Free Republic
Browse · Search
Topics · Post Article

Skip to comments.

Getting and keeping spyware off your computer

Posted on 01/18/2003 8:49:27 AM PST by Sir Gawain

Just thought I'd give this little PSA since I'm such a nice guy.

Many of you are already familiar with Lavasoft's AdAware, but you may not be familiar with SpyBot Search & Destroy, which is actually more powerful and more up-to-date. Lavasoft hasn't updated their definition file since September because they're working on a new release, so it won't clean newer spyware creations like CommonName. I would keep AdAware however. It's still very useful.

SpyBot also has a lot of other cool functionality built into it, like a clean on startup in case you are unable to remove the spyware's .exe or .dll because they have processes running. Yes I realize you can just unregister the .dll then reboot and delete it, but not everyone knows how to do that.

Here are a few other cool (and free) tools to help keep the stuff off your PC:


(From website) "SpywareBlaster doesn't scan and clean for spyware - it prevents it from ever being installed.

How? By setting a "kill bit" for the CLSIDs of spyware ActiveX controls, it prevents the installation of any of them from a webpage. You can run Internet Explorer with Active-X enabled, but you will never even get a "Yes/No" box popped up, asking you to install a spyware Active-X control (Internet Explorer will never download or run it!). All other Active-X controls or plug-ins will work fine.

The SpywareBlaster database contains information on these known spyware Active-X controls. Make sure you run the Check For Updates feature frequently to get the latest database! (And make sure you check the new items to protect your system against them!)

As a side benefit, setting this "kill bit" will also prevent the spyware Active-X from running, in many cases, if it is already installed on your system.*"


(From website) "SpywareGuard provides a real-time protection solution against spyware that is a great addition to SpywareBlaster's protection method.

An anti-virus program scans files before you open them and prevents execution if a virus is detected - SpywareGuard does the same thing, but for spyware! And you can easily have an anti-virus program running alongside SpywareGuard.

Features Listing: Fast scanning engine
Scans exe and cab files - the two most popular file types for distributing spyware
Signature-based scanning - for known spyware (list)
Heuristic/generic detection capabilities - some spyware programs can be detected even if the code undergoes significant changes
Small size - with a small size and small definition sizes, download and updates are quick
SG Control Panel - provides easy access to help and integration options
SG LiveUpdate - provides an easy updating solution
Spyware files are blocked before being opened or run - they are not simply shut down after they are loaded in memory (and after they have performed their tasks)
The full path to the spyware executable is provided on the alert screen
Once a spyware file is detected and blocked from running, the options are provided to either continue or to delete the spyware file
It's a free download

Most of this info and much more can be found at

TOPICS: Miscellaneous; Technical
KEYWORDS: computersecurityin
Navigation: use the links below to view more comments.
first 1-2021-4041-6061-80 ... 101-111 next last
Yes it sounds like an infomercial, and no I don't work for these companies. These are totally free downloads. Have a nice day.
1 posted on 01/18/2003 8:49:27 AM PST by Sir Gawain
[ Post Reply | Private Reply | View Replies]

To: All
Do You Think He Wants You To Donate To Free Republic?

Tick him off. Donate Here By Secure Server

Or mail checks to
FreeRepublic , LLC
PO BOX 9771
FRESNO, CA 93794

or you can use

PayPal at


2 posted on 01/18/2003 8:50:57 AM PST by Support Free Republic (Your support keeps Free Republic going strong!)
[ Post Reply | Private Reply | To 1 | View Replies]

To: Billthedrill; Cyber Liberty; dead; Victoria Delsoul; Fiddlstix; glock rocks; nunya bidness; ...
3 posted on 01/18/2003 8:51:14 AM PST by Sir Gawain (_|_)
[ Post Reply | Private Reply | To 1 | View Replies]

To: Sir Gawain
Helpful. Thanks!
4 posted on 01/18/2003 8:52:54 AM PST by AntiGuv ()
[ Post Reply | Private Reply | To 1 | View Replies]

To: *Computer Security In
5 posted on 01/18/2003 8:53:31 AM PST by Libertarianize the GOP
[ Post Reply | Private Reply | To 3 | View Replies]

To: Allan
6 posted on 01/18/2003 8:54:53 AM PST by Allan
[ Post Reply | Private Reply | To 4 | View Replies]

To: All
Also realize that if you strip out the adware from certain programs, they might cease to execute properly. Imesh will still run correctly; it will just throw up an error at startup. I haven't stripped out the adware from Download Accelerator, so I'm not sure if it will still function correctly after you do.
7 posted on 01/18/2003 8:56:34 AM PST by Sir Gawain (_|_)
[ Post Reply | Private Reply | To 1 | View Replies]

To: Sir Gawain
This must be deja vu. Last night I was doing a diagnostic check using pitstop and even though I have Ad Aware installed, I noticed that my pages were loading very slow. I got the results from my check and sure enough I have spyware playing games with me. I'll try your suggestion. Thanks
8 posted on 01/18/2003 9:00:26 AM PST by shadeaud
[ Post Reply | Private Reply | To 1 | View Replies]

To: Sir Gawain
good stuff. found a need for spybot last week at work, and it works as advertised. thanks SG.
9 posted on 01/18/2003 9:00:56 AM PST by glock rocks (only you can prevent fundraisers - become a monthly donor)
[ Post Reply | Private Reply | To 1 | View Replies]

To: Sir Gawain
Some claim backdoors are in every Microsoft OS since 98 SE, from what I've seen of Windows I tend to agree with them.

If you're running XP some claim you have already granted administrative authority over your computer to Microsoft, they can access it as they please. Anybody read the license agreement on XP to verify this?

10 posted on 01/18/2003 9:04:14 AM PST by steve50
[ Post Reply | Private Reply | To 1 | View Replies]

To: Sir Gawain
I'm really glad you brought this up, Sir! I'm a real computer lightweight and recently installed AdAware.....after I scan, I'm in the dark as to what to do next.....I click here and there (even after reading the help topics), and remain unsure if I've accomplished anything.

Plain English tutorial?

11 posted on 01/18/2003 9:04:31 AM PST by ErnBatavia ((Bumperootus!))
[ Post Reply | Private Reply | To 1 | View Replies]

To: steve50
Backdoors? Huh? Who have you heard this from, or is this your own experience with 98 and or XP? What ports do you have open when you are connected? Oh wait, they must be invisible ports linking directly to Bill Gates' home. Do listen to lies. There are no "back doors" or connections in XP that yield control of your PC to a server, unless you allowed it on there.
12 posted on 01/18/2003 9:09:28 AM PST by RedBloodedAmerican
[ Post Reply | Private Reply | To 10 | View Replies]

To: steve50
AutoUpdate will try to communicate with Microsoft, possibly even if you disable it.

More info can probably be found here:

13 posted on 01/18/2003 9:13:22 AM PST by Sir Gawain (_|_)
[ Post Reply | Private Reply | To 10 | View Replies]

To: ErnBatavia
After AdAware gets finished scanning, right click on one of the items it found and select "Check All", then select Continue.
14 posted on 01/18/2003 9:14:13 AM PST by Sir Gawain (_|_)
[ Post Reply | Private Reply | To 11 | View Replies]

To: Sir Gawain
Bump for later :)
15 posted on 01/18/2003 9:15:57 AM PST by Jennifer in Florida (Where it's FREAKING COLD!!)
[ Post Reply | Private Reply | To 1 | View Replies]

To: steve50
Here's all you need to know:

OrgName: Microsoft Corp

NetRange: -

Blackhole that netblock at your router!
16 posted on 01/18/2003 9:19:45 AM PST by proxy_user
[ Post Reply | Private Reply | To 10 | View Replies]

To: RedBloodedAmerican
A British research lab ran the story a couple months ago.
17 posted on 01/18/2003 9:20:08 AM PST by steve50
[ Post Reply | Private Reply | To 12 | View Replies]

To: Sir Gawain
Danke Schoen!
18 posted on 01/18/2003 9:20:31 AM PST by ErnBatavia ((Bumperootus!))
[ Post Reply | Private Reply | To 14 | View Replies]

To: steve50

"Read this on another site--thought it might be of interest to some folks.

XP Phone Home
I've mentioned my recent play with ZoneAlarm Pro, and while I don't use it heavily, I have left it to start automatically on one workstation where I do a lot of software testing. It's a fairly clean installation of Windows XP Pro, Office XP and a few other commonly used tools. Part of my routine with XP is to put a halt to the various automated procedures that it attempts to shove down my throat. This would include Automatic Updates most notably, but I also be sure to disable Windows Messenger, IE automatic updates and Error Reporting. Nothing should be contacting Microsoft without my knowledge as things are configured.

Imagine my horror when ZoneAlarm informs me that rundll32.exe wishes to contact I realize that spyware and viruses have posed as the legitimate rundll32.exe, but there are two things to consider. First of all, is Microsoft's Windows Update site. Second, the version and date are identical to those of the rundll32.exe file on a different Windows XP Pro installation.

Nothing is launching from any of the startup registry entries or Startup Program Group using rundll32.exe explicitly, and there certainly isn't anything specific to Microsoft that is launching in those areas.

A service perhaps? Well, the process associated with rundll32.exe is executing under the context of my username, versus SYSTEM, which most services utilize unless configured to use different credentials. Speaking of services, both the Cryptographic Services and (gasp) Automatic Updates have been started by the operating system behind my back!

I have denied the access for now, but I have not forgotten. Next, I dig out a hub so I can sniff the packets as they wander by for clues regarding the suspicious activity. Not that I'm going to let it contact Microsoft, mind you. I also plan to fire up a full- blown hardware router to further isolate the machine from Microsoft, add a static route for the offending IP address, pointing it at a Windows 2000 server running IIS so there will at least be a session establishment attempt instead of the request being immediately stomped by the router and/or ZoneAlarm.

My suspicions at this point are not that Microsoft is being deceptive, collecting my hat size or preference in pain relievers for subversive use, but this lends weight to my very sincere believe that Microsoft is overstepping the bounds of reasonable respect to paying customers. Whatever XP is trying to do is likely trivial, but how it's being done is far from it. I'm plenty steamed, believe me."

19 posted on 01/18/2003 9:22:50 AM PST by Sir Gawain (_|_)
[ Post Reply | Private Reply | To 17 | View Replies]

To: Sir Gawain
Unbeknownst to me, my daughter downloaded Kazaa last night. Imagine my surprise this morning when Kazaa and Weather Bug and at least two other programs wanted permission to access the Internet!! (Thank goodness for ZoneAlarm!) I had to go throught and uninstall all of them. Then I had to run Adaware and delete over 100 files and about 40 keys that had been inserted in my registry!
While I don't use IE Explorer unles my arm is twisted, I do use Mozilla. Infinitely preferrable. Since IE is on my machine, thugh, I'm checking into the programs you've mentioned. Thanks for posting the info.
20 posted on 01/18/2003 9:22:53 AM PST by Clara Lou
[ Post Reply | Private Reply | To 1 | View Replies]

Navigation: use the links below to view more comments.
first 1-2021-4041-6061-80 ... 101-111 next last

Disclaimer: Opinions posted on Free Republic are those of the individual posters and do not necessarily represent the opinion of Free Republic or its management. All materials posted herein are protected by copyright law and the exemption for fair use of copyrighted works.

Free Republic
Browse · Search
Topics · Post Article

FreeRepublic, LLC, PO BOX 9771, FRESNO, CA 93794 is powered by software copyright 2000-2008 John Robinson