Gulf Coast Midrange Users Group

1
Gulf Coast Midrange Users Group

• Eliminating Spy-Ware and Ad-Ware
• From Your Life

2

3
According to ZD Net

• At Southwire, a producer of building wire and
  utility cable, at least 70 percent of the
  company's 2,500 computer users encountered some
  form of spyware in the last 18 months
• Time Warner Cable in Greensboro, N.C has a
  450-user network and had one PC that had 1,400
  pieces of spyware on it. The IT Director
  estimates his staff deals with 8-10
  spyware-related incidents per week
• Much or even most spyware comes from consumers
  installing 'free' content or software that they
  shouldn't
• However, it is also possible to simply misspell a
  common domain name and you are likely to land on
  a domain that will inject spyware into your PC.

4
Spyware, Adware, Trojan Horses and RATS

• Spyware is a general term used for software that
  performs certain behaviors such as advertising,
  collecting personal information, or changing the
  configuration of your computer, generally without
  appropriately obtaining your consent. You might
  have spyware or other unwanted software on your
  computer if
• You see pop-up advertisements even when you're
  not on the Web.
• Your computer tries to dial out automatically.
• The page your Web browser first opens to (your
  home page) or your browser search settings have
  changed without your knowledge (I.e.
  CoolWebSearch.com).
• You notice a new toolbar in your browser that
  you didn't want, and find it difficult to get rid
  of.
• Your computer takes longer than usual to
  complete certain tasks.
• You experience a sudden rise in computer
  crashes.

5
Confirming an Infection

• Check Running Processes
• MSCONFIG
• Registry
• HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet
  Explorer\Main
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet
  Explorer\Main
• HKEY_USERS\Default\Software\Microsoft\Internet
  Explorer\Main

6

Watch for res// and 0F characters
7
Cleaning an Infected PC

• Run AD-Aware (www.lavasoft.com)
• Run SpyBot SD (http//security.kolla.de)
• Run CWShredder (good for coolwebsearch
  hijacker)(http//www.intermute.com/spysubtract/cws
  hredder_download.html )
• Microsoft Antispyware (beta from GIANT
• for XP, 2000, and 2003 only)
• ALSO
• - Replace the .exe files

8
Preventing Spy-Ware

• Use non-IE browser whenever possible
• Keep your OS updated (XP SP2)
• Only download programs from Web sites you trust.
  If you're not sure whether to trust a program you
  are considering downloading, ask a knowledgeable
  friend or enter the name of the program into your
  favorite search engine to see if anyone else has
  reported that it contains spyware.
• Read all security warnings, license agreements,
  and privacy statements associated with any
  software you download.
• Never click "agree" or "OK" to close a window.
  Instead, click the red "x" in the corner of the
  window or press the Alt F4 buttons on your
  keyboard to close a window.
• Be wary of popular "free" music and movie
  file-sharing programs, and be sure you clearly
  understand all of the software packaged with
  those programs.

9
Preventing Spy-Ware

• Load Spyware Blaster (http//www.javacoolsoftware.
  com/spywareblaster.html)
• Make sure your JVM is up to date.
• Replace Microsofts JVM with Suns if possible
  (http//www.winnetmag.com/WindowsScripting/Article
  /ArticleID/38206/WindowsScripting_38206.html)

10
More Information

• http//home.planet.nl/kleyn080/Spywareinfoen.html
  
• http//www.intranetjournal.com/spyware/
• http//www.lavasoft.com
• http//security.kolla.de
• http//www.majorgeeks.com/download4086.html
• http//www.microsoft.com/athome/security/spyware/s
  oftware/default.mspx
• http//www.merijn.org