Slashdot Mirror
Does Spyware Damage Windows Networking?
DerBryGuy asks: "I work for an ISP in Canada. Recently we have had a rash of customers whose computers can connect via DSL, but cannot browse, or often even ping. Invariably it turns out that there is some spy ware of some sort installed on the customers machine - usually New dot Net or the other drek that comes with Kazaa. About half the time if this is removed correctly (manually or by using ad-aware) then the machine will regain http access. However the other half of the time the only option we have found is to format and reinstall the OS. So I am wondering, are other ISP's seeing this? What do they do when they get a similar complaint and they detect spyware on the machine. Is there any recourse for the customer? I mean most of these people had no idea what New dot Net was when their kid installed Kazaa, and now they are stuck with a computer store bill for reinstalling their machine."
Details:
IRC Server - 208.252.182.107
Port - 6667
Channel - #trolls
You need an IRC client to chat on the IRC server.
3601.17251225377
Details:
IRC Server - 208.252.182.107
Port - 6667
Channel - #trolls
You need an IRC client to chat on the IRC server.
6178.15183067756
Details:
IRC Server - 208.252.182.107
Port - 6667
Channel - #trolls
You need an IRC client to chat on the IRC server.
537.459974525987
Details:
IRC Server - 208.252.182.107
Port - 6667
Channel - #trolls
You need an IRC client to chat on the IRC server.
8685.38951499165
Details:
IRC Server - 208.252.182.107
Port - 6667
Channel - #trolls
You need an IRC client to chat on the IRC server.
1357.02102849679
We seen this but not with spyware. Customer calls saying they no longer can access the internet. Invariably, they have updated their antivirus software and it now includes a personal firewall. Said firewall doesn't allow ports 80, 25, or 110. We've seen this with McAfee and with a less well know brand the name of which escapes my memory at the moment.
We have seen spyware cripple the performance of a machine though.
posters that spell Microsoft with a or spell it MicroCrap or something posters that glorify a feature that Linux has that BSD or Solaris as had for years and list this reason as the most important reason to switch over posters that say Slackware is better because you have to compile all of the applications for yourself Rob Maldas arrogance frequent spelling and grammar mistakes Im not talking something really obscure or a minor technicallity in English either Im talking substituting loose for lose or theyretheirthere Really easily corrected mistakes Any halfway decent fifth grader could pick up on these errors people that post a mirror to a site that has been Slashdotted which normally would be nice but is hosted on a cable modem that is soon Slashdotted page widening random quashing of posts that dont agree with the Slashdot mindset really annoying sigs unhumorous jokes that have to be explained to the audience If your joke has to be explained its not funny BOYCOTT RIAA and I cant wait to see Episode II all in the same day Rob Maldas childish obsession with legos the Slashdot crew doesnt have any other jobs other than Slashdot yet it seems it was better run when Rob was running it on a Multia in college in his spare time the page limit with the subscription The expulsion of Signal 11 ranting paranoid articles whenever there APPEARS to be a GPL violation with no verification whatsoever Just a bunch of ranting posts about freedom for that matter no verification of articles at all I wish I could count the number of times Slashdots been scammed on two hands but its been so many April Fools articles on Slashdot THESE ARENT FUNNY I wasnt going to explain but whatever Okay lets say you run a website On April Fools you post say ONE or TWO fake pieces of news along with the real news This way some people are fooled By posting ALL fake news and jokes no one falls for the prank no one buys Lokis games but there is a big mystery when they go out of business no NNTP frontend to Slashdot direct links to bugzilla continuing tightening of the troll filters to the point where even normal posts are rejected by some stupid criteria self righteous posters who want everything under the sun to be Open Source even though they have never written a line of code in their life whenever an article on a new scripting language is posted all of the C users chime in but its not as fast as C shortly after all the assembly users chime in assembly is the fastest predictably right after that someone says why dont we all just use machine code anecdotes on your grandmother using Linux to check her email and whatnot this ALONE proves that Linux is better than Windows for ALL uses cultlike devotion to Linux reserve your fanaticism for a church not a kernel someone is not less of a person if they dont use Unix posters who think that BeOS is having a bad moment and will surely rise to defeat all other operating systems posters who think Palm will open the source to BeOS for no reason at all people who think that Amiga isnt dead The new virtual Amiga doesnt count people who think that OS2 isnt dead Ecomstation doesnt count people who bemoan the loss of OS2 while thinking it was a big conspiracy completely IGNORING the fact that IBM did not advertise we all KNOW OS2 was technically superior to Windows at the time You dont have to bedazzle us with tales of running all the latest Windows and DOS applications aside native OS2 apps Weve heard it all before We know it WAS better people who think that this is the last year ever well ever have to hire C programmers because as we all know Java is going to kill it off this is a good one Completely expositionary articles such as Surprised by Weath in which ESR BRAGGED about how rich he was and how he wasnt going to give us any money NO SIR bitchslapping benchmarks that pit say Linux lastest revision against FreeBSD 30 or something old and useless how banner ads for the site only link to other OSDN sites any links to nytimescom when someone writes a comment with H to signify deletions the moderation rtbl meta moderation people that spell Red Hat as RedCrap
Details:
IRC Server - 208.252.182.107
Port - 6667
Channel - #trolls
You need an IRC client to chat on the IRC server.
7540.49857127458
Really i wish the people behind Kazaa Lite would have used some name that didn't have the word kazaa in it, what the heck am i supposed to tell people to install? Kazza LITE, not Kazaa, very important.
What is this Lunix that you speak of? Will it work on Windows 3.1? I have old computer.
Ishbar of Tansania
I have experienced the same problem where I work at my school. Many of our users can dial-up, but they cannot access web sites or ping anything. I have not been able to fix this except with Windows ME or XP, both of which have the System Restore function. I thought that it could be spyware and I warned others in my staff about it. They told me basically that I was full of crap and that there was no way spyware could damage someone's network settings. I always thought that spyware on a windoze box had the power to do whatever it felt like. Maybe now that they see this on /., they might take me seriously or no, I am probably still full of crap.
Window's DNS is somewhat finicky. If you have a virus, or spyware that tries to make DNS lookups while you're connecting to your ISP, it can prevent DNS from working once you do connect.
Do you even lift?
These aren't the 'roids you're looking for.
Opinions on the Twiddler2 hand-held keyboard?
I'm sure that using that crap is against the TOS. Send out a bulk email to all customers saying that there is a grace period of 30 days where you will help them through uninstalling Kazaa and all that rubbish. After that, it will be either a $100 per incident fee to do it, or you will be on your own.
Yeah, probably wouldn't work unless you were AOL or someone like that. Being a small ISP must really suck at times.
Jesus was all right but his disciples were thick and ordinary. -John Lennon
"they are stuck with a computer store bill for reinstalling their machine"
So now spyware makers/bundlers are going to justify their actions by saying that they create third-party jobs and help strengthen the economy... great.
I have had machines unale to connect to our lan because bonzi buddy had hijacked his networking some way or another. Same with a few other odd connectivity problems that cleard up once ad aware was run on the machine.
All Troll + "offtopic" mods are meta moderated as "Unfair", because you abused the system.
I've talked several buddies through disabling the AOL installed "Compuserve WAN Device" whatever that is. It prevents a lot of SMB network services like file and printer sharing, from working in Windows NT/2000/XP. It seems to re-enable itself occassionally.
Is AOL installing this thing as spyware?
Ever dream you could fly? Get up from the Flight Sim. I Fly
I've been on several different levels of ISP tech support and fully agree that spyware causes A LOT of problems. New dot Net, especially, seems to affect not only DSL but dialup as well. It replaces the winsock files with its own versions, which causes the inability to browse. Many times, though, extracting native winsock dlls off the installation disk will restore browsing. Something to consider before reinstalling the entire OS.
I first developed an awareness of this problem when discovered I started experiencing strange random slowdowns and hangs, and started killing background processes until the problem went away. This narrowed the problem to a spyware component that seems to have been trying to extract really detailed usage information from Windows Explorer. Every since then, I've been running Ad-Aware every time my system seemed to lag -- usually with positive results. The alternative is to give up downloading any Windows software ever. Which I suppose I could do, but only as a last resort.
And if spyware vendors are going to snoop on what programs you have installed (I thought my problems with the installer applet was simple feature bloat!), there's sure as hell gonna snoop on what web sites you access. And if they destroy the very thing they're trying to profit from -- well, that just makes them a kind of spammer, doesn't it?
I would recommend running Ad-Aware before you re-install the OS. It's quite good at finding those spyware components. And you can't beat the price!
I've been having a weird problem on my WinXP machine where when it gets disconnected, then automatically reconnects, none of its http access works. Connecting manually works 100%, though. I've already taken of all my spyware a while ago, though. Lasting effects?
By the way, check out Gnucleus, the open-source (and spyware-free) gnutella client.
WeRelate.org - wiki-based genealogy
Have the customer install Lavasoft's wonderful Ad-aware. This freely available program should remove any spyware that is installed.
http://linmx.sourceforge.net/
The project doen't appear to have released anything yet, but at least someone is working on a Linux WinMX project.
These screw with the HKEY_LOCAL_MACHINE/Services/Winsock2 keys and make things break. It's not easy to remove them until you get used to it. We had to request several times from New.Net to get removal instructions.
I work for another Canadian ISP and we've discovered this in our search for answers.
C lick OK .dll from loading up at startup of your computer
c es
If the uninstall of New.net does not work:
Do the following to remove the New.net application from your computer:
First, you will need to locate the New.net ".dll" file that is on the computer. Do this by doing a search for "newdot*.*".
The file will be located in your "Winnt" or "Windows" folder (depending on what version of Windows you are running). Once found, make note of the actual filename which should look something like this:
Example:
newdotnet2_90.dll
Close the Find or Search window then...
Click Start
Click Run
Type in the following line:
For Windows NT users:
rundll32 c:\winnt\newdotnet2_90.dll,NewDotNetUninstall
For Windows 95/98 users:
rundll32 c:\windows\newdotnet2_90.dll,NewDotNetUninstall
You should then see a small window asking if you want to uninstall the New.net application.
Click Yes. Once this is done, restart your computer. This should keep the
After this you'll need to repair the corrupt winsock2 key in the Windows 9x registry. Follow the link and all should be good.
There is also a way of recreating the winsock2 key in Windows 2000:
1. Export (as backup) the winsock and winsock2 keys under: HKEY_LOCAL_MACHINE|SYSTEM|CurrentControlSet|Servi
2. Delete the keys mention above.
3. Create a Dial-Up connection (a dummy one). This will create a new winsock2 key.
4. UNINSTALL TCP-IP protocol from any connection (dial-up or "Local Area Connection").
5. Boot the machine as required after uninstalling TCP/IP.
6. Once machine has reboot re-install TCP-IP protocol (this will create a fresh winsock key).
7. Don't need to reboot this will fix the problem.
Not sure for the other OS's...can anyone else help?
Missing the link for Win 9x winsock2 registry fix
k b; EN-US;q246727
http://support.microsoft.com/default.aspx?scid=
Some things install webhancer. They're evil. They modify the TCP/IP stack so that it won't work when Ad-Aware removes their files. Programmers that do stuff like this should be destroyed.
"Nature doesn't care how smart you are. You can still be wrong." - Richard Feynman
The latest CVS version of Lopster does WPNP as well as OpenNap. Here are instructions on building it and getting connected to the WinMX network.
Hey folks, :-)
I have read about Kazaalite which is the same as Kazaa, but with a sterilized version of the spyware that would be normally installed in Kazaa. Aparently, the SpyWare "ghost" needs to remain in order for the application to work, but is non-intrusive... kind of like hacking to get around the software key requests of your favorite aplications..
Has anyone else tried this application? Is Kazaalite as good as Kazaa? Is it truely spyware free?
G
The catch-22 is recognised and we explain to customers that the problem is in the PC and they need to access the info via a working machine. And while "We do not support or officially recommend" ad-aware we let them know it may fix them up and keep them clean.
Everyone is sue-happy, we gotta cover our butts. In an ideal world, "Layered Service Providers" and "Internet Explorer Helpers" would be easily disabled.
Is it possible to remove the spyware component of Kazaa without losing the functionality?