|
Spyware - Adware - Malware Partial Alphabetized List below |
Spyware Threat Continues to Grow
Every week, we get reader mail about spyware. According to many experts, the term spyware first came into use with its current meaning - software that transmits information back "home" to its creator or perpetrator without the user's permission, and often without the user's knowledge - sometime around 1999.
It has grown into one of the four biggest "malware" (malicious software) threats to computers worldwide, along with viruses, trojans and worms.
Many legitimate programs transmit information for purposes that are useful to the user. For example, Windows sends information about errors back to Microsoft to help the company troubleshoot and fix the problems that cause the errors. Key characteristics of malicious spyware is that its makers go out of the way to disguise its nature (for example, installing it along with other, legitimate programs) and usually don't provide users with a way to turn it off or easily uninstall it.
So what are the dangers of spyware? First, it can bring system performance to a crawl. Most spyware installs itself configured to start whenever you boot the computer and run all the time. It not only steals your system resources but also your Internet bandwidth, thus not only slowing down the computer on which it's installed but also potentially slowing network performance for other computers on the same network. It can also cause your system to become unstable and crash.
Spam bots, keyloggers, kiddie porn connect with major adware companies – 180solutions, Direct Revenue, SurfSidekick, BullsEye Network and ShopAtHomeSelect installed in conjunction with a spam zombie and rogue anti-spyware program, all of which started from a child porn site and were installed through an exploit.
See
List Below
However, the danger that worries most people more is invasion of privacy. Spyware programs can collect all sorts of data off your computer to send back to its maker. Usually it's information that can be used for advertising/marketing analysis, such as what Web sites you visit frequently. However, there is the potential for spyware programs to gather almost any information stored on your computer, including financial/credit card information and personal ID information (for the purpose of identity theft), e-mail addresses of your contacts (for spamming purposes) and so forth.
And it's getting worse. The latest way to infest computers with spyware is through a bot net. That's a group of computers that have been infected with "agent" or "bot" (short for "robot") software and work together to launch attacks on other computers. These bot nets have recently started focusing more and more on installing spyware programs on the targeted victim computers.
The most common are Bargain Buddy, GAIN, b3d projector, Gator, n-Case, SaveNow, Search Toolbar, Webhancer, and Search Assistant.
From difficult-to-uninstall toolbars to home-page hijackers and pop-up window generators.
Most promoters of Spyware or Adware say they are not doing anything wrong
because when you agree to the terms or service or the EULA. It states that you
will be providing this information to theses companies.
Some people don't mind
being a nameless statistics generator. But sometimes these programs can lead to
problems with your computer, and can even compromise security.
All of these programs will store files on your computer. From a few cookies to .dll files and registry entries installed on your computer. Spyware is like any other program on your computer. When running, it uses your system memory, and processor to keep it running, taking away precious resources from other, more important programs!
Much or even most spyware comes from consumers installing 'free' content or software that they shouldn't. Be careful of "FREE".
Some of the above
content from WXPnews
What is (and isn't) spyware, anyway?
| Executables
from SPYWARE INFORMATION CENTER |
|
|
Below is a partial list of online data collectors. Spyware & Malware This list is the most common spyware and by far not a complete list. New spyware/adware is coming out every week. |
|
|
Numbers A AntiVirus 2008
B C D E EconForecast® F G H I
J
L
M
|
N
P Q R S T V W X Z End
If you know of any
Spyware to add to this small collection, please email me and I will check it out and add it to the list.
|
|
Executables File Name ----------------------Description |
From WXPNews
http://www.wxpnews.com/
What is (and isn't) spyware, anyway?
"Computer users are all up in arms about spyware - and rightfully so. Programs that install themselves on your computer without your permission, and then surreptitiously report information about you and/or your system back to someone else over the Internet are scary, and can be downright dangerous. That information could include things such as your credit card numbers, bank account numbers, passwords and other data that can be used to steal your identity and/or your money.
In its recent annual study, CompTIA concluded that spyware has become the number one security threat for the business organizations they surveyed - winning out over viruses and worms and browser-based attacks. Over half of those surveyed noted that the amount of spyware has grown over the last year.
Any effort to address the spyware problem, however, has to start with defining exactly what it is - and this is where industry pundits and even anti-spyware vendors part company. Spyware extremists even accuse Windows of being spyware, because it sends crash reports and validation information to Microsoft servers. Others see every cookie installed on your hard drive by a web site as spyware, because cookies interact with the site when you go there again.
In fact, if your definition of spyware includes all software that connects back to its "mothership" over the Internet, then you're talking about the vast majority of computer programs used today. Anti-spyware programs themselves, like anti-virus programs, must periodically connect to their servers to download definitions databases so they have the latest information about the malware that's out there and can recognize it when it tries to install itself on your computer.
Many of these programs also send information they gather from your computer about the malicious software they find there, to compile statistics and help increase protection for all their customers. Does this mean anti-spyware programs are spyware? Of course not.
There are two key factors in defining real spyware: the information it collects is used for malicious purposes, and/or it's done without your knowledge or permission. When you install Windows, you accept a EULA that states you give permission for certain information, such as validation information, to be collected from your computer. As for crash reports, Windows asks permission each time before sending them, and you can turn them off altogether if you want.
What about cookies? These are bits of text that are placed on your computer by a web site and then sent back to the web site's server every time you go to that site. You can disable cookies in most web browsers, but you might not be able to access some web sites if you do. Unlike true spyware, cookies aren't programs and don't do anything to your computer.
But these differing definitions of spyware lead to some interesting situations. In particular, some anti-spyware programs identify cookies as spyware and others don't. We've heard from computer users who say CounterSpy isn't a good anti-spyware program because they ran it and then ran another anti-spyware program and it "found all kinds of spyware that CounterSpy didn't find." In most cases, all that "spyware" turns out to be cookies. In other cases, the other program was detecting a harmless registry key that it identified as belonging to spyware, even though there were no corresponding executable files capable of committing malicious acts.
Quoting a Sunbelt Software executive: "The bottom line is that running one spyware product after another, then attempting to draw grand conclusions from such anecdotal evidence isn't a useful exercise. I can take any two products, run them any which way, and one will usually detect something that the others didn't. Even still, that tells you nothing about either of the products. The only tests that can tell you something meaningful about the products are those conducted in controlled environments with a well-defined methodology against a statistically significant number of samples."
So the value or efficacy of an anti-spyware product can't be measured by the sheer volume of spyware it claims to have found, if some of those items it detected aren't spyware at all. To be effective, an anti-spyware program must not only guard against false negatives (that is, allowing spyware to go undetected) but must also guard against false positives (identifying something as "spyware" that really isn't). The same goes for anti-virus, anti-spam and other security-related products."
HuntBar is a toolbar providing searching features, which is added to every
Internet Explorer and Windows Explorer window.
It also changes your home page and search bar settings to point to HuntBar's servers, and automatically opens this search bar when it detects you using any other search engine.
Distribution
Through ActiveX drive-by-download at affiliate sites, possibly in pop-up advertising.
TrafficSyndicate, the makers of HuntBar, offer 'co-branded' versions of HuntBar which may be installed by other sites under a different name.
What it does
Advertising
No.
Privacy violation
HuntBar sends the domain name of the site being viewed, the domain name of any site previously being viewed and the title and any keywords in the current page to its controlling servers whenever a new site is viewed. It does this even if the toolbar is not turned on.
However, it does not (currently) use a cookie or unique ID to track visits across sites.
Security issues
Yes. HuntBar can silently download and execute arbitrary code, as an update feature.
Stability problems
None known.
Removal
TrafficSyndicate offer two removal programs. (Also try Spybot.
I've had recent success removing Huntbar with this program)
Ad-Aware cannot yet remove this parasite.
Manual removal
HuntBar stores its code in a folder called 'MSIETS' inside the 'Common Files' folder in 'Program Files'. Before you can delete it, you must deregister its DLLs. There will be one called 'msiets.dll', and, if HuntBar has been running long enough to download some updates, probably also 'msielink.dll'. If you don't have msielink.dll you will only have to use the first of the two following commands.
Open a DOS command prompt window from Start->Programs->Accessories, and enter the commands. For Windows XP, 2000 or NT:
regsvr32 /u "C:\Program Files\Common Files\MSIETS\msiets.dll"
regsvr32 /u "C:\Program Files\Common Files\MSIETS\msielink.dll"
Or for Windows 95, 98 or Me:
"%WinDir%\SYSTEM\regsvr32.exe" /u "C:\Program Files\Common Files\MSIETS\msiets.dll"
"%WinDir%\SYSTEM\regsvr32.exe" /u "C:\Program Files\Common Files\MSIETS\msielink.dll"
You will need to change the path 'C:\Program Files\Common Files' in the above commands if your Program Files are on a different drive, or have a different name (eg. non-English Windows installations).
Having done this you can restart the machine and delete the MSIETS folder, along with the entry '{8A05273A-2EA5-42DE-AA75-59EA7D9D50D7}' inside 'Downloaded Program Files' in the Windows folder. You can also run 'regedit' and remove these entries from the registry to clean up if you like:
HKEY_CURRENT_USER\Software\MSIETS
HKEY_CURRENT_USER\Software\MSIETSLink
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar\{8A05273A-2EA5-42DE-AA75-59EA7D9D50D7}
After removing the software you may want to delete the shortcuts it adds to the desktop, start menu and
favorites menu, and set your search and home pages back to normal (in Control
Panel / Internet Options).
|
|
|
Software Publisher's Description
|
|
Free
Download
|
|
Software Publisher's Description
|
|
Microsoft's
Free anti-spyware
tool!
|
From Trend Micro
Spyware & Adware - How the Bad Guys Profit
------------------------------------------------------------------------
Broadly defined, spyware is any software program that surreptitiously monitors
and gathers user information. What was once written and installed only by
malicious
authors seeking to steal users' personal information, adware has emerged as a
new
and more prominent form of spyware. A slightly less malicious form of spyware,
adware can display pop-up advertisements produced by so-called legitimate adware
companies. Adware companies are well funded, to the extent that some have even
discussed launching multi-million dollar IPOs.
The current mix of spyware and adware presents a compelling challenge to both
computer users and security companies, because of the lack of clarity about what
constitutes legitimate marketing techniques ? and is further complicated by the
fact
that the rules vary widely throughout the world.
A narrow definition of spyware includes programs on a user's computer that
report user
behavior, such as keystrokes or Web browsing history. According to this
definition,
some types of spyware may be used for marketing purposes, while other types are
used
for the purpose of criminal fraud leading to profit making.
Trend Micro uses both broad and narrow definitions of spyware, according to
Anthony
Arrott, Trend Micro's manager of spyware research. "A broad definition of
spyware
would include adware and Trojan spyware," he explained. "Anything that
interferes
with the privacy, productivity, or security of your PC can be called spyware -
with
the caveat that it is non-propagating. Spyware stays on a system as long as it
can
without being noticed. Also, while viruses and worms are essentially about
vandalism,
broad-definition spyware is about monetary gain."
The story of how the money flows in the spyware cycle involves four contributors
or
sources. First are the advertisers themselves, and second are the agents they
hire to
market their products. Third in the spyware food chain is the publishers, the
writers
of the program 'payload', the crimeware or grayware that actually gets delivered
to
the user's computer. Fourth are the distributors, who often distribute multiple
payloads for a variety of publishers, since they earn their money on a "per
install"
basis.
Spyware and adware were prevalent trends in 2005. According to Trend Micro's
research,
29 per cent of the total threat landscape for the year was comprised of spyware
and
adware. 2005 also saw the use of blended threats, in which malware authors
initiated
multi-trojan attacks ? including worms that drop or download spyware/adware
programs
onto systems ? to take advantage of marketing programs that pay a small fee per
installation.
The trend is likely to continue in 2006 and beyond. Adware-driven campaigns can
generate significant amounts of money, and many adware companies are eager to
have
their products installed in as many PCs as possible. As the threat of spyware
and
adware continues to grow, it becomes even more critical for computer users to
scan any
program downloaded through the Internet - including any downloads from P2P
networks,
via the Web, or any FTP server, regardless of the source - with updated
anti-virus and
anti-spyware software.
If you would like to scan your computer for worms, viruses, Trojans and
malicious code,
visit HouseCall, Trend Micro's free, online virus scanner at:
http://trendnewsletter.rsc03.net/servlet/cc5?lgLQSRBYQTVKhgplLtpxLHjlotpgsQgLlV2VU
Viruses: Self-replicating code inserts copies of the virus into host programs or data files. Viruses can attack both operating systems and applications.
Worms: A self-replicating, self-contained program executes without user intervention. Worms create copies of themselves, and they don't require a host program to infect a system.
Trojan horses: This self-contained, non-replicating program appears to be benign, but it actually has a hidden malicious purpose. Trojan horses often deliver other attacker tools to systems.
Malicious mobile code: This software with malicious intent transmits from a remote system to a local system. Attackers use it to transmit viruses, worms, and Trojan horses to a user's workstation. Malicious mobile code exploits vulnerabilities by taking advantage of default privileges and unpatched systems.
Tracking cookies: Accessed by many Web sites, these persistent cookies allow a third party to create a profile of a user's behavior. Attackers often use tracking cookies in conjunction with Web bugs.
Great Site for Weeding
out the Scams!
Rogue/Suspect Anti-Spyware Products![]()
In a case that threatened to undermine the effectiveness of antispyware technology, a federal court last month sided with consumers when it ruled that companies can't be sued for providing Internet users with effective tools to protect themselves against online threats.
The case pitted Kaspersky Lab--which offers a range of antispyware and antivirus tools--against notorious adware distributor Zango.
A ruling in favor of Zango would have had wide-ranging negative impact, not just for Kaspersky, but for all antispyware developers, and, in turn, for the millions of consumers who rely on those companies to keep their computers free of unwanted, often malicious programs.
Thankfully, U.S. District Court Judge John Coughenour sided with Kaspersky, holding that the Communications Decency Act immunized the company against Zango's claims and giving users of antispyware software the comfort of knowing that their antispyware software can alert them about the potential risks of all questionable software.
By Ari Schwartz,
News.com
Published on ZDNet News: Oct 3, 2007
Artical http://news.zdnet.com/2010-1009_22-6211302.html?tag=nl.e550
Just