Slashdot Mirror
Spyware on One in Twenty Computers?
SpaceDonkey writes "New Scientist reports that researchers at the University of Washington carried out a scan of the campus network for signs of spyware. They found spyware lurking on more than one in 20 machines and also discovered a serious vulnerability in two of the four spyware programs they looked for."
Download yourself a free copy of Ad-Aware from here. I ran it on my computer the other day and it found 22 infected files, that it cleaned up for me :)
I'm a tech for a medium sized publishing company, and I find that the first thing I do when I get complaints of slowness and random unexplained crashes is to run spybot. In roughly half of the systems I check, I can find some kind of spyware.
Upon reading the article, it says that they only tested for 4 specific programs: Gator, Cydoor, SaveNow, and eZula. And got 5.1% positives. So yeah, you're probably right.
I think someone has a spyware detector that is not detecting some of the spyware...
That's absolutely correct. According to the article they only scanned for Gator, Cydoor, SaveNow and eZula.
Have you tried Linux yet?
Spyware makes it on to 100% of the computers in my network. I have taught my users to put in, use and update ad-aware, but I think even with that there is spyware it's not recognizing. I come to this conclusion thanks to erratic behaviour in many of my machines that is not due to viruses.
Some of my users like spyware. Hotbar is a good example of a program that's actually liked by a number of people. But the programs that seem to do the most harm are the ones that try to stay invisible.
There are two computers on my network that never have spyware problems. One of them is the Mac I do all my web surfing on, and the other is the PC I do no web surfing on at all.
Any company I found is going to be Mac-only. There's little point in tolerating the huge overhead associated with running a Windows network.
D
Installing a local firewall is one way to deal with spyware. I recently discovered that some freeware that all my co-workers had installed tried to dial out. Since I was running Sygate Personal Firewall (there are others) I was notified that the application wanted to dial home. After some research regarding this software I discovered that it was only trying to send out my registry file and my IP address. :-\
There's a lot of software out there that tries to dial home and any local firewall that is application aware is helpful when it comes to notify you about what's going on on your computer.
is the absolute bomb...
Note the paypal link... throw the author a few bones; it's a great program.
Even if a man chops off your hand with a sword, you still have two nice, sharp bones to stick in his eyes.
- University students and staff are probably more computer-savvy than the general population.
- They were only searching for four of the who-knows-how-many spyware programs out there.
If you're running Windows, you should have Spybot Search and Destroy and Ad-Aware. Not to mention a virus scanner and firewall. And run Windows Update for goodness' sake! Just more proof that Windows isn't ready for the average user yet. (Sorry, had to get a cheap jibe in there.In business environments where people's computers are locked down or there are policies against installing software yourself, the rates are much lower. But in the general university/home/small business user community, I'm more surprised when I find that somebody is aware enough to NOT have spyware than when they do.
Yeah, but that's like saying that IE's history file creates an unsecured log of where you've been unless you clear it or disable it. It's not spyware until something tries to send that log outward...
Speaking of spyware, the Federal Trade Commission is offering a workshop on spyware that needs comments. I think it would be highly appreciated if some of you guys would comment.
I have always thought of spyware as a virus. Perhaps not as destructive but, a virus none the less.
A large portion of my work is field service on home PCs. Spyware has actually become a more destructive problem than viruses for most of my residential clients who already have adequate virus protection.
Most people will have one or two spyware apps like Gator on their machines, which won't impact performance enough for them to notice. But if they have kids it's a different story. Kids download and install EVERYTHING until all the competing spyware renders the internet connection too slow to be usable. DNS requests are often hijacked and when that stops working they are dead in the water.
I get over 600 hits in an Ad-aware scan on a regular basis on machines where kids have access. I also return again and again to the same clients for the same problem. My favorites are the ones who download and install multiple "free" spyware-supported popup blockers, which just add fuel to the fire.
Ah....for all of you who are going to continue jumping in with "1 in 20? more like 1 in 1..." without reading the article...
:-)
The "1 in 20" figure the researchers got was not from scanning the HDDs with Spybot/AdAware/etc....they sniffed for known packets from FOUR of the significantly more than four known malwares.
So, to be detected at all, the machines had to be running and the spyware loaded and actively broadcasting packets during the sampling period. Given this lack of an exhaustive check, the 1 in 20 figure doesn't surprise me. (We all know it is 1 in 1...
Caveat Emptor is not a business model.
New Scientist is just carrying their little summary; one of the authors has the paper available on his site in HTML, PDF, and PostScript forms. It's to be presented at NSDI '04.
"You can never have too many elephants on your team."
I work in a campus Student Computing Helpdesk, and with the scans we run on most of the computers brought in, about 80-90% have a virus, trojan, or downloader (as found by AVG). I *never* see a computer where Spybot cannot find spyware, though to be fair, it will also find cookies and shortcuts. The computers that really worry me are the 25% that have a browser hijacker, such as CoolWeb. I've seen ones where every page request will redirect you to incredifind.com. We use CWShredder to clear up those. Side note: If you remove spyware from your computer and suddenly all your internet applications stop working, you possibly removed a spyware program that had rooted itself into Winsock. Try WinsockFix to clear that up.
Using mozilla firefox with the adblock plugin, I have been almost completely spyware-free. If you use wildcards properly (like *.doubleclick.net/*) you can block all ads, cookies and scripts from adservers or directories. Once you have a sizeable list, you won't get anymore nasties invading your system, and pages will load much faster.
There's not a lot to be missed after that. Process Explorer is also good for finding processes running that might not be of obvious origin.
Also, Spybot S&D works much better than Ad aware, but the user interface stinks. It's also "donation ware" so some of you guys may offer some help here. Don't use Google to find it, though. There are some nasty fakes that have tried to take over the Spybot name on searches. use the link provided.
Reference
$x='S24;r)>63/* h@<5+oZ)32"5cz';$me='phroggy'x$];
$x=~y+ -xz+\0-Tx+;print$_^chop$me for split'',$x;