|
 |
SPYWARE: Removal Procedure
PC Cruiser - Spyware Removal Procedure for Windows
This procedure is recommended for people who have an advanced knowledge of computers. You must be familiar with the various
computer major hardware manufacters and software vendors and the names of their products and drivers, as well as an understanding of how the
Windows registry works. Before your begin, you should check the following things, on the computer in question:
- Determine if you have access to your Task Manager
To see if it works press Ctrl-Alt-Del. If it opens a window then you know it works and you can now close it.
- Make sure you have a Run command in your Windows Start Menu
Note: Windows Vista's Run command has been combined with the Search box. So if your instructed to execute a Start-Run command, then just type
whatever your told into the search field and press enter.
- Determine if you have access to your Registry Editor
Using the Start-Run command type (without quotes): "regedit" and press enter or click ok. If it opens a window then you know it
works and you can now close it.
You should also know how to boot your computer into "Safe Mode"
- Whatever the Microsoft-based operating system, presssing the F8 key, about once a second, after you hear a single beep, when
the computer is restarting or just after it is turned on will get you into "Safe Mode". Only a few computers will have the BIOS configured
to bring up a Boot-Selection menu, if your pressing F8 at startup. If it does, just select the main hard drive from the list and then immediately
begin pressing F8 again.
- When it brings up a white menu on black background you will be able to use the arrow keys to choose the different options, and when you have
selected "Safe Mode" press Enter.
- If you see a logon screen, then enter the username and password for the main user of the computer (not the Administrator account).
You may also need to know how to boot your computer into "Safe Mode with Command Prompt"
This is the same as "Safe Mode" except at the white menu select "Safe Mode with Command Prompt" instead.
If your Task Manager works, you have a Run command in your Windows Start Menu and you can open the Registry Editor, then you can skip ahead to the
section Set system to show hidden files and folders,
- If your Task Manager doesn't open
If you get the error message: task manager has been disabled by your administrator:
Reboot your system into "Safe Mode with Command Prompt"
After you get the window with the old fashion DOS C:\...> prompt
Type (without quotes):
"REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 0 /f" and press enter to execute the command.
Now type (without quotes):
"REG add HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v Start_ShowRun /t REG_DWORD /d 0 /f" and press enter to execute the command.
Finally type (without quotes):
"REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 0 /f" and press enter to execute the command.
Now reboot the computer.
- If you do not have access to your Registry Editor
If you get the error message: registry editing has been disabled by your administrator:
Open Start-Run and type (without quotes):
"REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 0 /f" and press enter or click ok
- If you had to perform any of the above actions to re-enable the Task manager or Registry Editor
It is very likely that there are many other options that have also been disabled.
Note: The following requires that you are familiar with editing your computers registry, and the consequences if any mistakes are made during such modifications to your system.
Open the Registry Editor and navigate to modify the following keys:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
This key should be empty (except for maybe an empty run subkey). Delete all other entries:
Start_ShowRun, NoStartMenuMFUprogramsList, NoStartMenuPinnedList, NoStartMenuSubFolders, NoCommonGroups, NoSMMyPictures, NoStartMenuMyMusic,
NoSMMyDocs, NoDesktop, NoActiveDesktop, NoViewOnDrive all should be set to zero or deleted.
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced
This key should only have a TaskbarSizeMove key (and a Folder subkey). Delete the following entry:
Start_ShowRun should be set to zero or deleted.
HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main
The Start Page key may have been altered.
The Window title key may have been altered.
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer
NoViewContextMenu should be set to zero or deleted.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
Only the NoDriveTypeAutoRun should appear in this key. Delete all others:
NoStartMenuPinnedList, NoStartMenuMFUprogramsList, NoStartMenuSubFolders, NoCommonGroups, NoSMMyPictures, NoStartMenuMyMusic, NoSMMyDocs,
NoDesktop, NoActiveDesktop, NoViewOnDrive, NoControlPanel, NoDrives, NoRun, NoFind, NoFavoritesMenu, NoRecentDocsMenu, NoLogOff, NoClose,
NoSaveSettings, NoUserNameInStartMenu, NoToolbarCustomize, NoThemesTab, NoSMHelp, NoPrinterTabs, NoPrinters, NoNetHood,
NoManageMyComputerVerb all should be set to zero or deleted.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System
This key should be empty. Delete all entries.
DisableCMD, DisableTaskMgr, DisableRegistryTools, NoFolderOptions, NoFolderOptions all should be set to zero or deleted.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Uninstall
This key should not exist. Delete the entire key.
NoAddRemovePrograms should be set to zero or deleted.
HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main
The Start Page key may have been altered.
The Window title key may have been altered.
The following keys should be deleted:
NoControlPanel, NoDrives, NoRun, NoFind, NoFavoritesMenu, NoRecentDocsMenu, NoLogOff, NoClose, NoSaveSettings, NoUserNameInStartMenu, NoToolbarCustomize,
NoThemesTab, NoSMHelp, NoPrinterTabs, NoPrinters, NoNetHood, NoManageMyComputerVerb should be set to zero or deleted.
HKEY_CURRENT_USER\Control Panel\Desktop
The WallpaperOriginX key should be set to 0.
The WallpaperOriginY key should be set to 0.
The MenuShowDelay key should be set to 400.
HKEY_CURRENT_USER\Control Panel\International
The sTimeFormat key should be set to "h:mm:ss tt" (for standard time) or "HH:mm:ss" (for military time).
Now Reboot the computer.
- Set system to show hidden files and folders
Reboot your system into "Safe Mode" and double-click on My Computer. Select the Tools menu and then Folder Options
(This may be under the View menu in Windows 9x/ME). Click the VIEW tab at the top of the Folder Options window. Turn on the options to show hidden
files and folders, and uncheck Hide extensions for known types.
- Run HiJackThis
Click on Do a system scan only.
You will need to know what should be considered BAD:
- It is not BAD if it has a legitimate company name such as: your AntiVirus software, Java, Adobe, Yahoo, Google, MSN,
Windows Live, Msn Messenger, Hewlett Packard, Canon, Lexmark, Dell, Acer, Logitech etc...
- It is not BAD if it contains a legitimate web addresses like: symantec.com, mcafee.com, trendmicro.com, pandasecurity.com, ea.com,
hp.com etc...
- Anything with a random name like uksdhjk.exe it is BAD.
- If it has (no name) and the files location gives no hint of the owner (e.g. the file is in the C:\WINDOWS\SYSTEM32 folder instead
of it's own folder such as C:\Program Files\Symantec). Then do an Internet search on the part of the name that comes after the last "\".
If you cannot easily identify it as belonging to a legitimate program or driver that is supposed to be installed on the computer, then it
can be considered BAD.
- If it is known to be Spyware (e.g. XP AntiVirus 2008), and doing an Internet search for the product name results
in a bunch of pages talking about how to remove it then consider it BAD.
- If it has (no file) consider it BAD (the file associated with the item is missing).
The following is a list of explanations for each of the codes in HiJackThis:
- R0, R1, R2, R3 Internet Explorer Start/Search pages URLs. Put check marks beside BAD ones
- F0, F1, F2, F3 Autoloading programs from INI files. Put check marks beside ALL.
- N1, N2, N3, N4 Netscape/Mozilla Start/Search pages URLs. Put check marks beside BAD ones.
- O1 Hosts file redirection. Put check marks beside ALL.
- O2 Browser Helper Objects. Put check marks beside BAD ones.
- O3 Internet Explorer toolbars. Put check marks beside BAD ones.
- 04 Autoloading programs from Registry. For most BAD items it would be best to open the Start-Run command and type (without quotes):
"msconfig", to open the System Configuration Utility. Click on the Startup tab and uncheck items from there. This way, you
can later determine if they can safely be re-activated. For the BAD items that are known to be illegitimate or with a random name put a
check mark beside them.
- O5 IE Options icon not visible in Control Panel. Put check marks beside ALL.
- O6 IE Options access restricted by Administrator. Put check marks beside ALL.
- O7 Regedit access restricted by Administrator. Put check marks beside ALL.
- O8 Extra items in IE right-click menu. Put check marks beside BAD ones.
- O9 Extra buttons on main IE button toolbar, or extra items in IE 'Tools' menu. Put check marks beside BAD ones.
- O10 Winsock hijacker. Do not fix these with HiJackThis. Do not put check marks on these.
- O11 Extra group in IE 'Advanced Options' window. Put check marks beside ALL.
- O12 IE plugins. These are mostly safe. Put check marks beside any items with .ofb or if you unsure of any item do an Internet
search to find out if it is legitimate.
- O13 IE DefaultPrefix hijack. Put check marks beside ALL.
- O14 'Reset Web Settings' hijack. Put check marks beside ALL.
- O15 Unwanted site in Trusted Zone. Put check marks beside BAD ones.
- O16 ActiveX Objects (aka Downloaded Program Files). Put check marks beside BAD ones.
- O17 Lop.com domain hijackers. If domain is your ISP then leave it. Or, if this is your (home or company) network address then
leave it. Put check marks beside the rest.
- O18 Extra protocols and protocol hijackers. . Put check marks beside BAD ones.
- O19 User style sheet hijack. If any are found then you will need to put a check mark beside ALL of them and later your will need
to run CWShredder.
- O20 (AppInit_DLLs and Winlogon Notify). Put check marks beside BAD ones.
- O21 (ShellServiceObjectDelayLoad). Put check marks beside BAD ones.
- O22 (Shared Task Scheduler). Put check marks beside BAD ones.
- O23 NT Services. For most BAD items it would be best to open the Start-Run command and type (without quotes):
"msconfig", to open the System Configuration Utility. Click on the Services tab and uncheck items from there. This way, you
can later determine if they can safely be re-activated. For the BAD items that are known to be illegitimate or with a random name put a
check mark beside them.
After selecting all the BAD items hit the Fix Checked button.
Wait for the items to be removed and the screen clears all the items. Then exit HiJackThis.
Now Reboot the computer back into Normal Mode (out of Safe Mode).
- Install spyware removal and protection software
Install SpyBot or other such software (e.g.
Ad-aware).
Selecting options when installing Spybot
- If you do not have an Internet Connection at the Select Components screen uncheck the box to the left of
Download updates immediately
- When asked to Select Additional Tasks.
Under the Permanent protection section you should uncheck the box to the left of Use system settings protection (TeaTimer).
- When done uncheck the mark beside Run Spybot before finishing the installation.
After the installation is complete get all the updates available for the product.
Spybot will have an update file known as "spybotsd_includes.exe" available for download directly from the download page of their web site labeled Detection updates YYYY-MM-DD, which should be run
after installing, but before using the Spybot program. This will update the definition files for the most recent release of their product.
TeaTimer will repeatedly complain every time you fix something with Spybot, MSConfig, or installing any new software.
You can turn on Tea-Timer later, but it will pop-up a window for every attempt to modify the registry, which allows you incredible control,
if you can understand which kind of registry changes are good and which ones are not.
- Now reboot the system into "Safe Mode" and run Spybot
- Answer Yes, if asked to remove temporary files.
- Click Next-Next through the wizard, and then hit Start using the program.
- Click Immunize in the left column and then click Immunize with the green plus sign beside it. This will activate SDHELPER (it appears as a BHO
in HiJackThis). It's Spybots browser protection component. Wait until the number of Unprotected items reaches zero.
- click Search & Destroy in the left column, and start the search by clicking on Check for problems
- When the search is finished click on Fix selected problems.
If some of the items cannot be deleted choose not to run spybot at startup. You should already be in "Safe Mode",
so running at startup will not likely be any more successful.
- Now Reboot the computer back into Normal Mode (out of Safe Mode).
- Perform a virus scan
Use the computers installed anti-virus software to perform a virus scan. Make sure the software is up-to-date. If it isn't, then either update it,
purchase the software necessary to update it, or perform a virus scan with an online virus scanner. You can use
Trend Micro's Housecall,
Symantec's Security Check,
McAfee's freescan or
Panda's ActiveScan.
Remove or quarantine everything found.
- If neccessary Run TheKillBox, CWShredder or SmitFraud Removal Tools
Reboot the computer into "Safe Mode" again and run the follwoing tools, if any of the following statements are true:
- If your AntiVirus or AntiSpyware finds but cannot remove VX2.BetterInternet, use TheKillBox to search for ABetterInternet Select Fix L2M and choose Kill VX2.BetterInternet
- If your AntiVirus or AntiSpyware finds but cannot remove CoolWebSearch, use CWShredder. Un-check the box that says to move the bad files to the recycle bin instead of deleting them. CWShredder will remove CW and variants automatically.
- If your AntiVirus or AntiSpyware finds but cannot remove SmitFraud (Known akas forSmitFraud) use SmitFraudFix Tool (Windows 2000/XP) or smitRem Tool (Windows 9x/Me/2000/XP). Do not use both to repair your system.
- Re-run HiJackThis
- Click on Do a system scan only.
- Some items may have (no file) or (missing file), and you can put a check mark beside them and then click on Fix Checked. They will
appear because your spyware or AntiVirus removed the file earlier in this process but not the actual item (registry entry).
- Click on Scan to recheck, and verify that HiJackThis onlys shows legitimate programs settings and drivers for applications
that you now recognize, at this point.
- If HiJackThis cannot remove any items or certain items just keep coming back, then you still have Spyware on your computer or you are trying
to remove something that is critical to your system. Verify with an Internet search that the items are in fact actually BAD. If they turn
out to be legitimate, then you are done. If not, then write down the filename (e.g. XPAntVir.exe) and it's location (e.g. C:\WINDOWS\Program Files\XP AntiVirus 2008\).
- Reboot the computer into "Safe Mode with Command Prompt", and using DOS commands change to the folder then delete the file, then
create a folder with the exact same name as the file. Now change it's attributes to Read Only Hidden and System file. Next Reboot the computer into
"Safe Mode" and remove the Inherit permissions from parent for the folder that you created in DOS. Now the item will be unable to
re-load itself, and the item can be removed with HiJackThis.
- Reset Internet Explorer's security settings
Many spyware components alter the security settings for Internet Explorer. Go to the Control Panel and open the Internet Options.
Reset the security settings to Default:High or Default:Medium. Then, check the Trusted Sites zone for entries. There shouldn't be any in there
unless you want certain web sites to be trusted, remove any others. Then reset the security level to Default:High or Default:Medium.
Reset the Restricted Zone to Default:High. Under the Programs tab click Manage add-ons (newer versions of IE only) and disable any BAD
items. Finally reset the Defaults on the Advanced tab.
- Install new HOSTS file
A HOSTS file contains a list of websites that you do want your browser to be allowed to visit. You can find a great list of sites that are
known to cause problems for many Internet users. Go to your C:\Windows\System32\Drivers\Etc\ folder, and make a backup copy of the HOSTS
file there. (Note, there is no TXT extension on it.) Open the HOSTS file with Notepad (right click on it choose open with and then choose
notepad). Then copy the list found at the following link using the Edit menu's Select All option:
http://www.mvps.org/winhelp2002/hosts.txt.
Now go back to your original HOSTS file and again using the Edit menu's Select All option, and then paste it over the text that was
there. Save and exit notepad.
- For Protection From Future Spyware Attacks Install SpywareBlaster
Install SpywareBlaster, download the udpates for it and click the Enable All Protection link.
- Run Process Explorer
If you still see there is a process in the Task Manager that shouldn't be there, or you thought it had already been removed and seemed to come
right back then launch Process Explorer which will show you more detailed information about
each task running including their associated files and registry keys. This is a lot more useful than using the task manager to identify possible
spyware that may still be active.
- Run BHO Demon to Get Rid of Unwanted BHO's
If HiJackThis finds but cannot remove any BHO (Browser HiJack Objects), and your sure they're not one of your wanted BHO's (some BHO's place
convienient toolbars and buttons for you to use inside Internet Explorer. Then you should run the BHO Demon
program, and disable any BHO objects that you are not familiar with, or do not wish to use Note: SDHelper.dll is a the part of Spybot Search &
Destory's active spyware prevention system.
- Launch Your Internet Browser
Consider an Alternative Browser. Try Firefox or Opera. Check them over, and see if it will suite your needs.
If you still prefer, Internet Explorer, try using it now and surf around for a bit and see if any unwarranted pop-ups occur. Only go to sites that you know do not launch pop-up ads. It makes it easier to diagnose. If you see a pop-up or two, or, worse, TeaTimer complains about settings changes, it's likely you still have ABetterInternet hooking into Explorer via registered DLLs. Go to Run TheKillBox.
- To Check For Unwanted Active DLL's Run PV.ZIP
DLL's are small pieces of an applications that are needed to be active for a program to work properly. If your a power user and you want to kill unused DLL's that were associated with your recent virus of spyware infection. Note: this task is not recommended for anyone but the most experienced of users.
Launch Internet Explorer then unzip the PrcView file. In there will be a batch file called “RUN ME.” Run that and a notepad window will launch with a list of open DLLs. You will have to do a little detective work here. One of the DLLs is likely a spyware component. Do a Google search on them and see what you come up with. You will use TheKillBox to remove the DLL by selecting the "Delete on Reboot" option, adding the file you want to delete, then the "Process and Reboot."
- If You Have XP Get Service Pack 2
The new version of Internet Explorer that is installed with Service Pack 2 has a built in pop-up stopper, but it can still be fooled by spyware. After upgrading to Service 2 for XP, the adware and spyware still gets through. There is a new option to manage the add-ons that get installed into the Microsoft browser, under the "Tools" menu - Select "Internet Options" - Choose the "Programs" tab and click "Manage Add-Ons". Disable anything that your not familiar with.
|
SPYWARE: Alexa
- Alexa Spyware Installed Whenever You Install Any Microsoft Product
Alexa is a free, ad-based product which installs itself into your Internet Explorer or Netscape browser. It ads a bar which has a series of links into your browser which gives quite a bit of information about each web page that you visit. For example, the contact information, related links, reviews of the site, traffic and some other information is displayed.
Alexa has an additional purpose, however, as is explained in their privacy policy.
"ALEXA COLLECTS AND STORES INFORMATION ABOUT THE WEB PAGES YOU VIEW, THE DATA YOU ENTER IN ONLINE FORMS AND SEARCH FIELDS WHILE USING THE ALEXA SOFTWARE, AND, WITH VERSIONS 5.0 AND HIGHER OF THE BROWSER COMPANION SOFTWARE, THE PRODUCTS YOU PURCHASE ONLINE. ALTHOUGH ALEXA DOES NOT ATTEMPT TO ANALYZE WEB USAGE DATA TO DETERMINE THE IDENTITY OF ANY ALEXA USER, SOME INFORMATION COLLECTED BY THE SOFTWARE IS PERSONALLY IDENTIFIABLE. ALEXA AGGREGATES AND ANALYZES THE INFORMATION IT COLLECTS TO IMPROVE ITS SERVICE AND TO PREPARE REPORTS ABOUT AGGREGATE WEB USAGE AND SHOPPING HABITS."
So what does this and the remainder of a very long privacy policy translate to in plain English? Alexa watches you surf the internet and transmits the URLs of the sites that you visit back to their computer system. Their stated intention is to build up a list of related links for each page that you visit. They also watch your shopping patterns to get an idea of what you are purchasing online, and presumably where you are purchasing things on the internet.
It's very interesting that Alexa is owned by Amazon.Com, and one of the "great" features of their browser bar is something they call a "shopping feature". This allows Amazon (and other business partners) to offer you comparative shopping advice while you surf through other sites.
Alexa now has a well written and lengthy privacy policy, but it was not always that way. In fact, there is a pending (as of May) class action lawsuit because Alexa didn't have a privacy policy posted on it's website at all. This meant that people who downloaded and installed the bar were not made aware that their movements through the internet were being watched and recorded.
http://www.internet-tips.net/Tanstaafl/spyware_alexa.htm |
SPYWARE: Aureate / Radiate program
BHO - Browser Helper Objects
- BHO
Cop (Browser Helper Object)
An additional tool to complement
Ad-aware, listed above.
The integration of BHOs with IE offers
rich opportunities but can cause trouble. Poorly written BHOs can bring
about IE crashes. Also, BHOs can conflict with each other, causing
problems with IE that can be very difficult to diagnose and fix, because
there's no way for you to know that a BHO has been
installed.
http://www.pcmag.com/article/0,2997,s%253D1478%2526a%253D4453,00.asp
- How
to Disable Third-Party Tool Bands and Browser Helper Objects
This article describes the steps to disable the third-party
Tool Bands and Browser Helper Objects features that you installed for
use with Internet Explorer. You may have to disable these features when
you have to troubleshoot Internet Explorer
problems.
http://support.microsoft.com/default.aspx?scid=KB;EN-US;q298931
- BHO Demon
BHO Demon, from Definitive Solutions, Inc., lists the BHOs that are currently
installed. You can then disable those you don't want to keep
http://www.siena.edu/antivirus/spyware/bhodemon.asp |
SPYWARE: General - Information
Spyware programmers like Virus programmers are constantly trying to stay ahead of the tools. Eventually one, or more, of the Anti-Spyware products will mature, and be able to handle all aspects of spyware or it will be incorporated into the Anti-Virus product suites, if the politics can be put aside. Spyware, in our opinion, borders on actually being a virus typically referred to as a Trojan. Trojans posses no viral (spreading) capabilities, but will inflict damage, compromise your system, steal personal information or inflict an annoyance of some kind on the user.
To explain why spyware is not being addressed as though they were Trojans by Anti-Virus vendors, you have to look at the rapid increase in spyware activity over the past year. There are more than 65,000 (See Here) known viruses increasing by the hundreds every month. There were very few major Trojans, before the new millenium, so Anti-Virus vendors would include almost all of them in their definitions. Since 2001, spyware has gone from a just few new ones every month to over 20000, in total (See Here), and the rate is steadily increasing by hundreds every month. They will probably soon exceed rate of new viruses.
Who decides which ones are considered worthy of making Anti-Virus vendor definitions is based on a few things. The resources of the vendor, at a time of post .com restraint they would have to increase their research workforce to tackle all of the new Trojans aka spyware. What is not very clear is what to do about software vendors that incoropate the spyware and adware into their software. Along comes your Anti-Virus's disk scan and disables your favourite program. Then your not going to be happy with them. So are they going to tackle the politics of the problem head on, and admit that all spyware are Trojans? Some recent spyware has the ability to prevent you from being able to run/update your Anti-Virus software. Surely these will be on the top priority lists for their workforce, but the rest of it may slide through unscathed.
- Anti-Spyware Coalition
The Anti-Spyware Coalition (ASC) is a group dedicated to building a consensus about definitions and best practices in the debate surrounding spyware and other potentially unwanted technologies.
Composed of anti-spyware software companies, academics, and consumer groups, the ASC seeks to bring together a diverse array of perspective on the problem of controlling spyware and other potentially unwanted technologies.
http://www.antispywarecoalition.org/
- Spy Checker
An alphabetically maintained list of know Spyware programs.
http://www.spychecker.com/
- Pest Patrol
Anti-Spyware software vendor with an excellent research section.
http://www.safersite.com/
- SpywareInfo, Home of the
Spyware weekly.
http://www.spywareinfo.com/
- Sandra
Hardmeier's contribution to
Spyware.
http://www.mvps.org/inetexplorer/Darnit.htm
- System wide
filtering and blocking
An introduction to eDexter. You
can modify your HOSTS file to filter unwanted
sites.
http://www.pacificnet.net/~bbruce/
- Gorilla Design Studio
Presents: Using the Hosts File
You can begin blocking ads and
help keep yourself from being tracked by using the Hosts file in Windows
and other operating
systems.
http://www.accs-net.com/hosts/
|
SPYWARE: Kazaa
- Kazaa, not only installs several spyware applications, but it also installs Brilliant Digital's software.
During Kazaa's installation you asked to agree to the following in the user licence agreement, which you must
accept in order to install Kazaa.
You hereby grant BDE (Brilliant Digital Entertainment) the right to access the unused computing power and
storage space on your computer/s and/or internet access or bandwidth for the aggregation of content and use in
distributed computing. The user acknowledges and authorizes this use without the right of compensation.
How
to uninstall Brilliant Digital's software
CNET's News.com has posted instructions for removing the Brilliant Digital software. While these instructions do work
now, KaZaa or Brilliant Digital could change the installation at any time to make these instructions fail.
http://news.com.com/2100-1023-875274.html
- Spyware Bundled With Kazaa 1.9
New.Net
SaveNow
- Spyware Bundled With Kazaa 2.5
This version comes with Peer Points. Configured to run at startup. Whether you want it to or not. What's more, that's not ALL you get.
"Peer Points Manager" includes a number of program and data files, mostly installed in the C:\Program Files\Altnet folder," say the guys. "Some software components (DLLs used by Peer Points Manager and other Altnet applications) are installed to the Windows\System or WinNT\System32 directory. Installing Altnet applications will not modify any existing files on your computer.
"Peer Points Manager" includes the Altnet Download Manager, a program that allows you to download Altnet files from the Altnet P2P network when clicking download links on supporting web sites.
"Peer Points Manager" uses PeerEnabler, a P2P networking component from Joltid (www.joltid.com). PeerEnabler is also used by other 3rd party applications, including Kazaa Media Desktop. If PeerEnabler is not already installed on your computer then it will be installed as part of Peer Points Manager installation.
By agreeing to the Altnet EULA at installation you also agree to the installation of ‘My Search Toolbar’ provided by The Excite Network, Inc.The My Search Bar is a customizable browser toolbar which provides end users with easy access to search results from the best search engines on the Internet in just one click, including results based on websites, directory listings, images, news, and FTP files.
For removal you can use the Add/Remove Control Panel to remove Pier Points Manager,
and ADAware 6 can remove the Brilliant Digital spyware, but removing Cydoor will cripple Kazaa so that it requires Kazaa to be fixed (which will re-install cydoor) or re-installed (which will re-install all the programs). To disable Cydoor (the advertising window built into Kazaa) the "C:\WINDOWS\SYSTEM32\AdCache" folder needs to have its Inherit From Parent
permissions unchecked and the Permission entries are blanked out (so no-one has permission to the folder), this program does cannot run (NTFS file system only - Windows NT 2000 XP 2003). Kazaa still works, but the advertisments area will be blank
- Spyware Bundled With Kazaa 2.6
This version also comes with Peer Points. Configured to run at startup.
You can use the Add/Remove Control Panel to remove the My Search Bar; however, most spyware removal programs will cause Kazaa to insist that it be re-installed with all the spyware (i.e. they now check to see if the spyware is running before allowing Kazaa to load).
This version also introduced a pay version, which they claim includes no advertising content.
- Spyware Bundled With Kazaa 2.7
This version comes with fsg_4104.exe, known as Claria, which is a utility that may be used to interfere with spyware removal and protection programs. It will appear in several locations. Initially it will show up in your WINDOWS\TEMP folder, but then it uses part of the registry to rename the file on reboot to the current users temp folder e.g. "C:\Documents and Settings\CurrentUsersName\Local Settings\Temp". After deleting these files they will re-appear the next time you run Kazaa, or the next time you reboot if you left the default option to Start Kazaa when you start Windows.
Blocking this application will not succeed. If you locate each file named fsg_4104.exe and each folder fsg_tmp and set Inherit From Parent permissions to unchecked and the Permission entries are blanked out (no-one has permission to access the files or folders), this program will then not be able to run under the filename fsg_4104.exe (NTFS file system only - Windows NT 2000 XP 2003). However, the next time your run Kazaa it will re-appear as fsg_4104a.
Also installed is the P2P Networking program, and they probably want you to think that it is part of Kazaa; however, if the "C:\WINDOWS\SYSTEM32\P2P Networking" folder Inherit From Parent permissions are unchecked and the Permission entries are blanked out, this program does not run (NTFS file system only - Windows NT 2000 XP 2003). Kazaa still works, after you do this, so does it really have anything to do with Kazaa or peer-to-peer file sharing?
Ad-aware 6 can remove the EUniverse spyware.
Spybot can remove the SearchForIt spyware.
To disable Peer Points the "C:\Program Files\altnet" folder needs to have its Inherit From Parent permissions unchecked and the Permission entries blanked out (NTFS file system only - Windows NT 2000 XP 2003). Kazaa still works without the peer points.
To disable Cydoor (the advertising window built into Kazaa) the "C:\WINDOWS\SYSTEM32\cache329" folder needs to have its Inherit From Parent permissions unchecked and the Permission entries blanked out, the program will then not run (NTFS file system only - Windows NT 2000 XP 2003). Kazaa still works, but the advertisments area will be blank
If after all that your Kazaa still works, then congratulations, but after each time you start it, you have to remember to stop the fsg_4104 process, and after your finished you'll have to manually remove or run Ad-aware to get rid of the reg keys associated with Claria:
- HKEY_CLASSES_ROOT:Clsid\{21ffb6c0-0da1-11d5-a9d5-00500413153c}\
- HKEY_LOCAL_MACHINE:Location\Software\Gator.com\
- HKEY_LOCAL_MACHINE:Software\Microsoft\Windows\Currentversion\Run\Trickler
|
SPYWARE: OPTOUT (Tool)
- What is Spyware?
Spyware is ANY SOFTWARE which employs a
user's Internet connection in the background (the so-called
"backchannel") without their knowledge or explicit permission.
Silent
background use of an Internet "backchannel" connection MUST BE PRECEDED
by a complete and truthful disclosure of proposed backchannel usage,
followed by the receipt of explicit, informed, consent for such
use.
ANY SOFTWARE communicating across the Internet absent these
elements is guilty of information theft and is properly and rightfully
termed: Spyware.
- OptOut
If you are
concerned of what is being gathered about your habits on the WEB then
you MUST download this OptOut program to delete any
unwanted requests.
http://grc.com/optout.htm |
SPYWARE: COMET.DLL
- If you have an earlier version of RealPlayer, it probably
installed a troublesome little thing called Comet Cursor without
you knowing it.
See if you have the file c:\windows\system\comet.dll
on your system. If you do, it may be the reason behind some errors you
are getting.
- Comet Cursor's Web Site
http://www.cometsystems.com
- CometSystems
Pest Patrol Report
http://www.pestpatrol.com/pestinfo/c/cometsystems.asp
|
SPYWARE: DSSAGENT.EXE
- Is a piece of code placed on your PC without your knowledge by
Broderbund (now Mattell Interactive). You can read about it and get a
patch that safely removes it from you PC (and other files and cleans up
your registry)
- Error
Message: DSSAgent Caused an Invalid Page Fault in Module
Unknown
DSSAgent caused an Invalid Page Fault in
module
unknown
http://support.microsoft.com/default.aspx?scid=KB;EN-US;q296077
(ME Jul. 12, 2001) |
SPYWARE: GOHIP.COM
- What it does:
1. Your DEFAULT LINK to your Home page will take
you to Go Hip
2. Your SEARCH DEFAULT will take you to the Go Hip
search.
3. A BOOKMARK feature will be added to your file. This
feature will add additional BOOKMARKS to your directory.
4. Your
SIGNATURE LINE on all of your out bound e-mails will be modified to
promote the GO HIP Video Update, making your e-mail recipients eligible
for video at no cost.
|
SPYWARE: Morpheus
- Morpheus
by StreamCast Networks counts the number of times its file swappers visit
high-profile shopping sites. The company has begun installing a Web browser add-on that sends
some Morpheus users on an invisible Web detour aimed at capturing data about file swappers' surfing
habits.
http://www.safersite.com/PestInfo/M/Morpheus.asp |
SPYWARE: MSIPCSV.EXE
- MSIPCSV.EXE is, from what I can tell, part of what is known
as "Spyware".Otherwise known as the stuff that comes attached to lots of
"freeware" that shows advertising while you are using the product,
and/or collects marketing info. Aureate, etc. All I can tell you is that
my "Spyware" removal program looks for that file (among many others) and
suggests removing it.
Look at
OptOut for more information on SPYWARE. |
SPYWARE: NewDotNet
- NewDotNet
There does not appear to any obvious spying taking place by this browser plug-in, which intent is to add
support for some new high level domains, ".shop" etc... However, the New.Net plug-in downloads and installs
updates to itself silently, with no crypto-based integrity checks that can even bypass firewall protection.
It also integrates itself into the operating system through it's re-configuration of your winsock applications,
which are critical to your computers ability to access the internet. If New.Net is un-installed incorrectly your
internet connection will be lost. Even though your actual harware is connected, and it can be shown that the
internet connection is live, all of your applications will indicate that pages are not found or could not connect
to the server. Leaving it installed, at least for some versions has been known to cause Internet Explorer to crash
regularly.
http://www.pestpatrol.com/pestinfo/n/new_net.asp
- Iexplore
Caused an Invalid Page Fault in Module Unknown with SaveNow or New.net Installed
SAVENOW
executed an invalid instruction in module Unknown at address...
http://support.microsoft.com/default.aspx?scid=KB;EN-US;q302463
- Manual NewDotNet foistware removal
If you have experienced problems with the New.Net uninstall using Add/Remove Programs, it is recommended that you contact New.Net tech support for assistance. The information below is provided FOR REFERENCE ONLY, and could make things worse if used improperly. Do not attempt unless you are a guru and willing to accept the possibility of your computer losing Internet access, and hold New.Net and CEXX.ORG harmless for any results.
WARNING WARNING WARNING
This procedure from New.Net techs is intended to manually restore your previous Winsock settings. Do not use without advising by New.Net support.
Go to HKEY_LOCAL_MACHINE\CurrentControlSet\Services\WinSock2\Parameters.
You should see 2 folders, "NameSpace_Catalog5" and "Protocol_Catalog9". Click the small "+" (plus) signs next to both of them.
Inside both folders, you should see a "Catalog_Entries" folder. Within each of those folders are numbered folders (i.e. 000000000001,000000000002, etc.)
For the "NameSpace_Catalog5" numbered folders:
A. First, make note of how many folders there are
B. Highlight the first one
C. On the righthand side, locate the line "Library Path"
D. In that line, the rightmost column should begin with something similar to "C:\windows" or "%SystemRoot%".
E. Locate any of the numbered folders that read "C:\windows\newdotnet2_90.dll" or similar in the "Library Path" line
F. Delete each of those folders referring to "newdotnet"
G. Rename each numbered folder so that they are all consecutive. For example, if there were 4 folders and you deleted 2 of them, you will need to rename the remaining folders "000000000001" and "000000000002".
H. Do this by right-clicking the folder name, left-click Rename and then type in the new number (be absolutely sure you don't delete any of the zeros).
I. Next, highlight the "NameSpace_Catalog5" folder on the lefthand side.
J. On the right, locate the "Num_Catalog_Entries" line. At the end of this line is a number in parentheses.
K. Edit that number by doing the following:
i. Double-click "Num_Catalog_Entries"
ii. In the small pop-up window, select "Decimal"
iii. Edit the value of the number on the left to reflect the number of remaining folders (in the case of the example in step G above, you would enter 2)
iv. Click OK
For the "Protocol_Catalog9" numbered folders:
A. First, make note of how many folders there are
B. Highlight the first one
C. On the righthand side, you will see a line beginning with "PackedCatalogItem". Double-click on that word and a small window will pop-up.
D. In the "Edit Binary Value" window, several columns appear with numbers and letters. In the last column appears a path that will look something like, "C:\WINDOWS\NEWDOT~.DLL" or "%SystemRoot%" followed by a long list of characters.
E. Locate the numbered folders that make reference to "newdotnet" in the "Edit Binary Value" window described above and DELETE each of them. This is done by closing the "Edit Binary Value" window, highlighting the folder, and pressing the DEL key.
F. Rename each remaining numbered folder so that they are all consecutive. For example, if there were 13 folders and you deleted 2 of them, you will need to rename the remaining folders "000000000001" through "000000000011".
G. Do this by right-clicking the folder name, left-click Rename and then type in the new number (be absolutely sure you don't delete any of the zeros)
H. Next, highlight the "Protocol_Catalog9" folder on the lefthand side.
I. On the right, locate the "Num_Catalog_Entries" line. At the end of this line is a number in parentheses.
J. Edit that number by doing the following:
i. Double-click "Num_Catalog_Entries"
ii. In the small pop-up window, select "Decimal"
iii. Edit the value of the number on the left to reflect the number of remaining folders (in the case of the example in F above, you would enter 11)
iv. Click OK
K. Close the Registry Editor. Your changes will be automatically saved.
L. Restart your computer and then try accessing the Internet as you would normally.
|
SPYWARE: SaveNow
- SaveNow
It
tracks where a person goes online and then pops up separate browser windows with targeted advertisements
or special offers... continuously downloads updated information about new offers and keeps a record of
where a person surfs on that person's own computer. It runs continually--even when the program it came
with is not operating.
http://www.pestpatrol.com/pestinfo/s/savenow.asp
- Iexplore
Caused an Invalid Page Fault in Module Unknown with SaveNow or New.net Installed
SAVENOW
executed an invalid instruction in module Unknown at address...
http://support.microsoft.com/default.aspx?scid=KB;EN-US;q302463
|
SPYWARE: SmitFraud.c
- Trojan-Spy.HTML.Smitfraud.c is a wide spread Trojan Virus. Popup windows saying you are infected! Backgrounds are changed to display Virus alert messages! The system Clock in the taskbar says Virus Alert! System tray icons with virus alert messages! The task manager may be disabled. The registry editor may be disabled. The Logoff option may be disabled. My Computer, My Pictures, Control Panel, All Programs etc.. may have disappeared from the Start menu. The worst part may be that Routing and Remote Access may have been enabled, and your computer has turned into a slave computer or botnet to be spied upon by the perpetrators. Your computer can then be used to hide themselves while performing their nefarious activities on other computers.
- Do not be fooled by their slick pop-ups that claim to be able to remove the problems they have found with your computer. It's a lie. They want your name, your address, phone number, mothers maiden name, credit card numbers and any other personal information for use in identity theft.
- SmitFraudFix Removal Tool is a Windows 2000, XP tool we have had some success using to repair systems infected with this Trojan.
- SmitRem Removal Tool is a Windows 9x, Me, 2000, XP, removal tool we have had some success using to repair systems infected with this Trojan.
- SmitFraud goes by various names, and once your computer is infected the names will change almost every week. The following is a list of names they have used in the past:
AdwarePunisher, AdwareSheriff, AlphaCleaner, AntiSpyCheck, Antispyware Soldier, AntiVermeans, AntiVermins, AntiVerminser, AntiVirGear, AntivirusGolden, AVGold, Awola, BraveSentry, IE Defender, MalwareCrush, MalwareWipe, MalwareWiped, MalwaresWipeds, MalwareWipePro, MalwareWiper, PestCapture, PestTrap, PSGuard, quicknavigate.com, Registry Cleaner, Security iGuard, Smitfraud, SpyAxe, SpyCrush, SpyDown, SpyFalcon, SpyGuard, SpyHeal, SpyHeals, SpyLocked, SpyMarshal, SpySheriff, SpySoldier, Spyware Vanisher, Spyware Soft Stop, SpywareLocked, SpywareQuake, SpywareKnight, SpywareRemover, SpywareSheriff, SpywareStrike, Startsearches.net, TitanShield Antispyware, Trust Cleaner, UpdateSearches.com, Virtual Maid, Virus Heat, Virus Protect, Virus Protect Pro, VirusBlast, VirusBurst, VirusRay, Win32.puper, WinHound, Brain Codec, ChristmasPorn, DirectAccess, DirectVideo, EliteCodec, eMedia Codec, EZVideo, FreeVideo, Gold Codec, HQ Codec, iCodecPack, IECodec, iMediaCodec, Image ActiveX Object, Image Add-on, IntCodec, iVideoCodec, JPEG Encoder, Key Generator, LookForPorn, Media-Codec, MediaCodec, MMediaCodec, MovieCommander, MPCODEC, My Pass Generator, NetProject, Online Image Add-on, Online Video Add-on, PCODEC, Perfect Codec, PowerCodec, PornPass Manager, PornMag Pass, PrivateVideo, QualityCodec, Silver Codec, SearchPorn, SiteEntry, SiteTicket, SoftCodec, strCodec, Super Codec, TrueCodec, VideoAccess, VideoBox, VidCodecs, Video Access ActiveX Object, Video ActiveX Object, Video Add-on, VideoCompressionCodec, VideoKeyCodec, VideosCodec, Vista Antivirus 2008, WinAntiSpyPro, WinMediaCodec, X Password Generator, XP Antivirus 2008, X Password Manager, ZipCodec..
|
SPYWARE: WEBHANCER
- Webhancer Customer Companion
It's reported that this software is installed on more than 10 million systems all accross the world, and
like many other spyware is bundled with many free software applications, and it provides a traffic
measurement service that uses a client agent that is installed on user machines, gathering detailed
data about sites visited, their performance and, most important, what the user actually does while there.
The WebHancer install will alter critical Registry keys relating to Windows Sockets, causing the system's Internet
connection capabilities to break if the user tries uninstalling it.
The running WebHancer process will appear on the Ctrl-Alt-Delete list (Task List)
in Windows as Whagent. Customer Companion files are installed in C:\program Files\WebHancer\
The files webhdll.dll and whwsdc.dll are known to cause some Windows
errors.
http://www.pestpatrol.com/pestinfo/w/webhancer.asp |
SPYWARE: Win32.DlDer
- Description
of the Win32.DlDer Spyware Trojan Program
Trojan programs are programs that pretend to do one
thing while secretly doing something else. DlDer.exe (also known as Win32.DlDer) is supposed to be an
online lottery game with advertisements. It also includes a component that spies on your Internet
activities and reports them to a Web site.
http://support.microsoft.com/default.aspx?scid=kb;en-us;q317013 |
|
|
|
| ©2002-2007 Alexander Cameron Computer Repairs. All rights reserved. |
|
|
|
