Slashdot Mirror


Which Adware and Spyware are the Most Insidious?

the_dreadnought asks: "I was just asked today which adware and spyware are the most insidious by an acquaintance. He asked me if this stuff was really legal, or was it just not important enough for law enforcement to deal with? I know the porn stuff (not from experience,,,ok, from experience) that dials out to foreign countries is one of the more extreme examples, and Gator is well known, but if Slashdot readers could describe what adware and spyware they think is the sneakiest I would appreciate it. Also, any thoughts on whether some of this stuff is even legal, as it is almost certainly not ethical."

29 of 840 comments (clear)

  1. New.Net by TheSpoom · · Score: 5, Interesting
    I do tech support, and one of the worst things I've seen is a piece of software called New.Net. While not technically spyware (though that's arguable), it actually overwrites parts of the user's TCP/IP stack so that any time they access the internet (not just their browser), it gets pushed through the (usually fairly buggy) New.Net DLLs.

    And the fun part is, if you (or the user) uncheck the New.Net software in MSCONFIG, it doesn't just stop New.Net from working... They simply stop being able to use the internet. At all. So then we have to pray that their version of New.Net has a working uninstaller, or we have to go through a huge manual uninstall that involves removing multiple registry keys. BTW, if anyone here gets this or other spyware that is difficult to remove, try using a program called HijackThis and "Fix" anything that looks out of the ordinary (use common sense... don't delete everything).

    --
    It's better to vote for what you want and not get it than to vote for what you don't want and get it.
    - E. Debs
    1. Re:New.Net by shawnywany · · Score: 5, Informative

      I agree, that HijackThis program did wonders for my parents' messed up computer. Not only did the search page mysteriously get changed after every reboot, we had the misfortune of answering questions from my little sister about the porn popups the BHO caused when she accessed Neopets. However, one or two clicks with HijackThis and all was right again. Adaware and S&D don't catch everything, looks like I had to add ANOTHER program to my arsenal.

    2. Re:New.Net by caseih · · Score: 5, Informative

      The easiest way to delete New.Net is to do the following:
      1. remove it using "Add/remove" programs
      2. if still not working, remove the WinSock and WinSock2 registry keys from CurrentControlSet
      3. Go to network settings on win98 or on 2000/XP, just go into the properties of your network connection and if possible, remove tcp/ip. On XP this is impossible, so ignore this step
      4. Add new service. If you're not on XP, just reinstall tcp/ip. On XP, select "have disk" and point it at C:\windows\inf. Then select tcp/ip and install it
      5. clean up any newdotnet files lying around.
      6. Join a class-action lawsuit against the company that makes this piece of crapware.

      Be aware that these steps can cause problems with programs like cyber-sitter or firewalling programs that modify the networking stack. Do this at your own risk.

      This is very prolific. I've cleaned it on on laptop twice! I have a supsicion the user is downloading crap all the time, but I do wonder in what form it come in.

      Michael

    3. Re:New.Net by Anonymous Coward · · Score: 5, Informative

      Or you can just reset Windows XP's TCP/IP stack

      from command prompt:

      netsh [enter]
      int ip [enter]
      reset [enter]

      then reboot

    4. Re:New.Net by TaoJones · · Score: 5, Funny
      The easiest way to delete New.Net is to do the following:
      1. remove it using "Add/remove" programs
      2. if still not working, remove the WinSock and WinSock2 registry keys from CurrentControlSet


      This is the "easiest" way? Slow down there Turbo... Now, over the phone, YOU try to talk my mother through this "easy" way. Believe me, I'll Make Money Fast selling you a couple of Valium when (and if) you ever get the job done ;)

      --
      "Fear is the rootkit of democracy.." Blarkon
    5. Re:New.Net by TheQuantumShift · · Score: 4, Informative

      or run them all together as MSN tech support is trained to do... "netsh int ip reset resetlog.txt" That along with "regsvr32 softpub.dll" and "regsvr32 wintrust.dll" will fix 99% of MSN problems. That and Referring to OEM...

      --

      Shift happens. Fire it up.
  2. IMHO the worst one was........ by i_want_you_to_throw_ · · Score: 4, Informative

    Xupiter! Or what used to be Xupiter. In it's time it really wreaked havoc. Although going to their home page says they are out of business, ths link on their site shows that they may be up to something else soon

    You can share some of the love for the Yomtobians here. These guys are right up there with Spamford Wallace and the Cantor/Siegel in the Internet Hall of Shame.

  3. RealOne by JanusFury · · Score: 5, Interesting

    I'm sure there aren't many people who agree with me, but I personally consider RealOne to be spyware. It's intrusive and has lots of 'features' that are extremely difficult to turn off if you can turn them off at all, and it installs things without telling you. (For example, its 'message center' in the system tray that tells you to Buy RealNetworks Products(tm)(r)!0

    Other than that, I don't really run into spyware much, but I find gator and its kin to be the most intrusive and common on the web.

    --
    using namespace slashdot;
    troll::post();
    1. Re:RealOne by CaptBubba · · Score: 5, Informative
      "unfortuantly there is no other player which plays their media"

      There is Real Alternative. I'm not sure how legal it is, but it plays the files and I don't have to install the RealOne crap. Until I found it I simply didn't use any sites that relied upon realplayer files. I was so happy when Amazon.com added WMP samples.

  4. One word...GATOR by bluethundr · · Score: 5, Insightful



    Without any doubt in my mind, the most evil form of spyware I am personally aware of is the infamous insidious Gator. Booo, hisss!!!! I am sure there are others, but I'm sure of this: there is a special place in hell for these folks.

    --
    Quod scripsi, scripsi.
    1. Re:One word...GATOR by bhtooefr · · Score: 4, Informative

      Google Toolbar doesn't count, because it is a VOLUNTARY move to enable the spying features (default is to disable them, they give you a nice short EULA that tells you they'll get some info from you if you enable PageRank). Gator and the more insiduous MemoryBlaster (or something like that - it's a taskbar icon that shows you percent free RAM, and takes up about 50% of RAM on a 128MB box with XP itself) count. Taking into account that someone could be blindly clicking links, one could VERY easily get the whole GAIN suite in a few seconds. (BTW, there are MUCH nicer alternatives to those - I've heard RoboForm isn't spyware, and can even import your Gator data if you did once use it, Date Manager? double click on the clock! (oh wait, roblimo can't figure that out) PrecisionTime? ArgoSoft Time Synchronizer is what I use - good ol' fashioned freeware)

    2. Re:One word...GATOR by DeadMeat+(TM) · · Score: 4, Informative
      Roboform is your friend. It can import Gator passwords and then export them to HTML for printing (or parsing with your favorite scripting language).

      It's recommended as Pricelessware by alt.comp.freeware, which means no nasty spyware or adware.

  5. Windows Spyware Removal by Davak · · Score: 5, Informative

    Here are the removal programs...
    Spybot
    Adware

    However, this begs the more interesting questions....

    Is there *nix spyware?
    Why not?

    Davak

  6. Windows Media Player... by penguinrenegade · · Score: 4, Interesting

    gets my vote. Not only does it report your media files, but also any other apps you're running!

    /me adjusts tinfoil hat...

  7. Lop.com by DJ+Rubbie · · Score: 5, Informative

    Lop is by far the worse one ever... recently I convinced my cousin to switch over to Mozilla Firebird, but this article (http://www.spywareinfo.com/articles/lop/) suggested that Mozilla isn't 100% safe, but is much easier to cure than hacking the registry (apparently it's just one line in the user_prefs). One sources said that it changes 47 registry keys... I also found that it randomly mutates into new filenames (actually it downloads newer versions), making it much harder for programs like Adaware to hunt it down.

    Also, Lop disguises itself as a mp3 search toolbar. It also comes with newer versions of MSN Plus.

    One more thing, some people are willing to profit from lop uninstaller, such as this one - http://www.onlinepcfix.com/spyware/Lop.htm - it contains some more information related to lop.

    --
    Please direct all bug reports to /dev/null
  8. hotbar by a.koepke · · Score: 5, Interesting

    One program that really annoys me is hotbar. The main reason so, it adjusts your MS Outlook settings all the time turning off using Word as your HTML editor. It also requires about 2 hours to remove the stupid program.

    You remove it using AdAware and it will remove it for that user profile. Then login as another user it will actually install itself again. I logged on as each user to remove it and finally managed to get rid of it, so I thought. It has now appeared back and I know it wasnt the (l)users installing it again since I gave them a lecture about adware and installing crap on machines that I am in charge of.

    If a program comes with a valid uninstall feature then I can tolerate it. When its a program thats a biatch to get rid of and keeps coming back I get really ticked off.

    --


    (\(\
    (^.^)
    (")")
    *This is the cute bunny virus, please copy this into your sig so it can spread
  9. a musical analogy by Savatte · · Score: 5, Funny

    which Creed album is the worst?

  10. Pre-Installed Dell Software by Jouster · · Score: 5, Interesting

    How about Dell's SupportLink, which (and I have the TCPdumps to prove this) broadcasts your system's S/N, your MS Windows S/N, and several other tantalyzing bits of data back to Dell every 30 minutes or so?

    Mind you, I love my Dell, but this pissed me off.

    Jouster

  11. SaveNow by pavera · · Score: 4, Informative

    The worst program I've ever seen is savenow..
    It starts like 5 processes on boot (using between 50-75mb of ram and 20-25% cpu), sends all of your browsing habits somewhere else, and pops up porn, and other various ads randomly while using the computer. It is by far the worst spy/ad ware I've ever seen.

  12. I agree with you by sweatyboatman · · Score: 4, Interesting

    I don't use RealPlayer at all. If for some reason a website offers only RealPlayer videos I just do without. not a big deal for me. much more annoying, as you say, to remove the tentacles of Real after you've installed their "free" player.

    -sweatyb

    --
    It breaks my pluginses, my precious!
  13. Business plan by Chuck+Chunder · · Score: 5, Funny

    1. Ask Slashdot what sort of spyware is the worst. 2. Make this sort of spyware. 3. Profit!

    --
    Boffoonery - downloadable Comedy Benefit for Bletchley Park
  14. Worst Adware Revealed! by missing000 · · Score: 4, Funny

    With absolute certainty, the worst adware is the threadjack /. post

    Especially evil is the sig line advertisement.

  15. I'll never know the name. by Elwood+P+Dowd · · Score: 5, Interesting

    I didn't think that spyware existed on MacOS X, but... my girlfriend came home from school last winter with something really odd. Internet Explorer would, no matter your user preferences, always go to a certain internet shopping site as a homepage. And would give you a barrage of popups constantly. I forget what shopping site, and back then I only had inbound firewalling, so I had no logs to check.

    No toolbars installed. No plugins. I created a new user account for her, and that worked, so apparently it hadn't messed with the internals of the Internet Explorer.app (which seems like a vector they'll soon exploit). Crappy, though.

    --

    There are no trails. There are no trees out here.
  16. Obviously by lurker412 · · Score: 5, Insightful

    The most insidious are the ones we don't even know about.

  17. Shocking disrepect for consumer choice by StefanJ · · Score: 5, Funny
    You should be ashamed, ashamed!

    All these companies want to do is let you know about exciting new products and services that could entertain you, improve your life, and lengthen you genitalia.

    Shutting out these innovators . . . well, it smacks of Communism, doesn't it? First TiVO, screening out the ads that broadcasters, our public servants, need to survive. Now this ungrateful attack on champions entreneurship and freedom of choice. Just a bunch of surly, consumer-choice hating Reds is what you all are.

    I'm going to tell John Ashcroft what you've been up to so these SpyBot removers can be banned!

    Stefan "scared to hell that someone out there might actually be thinking like this" Jones

  18. Not just adware and spyware by Ryan+Mallon · · Score: 4, Interesting

    More and more applications are becoming intrusive, software such as Winamp, Windows Media Player and Kaaza all having annoying dialog boxes which popup each time you run them if they detect a newer version which you haven't yet downloaded. MSN actually refused to do anything until I upgraded it.

    A large number of applications now have an online registration feature, they dont force you to do the registration, but they will bug the hell out of you if you choose not to.

    Applications such as RealPlayer try and sign you up to email based newsletters(spam), why should I have to give my details (email address, home address and hobbies for example) to a company in exchange for using their software?

    There seems to be a gradual increase in the invasiveness of software, currently most of these 'features' are still optional, but I dont think it will be long before many software companies start making things like software updates, online registration and having a valid email address mandatory.

  19. Mostly Ethics, Seldom Legality by billstewart · · Score: 5, Interesting
    Most of this software, while some of it is Ethically Challenged, doesn't have legal problems, at least in the US. The stuff claims to be free or cheap, and usually tells you that you'll get advertising, and even though it doesn't always tell you how much data it's collecting, it's usually not breaking any laws by doing it. Even the annoying features like popups or making your machine dog-slow aren't illegal, they're just misfeatures. Often you even have to press a "Pretended to read the fine print of the license" button for it to install.

    Some of it's not even broken ethically - if all they're doing with it is deciding which ads to show you, rather than tracking your every move online, especially if they didn't collect personal information about you, and if they didn't lie to you about what they were doing, and if they have a privacy policy that actually reflects what they're doing, that's ok. Not necessarily something you want to run, but ok. Some particular examples are the adware versions of Eudora and Opera.

    European data collection laws may have terms that popular spyware violates, but usually the spyware companies aren't based in Europe so there's no legal jurisdiction. The data collection laws themselves are often effectively spyware - in return for "protecting" you, they're also subjecting you to possible audits of your machines because you *might* have personal information about other people on your computer or your PDA or your cell phone. (Sure, they mostly pretend they wouldn't do that to regular citizens, only businesses, but it's pretty much a selective enforcement thing. And you are registering all your computers with the data protection bureau, aren't you?) But at least it doesn't slow your machine down when they're not auditing you.

    --

    Bill Stewart
    New Fast-Compression-only CPR http://preview.tinyurl.com/dy575ks
  20. For more info ... by fygment · · Score: 4, Informative

    ... maybe this site would help:

    http://www.spywareinfo.com/downloads.php

    --
    "Consensus" in science is _always_ a political construct.
  21. How to stop it on XP and above by friday2k · · Score: 5, Informative

    In Windows XP there is a feature called Software Restriction Policies (SRP, see here). This feature allows you to deny software to run based on Certificates (and Path, and Hash, and Zone for MSI). Since all the Spyware installers use signed Active-X "drive-by" installers this is an effective way to kill them. This, however, is an arms race. You need to collect the certs you want to invalidate first (upon first encounter of a spyware safe their cert into a file and disallow it). You can find the feature in Control Panel->Administrative Tools->Local Security Policy. Have fun!