New Tricks from Browser Hijackers?

Fortunato_NC asks: "I'm the IT manager for a small business that delivers its service via a browser-based application, and we take around two dozen to three dozen tech support calls from users each day. Many have something to do with pop-up ads making using our product nearly impossible, which is odd, since we don't have any advertising on our website. Of course, it's spyware causing the pop-ups, and we recommend using a product like Ad-aware to take care of the issue. However, not everyone gets the message. Today I was on a client's computer using WebEx helping them remove yet another 'browser helper'. The uninstaller for this program consisted of running no fewer than four separate programs, each of which forced closed the Internet Explorer windows, killing the WebEx session, and making it very difficult to service an already upset client ('What do you mean I have to join the meeting AGAIN?'). It seems as if this product anticipated the need to have someone remotely help the user remove it and went out of its way to make that task nearly impossible. Has anyone else on Slashdott encountered spyware or malware specifically designed to make life miserable for *remote* support techs? What other nasty tactics are spyware authors using that you've noticed?"

Comments

Stop using IE

[Anonymous Coward]

Tell your users to use a decent browser instead of IE (Firefox, Mozilla, Opera, whatever). Let them handle their spyware infestations themselves.

Re:Stop using IE

[Anonymous Coward]

Tell your users to use a decent browser instead of IE (Firefox, Mozilla, Opera, whatever). Let them handle their spyware infestations themselves.

Not an option in almost all business environments. In fact, we're specifically prohibited from even suggesting to users that they use an alternative browser because it'd be a bigger support hassle for the desktop support group. SAP requires IE, WebEx requires IE, our timecard program requires IE, and now they want to migrate people from POP mail to using Exchange Server. I work for morons (the US government).

Re:Stop using IE

[Fortunato_NC]

That would be easy, except that we deliver many of our products in crowded, cutthroat markets to people who usually have little in the way of on-site or corporate tech help. We differentiate ourselves on service and ease-of-use, since we have no hope of competing with the industry "big boys" on straight price. In fact, we buy many of our products from the "big boys", repackage them, add our own unique data, and deliver the whole ball of wax in an easy-to-read format.

Simply telling them "that's not our fault" isn't going to cut it. If we're not providing the best experience possible, our customers can easily take their business to our competitors. And then, I'd be Asking Slashdot about where I could find a new job.

The fact is that most of the "low-end" computer users use MS products because they're the easiest to install - especially since they came preinstalled on the computer. Asking them to download and install software is beyond the capabilities of many of our users. I don't like it, but I have to play the cards I'm dealt - and right now those cards say that 90%+ of my customers are using IE. And unfortunately, when those customers are trying to use my product and spyware prevents them from doing so, it falls on me to fix it. If I don't, one of my competitors will.

Re:Stop using IE

[dheltzel]

Asking them to download and install software is beyond the capabilities of many of our users.

Yet they seem to have no trouble at all installing all that spyware. Someone needs to create a one click install via a popup for Firefox, then you just put that popup on your site and wait until they inadvertently fix themselves.
Extra credit for the hacker if can wipe the existing spyware (the competition) and put the firefox path into all the shortcuts and registry keys that currently point to IE.

Imagine a "spyware" program that make the computer run better and safer than it was before.

Solution:

[Lord Bitman]

Why not stop requiring your clients use IE to get support? That help?

remote shremote

[perlchild]

You think just because you're using a web browser tool, to remotely access a web browser, to remove vermin, is a design decision on the vermin designer's part?

Hate to break it to you, but when you've got a broken arm, you don't usually use that arm to set the bone.

Ever heard of non-browser based remote access? Like VNC, pcAnywhere, NetOP or remotely possible?

It has nothing to do with this vermin's author being clever, you're just using a not very optimal tool for your removal of that vermin.

Re:a few steps to clear yourself of all problems

[Idealius]

Actually, many "Browser Hijackers" are coupled with their TSR spyware buddies so #4 would oftentimes backfire on you.

If anyone is familiar with HijackThis they'll know that Spyware/Malware comes with several modules placed in different portions of people's startup/browser configurations so if a piece of the spyware is removed from one area the other modules will replicate back to these areas sometimes with random filenames and a host of many other tricks that anyone familiar with "the game" will know.

Anyway, a lot of us are going to need replacements for HijackThis because the last version Merijn released is just that: the last version.

Re:Sounds nice but wouldn't work

[daviddennis]

It seems excessively negative to say that someone's beyond help if he hasn't ensured browser compatibility. When confronted with a potentially company-killing problem, I think he'd be willing to listen.

I actually talked to a customer today who I told should switch from IE, and she was receptive to it because the spyware was driving her bats. There's no question that you can't turn away people using IE, and you must ensure that your software is compatible with IE, but there's no reason in the world not to suggest that using other browsers would fix the problem. People who have the kind of severe spyware problems I've seen are likely to be receptive to that kind of pitch; they don't love IE, they just want to get things done. If that means download something new, I think they'd go for it.

D

Netmeeting?

[mozingod]

Since I'm betting 99% of your users will be using Windows, why not just use netmeeting? Our techs have been using it for quite some time and never have a problem getting rid of spyware with it, since it's not browser based.

We must live in different worlds

[SmallFurryCreature]

I seen this problem before, the trick is hardly unknown. And yet there seems to be very little movement in people switching browsers. Sure a lot of noise is made about it here but just look at the statistics. How much did IE loose in a recent /. story? 1% wasn't it. OH WOOPIE. That was right after one of the biggest security hits in the history of computing (several regular sites being used to steal information and forward it to criminals) that was only stopped because it was to successfull and the receiving server was overloaded.

Of course I don't know if the guy with the problem has an IE only site, I was only speculating, but I have argued this point in the past with customers and employers and it rarely gets across. I found that the only way to reliable create a cross-browser site is if I am the person in control and then to just do it. Don't mention it, it doesn't cost any extra so no need for the customer ever to known his brand new site works with every graphical browser on every OS (well linux windows and OS-X) and can even be used with links. (lynx is harder)

I never ever had a customer or employer ask for cross-browser compitabilty let alone cross-platform.

My answer nowadays when people ask me about obvious MS caused spyware/trojans/virusses/bugs. "I don't know."

I used to recommend firebird or opera. And everytime I get repaid by having them complain to me that site X doesn't work anymore. Worse when I used to remove spyware they complained about their missing desktop toys. I only did that a couple of times. Waste of time.

Fat people don't listen to advice on diets, drunks don't listen to advice on not drinking, windows users don't listen to advice on security. If they did they wouldn't be fat drunk windows users.

BUT you could restore my faith in mankind, well womankind at least. Did your customer switch browser? I bet my cynisism against a shred of hope for the human race she didn't.

Re:We must live in different worlds

[Captain Splendid]

How much did IE loose in a recent /. story? 1% wasn't it.

One percent of IE users switching is something upwards of a few hundred thousand right? And it's a growing trend. We can assume alternative browser usage will plateau at some point once MS gets the lead out, but that's not for another couple of years, considering all the visible bad press IE has been getting lately, and the fact that their development team is way behind the curve.

I think the anti-IE backlash (and subsequent switching) will reach critical mass, say when millions (still only a few percent!) switch over. And that will be hard to ignore, for web developers, the press, and the average user worldwide.

Bottom line: Yes, it can be tough to convert, particularly a company of thousands entrenched in their habits. But keep working at it. Every convert is an evangelist to the cause, and we have nowhere to go but up.

Re:We must live in different worlds

[daviddennis]

I'm not really in touch with my customers, so I don't know. (I do computer system design for the company, so I'm not on the leading edge of customer contact). But I do know she said she would bring it up at their meeting, which probably increases your cynicism tenfold :-).

I think there are a few problems worth noting. First, we tend to sound a bit fanatical about these issues, and most people tend to discount fanatical statements. Imagine what you would say if someone told you your car had a good chance of blowing up. You'd think they were out of their mind until you saw some exploding cars yourself.

Second, people are conditioned to feeling computers don't work right. Even when Windows has no viruses or spyware, it still slows down over time; the spyware just accelerates this. Since computers are getting faster all the time, that hides the affect of malware from view, and people think it's normal, and accept it.

So it's very likely that people don't understand the full impact of the problem. A few have to be injured by these scams and problems, and then others are likely to fall into place if you explain things properly. Understand that most people don't like change and just expect things to work.

If you understand that's how people think, then you're in a better position to try and convince them.

Hope that helps.

D

Bad Malware... Bad!

[sjs132]

I've actually had some malware that gets into the system like a tick...

Not only is it set in the Hkey\..\run, but I had one that stuck it's html based install into the windows active desktop folder, so once the computer was "clean" it reinstalled itself on reboot...

I've even seen a few where if you try and use AdAware and the first thing you need to do after downloading it onto a new system is to update the REF. file... but adaware said no updates... Finally, I had to use another system to get the updates, put them on a ftp site, and pull the updated REF file from the ftp (or shared drive would work) because the malware blocked the adaware updates!

What I think is funny/sick is that if the author(s) of this crappy malware type software actually spent as much time/effert into a GOOD PRODUCT as they put into making it's removal difficult (my.search, etc...) then they would probably have a great product and people would enjoy using it, and maybe even give them legit business... Not trick people into installing it because it sucks so badly!

Of course the simple answere would be:
boot Dos-format-reinstall (or reimage...)

Bad client. No biscuit.

[mcmonkey]

If we're not providing the best experience possible, our customers can easily take their business to our competitors.

Which isn't always a bad thing.

There are customers who make you money, and there are customers who cost you money. It sounds this customer (the client requiring several WebEx sessions) is a money pit.

Now there are several good reasons to take a loss on a particular customer--large clients often grow from small clients, good clients come from referrals made by bad clients treated well, you don't want your support staff bailing on tough calls with the excuse, 'oh, this customer is losing us money' (that's a call for the bean counters, not the support or tech folks).

So, let's presume the company is losing money on such high-maintenance clients. Let's also presume the company is not willing to just let their business go. What do you do?

You do your homework! Boy Scouts' motto, Ounce of prevention, pound of cure, stich in time, and all that. Take a machine off the company network, do a standard client install, dial-up to the internet, and let the ad-ware be your guide. Install whatever it is you keep having to uninstall for your clients. Then document the steps to uninstall.

Rinse and repeat as needed. Go through the permutations of OSs, versions, and browsers to cover 95% of your client base.

Now, you still have clients with ad/spyware issues, and your support staff is still helping them out. For those that don't know but can learn, you put your documented cleaning routines on your web site or at least have a formatted email ready to go when the call comes in.

Those that can't follow the written directions, get the walk-through on the phone, but now 1) you don't sound like you're making up as you go along. Bad clients are more likely to become good clients when you have a solution on hand and ready to go. And 2) you can pass that job down the chain so you lose a little less money on that client.

ASP Kiddie?

[Anonymous Coward]

Somewhat offtopic, I know, but using ASP has nothing to do with how compatible your site is likely to be.

I've been using ASP, PHP and Perl for the past few years on various projects, and recently won a UK accessibility Best Practise award for a huge ASP project - my point being that ASP and compatibility are not mutually exclusive! In fact, you find many more "web kiddies" using PHP than ASP, which requires small enterprise-level systems to do anything useful with, realistically.

Now the very interesting thing about the accessibility award is this:

I didn't do anything hugely complex to make it cross-browser and W3C compliant - I simply followed guidelines. This says to me that if I'm supposedly one of the top cross-browser, accessible developers in the UK right now, the majority of web-shops obviously don't know shit, and *that's* the problem.

Also, frequently, developers know full well how to make a site compatible with all browsers, but when they ask for an extra week to fix CSS, layout etc, the client tells them that the non-IE market is unimportant. A bad idea, since on a large site even 1% can be thousands of potential customers, but hey, that's middle management for you.

Nastier Browser Hijacks

[fuzzybunny]

What's actually worrying me a lot more than spyware hijacks are active scripting tricks.

We've encountered a lot of these recently, using compromised IIS5.0 pages (innocuous sites)--you can read a high-level overview here.

People are hijacking sites and leaving them as-is, but appending malicious scripts. The sites are innocuous enough for average users to access regularly, but they take advantage of various IE exploits, such as Download.Ject and friends.

The MS patches for ADODB stuff aren't too widely used in a lot of outfits as they can break lots of bits and bobs of the help "system" in Outlook and other vaguely browser-related toys. I'm currently doing some security work for a large corporation, and am having a demon of a time just trying to figure out with application testing people which MS patches do exactly what, what they break, etc. Ah the joys of using high quality commercial software backed by a reputable vendor.

It's not just IE either; there've been a number of browser vulnerabilities released recently, albeit more to do with spoofing or redirects than actual remote code exploits. For Joe Average, though, the result will be nearly as serious (for example, if cnn.com prompts him to click 'yes' on a popup he may do it, when he would not for a random porno site.)

To be fair to Microsoft, their local security guys are being extremely cooperative and helpful just trying to sort out the mess.

So evaluate it!

[4of12]

In fact, we're specifically prohibited from even suggesting to users that they use an alternative browser because it'd be a bigger support hassle for the desktop support group.

Several points.

First, you are wise to standardize on a browser to help reduce support costs, supporting IE+Mozilla/Firefox will cost more than supporting IE, on the surface. But wait - there's more!

While it costs more for support techs to be trained in both browsers, what if the Mozilla/Firefox users put in fewer trouble ticket calls for support?

It might just be that the cost of supporting IE+Mozilla/Firefox could be less than supporting IE!

Which then leads naturally one to consider whether moving all users to Mozilla/Firefox might lead to even greater savings.

Especially if you consider long term savings from internal web site developers creating content that is more W3C standard and less specific to IE version du jour on Windows OS du jour, things which will surely change.

OK, so don't suggest to users they use a different browser. Instead, do what you're supposed to do: evaluate Mozilla/Firefox in your testbed development department and see for yourself, before you even consider deploying it, whether it makes sense from a business perspective. And ask yourself what the true overall costs are of IE in terms of spyware, adware, security lapses if proprietary information about your business were to leak out, and how much downtime and loss of productivity users have to endure if they have to turn off Javascript, etc.

Then, when you know the answers for your business, do a roll-out and tell people not to use anything but Mozilla/Firefox!

BTW, in my environment it turned out that Mozilla/Firefox supported a lot more web applications than most people expected. Sites would say they needed IE, but it turned out that Moz worked fine. In fact, one of the few web applications that broke under Moz/Firefox was one that relied upon a broken old DOM model for Javascript that origined back in the old Netscrape 3 days.