Slashdot Mirror
Does Spyware Damage Windows Networking?
DerBryGuy asks: "I work for an ISP in Canada. Recently we have had a rash of customers whose computers can connect via DSL, but cannot browse, or often even ping. Invariably it turns out that there is some spy ware of some sort installed on the customers machine - usually New dot Net or the other drek that comes with Kazaa. About half the time if this is removed correctly (manually or by using ad-aware) then the machine will regain http access. However the other half of the time the only option we have found is to format and reinstall the OS. So I am wondering, are other ISP's seeing this? What do they do when they get a similar complaint and they detect spyware on the machine. Is there any recourse for the customer? I mean most of these people had no idea what New dot Net was when their kid installed Kazaa, and now they are stuck with a computer store bill for reinstalling their machine."
We seen this but not with spyware. Customer calls saying they no longer can access the internet. Invariably, they have updated their antivirus software and it now includes a personal firewall. Said firewall doesn't allow ports 80, 25, or 110. We've seen this with McAfee and with a less well know brand the name of which escapes my memory at the moment.
We have seen spyware cripple the performance of a machine though.
I have experienced the same problem where I work at my school. Many of our users can dial-up, but they cannot access web sites or ping anything. I have not been able to fix this except with Windows ME or XP, both of which have the System Restore function. I thought that it could be spyware and I warned others in my staff about it. They told me basically that I was full of crap and that there was no way spyware could damage someone's network settings. I always thought that spyware on a windoze box had the power to do whatever it felt like. Maybe now that they see this on /., they might take me seriously or no, I am probably still full of crap.
If you really want KaZaA, but without the spyware, you should checkout KaZaA lite (kazaalite.com). Be sure not to allow KaZaA to update itself (like now with the 1.7 version), as it will install the Sharman Networks version with said spyware. A nice p2p-program without spyware is WinMX, too bad there are no Linux clients for it. (for their own network, that is.. Opennap clients enough.)
Window's DNS is somewhat finicky. If you have a virus, or spyware that tries to make DNS lookups while you're connecting to your ISP, it can prevent DNS from working once you do connect.
Do you even lift?
These aren't the 'roids you're looking for.
I'm sure that using that crap is against the TOS. Send out a bulk email to all customers saying that there is a grace period of 30 days where you will help them through uninstalling Kazaa and all that rubbish. After that, it will be either a $100 per incident fee to do it, or you will be on your own.
Yeah, probably wouldn't work unless you were AOL or someone like that. Being a small ISP must really suck at times.
Jesus was all right but his disciples were thick and ordinary. -John Lennon
"they are stuck with a computer store bill for reinstalling their machine"
So now spyware makers/bundlers are going to justify their actions by saying that they create third-party jobs and help strengthen the economy... great.
I've talked several buddies through disabling the AOL installed "Compuserve WAN Device" whatever that is. It prevents a lot of SMB network services like file and printer sharing, from working in Windows NT/2000/XP. It seems to re-enable itself occassionally.
Is AOL installing this thing as spyware?
Ever dream you could fly? Get up from the Flight Sim. I Fly
I first developed an awareness of this problem when discovered I started experiencing strange random slowdowns and hangs, and started killing background processes until the problem went away. This narrowed the problem to a spyware component that seems to have been trying to extract really detailed usage information from Windows Explorer. Every since then, I've been running Ad-Aware every time my system seemed to lag -- usually with positive results. The alternative is to give up downloading any Windows software ever. Which I suppose I could do, but only as a last resort.
And if spyware vendors are going to snoop on what programs you have installed (I thought my problems with the installer applet was simple feature bloat!), there's sure as hell gonna snoop on what web sites you access. And if they destroy the very thing they're trying to profit from -- well, that just makes them a kind of spammer, doesn't it?
I would recommend running Ad-Aware before you re-install the OS. It's quite good at finding those spyware components. And you can't beat the price!
Have the customer install Lavasoft's wonderful Ad-aware. This freely available program should remove any spyware that is installed.
These screw with the HKEY_LOCAL_MACHINE/Services/Winsock2 keys and make things break. It's not easy to remove them until you get used to it. We had to request several times from New.Net to get removal instructions.
Maybe it doesn't have any spyware (even though I oculd have sworn it did), but WinMX did a pretty good job of pissing me off up until the latest version. I installed it and decided it wasn't for me, and when I went to hit the uninstall button there was a big X over the icon. When I clicked on it a message would pop up about uninstalling the program, then it would just exit. I had to wait until the newest version that just came out a few weeks ago was released, install that, and then procede to uninstall the program. Definitely soured me on the whole WinMX experience.
"Well kids, you tried your best, and you failed. The lesson is, never try." -Homer Simpson
Some things install webhancer. They're evil. They modify the TCP/IP stack so that it won't work when Ad-Aware removes their files. Programmers that do stuff like this should be destroyed.
"Nature doesn't care how smart you are. You can still be wrong." - Richard Feynman