Spyware

As most people already know, spyware is always something we want to keep off of our computers.

As with my other tips, this one is also designed so anyone can keep their computer clean of spyware.

All you have to do is a google search for What is spyware and you get lots of results and most of the results basically say they same thing about spyware....it's bad and we don't want it on our computers.

Opinions will always vary but most agree....no single program will get everything. Run several different programs to have the best chance of finding everything.

I've tried many free anti-spyware programs and these seem to do the best so far....click the link to go to their download page.
1. Ad-Aware
2. Spybot-Search & Destroy
3. SpywareBlaster

NOTE: Before running any of these programs, check for updates to insure you don't miss anything new that might not get detected otherwise.

Tutorials....here are some tutorials I made to show people how to use and update the programs....just click the link to download them.
Ad-Aware Tutorial
Spybot- Search & Destroy Tutorial
SpywareBlaster Tutorial

They are all fairly easy to use and come with help files but if you still have problems....feel free to contact me and I will help in any way I can.

As technology advances and more people come to rely on the Internet for information, leisure, and business it seems as if keeping your computer free of advertising is a daunting task. Not technically fitting into either the virus or spam category we have spyware and adware, which are growing concerns for Internet users. At times these programs may invade your privacy, contain malicious code, and at the very least they can be a nuisance when using a computer connected to the Internet.

Adware is considered a legitmate alternative offered to consumers who do not wish to pay for software. Programs, games or utilities can be designed and distributed as freeware. Sometimes freeware blocks features and functions of the software until you pay to register it. Today we have a growing number of software developers who offer their goods as "sponsored" freeware until you pay to register. Generally most or all features of the freeware are enabled but you will be viewing sponsored advertisements while the software is being used. The advertisements usually run in a small section of the software interface or as a pop-up ad box on your desktop. When you stop running the software, the ads should disappear. This allows consumers to try the software before they buy and you always have the option of disabling the ads by purchasing a registration key.

In many cases, adware is a legitimate revenue source for companies who offer their software free to users. A perfect example of this would be the popular e-mail program, Eudora. You can choose to purchase Eudora or run the software in sponsored mode. In sponsored mode Eudora will display an ad window in the program and up to three sponsored toolbar links. Eudora adware is not malicious; it reportedly doesn't track your habits or provide information about you to a third party. This type of adware is simply serving up random paid ads within the program. When you quit the program the ads will stop running on your system.

Unfortunately, some freeware applications which contain adware do track your surfing habits in order to serve ads related to you. When the adware becomes intrusive like this, then we move it in the spyware category and it then becomes something you should avoid for privacy and security reasons. Due to its invasive nature, spyware has really given adware a bad name as many people do not know the differences between the two, or use the the terms interchangeably.

Spyware is considered a malicious program and is similar to a Trojan Horse in that users unwittingly install the product when they install something else. A common way to become a victim of spyware is to download certain peer-to-peer file swapping products that are available today.

Spyware works like adware but is usually a separate program that is installed unknowingly when you install another freeware type program or application. Once installed, the spyware monitors user activity on the Internet and transmits that information in the background to someone else. Spyware can also gather information about e-mail addresses and even passwords and credit card numbers.

Because spyware exists as independent executable programs, they have the capability to monitor your keystrokes, scan files on the hard drive, snoop other applications, such as chat programs or word processors, install other spyware programs, read cookies, change the default home page on the Web browser, while consistently relaying this information back to the spyware author who will either use it for advertising and marketing purposes or sell the information to another party.

Licensing agreements that accompany software downloads sometimes warn the user that a spyware program will be installed along with the requested software, but the licensing agreements are not always be read completely by users because the notice of a spyware installation is often couched in obtuse, hard-to-read legal disclaimers.

There are lots of spyware/adware programs on the market. I've tested many and found that there is no need to pay for any.

I've found to keep your computer clean of spyware/adaware, all you need is a few free software programs.

I use these same programs and they keep my computer clean of all spyware and adaware.

Spybot - Search & Destroy can detect and remove spyware of different kinds from your computer. Spyware is a relatively new kind of threat that common anti-virus applications do not yet cover. If you see new toolbars in your Internet Explorer that you didn't intentionally install, if your browser crashes, or if you browser start page has changed without your knowing, you most probably have spyware. But even if you don't see anything, you may be infected, because more and more spyware is emerging that is silently tracking your surfing behaviour to create a marketing profile of you that will be sold to advertisement companies. Spybot-S&D is free, so there's no harm in trying to see if something snooped into your computer, too.

Spyware, adware, browser hijackers, and dialers are some of the fastest-growing threats on the Internet today.

-By simply browsing to a web page, you could find your computer to be the brand-new host of one of these unwanted fiends!

-The most important step you can take is to secure your system. And SpywareBlaster is the most powerful protection program available.

-Prevent the installation of ActiveX-based spyware, adware, browser hijackers, dialers, and other potentially unwanted software.

-SpywareBlaster can help keep your system spyware-free and secure, without interfering with the "good side" of the web.

-And unlike other programs, SpywareBlaster does not have to remain running in the background.

Ad-Aware is designed to provide advanced protection from known Data-mining, aggressive advertising, Parasites, Scumware, selected traditional Trojans, Dialers, Malware, Browser hijackers, and tracking components. With the release of Ad-Aware SE Personal edition, Lavasoft takes the fight against Spyware to the next level.

NOTE: The following tutorial is a last resort step if your still having spyware/malware issues after trying the above tips.

Posted: Dec 15, 2006 10:39 AM in a "Computers" forum by "Phrost Byte"

This time, I thought I'd offer a few tips for when you have to scan & remove malware.

Disclaimer: I am not responsible for things that could go wrong. Also, this is not a "cure all" for malware infections. You may have to follow these steps several times (using a different scanner each time) to completely clean your system.

Now, on with the tutorial:

What is malware?

Malware is pretty much any application that reduces the functionality and performance of a pc.

some examples include:
Popup windows alerting you that your "machine is at risk", or that "your machine is infected"

Changes to your homepage, and/or sudden redirects to pages that you would normally never visit (also known as browser hijacks, or browser re-directs)

Random browser lockups & crashes. Usually, the browser locks up, and eventually the window that it’s in turns white, with a "(not responding)" message in the title bar.

However, this does NOT mean that you DO have spyware. This could also be caused by corrupted plug-in from a bad install, or bad download.

Now, there’s 2 ways to go about this, and they both have their good points & bad points:

One, is to adjust your browsers security settings by removing execution privileges for certain folders on your system, as well as disabling features that could be used to cause you grief, such as active x & javascript.

Exec & Synja both have a tutorial on that, I'll have to convince them to post it here on the forums :-P

Basically what the above means is, is that because each user has rights & abilities, (such as running files) by removing it, malware may still be downloaded to your pc, but, because it doesn’t have permission to run (aka – execute) it cant modify your system (such as: disabling taskmanager, running on boot up, etc)

(Note: This tips/tutorial is geared more towards Internet Explorer users - If you use Firefox, that’s fine. Personally, I don't like it, but on the same token, I have more than the "average" users knowledge, so doing this is a snap for me and other peeps here on the Comp & Tech forum)

The good thing about doing this, is that it's a one time deal. Do it once, and your good for life. (At least... until you reformat =o| )

The only bad thing, (and this can't even be deemed "bad") is that it may seem too intimidating for someone who uses their pc for browsing the web, and writing email.

The second thing to do, is to install, configure, update, and then scan your system for malware, which is the purpose of this tutorial.

And yes, that is the preferred order. What good is doing a scan if your using out of date "fingerprints" to scan? That's like looking at last weeks t.v guide to find out what time this week your favorite t.v. show is on.

Now:

First things first.

Scanners:
There's a whole plethora of them out there:
AVG/Ewido
Spyware Doctor
Webroot
Spybot Search & Destroy
LavaSoft Ad-Aware

Note: Use ALL the default installation options - especially the one that says "install for all users" or "install for just this user"
( Make sure the "install for all users" option is the one that’s checked - You'll see why later on in this tutorial.)

It's always a good idea to update the definitions before doing a scan & removal, simply because new malware is being written & released on literally an hourly basis. Granted, updating your definitions now, may not protect you against malware that was released 10 minutes ago, but it still a good idea.

For the purposes of this tutorial, my workstation has Ewido/AVG Anti-spyware installed, so that’s where the screen shots are going to be from.

Here's the main screen for AVG:

Now, before we do anything, we want to update our signatures/definitions. Because like what was previously stated, new spyware types are being released on literally on an hourly basis.

So, click the following icon:

Clicking that icon will bring you to the following screen:

Now, before you scan, you want to change the default action:

Then, click the "Settings" tab

After that, click the link that says "Recommended actions" and a little drop down menu will open up:

Personally, I would recommend that you select the "Delete" option. There is one down side to this however:

If an application critical file becomes infected, (usually malware targets files that end with .dll) then Ewido/AVG will delete the file, more than likely rendering the program unusable.

However, there is a very simple fix for this: just reinstall the application.

Ok.

Lets go through our checklist:
Anti-Spyware application installed? - Check
Spyware definitions updated to the latest signature file? - Check
Default action set to delete? - Check

Now, lets get the ball rolling:

Once the above things are done, reboot your pc.

Immediately, during the boot up process, continually hit the "F8" key

(You only have a 5-10 second window to access the boot up menu, so you have to continually hit the F8 key)

You should get a black screen that says "Windows Boot Options menu"
You want to select "Safe Mode"

Now, your going to see a lot of white text show up, don't worry about this, that’s normal.

However, when you get to the login screen (It should be blue screen with 2 user accounts showing up)

Make sure you select the account titled "Administrator"

Why?
2 Reasons:
1. Because usually pre-built pc's have 2 accounts on them:
One titled "Administrator" and the other, depending on the make/model/manufacturer, will say something along the lines of: "HP_User"

2. Most types of malware installs it self under the account that was being used at the time of infection, and, 95% of the time malware creates several registry keys to allow it to start up when windows starts up. However, that usually only applies to the account that was being used when the pc was infected.

Usually, the Administrator account isn't the one that’s being used.

Most of the time, you wont see the login screen that allows you to select the account if there’s only one person using the pc.

Windows Xp, by default, automatically logs into the one account that was created when the pc was built. ( for example - if its an hp machine, there will be 2 user accounts: one called "hp_user" and one called "Administrator" the pc will then automatically log in using the "hp_user" account)

Now, because the Administrator account isn't normally used, the chances that this user profile has the start up entries for the malware written to it, is fairly low. This is important because, when a file is running, Windows prevents the files from being changed (namely: deleted and/or renamed)

Have you ever gotten the error message:

"Cannot delete "file name here" - Access is denied. Please make sure the disk is not write protected, or that the file is not in use"

That is because the file is in use, and windows has "locked" the file. The same thing applies to malware.

Here's why we did this:
1. Safe mode loads up with the bare minimum files needed to make it to the desktop.

2. Chances are that the Administrator account doesn't have the entries needed for the spyware to start up.
(Some spyware still starts up regardless if your in safe mode or not… think of this as added insurance that its not running.

Think of it like this: because each user profile is like a different set of instructions, and the instructions are specific to each person.

Now that that explanation is out of the way, lets go on with the scan.

Click the "Scanner" icon

Then below that, you should see "Complete System Scan"

Allow the scan to finish, and if anything comes up in the window, there should be a link at the bottom that says: "Apply default actions"

One important note:
It would be a wise idea to install/update and then scan with several different scanners, because one scanner will pick up several things that another scanner failed to pick up. There is no one "cure all" scanner out there.

Hope this helps