Getting and keeping spyware off your computer

me

[Sir Gawain]

Just thought I'd give this little PSA since I'm such a nice guy.

Many of you are already familiar with Lavasoft's AdAware, but you may not be familiar with SpyBot Search & Destroy, which is actually more powerful and more up-to-date. Lavasoft hasn't updated their definition file since September because they're working on a new release, so it won't clean newer spyware creations like CommonName. I would keep AdAware however. It's still very useful.

SpyBot also has a lot of other cool functionality built into it, like a clean on startup in case you are unable to remove the spyware's .exe or .dll because they have processes running. Yes I realize you can just unregister the .dll then reboot and delete it, but not everyone knows how to do that.

Here are a few other cool (and free) tools to help keep the stuff off your PC:

SpywareBlaster:

(From website) "SpywareBlaster doesn't scan and clean for spyware - it prevents it from ever being installed.

How? By setting a "kill bit" for the CLSIDs of spyware ActiveX controls, it prevents the installation of any of them from a webpage. You can run Internet Explorer with Active-X enabled, but you will never even get a "Yes/No" box popped up, asking you to install a spyware Active-X control (Internet Explorer will never download or run it!). All other Active-X controls or plug-ins will work fine.

The SpywareBlaster database contains information on these known spyware Active-X controls. Make sure you run the Check For Updates feature frequently to get the latest database! (And make sure you check the new items to protect your system against them!)

As a side benefit, setting this "kill bit" will also prevent the spyware Active-X from running, in many cases, if it is already installed on your system.*"

SpywareGuard:

(From website) "SpywareGuard provides a real-time protection solution against spyware that is a great addition to SpywareBlaster's protection method.

An anti-virus program scans files before you open them and prevents execution if a virus is detected - SpywareGuard does the same thing, but for spyware! And you can easily have an anti-virus program running alongside SpywareGuard.

Features Listing: Fast scanning engine
Scans exe and cab files - the two most popular file types for distributing spyware
Signature-based scanning - for known spyware (list)
Heuristic/generic detection capabilities - some spyware programs can be detected even if the code undergoes significant changes
Small size - with a small size and small definition sizes, download and updates are quick
SG Control Panel - provides easy access to help and integration options
SG LiveUpdate - provides an easy updating solution
Spyware files are blocked before being opened or run - they are not simply shut down after they are loaded in memory (and after they have performed their tasks)
The full path to the spyware executable is provided on the alert screen
Once a spyware file is detected and blocked from running, the options are provided to either continue or to delete the spyware file
It's a free download

Most of this info and much more can be found at http://www.spywareinfo.com/

[FReepaholic]

Ah, another LockerGnomie!

SpyBot works great.

[Cicero]

You may just be seeing Windows Autoupdate. By default it's turned on in Windows XP, so it downloads Windows Updates in the background and just asks you if you want to install them after they've been downloaded. You can go in and turn off the auto function if you choose. I don't mistrust Microsoft, but I prefer to turn it off so it doesn't start downloading right when I'm trying to do something else.

Thanks for your list. You also might want to have a look at SpySites, a Shareware or Freeware program at Camtech:

http://camtech2000.net/Pages/SpySites_Program.html

Scroll down to the bottom for the freeware version. It provides a list of troublesome and extra-troublesome sites and can be used to enter these sites in your blocked sites list under IE Explorer Options. This is especially useful if you have kids who use your computer who may be drawn to some site that installs spyware on your computer.

[AlexW]

I have WeatherBug...Is that bad? I do not have the spyware,
but I have been watching the cookies.

[Sir Gawain]

I just copied that post in #19 from another forum. I think the user was saying that Windows Update was trying to communicate with MS even after it was disabled.

[steve50]

I got a new XP box in the mail, planning to add a second HD for dual boot running a Linux or BSD(?) distribution. I have no idea if it will add any protection but don't see how it could hurt.

The article I read on this mentioned a NSA.dll file, of course the NSA part drew alot of attention from the less trusting. Think the story was up at voxnyc, which seems to be conspiracy oriented. Thanks for the info, don't know much about these things.

[Bloody Sam Roberts]

Great info good Sir knight!

Just this morning I un-installed AdAware and installed SpyBot Search & Destroy based on info from this website:

Stop Using LavaSoft's AdAware!

I must say I am much more impressed with SpyBot Search & Destroy than AdAware. It does so much more, and recovery backups are automatic and give you file level granularity as opposed to AdAware's all in one shot recovery.

Keep up the good work getting the word out.

[Sir Gawain]

Well I won't jump the AdAware ship so fast. I think once AdAware 6 comes out, it will catch back up to SpyBot. I'll keep both.

[Bloody Sam Roberts]

Here's a link to download Kazaa Lite
Download version 2.02 English version.

It is Kazaa with all the spyware stripped out of it. Current revision is 2.0. It works great and has none of the extra crap!

[Judith Anne]

I downloaded the trial version of spyware, and it wouldn't install. Now I can't even find it so I can right-click on it and install it...I'm such an ignoramus, I have no idea where it could be...any suggestions?

[woodyinscc]

Thank you very much for the link. Adaware was not doing the job.

[Clara Lou]

My daughter thanks you for that link!

[RedBloodedAmerican]

Thanks, I'll see if I can find the story. If you have a link to it handy, I'd like to know what the review was.

You can connect to the net and see what ports are open, then check to where (who) they connect to. And as for the auto update feature you can disable it in control panel and remove it from task manager. It does NOT control your computer in an attempt to contact MS when set up properly. The main problem with PCs running Windows is operator error.

[Clara Lou]

To be perfectly honest, I don't know if Weatherbug is "bad." It's just that Weatherbug is frequently included when you down certain programs (like Kazaa) with spyware. Maybe someone else here knows. I can't see that it really has any spyware beyond a cookie named "minibug," or something like that, that remained on my computer after I uninstalled the program.

[Tennessee_Bob]

Try running Fresh Download from www.freshdevices.com. Works great, no spyware.


http://www.freshdevices.com

[Capt. Tom]

An anti-virus program scans files before you open them and prevents execution if a virus is detected -

A lot of people rely entirely on their virus scans. If it says the mail is OK they will open it. If it is a new virus your scan won't detect it. You have to use some judgement with suspicious mail.

A week or so ago I was one of the first people to be sent the W32 So Big virus. It went through my Norton scan allright but I got suspicious, because it had a file and I didn't recognize the sender big@boss.com.

I tried to bring up www.boss.com to see if it was a site that might be sending me a fishing file. I couldn't bring up the website so I deleted the e- mail without opening it.

I got it a couple of days later with a different file, I deleted it, and a few days after that it came again only this time Norton flagged it as a new virus the W32Sobig.

That old line "don't open the file if you don't know the sender is good advice."

If you are the first in your neighborhood to be sent a new virus you won't have any protection, and if someone targets you specifically with a virus, your a goner if they know how to write it to get by the generic virus updates.

Freepers stay alert; there are people out there who dislike us, and they are not above targeting us with viruses, or virii, as the more advanced would say. - Tom

[UScbass]

Need ShowBehind elaboration.

1st, just installed and ran SpyBot - it detected and destroyed mucho stuff that AdWare did not, and system performance greatly improved -- THANKS!

Now, about ShowBehind, which somehow got installed in /windows/sbnet directory on 11-14-02. I had been wondering why I was suddenly getting "popunder" ads, now I know, and SpyBot detected it and destroyed it (AdWare did not). However, since I do not open emails from unknown parties or those from known senders which contain attachments that were not specifically requested, I cannot understand how it got installed.

Can anyone elaborate on this program?

[Texas Tea]

for later reading!

[ASOC]

Thanks much mi amigo.

The neatest part of the 'net is folks helping folks.

Hoo-ah

[facedown]

Thanks!

[Quix]

It just removed my FR COOKIE!!! AAARRRGGHHHH HERESY! What a dastardly deed!