New Tricks from Browser Hijackers?

Fortunato_NC asks: "I'm the IT manager for a small business that delivers its service via a browser-based application, and we take around two dozen to three dozen tech support calls from users each day. Many have something to do with pop-up ads making using our product nearly impossible, which is odd, since we don't have any advertising on our website. Of course, it's spyware causing the pop-ups, and we recommend using a product like Ad-aware to take care of the issue. However, not everyone gets the message. Today I was on a client's computer using WebEx helping them remove yet another 'browser helper'. The uninstaller for this program consisted of running no fewer than four separate programs, each of which forced closed the Internet Explorer windows, killing the WebEx session, and making it very difficult to service an already upset client ('What do you mean I have to join the meeting AGAIN?'). It seems as if this product anticipated the need to have someone remotely help the user remove it and went out of its way to make that task nearly impossible. Has anyone else on Slashdott encountered spyware or malware specifically designed to make life miserable for *remote* support techs? What other nasty tactics are spyware authors using that you've noticed?"

Comments

Stop using IE

[Anonymous Coward]

Tell your users to use a decent browser instead of IE (Firefox, Mozilla, Opera, whatever). Let them handle their spyware infestations themselves.

Re:Stop using IE

[Anonymous Coward]

Tell your users to use a decent browser instead of IE (Firefox, Mozilla, Opera, whatever). Let them handle their spyware infestations themselves.

Not an option in almost all business environments. In fact, we're specifically prohibited from even suggesting to users that they use an alternative browser because it'd be a bigger support hassle for the desktop support group. SAP requires IE, WebEx requires IE, our timecard program requires IE, and now they want to migrate people from POP mail to using Exchange Server. I work for morons (the US government).

Re:Stop using IE

[Fortunato_NC]

That would be easy, except that we deliver many of our products in crowded, cutthroat markets to people who usually have little in the way of on-site or corporate tech help. We differentiate ourselves on service and ease-of-use, since we have no hope of competing with the industry "big boys" on straight price. In fact, we buy many of our products from the "big boys", repackage them, add our own unique data, and deliver the whole ball of wax in an easy-to-read format.

Simply telling them "that's not our fault" isn't going to cut it. If we're not providing the best experience possible, our customers can easily take their business to our competitors. And then, I'd be Asking Slashdot about where I could find a new job.

The fact is that most of the "low-end" computer users use MS products because they're the easiest to install - especially since they came preinstalled on the computer. Asking them to download and install software is beyond the capabilities of many of our users. I don't like it, but I have to play the cards I'm dealt - and right now those cards say that 90%+ of my customers are using IE. And unfortunately, when those customers are trying to use my product and spyware prevents them from doing so, it falls on me to fix it. If I don't, one of my competitors will.

Re:Stop using IE

[hdparm]

Webex actually has a Mozilla client - no problems doing Red Hat webcasts.

Re:Stop using IE

[dheltzel]

Asking them to download and install software is beyond the capabilities of many of our users.

Yet they seem to have no trouble at all installing all that spyware. Someone needs to create a one click install via a popup for Firefox, then you just put that popup on your site and wait until they inadvertently fix themselves.
Extra credit for the hacker if can wipe the existing spyware (the competition) and put the firefox path into all the shortcuts and registry keys that currently point to IE.

Imagine a "spyware" program that make the computer run better and safer than it was before.

Re:Stop using IE

[caseydk]

I've started the initiative within our web development group to make all of the applications Mozilla/Firefox compatible.

It's really not that tough most of the time, there are even dozens of guides that show the Javascript equivalent for things and all of that.

Of course, if you use ActiveX components, you're probably screwed.

Re:Stop using IE

[br0ck]

put the firefox path into all the shortcuts and registry keys that currently point to IE

And then the user won't be able to use Windows Update and they'll be worse off than they already are. Also, switching from IE wouldn't stop 99% of the crapware which mostly comes from people installing screensavers, P2P apps or those oh-so-cute little doggies that show up in the toolbars.

Solution:

[Lord Bitman]

Why not stop requiring your clients use IE to get support? That help?

remote shremote

[perlchild]

You think just because you're using a web browser tool, to remotely access a web browser, to remove vermin, is a design decision on the vermin designer's part?

Hate to break it to you, but when you've got a broken arm, you don't usually use that arm to set the bone.

Ever heard of non-browser based remote access? Like VNC, pcAnywhere, NetOP or remotely possible?

It has nothing to do with this vermin's author being clever, you're just using a not very optimal tool for your removal of that vermin.

Re:remote shremote

[Idealius]

Our tech support firm uses a variant of VNC and we've had no problems with our connections being disrupted by spyware/malware.

However, our Diagnostic software does use an IE-shell so oftentimes it doesn't work. I've been bugging our developers/superiors to change this for years now but they don't seem to get the picture so I can see where this guy is coming from.

Anyway, try to get them to switch to a variant of VNC, better if it is provided by a firm so they work out all of the details making it SUPER-easy for customers to connect. If your company refuses to change here's what you do: Per-customer ask your superior if you can see if VNC will get the job done where WebEx fails. Enough times of that and the point should get across.

nasty stuff

[returnoftheyeti]

I've seen windows rebooting as soon as any user logs in (even safe mode). I've seen the media player exploit and Media Player added to HKEY LOCAL MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENT VERSION\RUN. So that the adware reinstalls its self even after running AdAware. I've seen a giant - full screen Active Desktop Ad advertising spyware removal, it even covers the taskbar. I've seen files that cant be deleted from the command line in the recovery console. Windows is the most insecure thing I've ever seen. What I want to know is if someone smarter than me can make a Knoppix like disk, that will read NTFS, run Adaware, CW Shredder, and an online scan like housecall.trendmicro.com and fix all the problems. Barts PE works ok for the purpose, but Knoppix is faster and more flexible.

Re:nasty stuff

[daviddennis]

I still remember the particularly nasty spyware program that redirected searches to ZestyFind.com. When you go to google and type in a search phrase. the software automaticlaly pulls up a ZestyFind search window and does your search there.

I couldn't resist trying it out. I visited it using Safari on my Macintosh and typed in a bunch of queries. Needless to say, the results were pathetic. My conclusion was that it was the most useless search engine in the world.

As I remember, the removal instructions for the program were something like ten pages long. I managed to do it but it was horrible.

Mozilla's looking pretty good about now. I managed to outsource that part of my job, thank goodness, but I will be talking to the outsource firm about that when I next see them.

D

Re:nasty stuff

[magefile]

Knoppix can already read NTFS, so it could (in theory) use AdAware, CWShredder, etc, it just can't write (so it can detect, but not fix).

Depending on whether housecall.trendmicro.com is ActiveX or Java or whatever, it might work. Just wouldn't be able to fix anything.

There is no stable NTFS writing driver yet. So ... no, there is no such tool.

Re:a few steps to clear yourself of all problems

[Idealius]

Actually, many "Browser Hijackers" are coupled with their TSR spyware buddies so #4 would oftentimes backfire on you.

If anyone is familiar with HijackThis they'll know that Spyware/Malware comes with several modules placed in different portions of people's startup/browser configurations so if a piece of the spyware is removed from one area the other modules will replicate back to these areas sometimes with random filenames and a host of many other tricks that anyone familiar with "the game" will know.

Anyway, a lot of us are going to need replacements for HijackThis because the last version Merijn released is just that: the last version.

Safe mode

[QuantumRiff]

Reboot the PC into safe mode (with networking) load adaware, (or whatever) get its updated def files, and scan.

Doesn't work remotely, but seems to get pretty much all of them.. However, I have seen in the last month one or two running even in safe mode on Win2k. As soon as you reboot back, they re-install about 10 more. Thank god for norton ghost for those nasty ones.

On a side note, is there a huge list of IP's that these spamware come from, or report back to, or whatever? Sure would be handy to ban those IP's at the router..

Re:Safe mode

[lounger540]

I do tech support for an ISP, we don't officially support removing spyware but this is a sure fire way to get the net running again. The dreaded 98/ME that's another story requiring a full TCP/IP&Winsock reinstall. We charge for that great service. BTW: Winsockxpfix.exe works very well on XP systems too, that's the first thing i d/l from inside safe mode or sometimes if email works but not ie, well you see the picture.

Sounds nice but wouldn't work

[SmallFurryCreature]

He is very shy mentioning his business so lets presume it is not something big like a bank asking this. Just a tiny webshop trying to survive. Sure they could be courageos and suggest people install a real webbrowser instead of the bug collection known as IE but very few people are brave. It would be like a shop deciding to charge for parking (no return of parking fee with a purchase in the shop) and tell people to take the bus instead.

Making sure your web application works in most browsers is ofcourse sound advice but requires you to hire programmers and designers who know their business. You would be suprised to learn how many sites are setup by some frontpage kiddie. Or worse ASP kiddie. Ugh. They wouldn't know about cross-browser capabilitie if you hit them with the IE open-bug log.

And they would be spending all their time telling their client that IE is the default browser and that coding for the others is not worthwhile because if they don't they are out of a job. As to the market share of Mozilla and others. Supermarkets in holland are involved in a prize fight over 0.1% market shares. Denying browsers other then certain IE versions is like turning away full percentages of customers at the door. Doesn't make sense does it to fight for fractions and then refuse them entry.

Frankly there is no solution, if this tech manager has made sure that his web page can be accessed in every browser (if he hasn't he is beyond help anyway). He can't force his clients to switch browser (clients with a clue will have switched by now and no business can survive turning away the clueless braindead zombies that are still on IE), he can't stop spyware, he can't ask his clients to install something like vnc (or ensure that vnc isn't killed by spyware). He is screwed. Maybe he should sue MS for putting him out of business and costing jobs. Closed source IE costing jobs. Oh well, it made me laugh.

Re:Sounds nice but wouldn't work

[daviddennis]

It seems excessively negative to say that someone's beyond help if he hasn't ensured browser compatibility. When confronted with a potentially company-killing problem, I think he'd be willing to listen.

I actually talked to a customer today who I told should switch from IE, and she was receptive to it because the spyware was driving her bats. There's no question that you can't turn away people using IE, and you must ensure that your software is compatible with IE, but there's no reason in the world not to suggest that using other browsers would fix the problem. People who have the kind of severe spyware problems I've seen are likely to be receptive to that kind of pitch; they don't love IE, they just want to get things done. If that means download something new, I think they'd go for it.

D

Referrer Log Spamming?

[xmas2003]

While I don't have any direct evidence of browser hijacking causing this (yet), it would not surprise if the the scumbags of the world are using this approach. In brief, referrer log spamming is causing the spammer's site (typically an adult/porn one) to be listed as the referrer (via HTTP_REFERRER) with the hope that the target web site will publish their web logs and the spammer will benefit with a link and/or more traffic - read more about referrer log spamming here. And these guys are smart enough to have "zombie" PC's do all the work for them, so some sort of browser malware would be one approach they would try.

Netmeeting?

[mozingod]

Since I'm betting 99% of your users will be using Windows, why not just use netmeeting? Our techs have been using it for quite some time and never have a problem getting rid of spyware with it, since it's not browser based.

We must live in different worlds

[SmallFurryCreature]

I seen this problem before, the trick is hardly unknown. And yet there seems to be very little movement in people switching browsers. Sure a lot of noise is made about it here but just look at the statistics. How much did IE loose in a recent /. story? 1% wasn't it. OH WOOPIE. That was right after one of the biggest security hits in the history of computing (several regular sites being used to steal information and forward it to criminals) that was only stopped because it was to successfull and the receiving server was overloaded.

Of course I don't know if the guy with the problem has an IE only site, I was only speculating, but I have argued this point in the past with customers and employers and it rarely gets across. I found that the only way to reliable create a cross-browser site is if I am the person in control and then to just do it. Don't mention it, it doesn't cost any extra so no need for the customer ever to known his brand new site works with every graphical browser on every OS (well linux windows and OS-X) and can even be used with links. (lynx is harder)

I never ever had a customer or employer ask for cross-browser compitabilty let alone cross-platform.

My answer nowadays when people ask me about obvious MS caused spyware/trojans/virusses/bugs. "I don't know."

I used to recommend firebird or opera. And everytime I get repaid by having them complain to me that site X doesn't work anymore. Worse when I used to remove spyware they complained about their missing desktop toys. I only did that a couple of times. Waste of time.

Fat people don't listen to advice on diets, drunks don't listen to advice on not drinking, windows users don't listen to advice on security. If they did they wouldn't be fat drunk windows users.

BUT you could restore my faith in mankind, well womankind at least. Did your customer switch browser? I bet my cynisism against a shred of hope for the human race she didn't.

Re:We must live in different worlds

[daviddennis]

I'm not really in touch with my customers, so I don't know. (I do computer system design for the company, so I'm not on the leading edge of customer contact). But I do know she said she would bring it up at their meeting, which probably increases your cynicism tenfold :-).

I think there are a few problems worth noting. First, we tend to sound a bit fanatical about these issues, and most people tend to discount fanatical statements. Imagine what you would say if someone told you your car had a good chance of blowing up. You'd think they were out of their mind until you saw some exploding cars yourself.

Second, people are conditioned to feeling computers don't work right. Even when Windows has no viruses or spyware, it still slows down over time; the spyware just accelerates this. Since computers are getting faster all the time, that hides the affect of malware from view, and people think it's normal, and accept it.

So it's very likely that people don't understand the full impact of the problem. A few have to be injured by these scams and problems, and then others are likely to fall into place if you explain things properly. Understand that most people don't like change and just expect things to work.

If you understand that's how people think, then you're in a better position to try and convince them.

Hope that helps.

D

Bad Malware... Bad!

[sjs132]

I've actually had some malware that gets into the system like a tick...

Not only is it set in the Hkey\..\run, but I had one that stuck it's html based install into the windows active desktop folder, so once the computer was "clean" it reinstalled itself on reboot...

I've even seen a few where if you try and use AdAware and the first thing you need to do after downloading it onto a new system is to update the REF. file... but adaware said no updates... Finally, I had to use another system to get the updates, put them on a ftp site, and pull the updated REF file from the ftp (or shared drive would work) because the malware blocked the adaware updates!

What I think is funny/sick is that if the author(s) of this crappy malware type software actually spent as much time/effert into a GOOD PRODUCT as they put into making it's removal difficult (my.search, etc...) then they would probably have a great product and people would enjoy using it, and maybe even give them legit business... Not trick people into installing it because it sucks so badly!

Of course the simple answere would be:
boot Dos-format-reinstall (or reimage...)

Spyware

[Chop]

I just got finished fixing an employees home computer because WindowsME (ugh..) would show the splash screen and then reboot. Start the computer in safe mode? Nope, it would get to loading the desktop and then blue screen (windows protection error, please blah blah blah).
Anyways once I got the the pc running I ran Ad-aware and it found ~70 or so items and removed them, however I had to remove one file that Norton Anti-Virus detected, that ad-aware missed, in the windows folder and I noticed an explorer.001 file. I renamed .001 to .exe and rebooted, I re-ran ad-aware and it found an additional ~200 spyware items that it could not find the first time!

NOTE: Ad-aware does not check the c:\recycled folder for spyware, however Nortion Anti-virus does...

Chop

Bad client. No biscuit.

[mcmonkey]

If we're not providing the best experience possible, our customers can easily take their business to our competitors.

Which isn't always a bad thing.

There are customers who make you money, and there are customers who cost you money. It sounds this customer (the client requiring several WebEx sessions) is a money pit.

Now there are several good reasons to take a loss on a particular customer--large clients often grow from small clients, good clients come from referrals made by bad clients treated well, you don't want your support staff bailing on tough calls with the excuse, 'oh, this customer is losing us money' (that's a call for the bean counters, not the support or tech folks).

So, let's presume the company is losing money on such high-maintenance clients. Let's also presume the company is not willing to just let their business go. What do you do?

You do your homework! Boy Scouts' motto, Ounce of prevention, pound of cure, stich in time, and all that. Take a machine off the company network, do a standard client install, dial-up to the internet, and let the ad-ware be your guide. Install whatever it is you keep having to uninstall for your clients. Then document the steps to uninstall.

Rinse and repeat as needed. Go through the permutations of OSs, versions, and browsers to cover 95% of your client base.

Now, you still have clients with ad/spyware issues, and your support staff is still helping them out. For those that don't know but can learn, you put your documented cleaning routines on your web site or at least have a formatted email ready to go when the call comes in.

Those that can't follow the written directions, get the walk-through on the phone, but now 1) you don't sound like you're making up as you go along. Bad clients are more likely to become good clients when you have a solution on hand and ready to go. And 2) you can pass that job down the chain so you lose a little less money on that client.

Re:Bad client. No biscuit.

[Fortunato_NC]

I'd love to let go of some of our customers, but the nature of our product is facilitating a data exchange between customers, so letting customers go would diminish the value of our product. Plus, the customers who are "trouble" are also the same ones who are likely to have data to report to us.

We have a well developed set of internal procedures, but this particular piece of spy-crud was one we hadn't run across before. I do have a "field guide to American Spyware" that I distribute to all our sales reps and customer service folks, but some calls still end up back in the tech department. We'd rather be writing code than doing tech support, no doubt, but ultimately keeping the customers happy keeps our business growing - and it is growing - we've had record volume the last two months and are on pace to break records again this month.

I've noticed this tactic

[UnrefinedLayman]

What other nasty tactics are spyware authors using that you've noticed?

One particular tactic I've seen is that they integrate themselves with the host software and say that it's impossible to sell without selling both. They do this to try to push competitors out of business, then once they succeed they stop development of their software despite the fact that it's poorly written and full of security holes and causes massive problems.

It reminds me of something, but I can't remember what.

Listen Mode of VNC

[WoTG]

Most (all?) of the VNC derivatives inherited the VNC Client "Listen" mode and VNC Server side "Add Client" command. I've used these a couple times when the other person has (or I suspect has!) a NAT to get through.

Assuming that you can configure the forwarding on your personal network correctly (I think listen mode is port 5400, but look it up), you can set your workstation to "Listen" for new VNC connections from your client's computer. Your client initiates the connection from their VNC Server program - right click, yada, enter remote support IP address, yada, yada. This nicely solves most of the common networking/port forwarding issues. It's also a heck of a lot easier than stepping someone through logging into a router and setting up port forwarding. It's a good design choice that VNC uses a single port, or else this wouldn't work very well!

Dealing with malware infected customers

[jcasey]

Of course, it's spyware causing the pop-ups, and we recommend using a product like Ad-aware to take care of the issue

Adaware and other canned products will usually work fine for well known problems. For the latest threats you need someone who is skilled enough to research these problems, hunt them down, etc...

we take around two dozen to three dozen tech support calls from users each day. Many have something to do with pop-up ads making using our product nearly impossible

If the client is having a client side problem with popup ads, then why not charge for your service or refuse to troubleshoot the problem? I assume of course that your web server has not been compromised.

A few things to consider are:

1. is the end user using a "power user" or administrator account? If so I would suggest that they set up a regular local/domain user account - this account. The "power user" and administrator accounts give the end user the ability to modify the OS and registry big time. You really cannot blame the "evil empire" if people's pc's are getting hosed because they have administrative rights and are clicking in unsolicited links, OKing every popup window they see without reading them etc...

2. Educate your customers about using the web securely - if needed, contact their IT dept and explain the problem.

3. Most (Windows) people dont patch their machines - educate them about this - while the evil empire is usually slow in issuing patches, old patches are better than none at all.

One last thing - Windows/IE is targeted by crapware writers because of its popularity - this is why you do not see anywhere near as many *nix/mozilla infestations etc... Lately many sites have been advising people to dump ie and use mozilla instead. If mozilla grows in popularity as a result, expect to see malware targeted for this too.

Nastier Browser Hijacks

[fuzzybunny]

What's actually worrying me a lot more than spyware hijacks are active scripting tricks.

We've encountered a lot of these recently, using compromised IIS5.0 pages (innocuous sites)--you can read a high-level overview here.

People are hijacking sites and leaving them as-is, but appending malicious scripts. The sites are innocuous enough for average users to access regularly, but they take advantage of various IE exploits, such as Download.Ject and friends.

The MS patches for ADODB stuff aren't too widely used in a lot of outfits as they can break lots of bits and bobs of the help "system" in Outlook and other vaguely browser-related toys. I'm currently doing some security work for a large corporation, and am having a demon of a time just trying to figure out with application testing people which MS patches do exactly what, what they break, etc. Ah the joys of using high quality commercial software backed by a reputable vendor.

It's not just IE either; there've been a number of browser vulnerabilities released recently, albeit more to do with spoofing or redirects than actual remote code exploits. For Joe Average, though, the result will be nearly as serious (for example, if cnn.com prompts him to click 'yes' on a popup he may do it, when he would not for a random porno site.)

To be fair to Microsoft, their local security guys are being extremely cooperative and helpful just trying to sort out the mess.

So evaluate it!

[4of12]

In fact, we're specifically prohibited from even suggesting to users that they use an alternative browser because it'd be a bigger support hassle for the desktop support group.

Several points.

First, you are wise to standardize on a browser to help reduce support costs, supporting IE+Mozilla/Firefox will cost more than supporting IE, on the surface. But wait - there's more!

While it costs more for support techs to be trained in both browsers, what if the Mozilla/Firefox users put in fewer trouble ticket calls for support?

It might just be that the cost of supporting IE+Mozilla/Firefox could be less than supporting IE!

Which then leads naturally one to consider whether moving all users to Mozilla/Firefox might lead to even greater savings.

Especially if you consider long term savings from internal web site developers creating content that is more W3C standard and less specific to IE version du jour on Windows OS du jour, things which will surely change.

OK, so don't suggest to users they use a different browser. Instead, do what you're supposed to do: evaluate Mozilla/Firefox in your testbed development department and see for yourself, before you even consider deploying it, whether it makes sense from a business perspective. And ask yourself what the true overall costs are of IE in terms of spyware, adware, security lapses if proprietary information about your business were to leak out, and how much downtime and loss of productivity users have to endure if they have to turn off Javascript, etc.

Then, when you know the answers for your business, do a roll-out and tell people not to use anything but Mozilla/Firefox!

BTW, in my environment it turned out that Mozilla/Firefox supported a lot more web applications than most people expected. Sites would say they needed IE, but it turned out that Moz worked fine. In fact, one of the few web applications that broke under Moz/Firefox was one that relied upon a broken old DOM model for Javascript that origined back in the old Netscrape 3 days.

Look2Me Installed as event processor?

[Webmoth]

One of the nastier ones I've dealt with lodged itself as a subkey in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify. Of course you couldn't delete the file because it was in use. You couldn't kill it because it was a DLL loaded by the winlogon process, which you can't kill. Attempting to remove it from the registry just triggered it to put it right back.

Ended up booting to recovery console and deleting the file there so it wouldn't load, then was able to remove the entry from the registry.

A quick Google search reveals it as "Look2Me". More info here.