[There's a reason that Yoda is the unofficial mascot of SBS. Size indeed matters not.] Spyware is getting bad..... - THE OFFICIAL BLOG OF THE SBS "DIVA"
Sun, Aug 8 2004 21:45 bradley

Spyware is getting bad.....

And while XP sp2 will help out, you may have another helper tool already on your network that you have not enabled!  If you are running the Trend CSM suite, there is a spyware module but the default is that it's not enabled.  I've put together screen shots to show you how to enable it.

Michael Jenkins SBS MVP shared his list of spyware tools that he finds helpful:

Moosoft

http://www.moosoft.com/

Registry cleaner tool

Hijack This

http://www.spychecker.com/program/hijackthis.html

Use this to review your registry.  It’s recommended to review this CAREFULLY as you could accidentally remove a registry item that is needed

Adaware

http://www.lavasoftusa.com/default.shtml.en

Ad-Watch is a good tool to ensure that your registry is proactively protected.  

Process Explorer

http://www.sysinternals.com/ntw2k/freeware/procexp.shtml

Helpful in investigating programs operating on your system

Spybot S&D

http://www.safer-networking.org/en/index.html

Use this and AdAware

CWShredder

http://www.spywareinfo.com/~merijn/downloads.html

Removes the Cool Web search tool.  At the time of the writing of this chapter the CWShredder author no longer maintains the tool but it still may be of help.

SpySweeper

http://www.webroot.com/

Also has an Enterprise version of Spysweeper

I also found a cool blog on spyware.  Scoble talks about how geek events are places where we can “talk security”.  You know what else occurs?  FUD - fear uncertainty and doubt also gets cleared out at these kind of events.  One of my fellow MVPs was an a training session and some folks started talking about XP sp2 as “that SP that breaks everything”.  Try not breaking anything.  I've got it loaded now on three machines and nothing is broken, everything is working and all is well in the world.  My buddy SBS MVP Steve Foster did run into an issue with a LaCie Firewire harddrive causing his laptop to get “frozen during boot” but bottom line, he knows what the issue is and can kick it up to the next level.

Filed under:

# re: Spyware is getting bad.....

Wednesday, December 08, 2004 4:17 PM by bradley

First, let me say I've found the hornets' nest but here goes...!

Disgusting Spyware Methods! Disgusting Anti-spyware Methods!

DiamondCS is a reputable software firm that developed one of the best Anti-tojan applications I have seen, TDS-3. Unfortunately, DCS employs a hardcode technique that redirects the user to its site with numeric IP 64.91.255.87 upon pressing the F5 function key. Of course there is nothing wrong with this process. This fact could have remained unnoticed had it not been for a spate of really nasty IGN/CWS infections that showed the DCS redirects along with the nasties in hijacked Host files and shown below:
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 64.91.255.87 www.dcsresearch.com
O1 - Hosts: 69.20.16.183 ieautosearch
O1 - Hosts: 69.20.16.183 ieautosearch

A quick google search of "O1 - Hosts: 64.91.255.87 www.dcsresearch.com" will provide at least 1,500 links (Yup! that many!). It should be noted that an HJT 01 entry will only appear if a Hostfile hijack is involved. Redirecting to the local host to will not appear in the HJT log. When asked about this, representatives of DCS at Wilders Security Forum replied that this is perfectly normal since it simply redirects from an alleged "bad site" to the legitimate DCS IP.

If such were the intention, a simple redirect to the local host would have sufficed as this blocking technique is acceptable. However, redirecting to a preferred website is in any laguage, a hijack. This type of redirect is the method used by hijackers with the same objectives: redirecting to the chosen website. DCS cannot claim that since they are reputable, a redirect to their site is acceptable. No one has nor can given them that status. A hijack is a hijack is a hijack.... The method is absolutely wrong!

Now comes an interesting scenario.

Quote:
"It’s becoming such a sizeable problem in the US that the Government voted unanimously in Spring 2004 to approve the first-ever anti-spyware bill. The Securely Protect Yourself Against Cyber Trespass (Spy Act), approved by the US House of Representatives, would levy fines up to $3 million for those who illegally collect personal information, change a browser's default home page or bookmarks, log keystrokes, or steal identities "

Quoted from http://www.net-security.org/article.php?id=746

Do you realize that if I invested in TDS3, bookmarked www.dcsresearch.com or set my homepage to www.dcsresearch.com, the chances are I will be redirected to DiamondCS? This can be documented and I can then sue DCS for illegally redirecting my browser, right? And all because DiamondCS has chosen to adopt a Trojan method instead of a Hostfile block or Help update? Think about it.

Too, what are the chances of a crazy picking up this post and doing exactly the above? This is a possibility they brought upon themselves for insisting that what they were doing was simply protecting their interests. They chose the expedient/easier route now they are susceptible to para-legal issues.... Sooner or later, this will happen....

Your thoughts?