Slashdot Mirror
Spyware Floods in Through BitTorrent
solareagle writes "Public peer-to-peer networks have always been associated with adware program distributions, but BitTorrent, the program created by Bram Cohen to offer a new approach to sharing digital files, has managed to avoid the stigma. Not any more, anti-spyware advocates warn. According to Chris Boyd, a renowned security researcher who runs the VitalSecurity.org nonprofit resource center, the warm and fuzzy world of BitTorrent has been invaded by a massive software distribution campaign linked to New York-based adware purveyor Direct Revenue LLC."
We had to see this one coming. The spyware/adware folks are getting good at putting their "product" everywhere. It was only a matter of time before bittorrent reached critical mass and became a good target.
Finance tutorials and more! Understandfinance
It's not bittorrent that has the spyware, it's crappy spyware-infested clients. A client can contain other malicious code obviously (as seen in Kazaa, etc). Bittorrent itself is just a file type with special download methods. How you download it is up to you. If you don't use a crappy client, and don't run .exe files that you don't remember downloading, you're all set, jesus-h-christ, how many times does this have to be re-hashed.
-Jesse
Nothing says "unprofessional job" like wrinkles in your duct tape.
"Many top Bit Torrent sites such as SuprNova, Lokitorren and Bit Tower support millions of downloads daily"
And it only affects the btdownloadgui client, not the torrents themselves. Seems like non-news for people who use Azureus (or any of a number of quality clients, really).
When you're afraid to download music illegally in your own home, then the terrorists have won!
is that Bittorrent is really not the problem here. The adware isn't coming from a Bittorrent client, or being 'snuck in' over the protocol instead of or alongside a file you're downloading, it's coming in the file you're downloading! It's the same way adware gets into a host of other files we've been told to be careful of, like email attachments.
Bittorrent is simply used to add a bit more hype and FUD to the same old same-o.
More info from Vitual Security here and here.
Azureus + the Safepeer/PeerGuardian plugin (http://azureus.sourceforge.net/plugin_details.php ?plugin=safepeer) specifically blocks much nasty stuff out.
Be smart when you engage in dangerous activity. No glove, no love.
My roomate has had Aurora installed on his system for about 2 weeks now, I just haven't had the time to get around to removing it. I've done some quick searches to find information about the removal of Aurora, and it looks like removal involves a lot of tedious work... Doea anyone know of some software that'll remove it so I don't have to do it manually? So far Microsoft Anti Spyware has found it, but not removed it. AdAware hasn't removed it. Spybot Search & Destroy hasn't removed it. AVG Antivirus hasn't removed it. Just a word of advice to others who may be "infected": Direct Revenue has a removal tool on their site. I wouldn't suggest using it after reading a number of posts on forums (computing.net)
Why is it still safer? Open Source / Freeware (no spyware) clients.
.exe or some such program. One program I did download asked me to install third party software... I quicky realized that the EULA was of a spyware company, asking me to waive all rights to privacy, and did not belong to the developing company.
Plus, even if you DO download a file that ends up being spyware, when you download the torrent from most sites, they allow you to give comments like "I FOUND SIXTEEN HUNDREN VIRUSES IN THIS TORRENT", and although some people lie, if people are complaining about stuff like that, you can usually guess that it is a spyware infested torrent.
Of course, even this only matters when you download something containing an
After reading the article, it seems that the client itself is not the vehicle for infection - it's tainted files. Which client you use is irrelevant.
=Smidge=
reboot in safe mode with command prompt and delete the file.
If you are uncomfortable with DOS then use WindowsKey+E to open an explorer window.
Wow, sent an e-mail as suggested when clicking on "use classic" banner, and got a fast response that addressed my msg
These spyware programs that use the Registry to spawn renamed multiple copies of the spyware programs are a nightmare to get rid of.
I had a client last night with the Backdoor.Agent.BA trojan which is incredibly hard to get rid of. There are plenty of varied instructions on the Net on how to detect it and find it, but the problem is deleting the DLL file. You can't delete it from the command line or from Windows - in Safe Mode or not (and of course if it's an NTFS system, DOS can't touch it - Linux with the Captive utility might be able to). Not only that, but the DLL does not EXIST in Safe Mode! It can ONLY be created and accessible during a normal boot - by which time you're screwed.
The only way to delete it is to get a program called KillBox which will prompt for the filename, set itself to run on reboot before Windows is fully loaded, and then reboot Windows, deleting the file before Windows can lock it down.
You also have to get into the Registry and delete a key which has an invisible value which is what causes it to recreate itself.
I get my hands on the asshole who wrote this thing, he's gonna need medical life support for the rest of his life.
Richard Steven Hack - This sig is TOO GODDAMN SHORT TO DO ANYTHING USEFUL WITH! MORONS!
http://www.marketingmetrixgroup.com/ Ha that didn't take long.
Don't bother calling their office. Don't bother emailing them for help. And no matter what you do, don't run their uninstall utility myPCtuneup - it simply installs more crap.
Direct Revenue LLC is VC backed. Please, complain to the right guy.
Insite Venture Partners
Mr. Deven Parekh
His desk number is 212-230-9216 and his real email address is dparekh@insightpartners.com
May we waste as much of his time as he has of ours. How many people here spend hours "helping" their non-tech friends remove this crap . . .
The story says that torrent files are being bundled with adware programs, not BitTorrent clients.
How can this happen? Again RTFA.
If seeing is believing, look at this link from the news story:
Vitalsecurity
You'll see a RAR--not an exe--for an episode of Family Guy. When you try to open it, you're faced with a licensing annoucement, which if you agree to it, will pack your Windows system full of spyware.
Would this fool someone who knew what they were doing? No.
Would it fool a lot of users just looking for a cheap thrill? Oh yeah.
Does this make it a real problem--as the article suggests--I certainly think so.
Maybe not for me, maybe not for you, but for those millions of clueless users, yes, oh yes it does.
Steven
Although this is not a tech support forum...
A simple solution is to remove execute permissions on the file. I've run across malware that doesn't like you accessing the permissions dialog, so I typically use the command line CACLS.exe. Then I reboot, get a few errors since it is trying to execute a file that no account has permission to access. Now you can restore the delete permission and remove the file since it's not locked.
If I drive fast enough at the red light, it'll appear green.
how an executable could be run if you downloaded a nonexecutable (e.g., a .mov or .avi file) .mov or .avi file for the user to watch. I'm not sure if windows even looks at the file extention anymore
It can't but that's not what's happening, people are used to downloading ZIP files, which are often self-extracting; so double click the file, which is executable i.e. self-extracting, the custom extractor, throw up a alert-box says extracting "suzie does donkies" checkbox "I agree to terms" and ok. users never actually reads the terms which says something like I agree to install software, give my first born son ect. then the extractor installs the spyware, and then extract the
Apocalypse Cancelled, Sorry, No Ticket Refunds
If you can't delete it from safe mode, boot up with your windows CD and delete it from the recovery console.
Do a google search for a program called dellater.exe - it does just what it says. It marks a file for deletion at the next reboot. Command line utility. Simple and it works.
--- Ãther SPOON!
I guess no one has suggested this yet: use Process Explorer and search for any open handles to the file. Once all the handles are closed, you can delete it safely because it won't be in use.
This technique is a little shaky because those running programs that have handles to the DLL might be a little upset that it the handle is suddenly closed, but just reboot after you complete the process if something breaks or crashes.
-fren
"Where are we going, and why am I in this handbasket?"
This is a well known bug in Windows 2000. The problem is that explorer leaves filehandles open when it shouldn't. Try the following:
1) create a directory 'foo'
2) create a file in 'foo' called bar.txt
3) delete bar.txt with explorer
4) move up the directory tree and try to delete 'foo'.
You won't be able to delete 'foo' because explorer has an open filehandle to it which it will NEVER close.
This bug has existed throughout all service patches of windows 2000. Microsoft's solution: Install XP. Bastards.
DOS can delete them if you feel like paying for the NTFS dos drivers which support both read and write. (read is free).
m l#win32 that gives steps for doing this.
Another option is to us a knoppix disk and boot to Linux. There is an article at http://www.planetfez.net/engl223/archive/page2.ht
Find coupons in Greeley
Looks like the company responsible for pushing the adware has already got some negative attention: http://www.marketingmetrixgroup.com/ (hacked)
What the hell's a "gewie?"
It's worse. .exe. Another lovely feature of Windows is that you can assign any arbitrary icon to a file. Like the llovely Winamp llama. So all the bastards need is to rename infect.exe to Britney_Spears-Fuck_Me_Harder.mp3.exe, give it a common mp3 icon, add it to RAR (BT doesn't hide file extensions), then seed it. Your average Windows moron will right-click on the RAR, pick "unpack here", then double-click the icon.
You see, Windows has this lovely feature known as "Hide file extensions for known file types". And guess what? One of these extensions is
Easy like that.
45 5F E1 04 22 CA 29 C4 93 3F 95 05 2B 79 2A B2
One of many methods to remove files:
I had a bunch of remote boxes that I needed to get rid of those pesky "won't go away" trojans.
Fortunately the box had cygnus
I just kicked off
while [ 1 ]
do
rm filename
done
Then I rebooted the box and the file was gone for good.
-Nuke the moon
I've always used a VMware machine for P2P software. I take a snapshot before installing any new app, and if it contains spyware/adware...just halt the OS and roll back....and it's all gone again.
Unfortunately, it seems as though alot of the vids are coming down as .exes (or rars containing exes). Supposedly, the .exes are just self extracting archives but I don't trust them, I generally send the .exe into winrar. If it is just an archive, winrar can extract it. If winrar can't open it I assume it is a trojan, delete it and immediately stop seeding.
YMMV
08048000-080b8000 r-xp 00000000 03:0a 171032
080b8000-080be000 rw-p 0006f000 03:0a 171032
What's different is that Windows has a "delete" function while Unix has an "unlink" function. In Unix, a file doesn't get truly deleted until all references to it are gone, including open file handles. Try creating a 2GB file in /tmp, writing a simple program to open it and sleep forever, then deleting it with rm. You won't get your space back until the sleeping process exits.
You can also usually crash a running process pretty easily by scribbling over its executable, proving that it's memory-mapped.
To me this makes much more sense than the Microsoft B&D method, which as you mentioned leads to a ton of "Please reboot because I couldn't touch this file" messages. If it worked like Unix, you could simply unlink the old file and (optionally) put a new one in its place without affecting currently running processes. When those processes restarted, they would use the new files.
Of course, spyware and virus authors must love the way MS does it.
The difference is that unix file-model is a lot more flexible than the model in dos (now largely inherited by Windows)
In Windows, a "file" is a collection of bytes with one name.
In Unix, a "file" is a collection of bytes with zero or more names.
Simply put, unix uses reference-counting, the actual blocks on disk are only freed when the last reference is gone. Thus it's unproblematic to allow deletion of an open file -- the deletion only affects the directory formerly holding a reference to the file, the file still exists because the process has a handle on it and the reference-count is thus not null.
You can try it out for yourself trivially:
The disadvantages of the unix-aproach you talk about don't exist, they are purely imagined and purely the result of you failing to grasp the unix file-semantics.