*SIGH* - Have I mentioned recently how bad Windows is? People think I'm
just prejudiced with my rants, but I really DO have reasons why I dislike
it so much! :-)  ) 

When I turned on the additional usage-tracking scans, Spybot - S&D found
another 80 things to bring to my attention, which aren't "critical", but
stuff to review and decide if I want around or not, like the 87 cookies IE
has decided to store despite my cookie-blocker tools, various logs, files
I've recently opened, and the like. 

I have been quite proud to have never had a virus on that machine, which
we've had for about 5 years. But now I see that there are other threats,
and other vectors, such as Instant Messaging, nasty web pages, and these
"helpful" free applets from websites that secretly install other things on
my computer. Simply not using this machine for email has worked pretty
well, but things keep evolving...

Some stats, links, and resources:

Email as a class is definitely still the #1 virus vector in the world, and
I think Outlook Express may still the #1 virus vector PROGRAM in the world,
due to a combination of factors that add up to danger: 

	1) its default inclusion with Windows & IE, (so everyone has it,
whether they use it or not)
	2) the automatic configuration wizards, which try to set it up to
talk to your mail servers when you first configure your browser or some
other programs, (so that even if you use a completely different program for
email, it's still there and able talk to the world, and to start sending
out worms, viruses, or spam whenever some malicious program asks it to.)
	3) the automated address-collecting functions, (so that if you *do*
use it for email, by default it keeps a database of the email addresses of all
your friends, family, co-workers, and anyone else who has ever contact you
via email. (Including all those spammers with their faked addresses!) 
	4) all the other security problems inherent in the underlying Windows
system.

So, simply disabling Outlook Express and using *ANY* other email program is
probably the single most effective thing you can do to protect yourself
from (some) internet threats. (The next best thing is probably to not click
on attachments in email...but you know that, right?  :-)  ) I get hundreds
of emails with virus/worm attachments each week, but they don't work on
Linux, so they're merely humorous, not scary. 

(Please also note that "Spybot - Search & Destroy" should not be confused with
the "SpyBot" peer-to-peer worm that I just discovered while researching
this article. Info at: http://www.viruslist.com/eng/viruslist.html?id=60639)

The VirusList.com site is worth exploring, as it seems to be a
clearinghouse of good info. It claims to be "the biggest virus
encyclopedia" and also has virus news, updates and calendar info, as well
as a monthly "Top 20" list of the 20 most widespread threats.

Interestingly, Internet worms are the most prevalent type of malicious
program, at 90.76% for October, 2003 (70.94% of *that* was just from the
"Swen" Internet worm!) Ironically, "Swen" disguises itself as a "Microsoft
Internet Update Pack" and pretends to go through a whole patch/install
procedure (complete with graphics and all)...before taking a big dump all
over your hard drive and spreading itself to everyone you know. True
"virus" programs were only 2.77% of the October threat, and Trojans like
the ones that hammered my friend's machine were more than twice as
prevalent as viruses (6.46%) and comprised 9 of the "Top 20"
threats.  See http://www.viruslist.com/ for the latest rundown, 

Spyware is relatively new technology, and most antivirus programs don't
detect them. (As I've been finding out.) Check out the Spybot website (or
its mirrors) and look at the FAQs and other info: 

		http://www.safer-networking.org/

And don't just take my word for it! Here's a great testimonial I found
from Chris Pirillo at TechTV:

http://www.techtv.com/callforhelp/freefile/story/0,24330,3416693,00.html

  "Spybot -- Search & Destroy
  If you're tired of hearing me recommend this free file, too bad. It works.
  Spybot -- Search & Destroy effectively detects spyware, adware, key
  loggers, Internet dialers, browser hijackers, and even some trojans. Are
  you getting charged $200 a month for phone calls to the Cayman Islands? Get
  this free file. Do you have to reset your homepage every time you open
  Internet Explorer. Download this free file. Do you.... You get the picture."


I give "Spybot - Search & Destroy" 2 thumbs up, and intend to tell my
family, friends, and anyone else who is either forced into (or still
insists on) using a Windows operating system, with all of its ridiculous
security holes. (65,000+ known viruses and counting! And roughly another
250 new ones each month...  Collect the whole set! :-)  ) 

I'm not about to say "mail this to everyone you know", but I'm certain that
you can probably think of a few people who might need this tool more than
others. :-) If you use Windows, you owe yourself a scan. However, you're 
liable to be frightened by what you discover.

One parting caveat, though: In my zeal to turn on all the advanced
automation features, I managed to wedge Spybot into a state where it would
seem to start at boot but wouldn't let me in to change any settings or
interact with it. I couldn't restore, maximize or close it. All I could do
was kill it from the Task Manager. 

As per the Support FAQ #023 at:
http://www.safer-networking.org/index.php?lang=en&page=knowledgebase/faq/faq023 
removing this file:

'C:\WINDOWS\Application Data\Spybot - Search & Destroy\Configuration.ini' 

fixed that problem and reset things to the default values. (Merely
rebooting or uninstalling and reinstalling didn't fix it, because that file
lives in a directory you must delete by hand, since that's where all your
backup files live. See FAQ #027.) The 'Spybot - S&D' author plans to make
some changes in the next release (1.2.1) to prevent such no-interaction
instances from happening. 

So don't be too gung-ho too soon!  :-) Take it easy when switching on
automation options, and take the time to read through the help files and
web site.  They've got lots of good info. 

-- 
Pat
	   ___________________Think For Yourself____________________
	 Patrick G. Salsbury - http://reality.sculptors.com/~salsbury/
      Interested in learning or teaching about the future? Check out the
    future-studies mailing list at http://reality.sculptors.com/lists.html
	   ---------------------------------------------------------
      "Once you have the knowledge about making something better, and you
 have the ability to do it, then you have the responsibility." - Sanford Mazel

Attachment: pgp00000.pgp
Description: PGP signature



This archive was generated by a fusion of Pipermail 0.09 (Mailman edition) and MHonArc 2.6.8.