Internet Necessities (or, Software you MUST get)

[SmartyPants]

I guess I'm one of those hard headed people. I never updated the security software that came on this old computer and have surfed without a hitch until recently. I had that start page virus that kept changing my home page and sending to anyplace but the website I tried to get to. I finally broke down and installed the McAfee 30-day RedZone suite and it immediately found that Trojan along with about 14 others. The best part of it was that it handled everything by itself I didn't have to do a thing.

My computer is now running great again, however it is old and out of date. I'm hooking up 2 new computers in the house next week and plan to install McAfee's Internet Security Suite -- this time around I'll keep it updated!

By the way, I use Earthlink for email and it has a very-good built-in Spam Blocker. It works great!

[Lei]

Odd One, is there any protective software for Mac"s ?

[clem]

One of the best free firewalls is:

www.sygate.com


For testing your system to see how good your security is, go to:

http://www.grc.com/default.htm


and use their "Shield's Up" program to test your computer, you will be surprised.

[Trasael Adnepos]

Ok. Help! I have run Norton firewall and anti-virus for years, (my anti-virus is current), I found Ad-Aware a couple of years ago and have updated after reading this.

I am on a deal-with-it-only-as-needed ignorance level on this stuff. Last night I was logged on EZ-board and I think one of what OddOne describes as "HTA" got in through my IE Browser. I instantly had endless windows replicating and stuff all over my desktop. I spent three hours deleting temp files and new program files, downloaded what I thought was free Xsoft deal to get rid of something that hi-jacked my browser called a "Begin 2 Search Bar", but after I scanned with it, it refused to delete anything, asked me to register, and when I tried it literally locked up box and I had to reboot, then the scan was gone, and when I got back to the site it wanted me to purchase because my "trial run" was gone. Do those guys own and operate Begin2search?

So then I ran the latest version of AdAware, quarantined and deleted no less than 56 files, including a bunch of stuff written to registry, but Begin2search is still there on my browser, doesn't "lock out", comes up whenever I open a new window, and is obviously running in the background, because it creates links all over every page I read from key words it is gleaning. I'm also getting a bunch of "can't finds" and at least one "searching for" when I reboot, so something is still in registry.

How the blazes do I get this thing out? I just downloaded Spybot from the link above, and am going to try that, but on this dial-up I can't get to go any faster than 37.2K, (they claim it's my phone company), this stinking spyware has commandeered far too much of my time.

All suggestions and instructions welcome!

Edit to add: Now I have run Spybot and deleted 3 more files. The new Begin2Search toolbar is still there and doing its thing. It is highlighting "spyware" in this post and creating links. ARGGGH!! (Contemplating computer with .45).


Also, I neglected to note that since cleaning files last night, my Outlook won't work, (thinks the mail servers are not responding), and I have checked the proper settings under "tools", re-entered passwords and etc. One of the files coming up with a missing warning after reboot is a driver(.dll). Did that stuff corrupt my Outlook driver and I deleted it?

Edit to add: I seem to have de-fanged the hi-jack toolbar, by going into system files and manually deleting everything related and created at that time. The thing is still there on the browser, but seems to be inactive. Since it is a toolbar Spybot and AdAware don't seem to be able to find it, but I have identified a line of code (evidently not a file name) which I have the box searching for in all files. Any ideas how to delete the thing from Registry or ID it further? I've been through Explorer with a fine tooth comb, and the thing must be invisible.

Thanks,

Tras

[RB Martin]

I think this should have been in a new thread Tras, but go to this URL

http://computercops.biz/postp302553.html

Instructions are there for removal of this Browser hijacker

[Trasael Adnepos]

Thanks, Martin, I found that on Google, downloaded the free No Adware, (I thought I was getting "Hijack This" from the info at computer cops, but it doesn't say that). That couldn't find it either, and it doesn't show up under any of the names they gave there. The thing is active again, and is still highlighting links on key words, (Virus, parasite, browser hijacker, spyware, spam - to name a few), generating pop-ups, but hasn't tried to re-direct lately (yet). I'm up to 70 some files deleted today, and the thing is still cooking/replicating. I found some log evidence it may be changing file names, but haven't found the thing itself. I'll go back to computer cops and see if I missed something.

The guy over there called it a "Bloodhound". What is that?

Seems right on point to this thread to me. This thing must DIE!

Tras

[OddOne]

What I've found works well is to use Hijack This! in safe mode to systematically remove any unusual applications. However, this requires a thorough knowledge of what is and isn't "normal" for the OS in question as well as a flair for spotting the bogies hiding among the friendlies - disabling the wrong things with HJT! can result in an unbootable computer!

So hat I usually end up doing is rebooting into Safe Mode, launching HJT, and then tracking down each and every autoloaded file by following the directory path it's in and checking the EXE in question for version info and other clues. If it looks suspect I make note of it, kill its entry in HJT!, reboot, and check to see if it restarts on its own. If it does, I force a rename on reboot (either by creating a WININIT.INI file or using the PendingRenameOperations Registry key, depending on the Windows version) to rename the file, reboot again (ignoring any errors about not finding the filenow), and remove the renamed file.

Of course this is awfully complicated and potentially risky if you lack the expertise, in which case I suggest seeking out some help.

oO

[Trasael Adnepos]

Thanks, OddOne. I have no idea what the heck I'm doing, but I have changed prompt lines in DOS before to get rid of the rest of a virus a few years past, and I've been trekking all over the Registry files, (and everywhere else), getting rid of stuff this thing has replicated or installed, so I am willing to try. I have learned to run a boot log (print it) and back up the registry in case I really screw up, but if I hadn't been hand weeding so far, I wouldn't have found quite a few components of this thing which the scan programs missed. I found a brand new WININIT.INI file last night that the thing had evidently created to rename files in Favorites it was hiding in.

I'll try again to get Hijack This! In the meantime, I have that machine off unless I'm working on it.

I also learned something else which others may be able to use from this remote location today, which is that if you enter begin2search.com using no caps, (the toolbar hijack uses caps (B) & (S), they claim to have an uninstall for the thing. I haven't tried it yet, but the link is there

Edit to correct: I thought I must have entered the link differently, but now that I brought up this machine to try it, it appears the hijack toolbar is actually re-directing me to the junk site where the uninstall link isn't. I am getting a different site than I did at the remote location, and it evidently wasn't the addy. Here's the link to the bad one. Someone see what you get.

http://dp.information.com/?a_id=1054...intosearch.com

That's where it goes when I enter begin2search.com. The uninstall links justs take you to other sites.

Thanks again,

Tras

[Trasael Adnepos]

Update. OK, apparently the difference in the urls was between (2) and (to), but I'm not going back to find out. I'm getting a little blinkey from this. Does it show?

I downloaded Hijack This! (saved to disk), brought it home, and the driver was missing. So much for that idea.

I did another Google and went through some more material at ComputerCops. Eventually I found this link someone had posted for removal of the hi-jack bar.

Here's the goods in case anyone else gets hit:

Download uninstaller for Begin2Search

http://216.130.185.143/uninstall.exe

It did change my home page to Yahoo and something (it?) loaded some other easy to delete crap. It did not appear to get anything BUT the active hijack toolbar which was highlighting words and making links of them, generating pop-ups, and appearing on every new window when I supposedly had the toolbar locked, but that was a big deal because it was a regular vacuum of malware whenever I logged on.

I then ran Spybot Search and Destroy, which ends up being far and away my favorite even over AdAware (which I also ran), identified and deleted over a hundred hostiles I either couldn't identify with the hijack bar running or which it had sucked up in a few minutes of running, but had a number of other Explorer Registry values and keys, including a bunch of plug-ins the thing had installed, which I couldn't delete with the program running.

Here's where Spybot S&D shines! I was able to set the thing to run at start-up. I won't bore you with the details, but after reboot failure from the stuff I had deleted and a bit of fooling around, I got it to boot and Spybot S&D scanned the thing before it let Explorer load, captured the hostiles, and may have even repaired my registry. The guy is getting a donation if I can get a mailing address!

I'm not completely done cleaning, but the difference in internet page load speed is remarkable already. Thanks OddOne & all for this thread. It's not a learning curve I would have chosen, but a profitable one nonetheless.

From Norton to the Spybot S&D files, this thing must be a combo of everything to date.

The Ballad of John Henry has been going through my mind, only with the computer being the steam-drill...



Tras

[OddOne]

Update:

For folks looking for spam handling, I found a great tool called SpamBayes (Link). It's free/open-source and can run on just about any OS for which there are Python libraries. (Most Windows versions, practically every Linux distribution, MacOS X, Solaris, you name it.)

SpamBayes acts as a mail proxy - you check mail through it, and it scans the mail it's fetching - so it'll work with any POP3-compliant mail client. There's also a plugin for Outlook to make it easier to use, although it's web-based administration is pretty straightforward. IMAP4 users can grab the plugin for that, too.

It's a Bayesian detector, meaning that you tell it what is and isn't spam and over time it "learns" to distinguish the two. The more you use it, therefore, the smarter it becomes at catching cleverly constructed spam and not tripping on legitimate traffic. If you already have a large "trash" message folder you can feed the whole thing into SpamBayes and say "these are all spam" and train it on a bunch of spam in one shot. Same for training on a bunch of good mail - feed it the mailbox and say "this is all good mail".

My results at the two-week point are up over 97% on spam and 99+% at non-spam, with one false positive (good flagged as bad) thus far, and about a half-dozen false negatives (bad not flagged as bad) per 100 messages. This after feeding it 2,200+ trash messages and 3,000-someodd good ones.

oO

[Myranya]

I miss Diamond CS RegistryProt on the list; a program that will warn you whenever something is added to your registry, and you can then allow (if you are installing new software you want, for example) or deny (if something nasty is trying to install itself).

It's available here:
http://www.diamondcs.com.au/index.php?page=regprot

[Trivium Pursuit]

As Cory would say, 'Halp Halp!' I pull up this thread, scan through and see dozens of programs recommended, some must be run from safe mode, etc, etc...
WHAT ONE PGM IS RECOMMENDED , simply, to start with? I do seem to have a virus as my other window, when I try to get Yahoo, keeps bringing up 'about:blank', and an AD for spyware removeres...

[SurvivalRing]

One of the best free firewalls is:

www.sygate.com

it WAS free....Symantec just bought them..you can't get the free version anymore.

But, the good news it that Zonealarm works fine and dandy...


Rich

[Fleataxi]

OddOne:

Thumbs way up!

This topic really helped me!

I ran Shields-up, and my computer was 100% protected - total stealth mode.

CFI suggested I add a couple of mal-ware detectors to my PC from the list you created - Thanks!

They found a bunch of malware, and once I got rid of it - my page loading time is down to zip, except on TB2K lately - you're probably busy!

Anyway - Thanks and Bravo Zulu!

Fleataxi

[Truly_Bug]

I have been having probs with my comp lately.
For some reason...when first turning it on... it usually takes about 30-40 MINUTES before the thing even comes up to the start up page. It apparantly is updating something.
I have gone into the settings to make sure it isnt set for updates but everything looks fine. and its set for no updates but I have to usually plan on "cranking up the computer" about an hour before I plan to use it in the mornings.
I have adware and spybot adn run them frequently but it doesnt seem to help. Any ideas?

[Joseph R. Whaley]

Viruses exist for Macs, and there are already malware apps that can breach a Mac's defenses.

The only reason Macs are not getting pounded is thet fact that there aren't enough of them to warrant coding for. This used to be the case for Linux, and now that Linux is becoming popular viruses for it are emerging.

Bragging that you're secure becuase you're on a system viruses aren't coded for -yet - is foolish and based on a total lack of understanding of IT security principles. You WILL be targeted eventually - Linux is, cellphones are, PDAs are, and yes, Macs are.

There is no security through obscurity.

oO

OK, here we are closing in on 3 years later, from August 2004, and my Macintosh running OSX ******STILL****** has no viruses or trojans or whatever found in the "wild" that can trouble me. NONE. I have not encountered ANY "malware apps that can breach a Mac's defenses." NONE. (If they exist, they are either theoretical or cannot propagate, and in either instance are insignificant as a practical matter.)

Meanwhile, the total for Windows has reached, what, 150,000 or something? I don't even know but it is a huge number. Bigger than in 2004. Mac OS X was at zero in 2004 and it is still zero in 2007.

I am still mystified by all these Windows fanboys who disregard the enormous personnel costs of specifying Windows, with all the crashes and lack of security. Enormous amounts of time are wasted deflecting the attacks, and then recovering from disasters. These Windows fans then portray themselves as such hardheaded realists. I just shake my head in bafflement.

They brag about being so practical minded. I don't get it. The practical decision is to dump Windows right now. Use the Dell for a doorstop.

The math is just so simple.

The Windows folks, many if not all of them, spend huge amounts of time tweaking all the Zone Alarms or whatever. Mac folks spend ZERO time on that.

This is a HINT, folks!

Yes, sure, I know, Apple is regularly issuing security updates. So what? So far as I know, no application can run on my Mac unless an administrator enters a password. That's like opening the front door at 3:15 AM to a bunch of burglars. Don't open the door! Don't authorize that mystery application to run!

Now Vista is coming out, supposedly more secure, and security updates are frequent and, apparently, truly needed because the security holes are real and hackers are using them. Not true for the Mac. The security holes found in OS X seem to be mainly theoretical, and not actually used by the criminals.

Someday, yes, someday, this may change.

However, the mantra is always the same: someday the Mac will have its first virus and then you Mac fanboys will have your comeuppance.

I am beginning to think the first true Mac virus will arrive when cold fusion arrives.

You know, cold fusion, the technology of the future which will always BE the technology of the future. Jam tomorrow.

"You will be targeted eventually." OK, but it is looking like I have another decade or so of peace and quiet while many Microsoft users go through enormous frustration.

I just flat out don't get it. Are the Windows fanboys just terrified to admit a mistake? Is that why all the commentary (such as quoted above) so regularly misses the point? Is this the fallacy the economists call the commitment to previous investment?

The time has come to write off the previous investment in Microsoft products.

Here is my suggestion: Switch to a Mac today, and someday when the Mac has 150,000 viruses, switch back to Windows! Someday. Maybe in 2030! Meanwhile you can enjoy a safe and profitable computing experience.

Use the time you saved not having to reformat and restore Windows and all your software and data, to get outdoors and enjoy your life a bit more. Or get more work done with that saved time, and make more money! Plus you'll never have to call Dell customer service! (grin)

It sure looks like a no-brainer to me.

Not only that, if there happens to be some rare application that ONLY runs under Windows, you can run Windows on the new Macs with Parallels just fine, simultaneously with OS X. (I would suggest installing XP for now, and turn off your Internet connection if Windows is active! Don't risk the Russians taking over your computer for distributing bad stuff that will get you arrested!)

Then when you are done with that unpleasant chore under Windows, click back over to the productive side of life: Mac OS X.

And feel your blood pressure drop!

[American Rage]

Thanks!


Rage

[corn]

Is there a program like ad aware that can run on win 98?

[Scott Mayland]

I just downloaded the free spy program from yahoo. I wanted to see if it would work. well it works really well. It found a highjack file on my computer that Norton and Spy Bot failed to find.

[corn]

Well, I know I'm outdated, but is there such thing as a free firewall that will run on Windows 98? All (or any) help will be appreciated.