Where do you get your spyware/malware?

Quote:

---

Originally posted by poppy4
however, the point that Nix and Goose are making with not using firewalls, and are not spending half of their life just going after the 'nasties, proves to me that most of MSoft's advancements in some programs opens up holes, and for my usage, I personally don't need these updates and perhaps (?) am safer??.....or maybe I'm just technically 'challenged'....(read 'ignorant'):rolleyes: .....another 2cent rant....:D
poppy

---

My 98SE rig has all the updates, Sygate firewall, etrust and the google toolbar which does have a popup stopper in it which has stopped 262 popups in 2 1/2 months.
AdAware, Spybot nor pest patrol have not found anything when run since long before I decided to format and do a clean install after 2 1/2 to 3 years.

Be we as compute users must take control and realize we are responsible for what happens when we do something. Whether it is clicking the Submit Reply here in vdr or clicking a link anywhere.

Now the old test XP SP2 is still clean.
Seems stuff folks want to disable what is added to help them in the OS :confused:

Coming strictly from a user's standpoint, ( one who is not necessarily technically oriented), I think there is an overwhelming need for a NEW user's education effort .......I was lucky to find this forum early on, and have had few problems because of the education afforded here.......but human nature is such, that people get a pc and rush head on to plugging it in and online, without a thought towards the consequences.......maybe a big sticker on the packing box....WARNING....MAY BE DANGEROUS TO YOUR MENTAL HEALTH......and make it part of the user's manual, in the very begining :D :D

Out of curiosity, I ran Hijack This last night on my system, the log was so small compared to others I have seen on VDr that I thought I must have run the wrong thing.

I guess I'm just running a real tight system, the way I want run it.

Logfile of HijackThis v1.99.1
Scan saved at 9:57:32 PM, on 17/02/2005
Platform: Windows ME (Win9x 4.90.3000)
MSIE: Internet Explorer v5.50 (5.50.4134.0100)

Running processes:
C:\WINDOWS\SYSTEM\KERNEL32.DLL
C:\WINDOWS\SYSTEM\MSGSRV32.EXE
C:\WINDOWS\SYSTEM\mmtask.tsk
C:\WINDOWS\SYSTEM\MPREXE.EXE
C:\WINDOWS\EXPLORER.EXE
C:\WINDOWS\SYSTEM\SYSTRAY.EXE
C:\WINDOWS\SYSTEM\DDHELP.EXE
D:\PROGRAM FILES\NORTON ANTIVIRUS\NAVAPW32.EXE
C:\WINDOWS\SYSTEM\WMIEXE.EXE
C:\WINDOWS\SYSTEM\STIMON.EXE
C:\WINDOWS\DESKTOP\HIJACKTHIS\HIJACKTHIS.EXE
C:\WINDOWS\NOTEPAD.EXE

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.ozemail.com.au
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about :blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int
ernet Settings,ProxyServer = proxy.ozemail.com.au:8080
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Int
ernet Settings,ProxyOverride = 192.168.1.1;192.168.1.2;
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - D:\PROGRAM FILES\ADOBE\ACROBAT 5.0\READER\ACTIVEX\ACROIEHELPER.OCX
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - D:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - D:\Program Files\Norton AntiVirus\NavShExt.dll
O4 - HKLM\..\Run: [ScanRegistry] C:\WINDOWS\scanregw.exe /autorun
O4 - HKLM\..\Run: [Tweak UI] RUNDLL32.EXE TWEAKUI.CPL,TweakMeUp
O4 - HKLM\..\Run: [SRP Startup] C:\WINDOWS\SYSTEM\SRP\SRRPRO.EXE /startup
O4 - HKLM\..\Run: [SystemTray] SysTray.Exe
O4 - HKLM\..\Run: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\SYSTEM\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NAV Agent] D:\PROGRA~1\NORTON~1\NAVAPW32.EXE
O4 - HKLM\..\Run: [devldr16.exe] C:\WINDOWS\SYSTEM\devldr16.exe
O4 - HKLM\..\RunServices: [LoadPowerProfile] Rundll32.exe powrprof.dll,LoadCurrentPwrScheme
O4 - HKLM\..\RunServices: [ScriptBlocking] "D:\Program Files\Common Files\Symantec Shared\Script Blocking\SBServ.exe" -reg
O12 - Plugin for .spop: C:\PROGRA~1\INTERN~1\Plugins\NPDocBox.dll
O14 - IERESET.INF: START_PAGE_URL=http://www.ozemail.com.au

With respect Nix it looks to me that you have a problem with line 2 (R1) but I'm no hjt expert.

Tj

Nix, If what TJ is refering to is in fact about.com you have a hijacker. Do you get a search page when you come up other than the one you want.

Also post this log in the HJT Forum and let our reident experts have a look.

Quote:

---

Originally posted by greengoose1
Nix, If what TJ is refering to is in fact about.com you have a hijacker. Do you get a search page when you come up other than the one you want.

Also post this log in the HJT Forum and let our reident experts have a look.

---

That's what I'm talking about.

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about :blank


Tj

I have my home page set to about:blank ie a blank page

I like it like that.

In the log there is no space between about and : but posting here puts one in.

here is an article , I posted on Virus and Spyware

http://jcpiercy.blogharbor.com/blog/...15/325569.html

Oh and by the way

Stop surfing with IE , to many holes use Firefox
http://www.mozilla.org/products/firefox/

JP :D

Quote:

---

Originally posted by johnpiercy
Oh and by the way

Stop surfing with IE , to many holes use Firefox
http://www.mozilla.org/products/firefox/

JP :D

---

I figure it is big enough now that they will mess with it also.
History repeating itself in my book.

Quote:

---

Originally posted by TJolly
That's what I'm talking about.

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = about :blank


Tj

---

Hmm must be a left over from a take over attempt that got me once.

My bad for leaving it behind.

Nix, Got caught that way myself. That's about the time I figured it would be worthwhile to include the registry and nasty .dll's in my malware checks.

Thought I'd bump this back up for those that have not seen it yet.

I am starting to think that maybe this ought to be a stickey. What do you all think? :)

I have had one instance of spyware from a freeware download in the past year and a half and thats it. My fault. Haven't seen a popup in 6 months. If you surf suspect sites with ANY browser you will get owned. Anyone who needs to run 3-4 resident spyware monitors consecutively is doing something wrong, or giving access to their pc to uneducated persons. I even ran a unpatched XP Pro up until January, never got hacked, hijacked, exploited or badly infected.

Rule1, Don't use Internet Explorer unless you absolutely have to. Firefox is good (for now) Opera is better.

Rule2, Update and patch your OS. I won't let MS download and install whatever they want, thats my decision, i do it manually.

Rule3, Secure IE, Outlook Express, disable unneeded services, do a port scan make sure you are stealthed.

Rule4, Set up a few garbage email account for software registrations, forums, newsletters, etc. Trust no one. Your personal account is just that, family and friends only. Disable preview pane and open no unrecognizable email. Delete it.


Rule5, Don't use P2P software, disable file sharing in windows, do a Google search for securing your OS whatever it may be.

Rule6, Be very careful what you download and install, if its free, be suspicious.

Rule7, Get a good popup blocker, router, firewall, antivirus, antispyware, anti-trojan software. Occasionally do an online scan.


Rule8, If you must surf porn or crack sites use Opera and disable java/javascript, but you'll still get whacked.

I probably missed something but you get the message.

Quote:

---

Originally posted by greengoose1
Thought I'd bump this back up for those that have not seen it yet.

I am starting to think that maybe this ought to be a stickey. What do you all think? :)

---

greengoose1.....can't hurt...:cool: ....lots of good info in here for newbies (and others), that take the time to learn .....

greyeyezz....very instructional, thanks.
poppy