OT: anti-malware progs ineffective

Jan 28, 2005 110 Replies

wrote in message news: snipped-for-privacy@news.netaccess.co.nz...

Pleased to know it's actually possible to get rid of the f***ing thing. I've just downloaded those 3 software items and will give 'em a try. What I'm ill at ease with, is paying for anti-virus software. The cynical part of me is suspecting I'd then be actively propping up the whole nightmare.

Past day or so I've been using Firefox as the browser which has been no problem. But the major scumware component is still present somewhere in windows and I'm seeing the Internet-Explorer browser opening up over the top of Firefox (or this outlook express) every 6 minutes or so and advertising crap. Even has the cheek to rattle my a: floppy disc drive and then put up an antivrus advert.

Even have my own f***ing bank advertising with coolWWW, so am having to pursue with vigour and extreme predjudice, the bank's marketing people. Each hour megabytes of scumware programmes are self installing all over the hard disc, along with scum p*rn and ringtone icons littered everywhere. They'll continously alter the 'host.TXT' file, the start up prog list, the active running progs,the home page, the IE addons and numerous registry entries. In addition to this, the scumware also enjoys auto-altering certain "permissions" on IE (an oxymoron if ever I saw one) so I can't close it down or get at the 'options tab etc. Have now to run another prog called 'permissions' to reset a number of IE check boxes before I can even start removing the rubbish that's come in. Even tried to remove IE itself

formatting link
but this prog is worthless. I tried reinstalling windows, but no joy as it assumes existing files are OK. There's only a couple of self supporting virus/trojan files at work but windows is littered across 1000's of files so manually finding 'em is damned near impossible. Can't even just delete all the windows files as any normal software install will bung masses of unknown .exes, .dlls, junk, etc, in among the windows stuff. Jesus H Christ, windows is a f***ing mess. 'Spybot', 'miniremoval', 'CWshredder', 'Hijackthis', 'Win patrolExplorer' (and about 4 others!), have proved useless and I just hope that your suggestions will work for me. If not, then I'm looking to manually dismantle as much of Internet Explorer as I can without unduly crippling windows (or Firefox).

10/10 for whoever wrote this POS. I just wish the major software companies would make their products as reliable.

regards john

Not well enough for me to use it for HTML. (Mozilla Composer)

If there are no graphics (only formatted text), I like .RTF (smaller than .DOC; no version issues). RTFs can even be read with Wordpad (which opens much faster), and unlike Wordpad, OOo saves the margin formatting in RTFs.

I use OpenOffice,

formatting link
, it saves all documents in a zip-compressed XML format.

True, but taken as a whole, it still looks a bit like an oxymoron.

Then there's duct tape ... (Garrison Keillor)

ah, apparently have a bit to learn about linux. Shared libraries are dlls by a different name. Daemons are independent processes, that can load shared libraries if they so choose. The concepts, however, are almost, but not quite completely dissimilar.

It's obvious. One works to get the biggest payoff. That's why applications and support for new hardware come out first for windows, and then grudgingly are ported to mac os, and then finally, to linux. This is common sense.

Tell me what the number of desktop machines is in relation to the number of server machines. Quick now. 1000 to 1? 10,000 to 1?

If you are going to bother to learn a system to hack it, why not go for one that is on 100 or 1000 times more desktops, and has a reputation for terrible security as well?

Another argument for this particular point is the lack of viruses on the mac. The mac has had from 5 to 15% of the US market for the last 20 years. I know for a fact that the macintosh, at least up to OS9, was incredibly easy to write viruses for, due to their crappy, non-existent security. The resource fork scheme was horrifying from this point of view. Any program could write any file on the system, and easily patch themselves into any application with a couple of os calls. There was no memory protection, even for system level data. It was freely avilable for anybody with a bit of incentive to hack. Microsoft and netscape wrote browsers for the mac, and the apps were microsoft apps for the most part. Thus, the software was equally lousy as on Windows. However, they never had 5 to 10% of the viruses, spyware, etc. Not by a long shot.

Regards, Robert Monsen "Your Highness, I have no need of this hypothesis." - Pierre Laplace (1749-1827), to Napoleon, on why his works on celestial mechanics make no mention of God.

Ah, I thought you did something more valuable than write HTML. I thought that was simply an example.

Well, since I'm not foolish enough to use either WinME, or Win98, I wouldn't have guessed they were quite *that* retarded. I do have to come up with a Win95 or Win98 system diskette to update the BIOS on my motherboard, which may be a small problem...

Dump it and get a real OS. Win2K, if you must.

So dump Win9x! It'll make your life so much more pleasant.

Keith

of

top

advertising

up

Each

hard

They'll

down

but

but

damned

normal

Explorer

companies

Same here Jim. I'm very pleased. Although I emptied the IE cache store every week, there were usually about

50-100 'tracking cookies' to be found in it.

Also, looks like 'Ad-Aware SE Personal' has managed to kill 'CoolWWW' !!!. It wasn't just-a-couple of files like I thought, but 39 separate CoolWWW

*.DLLs files, 58 registry changes, plus 44 other *.exe and *.DLL scumwares belonging to 5 other sales outfits. Big problem was a counterfeit MStask.exe running as if normal. It took 3 locks ups and 2 crashes before Ad-Aware winkled them all out. All this grief is the result of my visiting a p*rn site two weeks ago. Let one in and they hold the door open for the rest.

I'll give it a couple of days and hope I can thank Andrew for the recommend. regards john

Give it a try. Microsoft's web site refuses to let you download them.

-- kensmith@rahul.net forging knowledge

In article , Mark Jones wrote: [...]

It also writes fair HTML and *.doc files. It can also nearly read DXF format files. Sometimes it works sometimes it doesn't but it is nice to be able to directly import my drafting exports.

-- kensmith@rahul.net forging knowledge

In article , wrote: [....]

Thanks, I've go some reading to do.

-- kensmith@rahul.net forging knowledge

In article , keith wrote: [...]

I make *.DXF drafing exchange files, *.A51 8051 source code, *.VHD VHDL source code., *.SCH schematics and a whole bunch more. They all can't carry viruses.

I also make *.EXE files from the source code, but these can be recreated so I only need to save the source.

I used myself as the example and not my wife because her computer serves almost entirely as a machine for playing games. It wouldn't be so bad if I could just do a clean re-install by poping the CD in and walking away.

[...]

Windows really is that bad.

I run SUSE-Linux on the computer I'm using right now. My wife owns the WinME and doesn't want to switch to Linux. We don't own Win2K.

If the only fault there is with my wife is that she won't switch to Linux, I don't think I should complain.

-- kensmith@rahul.net forging knowledge

John,

I've only just gotten rid of it myself.

Spybot was useless but didn't crash on my machine. Ad-Aware SE Personal combined with the trial version of Spy Sweeper along with the new AVG Free and all with the latest definitions finally managed to do it.

The Spyware/Adware/Malware/Spam E-Mail just seems to be getting worse. I'm becomming more and more reluctant to go online because of the immense frustration at trying to get rid of them afterwards.

Good luck.

Andrew.

The text this gets you to is for downloading on a Windows machine. It seems to require activeX be enabled.

-- kensmith@rahul.net forging knowledge

Can now confirm, Yes!, it was the AD-aware SE personal that gone and dun the CoolWWWsearch fu**er!!!!!!. Thanks for the suggestions.

The glorious feature of these newsgroups is the time and effort saved simply by hearing from someone else who's been there and got the T shirt. In this case I could easily have spent the next 10-14 days pursuing the problem using more inferior software.

I'll look forward running the other 2 prog's to see if they can catch even more. What surprised me though, was the quantum leap in ability between the "well regarded" but markedly inferior progs I'd been using and the "well regarded" but superior progs that actually did the job.

(Of course, as is my lot in life, I'm usually the last to find these things out :-)

regards john

I write HTML from OpenOffice but I would net suggest it for someone developing web pages. I am mostly using it as part of converting *.TXT files to something else that others will know what to do with.

I like the RTF idea but it conflicts with the spirit of my suggestion. I suggested *.TXT partly so that the results will be ugly to look at.

RTF can produce fairly good looking documents without the security issues that come with MS-Word.

-- kensmith@rahul.net forging knowledge

....more like a moth trying to get warm by the fire.

Keith

If you have root access, anything is possible. Preventing root access has always been the problem with unix systems. Replacing kernel modules would be trivial with root access.

The real problem with linux, however, is the complexity of what runs in the kernel. The number of developers whose hands are in there is enormous, when you consider networking, file systems, scheduler, and devices. Any of these subsystems could have a (possibly unrecognized) backdoor that could be exploited. This leads to allowing users root access, leanding to security holes. A microkernel is far less likely to allow this sort of exploit.

I spent time helping to secure a linux network appliance, and applications that act as servers usually require root privs. That means they are susceptible to inadvertently allowing root access. You might be suprised at how easy this sort of problem is to overlook. Again, this is a big problem with unix. You might recall the issues that sendmail and bind have had. Most of these are user setup problems, as the developers are quick to point out, but that doesn't really help if your system is compromised. There are so many knobs on a typical linux app that people tend to tweak the knobs just to see what's up. Disaster waiting to happen. Often, they don't even need user access to use your system for no good.

Once the hacker gets root access, and installs a root kit, you will never know he is there, even while you are using the system. You think you own the machine, but you really don't... It could be sending spam, being used as a platform for denial of service attacks, etc. There was a raft of problems in the last few years with spammers using improperly installed sendmails as relays. They use it till your ISP turns off your account, or you get blacklisted, in which case your email is then forever dropped at most major hubs.

However, the spyware sickos are a whole different breed. They don't need to hack the kernel on Windows. They trick users into installing malicious applications, and later start up these malicious applications which then monitor what's going on. There is nothing stopping somebody from doing this with linux as well. User programs can almost always write into their own bins, modify their startup files, edit their .kde or .gnome files, etc. They can read any file the user owns, monitor network traffic, etc.

The fact that it takes somebody who knows a bit to set up and maintain a linux box means that most linux users are probably somewhat less oblivious to the risks, and secure their boxes more carefully, and are thus less prone to problems. Let's see what happens when everybody's mother is running linux, and the support for the 200 million users is Linus Torvolds and 100 teenage undergrads.

The hope that linux will help in any way with spyware or adware is just more wishful thinking.

Regards, Robert Monsen "Your Highness, I have no need of this hypothesis." - Pierre Laplace (1749-1827), to Napoleon, on why his works on celestial mechanics make no mention of God.

In article , Pig Bladder wrote: [...]

You've got it wrong. Its the challenge of trying to make Windows nearly good as Linux that is attacting us. It is a little like trying to figure out the steps required to convert a steam tractor to make it useful for space travel.

-- kensmith@rahul.net forging knowledge

Not sure what you mean there, Robert. Are you referring to loadable kernel modules? That's all I can imagine you mean, since the kernel does not use shared libraries.

It would be quite a feat to insinuate malicious kernel modules, run depmod, then get modprobe to load them.

Then there's duct tape ... (Garrison Keillor)

Ah. This leads to one of my favorite topics: Microsoft's business model (which is upside-down).[1] You give them money up front for software (and they tell you what you can't do with it) then, when you have problems, often they are no help (unless you are MegaCorp with megabux).

The new paradigm is: Get the software free and pay e.g. GeekSquad when you have problems.

[1] At this point, it would be easy to get off on a tangent about the RIAA's business model vs. that of The Grateful Dead. Y'know: *Bring your recorder to the concert

--we make our $$ performing*.

Join the Discussion

Have something to add? Share your thoughts — no account required.

Didn't find your answer?

Ask the community — no account required