Drive-by Downloads:
What exactly is a drive-by download?
A drive-by download is a program that a Web site surreptitiously
plants on your Windows PC when you load its pages. (This problem is, by
most accounts, limited to Microsoft's Internet Explorer browser.) Many
of these are only irritating -- they just force-feed advertising pop-ups
to your browser -- but some change your home and search pages
(hijackers), will alter your favourites and mangle important system
settings. Some automatically download to your computer, often without
your consent or even your knowledge. Unlike a pop-up download, which
asks for your consent (albeit in a calculated manner likely to lead to a
"yes"), a drive-by download is carried out invisibly to the user: it can
be initiated by simply visiting a Web site or viewing an HTML e-mail
message. Frequently, a drive-by download is installed along with another
application. For example, a file sharing program might include downloads
for a spyware program that tracks and reports user information for
targeted marketing purposes, and an adware program that generates pop-up
advertisements using that information. If your computer's security
settings are lax, it may be possible for drive-by downloads to occur
without any action on your part.
Xupiter, an Internet Explorer toolbar program, is frequently
installed as a drive-by download. The program is said to replace the
user's home page, change browser settings, and use redirection to take
all searches to the Xupiter Web site. In some versions, the program
initiates drive-by downloads of other programs. Furthermore, although it
comes with an uninstall utility, Xupiter is said to be next to
impossible for the average computer user to remove.
A few of these programs can be found and deleted within the usual
Add/Remove Programs control panel. Others may be featured in Internet
Explorer's list of "Browser Helper Objects" (some help!), which you can
view by going to IE's Tools menu and selecting "Internet Options . . . "
Click the "Settings" button and then, in the small window that opens,
click "View Objects." As you will see in the tutorial below, the
greatest majority of these scumware offenders are of the "search bar"
variety. Google Searchbar, Yahoo Searchbar & MSN Searchbar are
"benign" as far as I know as of this writing. There is some
controversy as to whether the eBay Searchbar is spyware or not. I
think not.
Top Spyware & Adware Threats:
Spyware can bring your computer to a screeching halt. Learning to
protect your computer from today's most dangerous spyware threats is
essential self-preservation. There are spyware programs that are so
dangerous they can open a backdoor to your confidential information,
consume massive amounts of CPU capacity and memory, clog your network
and destroy your business data. PCs affected by these programs slow to a
crawl, impacting employee productivity and business operations. Even
worse, frustrated users end up having to spend money getting it removed,
since many are totally impossible to get rid of.
Top 20 Worst SpyWare Products:
- KaZaA
- Cool Web Search
- Lop.com
- SearchNow
- MyWebSearch, aka MySearch
- My Search Bar
- My Way Speedbar
- CoolBar/LookThru
- Cool Searchbars
- IWon, iWon Co-Pilot, iWon Search Assistant
- MySearch/MyWeb (see write-up at bottom)
- Adult Search Bar (ASSbar)
- Excite Search bar
- LookThru Cool Search Bar
- IST Bar
- Comet Cursor
- Bonzi Buddy
- Ezula
- HotBar (Adopt.Hotbar.com)
- GameSpy Arcade
- Weather Bug
- Smiley Central
The spyware below is considered to be the most rapidly spreading at
this point:
- Gator/GAIN/Claria
- Grokster
- Adopt.Hotbar.com
Below is a compilation of the threat background and additional
spyware information on the worst of the worst ...
KaZaA
KaZaa is the number one spyware threat on the Internet in the eyes of
most technophiles because of its widespread popularity & it's "open door
to the net". Kazaa claims that its software has been downloaded 214
million times. It includes spyware, adware and browser help objects
(browser hijackers). It also increases your vulnerability of viruses,
trojans & worms as "fake files" are extremely wide-spread on these
networks.
Other peer-to-peer file exchange programs, such as Blubster, E-Mule,
Gnucleus and WinMX, could also degrade your systems performance and
consume storage space because they are all bundled with adware or
spyware.
CoolWebSearch (CWS)
CoolWebSearch has the ability to hijack your Web searches, home page,
and Internet Explorer settings. Recent variants of CoolWebSearch install
using malicious HTML applications or security flaws, such as exploits in
the HTML Help format and Microsoft Java Virtual machines. Over 80
different domains have now been identified as affiliated with
coolwebsearch. People are paying big money to hi-jack machines.
CoolWebSearch is probably one of the most vicious programs in terms of
how nasty it is. It completely hijacks the browser so you can't do
anything. I consider it to be the most dangerous program on the worst
spyware and adware threat lists.
PurityScan
PurityScan frequently displays pop-up advertisements onto your
computer whenever you are online. It induces you to install it by
claiming to find and delete pornographic images.
n-CASE
(msbb.exe) – n-CASE is an adware program that delivers targeted
pop-up advertisements to your computer. This program is usually bundled
with freeware applications.
Gator
Gator (GAIN) – is an adware program that has the ability to display
banner advertisements based on your Web surfing habits. Gator is usually
bundled with numerous free software programs, including the popular
file-sharing program Kazaa.
Transponder
Transponder (vx2) – Transponder is an IE Browser Helper Object that
monitors requested web pages and data entered into online forms, then
delivers targeted advertisements.
ISTbar/AUpdate
ISTbar/AUpdate – ISTbar is a toolbar used for searching pornographic
web sites that has been reported to display pornographic pop-ups and to
hijack your homepage and Internet searches.
KeenValue
KeenValue – KeenValue is an adware program that collects personal
information and delivers advertisements to your computer.
Internet Optimizer (Bargain Buddy)
Bargain Buddy delivers targeted pop-up advertisements to your
computer based on key words you might enter while surfing the Web.
Internet Optimizer
Internet Optimizer hijacks error pages and redirects them to its own
controlling server at
http://www.internet-optimizer.com.
Perfect Keylogger
Perfect Keylogger – Perfect Keylogger is a monitoring tool that
records all visited web sites, keystrokes and mouse clicks. For example,
it can log passwords, account numbers and other sensitive information.
It is usually installed manually.
TIBS Dialer
TIBS Dialer – TIBS Dialer is a dialer program that hijacks your modem
and dials toll numbers, usually to access pornographic "pay" Web sites.
Newly Discovered Threats:
- Searchit - Also known as: Pugi, after its internal object name.,
SearchIt Toolbar
- TrojanDownloader.Win32.Vivia.f
- TrojanDownloader.Win32.Vivia.e
- Advanced Excel 2000 Password Recovery
- Win32Info - Also known as: Adult content dialler
- Win32.ExeBundle.272 - Also known as:
TrojanDropper.Win32.ExeBundle.272 [Kaspersky]
- PS2 Emulator - Also known as: ->taskmgr.exe [F-Prot], packed:
SfxMaker [Kaspersky], TrojanClicker.Win32.VB.cr [Kaspersky]
- WinSpy 5.6.1
- Fake Delete - Also known as: FakeDel joke [McAfee]
- TrojanDownloader.Win32.Apropo.g
FunWebProducts
It turns out that FunWebProducts is an operation of a company called
IWon. Its software - a Web application - is essentially yet another
piece of adware (often mistakenly called spyware although that is
arguably a related subgenre). FunWebProducts is notable because it
acquired a large user population with remarkable speed. Iwon is
responsible for a series of notorious adware products including IWon,
iWon Co-Pilot, iWon Search Assistant, and MySearch/MyWeb.
What does it do?
What FunWebProducts actually does - as do a lot of other adware and
spyware products - is to make it difficult to uninstall the software as
well as hijack your browser by setting your home page to point to other
sites. Worse still, FunWebProducts attempts to reset the browser home
page should you dare to try to change it. But, of course, anyone who
downloads this free software will read the 5,000-word EULA that explains
it all in incomprehensible legal mumbo-jumbo. If you don't already have
it, you should download a copy of Lavasoft's AdAware. You'll probably be
surprised how much scumware is on your system.
Steps To Preventing Spyware:
- Use programs like AdAware & Spybot Search & Destroy regularly. I
use both, and a paid-for version of Pest Patrol. SpyBot also has an
"immunization" feature that will prevent many offenders from even
being installed. This must be done on a "clean" system or it won't
work however. You can't close the barn door after the horse has
escaped!
- For extreme infections, you can resort to using PestPatrol,
while not free, it is certainly cheaper than losing all your data.
It just "might" be able to get rid of it for you relatively
painlessly.
- Speaking of data, back it up to CD, DVD or external USB
hard-drive regularly (especially your digital photos). Use a program
like Handy Backup to do it for you every day & email you a
confirmation. I use this approach with a USB 180GB external
hard-drive at 3am every day.
- When faced with a pop-up asking if you want to download/install
"this or that" free goodie, don't click "yes" or "no" or "agree" or
"OK" to close a window. Instead, click the red "x" in the corner of
the window or press the Alt + F4 buttons on your keyboard to close a
window (safest bet)
- Don't use peer-to-peer download software unless you have a good
firewall (a hardware firewalled router is best) and fully updated
anti-virus software.
- A technique I use quite frequently in my ever-lasting attempt to
avoid spyware when I'm downloading free software is to use a search
engine (Google works best) to search for the item followed by the
word spyware and a question mark. Make sure it is spelled right.
Search like this example for KaZaA >>> "KaZaA spyware?" If any
results on, lets say the first two search results pages say anything
about spyware, adware or something like, "Help, I can't get rid
of..." your best bet is to avoid the download.
- The worst offenders like CoolWeb Search, burrow deep into your
system registry and need to be surgically removed with such
specialized tools as "HijackThis" and "CWShredder", free downloads
at
http://www.spywareinfo.com/~merijn.
- There are some good alternatives for utilities containing
spyware. Instead os KaZaA, use WinMX. Instead of WeatherBug, use
Weather Watcher, etc.
- Microsoft has just released it's beta version of "Microsoft
Windows AntiSpyware" for free download. To grab your copy visit
http://www.microsoft.com/athome/security/spyware/software/default.mspx.
Microsoft just bought out "Giant AntiSpyware and have put their
label on it.
- Surf and download smarter. Be more cautious when downloading
free software, especially "free" file-sharing applications, which
often are bundled with spyware. Do not download or run e-mail
attachments unless you know what they are. Only download from Web
sites and people you trust.
- Keep your operating system up-to-date. Windows XP Service Pack 2
adds significant security enhancements that can block spyware before
it takes root.
- Adjust your Web browser's security settings or use a more secure
Web browser. Microsoft Internet Explorer allows you to customize
your security settings.
Other Web browsers, such as Mozilla Firefox offer more security
settings than Internet Explorer. Note:These new browsers may not be
compatible with some websites, but are appropriate for general
day-to-day browsing.
- Use a firewall. The newest versions of both Microsoft Windows XP
operating system includes built-in firewall software.
- And finally: just be cautious! A huge amount of spyware
ends up on people's systems because they were not careful about what
they were installing or where they were surfing. It seems obvious,
but be careful what you do. Those windows that come up asking you if
you want to install so-and-so software? Read them before saying no,
just to make sure you hit the right button. Downloading free
software? Read the license agreement first, to make sure you are not
giving permission for additional spyware to be installed. This sort
of licensing is especially common in popular peer-to-peer products
like Kazaa. If other people use your system, educate them on the
dangers first. The shadier side of the Internet is crawling with
loaded websites. These come equipped with nasties that will mess up
your system if you let them. Just be careful out there.
|
