Monday, May 09, 2005 2:01 PM PT Posted by Andrew Brandt
Webroot, the company that makes the anti-spyware tool Spysweeper, released a report recently detailing their research into spyware. Titled "
State of Spyware Q1 2005," the report relates disturbing trends in spyware, based on statistics the company gathered during the first three months of the year.
The data comes from two sources: People who visited the company's Web site to perform
free SpyAudit spyware scans (1,044,000 people did this); and from a bot called Phileas, which spiders the sleazier corners of the Web looking for spyware on the sites that host it. Phileas is one of the tools the company uses to find new spyware quickly.
The state of spyware is very, very good--if you're a spyware maker. For the shady folks behind the most intrusive spyware, the money must roll in like Al Capone's bootleg liquor trade during prohibition. And if you're one of the millions of people who have spyware on your computer, you're left with the painful hangover.
Just how bad has it gotten? I've spent a few days dissecting the report, and pulled together some of the most salient statistics (if you're interested, you can
download the complete report). The report breaks out the results for corporate PCs and home PCs separately; I've listed mostly the home PC statistics, and stats derived from Phileas, in
the full blog entry.
Infections Rising
Some of the most startling stats come from the scans people performed. An infected computer has an average of 7.2 separate spyware applications--not individual files, but entire spyware ecosystems--on these machines.
The report provides stats that include cookies, but I find the stats that don't include cookies much more interesting. Whether you consider cookies intrusive or not, they're not exactly difficult to remove, and they're not even in the same class as keystroke loggers or Trojan horse programs.
Among home PC users, about 7 percent of scanned PCs--one in every 15--had keyloggers running on them; 19 percent of scanned PCs had some form of Trojan installed. Keyloggers can steal the passwords you use to log into your bank. A Trojan could commandeer your computer for almost any purpose: to steal information, distribute spam, or to overload the Web servers of online businesses as part of distributed denial-of-service attacks.
Business At Risk
In the corporate world, spyware infections may actually cause a bank, insurance company, or financial services company to fall out of compliance with important laws put in place to protect consumer information and privacy.
"Within the typical enterprise, from 3 to 12 percent of machines are infected with system monitors" such as keystroke loggers, the report says. The Sumitomo Mitsui bank in London very
nearly lost hundreds of millions of dollars last December, when a keystroke logger was found on an internal computer. The electronic theft plan was thwarted, but only at the last moment.
"It is imperative that auditors of financial institutions and their executives pose the question: 'Are we in compliance with
the Safeguards Rule of the Gramm-Leach-Bliley Act if there are malicious keystroke loggers on internal computers?'" the report asks.
Public Enemy #1: CoolWebSearch
Most companies take pride in making it to the top, and I'm sure the people behind the shadowy CoolWebSearch spyware are proud as well. They've made more than 100 versions of their spyware applications in the past year; SpyAudit scans found at least 17 different versions just in the first quarter of the year alone.
CoolWebSearch, which most anti-spyware folks refer to as CWS, wormed its way onto 8.2 percent of the scanned PCs in the study. They must be beaming with pride, because next worst offender, 180SearchAssistant, was found on only 2.2 percent of scanned PCs.
"CoolWebSearch dominates the adware business. Little is known of their business operations and CWS is guilty of using some of the most destructive methodologies in their pursuit of infecting and staying on as many machines as possible," the report says.
More Sites Hosting Spyware
Phileas is an automated tool that tracks down the URLs from which spyware, and spiders the entire Web sites looking for novel forms of spyware. The tool was launched last October.
The bot had a busy winter. In January alone it found 29,745 Web pages hosting spyware applications. In February, the number went up to 37,295--from bad to worse.
But the March statistics are downright scary: Phileas found 82,806 Web pages hosting this scumware.
Grim Predictions
The report has a final warning: For the rest of 2005, it looks like the problem of spyware is going to get a lot worse. Spyware has already been found that takes a scorched-earth apporach to infected PCs: If you dare try to remove the spyware, it blows away the Windows Registry, rendering the PC unbootable.
I get the distinct impression that the bad guys are starting to win this war.
Though the "bad guys" seem to be doing rather well lately, the main problem is that many computer users are either oblivious to the problem, or simply do not have the knowledge and tools necessary to remove spyware.
Even though major companies such as Microsoft are offering free programs to remove these threats, they fail to teach the common user how to prevent it from entering their system in the first place. There are many programs out there that do this, and little technical know-how is needed to use them.
Personally, I find that JavaCools Spywareblaster works great. After installing the program and tweaking minor IE settings, I have reduced the installation of spyware on my system to zero in a five-month period. Anyone can learn how to do this, really. It is just that methods such as this seem to stay in the dark for some unknown reason.
Another method of avoiding infection: make frequent images with e.g. Acronis true image. I myself have created 2 extra partitions on my hard drive. One contains a minimalistic clean and updated image of the C-partition. The other contains a recent complete image of the C-partition, which is created automatically once every week by Acronis TE, running in the background. When infected, i can always roll back to a clean state in less than 5 minutes. No worries mate!
Random Thought.
Developing a tool that combined a program like Phileas with a firewall application, and having it block sites which ID as positive as malware infectious, could prove usefull.
The application would run in the background and consume a couple of percent of bandwidth. Whenever malware was dicovered on a site, the application would offer the user the option to manually block, autoblock, or allow traffic from said site.
Perhaps the application could even re-scan sites every once in a while, to determine if otherwise legitimate sites had been disinfected, following an attack.
One thing is for sure.
Passive resistance isn't going to win this war...
I tend to use JavaCools Spyware Blaster in conjuction with Microsoft's Anti SpyWare and LavaSoft's Ad-Aware. Soon, it seems that we will be running anti-virus and anti spyware and mail scanners and have no room to run anything else in our computers to have fun anymore.
I can't help but wonder how much of this is the-sky-is-falling fear mongering. I just picked up a copy of SpySweeper and gave it a run... it found four harmless cookies that my wife hadn't yet deleted from her browser. Having an up to date virus scanner/firewall, running Netscape with Java disabled, and having already disabled Windows messenger may have already avoided many problems others have experienced, but I wonder if I shelled out forty beans for nothing. Granted, that's CDN dollars so... 3 bucks American or so.
SpySweeper has saved my bacon more than once. I've been running NIS2005 and found the firewall gets breached regularly on my system (the XPSP2 firewall works seems a lot lot better).
SpySweeper was worth every penny (?30 GBP about $55 us)
I have ran Spybot, Adware SE, and Microsoft Antispyware on my computer, and removed many adware and spyware threats, but they always come back. Maybe PC World could do an article on how to keep spyware off after using the anti spyware programs. By the way, Microsoft's Antispyware Beta really impressed me. Thanks, PC World!!
MOZILLA FIREFOX......
0 SPYWARE ... Spybot, adaware, microsoft anti, the list goes on and on... 0 entries
They always say download FREE and scan you Pc for spyware and delete it but it always come up with a get this key thing to make it work...Are there any free downloads that get rid of spyware?? Instead of getting you downloading and tell you you have 456 problems and spyware but we cant fix it until you buy this Bla Bla Bla....... I also think the programs you buy have spyware in them what do you think????? Money Money Money....just a way to get another dollar off some poor soul trying to get his old worn out pc to work for him or her....
FREE, (YES FREE) SPYWARE REMOVAL AND BLOCKING
Spybot search and destroy - removes ALL spyware
JavaCools Spyware Blaster - stops it coming back
what more do you need?
FIrst of all a simple update to service pack 2 (Windows XP) prevents the automatic downloading thru IE, assuming you won't run FireFox, but I still recommend you update anyways. I like MS-AS because it runs real-time scanners so once you clean it with a few anti-spyware programs it'll keep spyware from installing again. Lastly a firewall like ZoneLabs with all settings to high is great for keeping your information your own, just in case there's an infection. Common knowledge also works wonders, for example if it sounds too good to be true it is, if you've won money you haven't, if you can get an iPod, Laptop, etc you can't until you register to sites for spam (which of those spams have spyware). Basically use Google and don't go past page 3 :-).
"Maybe PC World could do an article on how to keep spyware off after using the anti spyware programs."
Stay away from the porno sites!
My ex-in-laws joined Very Wide Scale Organized Crime more than 30 years ago. Following a separation in 1997, I moved my Software/Engineering business to another office and it didn't take them long before the Organized Crime group broke into my network and work stations. Eventually they built software add-on's to the Window system(s) and everything I created from that point on, they owned.
Nothing commerically available worked. Since building my own computers, I changed to swapout drives, similar to what is used by the CIA and FBI. I added new drives once the original drive(s) used became contaminated hoping to preserve them for court. On my end, tackling the nightmare of reviewing and fixing them was a waist of energy since they were constantly in my systems. They were also breaking into my office very frequently and going through my office files. I was forced to stop opening my mail, letting the junk mail pile up to cause them frustration with finding anything. The swapout drive units were mouned in a special designed carrying case that I used to take them home each night. It eliminated them from having access when breaking in. Beleive me, security devices don't work as in the Chicago area, they're known as "The Outfit" for good reason. Eventually though reviewing their efforts would become necessary and that happened in mid 2002. Using a first release of Microsoft tools and assorted hacking tools taken off the Internet for Trojans, I was able to snoop around to learn what they were up to.
I went to a Microsoft sponsored tech posting site to see what others were learning about break-ins. After posting a few messages of what I've found, it didn't take the admin people long to kick me off. I guess at that time, telling tales of criminal behavior found in your Windows progam was a no no on a Microsoft sponsored site. I went back on with a new name later and again it didn't take them long to kick me off again. However, I did connect with a few company TI admins who offered information about "back door" abilities built within the Windows system.
Knowing more about my ex-in-laws ciminal life, I eventualy found my way to where many of the criminals collect. This is at a huge Mega church. There many of them approached me simply because they knew me and have known me for years without me knowing about it. It doesn't take long before you learn who is who even if they try like dogs to hide who they are.
What I did learn is that one of the church's top tech people has a Very High Security clearance as he is a Trained IT Tech Specialist for the US military. I learned they are trained in how to gain access to Windows through "back door" methods which also work on other Internet and Network systems as well as phones and Cell systems. I met a pretty lady who later turned out to be his ex-wife! To my amazement, this guy breaks into her office machine using the "Back Door" methods where she daily works. She of course is doesn't know what's happening.
My experience with watching, testing their methods and having reviewed their versions of rebuild in my system drives gave me an advantage to know how to understand when they are inside. All of this was reported to the Count Police in frequent faxed letters, but it appears it's fallen on deft ears. But, I'm still holding on to all the evidence as my whole office was ruined.
What's been learned about these people is staggering. Their involved in many criminal things way beyond simple "breaking into your systems". This involves A) International Drug Distribution, B) Very Wide Scale Political Corruption and C) Very Wide Scale Fraud. Fraud in general with criminals requires a high degree of snooping. In their case, they rule the Internet and all electronic devices. I had to get rid of my cell phone early on because they had cloned it with many units and my monthly bill was enormous.
A few things found within my office drives::
A) Redefinition of the drive geometry to establish a hidden additional drive. The original drive geometry would show it's original spec, but it was wrong. When defragging your drive, the process would stop near end and crash showing the second drive area where other data existed but was untouched. It wasn't until I piggy-backed one of my drives to a main drive that the add-on drive showed itself.
B) This is before popup windows hit us by storm, but they built in feedback pinging when you envoked certain functions in your Windows system. They wanted to be notified each time you were accessing something they felt was important in your system.
C) Trojans were embedded inside my Windows system. They originally used email to place them. Following that, they came in and implanted their software in my systems. The most difficult one for them seemed to be my NT4.0 system.
D) Adding phantom email names inside my email system duplicated outgoing email without me knowing. As time went on, they seem to grow with their expertise. Then they started to break into Hotmail and other servers on the Internet.
E) This was interesting -- They change the function of my Word program. This allowed them to have control over many other areas within my Windows system, another story. They would take small segmented parts of the file I was writing and squirted them over the Internet to a waiting IP address after it was first placed in the hidden hard drive area. Using Word became a huge problem as the more functionality they added to it, the slower and more sluggish the whole system became. Your system is really running in duplicate slowing down the resulting performance speed. I started reviewing my generated files and learned many things.
F) I tried limiting one computer to the Internet and keeping it off my Network. Isolating the others hopefully kept the criminals out of my network and printing services. They would change the printers to make them use more ink. I have a wireless connection straight to the server but purposely didn't change the hard IRQ setting. This way the server software showed a connection but it wouldn't function. the purpose was to show the wireless connection worked so it would signal me when someone was trying to break in.
G) The only computer used on the interent was sometimes needed to be placed on my network for printing. Of course I physically disconnected the Internet first. But they placed software inside my computer to look for the network. Then the computer would grab the files it wanted from the network and again place it in the hidden drive waiting for when it was back on the Internet.
H) There is a great deal more but that's for another time...You have a taste of what I went through above. After having system mother boards, peripherals blown up inclulding a large flat screen, I'm at the library for everything I want to do.
This is part of a huge criminal organization centered in Illinois. The latest news about political corruption is part of this they are part of a huge "Laundromat". My ex-in-laws are one of a small army of property developers who launder money for the three criminal groups outlined above. They move the money straight into property using Mortgage fraud techniques. Besides the technical stuff above, they're well experienced in many other crimes including attempted murder and murder.
So, "How Far Does Spyware Reach"? If you're not up on what's happening, They'll rob you blind! Just ask me, I know better than most! If you look around at some of the Politcal Corruption Blogs, you might read some other parts of my story.
Deep Throat II
Spyware Blaster works great. It only ever missed one thing in my case (a really nasty one that I couldn't uninstall). But to be fair, from what I learned from web posts, the little bugger had only popped up within a couple days of me getting it and no one had figured out how to remove it (I'm not sure anyone has yet, but I stopped looking).
Fortunately I have a separate OS partition (which all people should have these days) and I had put off upgrading to WinXP and installing a new HDD for a while.
I really don't care about spyware that comes with legitimate programs, that stuff doesn't kill my machine or steal personal info and I can easily remove it at any time. Malware on the otherhand, I hate with a passion. If I ever find one of the creeps that makes the stuff, I'll tell as many cops as I can find that have a computer. >:)
Re: Deep Throat II
WTF!?, that has nothing to do with the topic. That's just hacking, pure and simple. No real spyware involved.
As much as I understand that some of that is possible, save the giant, whiney, conspiracy theory rant posts for your personal blog.
Generally, I don't reply to those demonstrating an inability to maintain self control.
It may be inspiring and rewarding to learn more about what's happening outside a computer room. My partial experience (posted above) along with the evidence speaks volumes of connections with "Internet Sleaze - Conspiracy Theories - Criminal Activities". Actually, the so called Conspiracy Theory isn't really a Theory but well known fact that I'm aware of. Don't forget, I have more than 30 years experience dealing with Organized Crime!
That really was my point, but sometimes it's missed OR there's a serious intention to try to stop me from getting the word out. To understand this more, it would require learning more about the following:
"Internet Sleaze" - My term, comes from Political Sleaze as its using technology for the same thing. Using the Internet to "track" those who are reading "sensitive" news reports and focus on "hacking" into their computers for purposes of stealing information on them, disrupt their system to stop them and feed other criminals with targeted information for further criminal activities.
"Conspiracy Theories" - Current News events including factual Indictments speaks volumes questioning an existence of a Conspiracy Theory. Again, with over 30 years experience with Organized Crime, this isn't a theory, its fact.
"Criminal Activities" - In Chicago, Mayor Daley's administration plus others (and in other states too) are wallowing in Corruption. Some of this pertains to "Pay to Play". However, this problem goes up and I mean all the way up. When I was married, they bragged that President Clinton was involved! So maybe one might want to research about Bush, Rove and Abramoff? Don't forget about the recent Indictments with Abramoff and the suspicious murder surrounding Abramoff's Casino business dealings? Then think for a moment about Clintons 30+ deaths or murders surrounding his administration too. While married I was told those deaths were murder. I was also told that Daley owns property in what's called a "Laundromat" made up of a small army of Real Estate Developers (my ex-in-laws are one of them) who launder criminal money for Political Corruption. Oh yes, I also know about other murders as well and like the others listed above, no one ever got caught! So YES, there is a connection, especially today with using the Internet to "Sleaze-ball" your way into someone's computer I have the hard drives which have IP addresses and a lot more to show who and what they were doing. And there isn't ANY commercial software out there that will touch it! You have to litterly dig it out with hacking tools, that's if you have the time.
Of course part of the Internet problem is hacking, but NOT all of it! The part everyone needs to be concerned with is the part that is run by Organized Crime. Their intent is to worm into every area that provides information for purposes of stealing money. OR they want to worm into any official's computer to learn what they talk about. Learning what an appointed board member(s) might want to do when Organized Crime wants something else is invaluable. How about, State Gaming Boards. They vote on Gambling Licenses which cost millions. It would be important to learn how they feel about a particular group who seeks owning a license. Plus City or Town Trustee's, learning how they feel about a particular situation is important to someone who wants them to vote for their interests.
My ex-in-laws are Real Estate Developers and they also launder money for Very Wide Scale Political Corruption, International Drug Distribution and Wide Scale Fraud. The connected criminals involved with them use the Internet for learning about others as in my description of Internet Sleaze.
Finally, there are those who have opinions and those who are part of the Internet Sleaze. It's really about behavior when you come down to it. When raising children, when they're bad and confronted, they immediately try to distract your focus and point you in another direction. It boils down to this one point, when you're involved in something which can put you at risk, you're expected to throw a fit otherwise you shouldn't even care.
Deep Throat II
From one of the idiots out there who is just coming to terms with all this. a quick question.
Both my mother in law's and my brothers PC's keep coming up with recomendation to go to various sites to download anti spyware, registra updates etc. etc. From what I can tell they appear to be the same ones and it also appears that they only come up when IE is running. Also they are both using the old fashioned dial up.
I on the other hand have ADSL and have never come up with this problem on any of my 15 office PC or 4 PC at home. Any ideas what it is they have and also how I get rid of it.
I have installed Lavasoft Adaware and cleaned their machines, and also Norton Antivirus, but basically am not sure where to go from there...Javacool spywareblaster seems to be a possability?
Deep Throat II:
Just because you are paranoid, doesn't mean they aren't really after you.