Spyware Sucks

As an MVP, as it is for all support professionals, it is essential to stay up to date with latest and greatest Knowledge Base articles related to our area of speciality.

Microsoft now publicises information about the latest KB articles for all of their articles via RSS.  Check it out:
http://support.microsoft.com/selectindex/?target=rss

Time will tell how accurate/timely the information about new KB articles is...

Cold and calculated.. that's the only way I can describe what is described on that page:
http://blogs.zdnet.com/Spyware/index.php?p=644

I recommend you download and read the PDF file provided, but must add this disclaimer.  I have no idea where the document was 'found', so cannot say that it is genuine.

Even better:
http://www.msnbc.msn.com/id/9069570/

Seems he's antisocial in more ways than one:
http://www.msnbc.msn.com/id/9041549/

Listing about a Chris Smith at Spamhaus:
http://www.spamhaus.org/rokso/listing.lasso?-op=cn&spammer=Chris%20Smith%20/%20rizler.com

Excellent:
http://www.msnbc.msn.com/id/9086742/

This is kind of cool:
http://www.thinkgeek.com/gadgets/security/698d/

I note that it is not designed for (aka doesn't work with) multi monitor systems which means its no good for me - bummer, I'm such a gadget geek I'd buy one of them in a heartbeat if I could use it even though Windows 2000 and XP already have a 'Lock Computer' option accessed via ctrl/alt/del.

Hard to believe, isn't it - time flies by ...

Windows 95 turned 10 years old on 24 August 2005, which means that Internet Explorer turned 10 as well not much later.

The IE team have acknowledged the milestone on their blog:
http://blogs.msdn.com/ie/default.aspx

Anyway, my latest column discussing the history of Internet Explorer went live overnight - complete with screen shots.  Microsoft Virtual PC went through quite a workout these past few weeks, but it was FUN!!!, and quite a trip down memory lane.  Thank to MSDN and my packrat mentality it wasn't too hard to find all that old software.

Anyway, here's the end result - enjoy:
http://www.microsoft.com/windows/IE/community/columns/historyofie.mspx

I've been asked the question... has Patchou's petition been invalidated?

Well, I wouldn't say completely 'invalidated'.. I would say there is an even bigger question mark over it now than there was before.  Why do I say that, and why was I asked?

Patchou has updated his Messenger Plus! installer so that every time the programme is installed, the default web browser opens to his Petition Page.

Here's the problem.  The statements that people are being asked to make by signing the petition include, among other things, “..Messenger Plus! is not, and has never been, a threat to my computer or anyone else's for that matter. It is my opinion, based on solid evidence, that MSAS contributes to damaging thousands of computers every month because of its improper detection and removal of the Messenger Plus! software, in addition to greatly damaging the reputation of the product for no viable reason."

A new user is not in a position to be able to honestly say that they have 'solid evidence' that 'thousands of computers every month' are being damaged.  Nor are they in a position to say that Messenger Plus! has 'never been a threat to my computer or anyone else's'.

I have already commented on the above statement in my other Blog entries:
http://msmvps.com/spywaresucks/archive/2005/08/19/63394.aspx
http://msmvps.com/spywaresucks/archive/2005/08/18/63180.aspx

Back then, the petition was, in my opinion, flawed.  Now that new users are being directed to it and prompted to sign it while it includes declarations of knowledge and opinion that they cannot possibly have as a new user, the petition is on even shakier ground than it was before.  The fact that there are probably people who have signed the petition certifying statements about themselves that simply can't be true throws the entire petition campaign into doubt.

Update: 6 September:
http://msmvps.com/spywaresucks/archive/2005/09/06/65524.aspx

Ok, as I promised “James of UK” I had another look at Messenger Plus! and the Sponsor Program tonight.  I have a nifty little programme called inctrl5 that takes a snapshot of my system pre and post installation, and then generates a comparison report listing exactly what was changed - registry keys added/removed, files added/removed/changed, ini files edited, making monitoring quite easy.

If it turns out that MSAS does not detect *all* lop.com sponsor files and registry entries etc, then I do will what is necessary to make sure that that is fixed, and make sure that every trace of Messenger Plus! AND the Sponsor Program can be successfully removed by MSAS.  If the program is going to do the job, it has to do a complete job.

Bear in mind, lop has been known in the past to use random file names making detection and removal difficult. Time will tell if that behaviour continues with the Messenger Plus! version of the programs.

First attempt with (Microsoft Antispyware) MSAS running threw up a big warning window about the Messenger Plus! 'threat'.  Well, that's what comes from the assocation with C2 Media.  Pressing the 'allow' button made no difference.  MSAS was determined.  Had to disable the software to be be able to install Messenger Plus! at all.

Disabled MSAS, but forgot to disable Trend Micro PC-cillin Internet Security, which quarantined part of lop.com (aka the sponsor program) during the install - specifically a file called “love 2.exe“ - detecting it as troj_swizzor.dq.

The text of the detection was “Trend Micro PC-cillin Internet Security has detected a virus, spyware application, or other Internet threat, and performed the action specified..”

Ok, MP! and/or its Sponsor Program are seriously unpopular.

Despite the quarantining of one executable by Trend, the top toolbar was installed in IE, but the blue pass-through toolbar was seemingly damaged, not installing when I changed my home page back to my preferred setting.  Maybe the blue bar has been removed from this particular version of lop, maybe it hasn't.  Further testing will tell.

Something called 'locks third itch' (what the heck sort of name is that?) appeared in the program files directory, and 'mfcd aim.exe was added to registry startup.  Both disappeared when MP and the sponsor program were removed.

The Sponsor Program was cheeky enough to add 'lop.com', 'mysearch.now', 'www.lop.com' and 'www.mysearchnow.com' to XPSP2's pop-up blocker allow list, allowing the sponsor's advertisements to bypass XPSP2's anti-popup protections.  In the time it took me to change *that* a typical 'your pc may have a problem' snakeoil advertisement appeared.

My home page was changed.  And, more worrying, a shortcut labelled (may not be precise wording) 'my antivirus update' was added to my desktop.  Didn't have time to check *that* out, but I'm betting it wasn't pointing to my already installed antivirus product (being Trend).  I'll have a much closer look at THAT over the next few days.  As I have said before, the Sponsor Program is also what it advertises, where it leads people and what it encourages people to install.

A scan using MSAS detected Messenger Plus! *and* C2-lop (the sponsor program), with regards to lop it specifically detected setup.exe, and the *entire* lop program directory, recommending both for removal as a severe threat. 

Messenger Plus! now opens a browser window upon install directing users to Patchou's petition page (which is still languishing at just over 38,000 signatures after nearly a week - this despite Messenger Plus! having, apparently, 7 million users).  How many of these signatures are multiple signings by the one person, or fake names? We don't know.

Because Trend detected, and quarantined, the sponsor program, preventing a full install I didn't take things any further tonight. An important question for me is “does MSAS *only* Messenger Plus! and lop's set up.exe or does it detect more?  I say it detects more (assuming there are files in the lop program directory which is detected, and therefore deleted, in its entirety).  Of course, detection may be even more extensive once I run the install without my antivirus protection stepping in the way.  Will need to test further, with MSAS *and* antivirus protection disabled, then pitting Messenger Plus! and the sponsor program (aka lop.com, aka swizzor trojan) against MSAS, the new Trend Antispyware product and Vet Antivirus in various combinations.

Patchou is fighting a losing battle regarding his sponsor program - check out this list of detectors:

http://sarc.com/avcenter/venc/data/adware.lop.html (Symantec)
http://www3.ca.com/securityadvisor/pest/pest.aspx?id=453076024 (Computer Associates)
http://vil.mcafeesecurity.com/vil/content/v_120626.htm (McAfee)
http://www.trendmicro.com/vinfo/virusencyclo/default5.asp?VName=TROJ_SWIZZOR.AG (Trend Micro)
http://www.f-secure.com/v-descs/swizzor.shtml (F-Secure)
http://www.sophos.com/virusinfo/analyses/trojswizzorbq.html (Sophos)

BTW, Microsoft Antispyware Beta was rated number one in a recent consumerreports.org test - Trend Antispyware was rated number 7:
http://www.consumerreports.org/main/content/display.jsp?FOLDER%3C%3Efolder_id=760027&ASSORTMENT%3C%3East_id=333133&bmUID=1124890443240

What I think of the MSAS/Patchou kerfuffle, and the Petition itself:
http://msmvps.com/spywaresucks/archive/2005/08/18/63180.aspx

Update: 6 September:
http://msmvps.com/spywaresucks/archive/2005/09/06/65524.aspx

When trolls start posting abusive messages under one entry and then add trackbacks in different entries in this blog ... well enough is enough.

All messages posted to this blog are emailed to me for archiving, and can be removed immediately if I decide they're sufficiently abusive, and also automatically have identifying information such as IP addresses recorded, but I've got more important things to do than babysitting ;o)

Oh, and James of the UK (the anonymous poster who's message *wasn't* deleted). You may like to tell the other Messenger Plus! supporters about your email to me.  Its only because of that email (and the fact that you were not abusive) that your post stayed while others were removed.

I'm wondering just how long, and how loud, we have to yell before Sun wake up to themselves.

I was prompted to update to Sun Java VM version 5.0 Update 4 so I download and installed.  Once more, the Sun Java installer did NOT remove or overwrite older, vulnerable versions of Sun Java on my system.

I posted about this problem MONTHS ago; other MVPs have posted about the problem - we have all written to Sun warning them that they are leaving computers at risk by not removing vulnerable versions of their product during an update.   Their reaction?  We'll pass on your feedback.

Well, that ain't good enough!!

When we install a newer version of software that has been patched to lock out vulnerabilities, we expect to be safe, yes?

When it comes to Sun's Java Runtime Environment, the answer is NO!!!!

I strongly recommend that you go to Add/Remove Programs and see how many versions you have installed (at 100+meg per version!)

Did you know that old versions of Java's runtime are not overwritten when you update, and that malware designed to take advantage of java vulnerabilities can access those vulnerable older versions?  I ask you, what is the use of updating if the bad guys can come along and keep using the old stuff anyway?  I can almost here them laughing.

Sun Java recommend in their FAQ that older versions of their JRE be kept on computers -   BAD ADVICE!!! 

Those of us who are lucky enough to have heard of http://sunsolve.sun.com, and know that Sun release Alert Notifications, and know how to find them, also know that Sun recommends that affected versions of the JRE be removed from a computer (see Docs 57707, 57740, 57708 and 57591)!

Bad advice - advice that is directly contradicted in the Alert Notifications - is being given to new users that are the primary audience and users of FAQs.  The FAQ needs to be rewritten to advise users to remove older versions of the JRE, unless there is a mission critical application that only runs on an older version.  If there is such a mission critical application, Sun should strongly recommend that said mission critical application be updated to be compatible with the latest version of the JRE.

Uninstall all those older versions of the Sun Java Runtime - go on- go and do it now.

The classic solution for this problem (which invariably works) has always been to empty your Internet Explorer cache, but of course this is a workaround, not a fix. 

Well, it seems that the August Cumulative Update for Internet Explorer fixes this problem!  So go get it guys 'n' gals.
http://support.microsoft.com/kb/896727

Be warned, this is not an 'all circumstances' fix. There are rare instances when the cumulative update, and clearing the cache, and other fixes on my site, will not work - rare instances the circumstances of which I suspect are not public so I cannot not discuss them here.

The IE Team have launched a new column on the MSDN site called “Exploring Internet Explorer”:
http://msdn.microsoft.com/library/?url=/library/en-us/IETechCol/cols/dnexpie/expie_entry.asp?frame=true

This new site adds to an already comprehensive coverage suite.  The team have a blog at http://blogs.msdn.com/ie/, and a Developer Centre at http://msdn.microsoft.com/ie, not to mention a Technet site at http://www.microsoft.com/technet/prodtechnol/IE/default.mspx.

Oh, and let's not forget the slightly neglected Wiki on Channel 9:
http://channel9.msdn.com/wiki/default.aspx/Channel9.InternetExplorerFeedback

Several IE team members also have individual blog sites on MSDN.

All of the above have a heavy developer focus, but that does not mean the Consumer (Home User) misses out.  We can go to the Internet Explorer Community site at http://www.microsoft.com/windows/ie/community/default.mspx.

I've been writing a regular column for the Internet Explorer community for a while now.  If there is anything in particular that you would like to see covered in a future article, please feel free to contact me via this Blog, and I'll see what I can do.  Even if it doesn't make it on to the Community site, the suggestions will make excellent fodder for additions or improvements to http://inetexplorer.mvps.org or http://www.ie-vista.com.