worth reading(spyware)

deary65

taken from anoher forum:

Spyware note
Monday, August 8, 2005 at 10:56 pm
Posted by Mega (232 messages posted)



For those who don't worry about spyware.. and the ones that do know what it can do.. Thought you might find this informative.
I know many people have asked how to get rid of "CoolWebSearch", now it is more than just pop-ups and browser hijacking.
Ryan Naraine - eWEEK Mon Aug 8,10:43
Spyware researchers picking apart one of the more notorious spyware programs have stumbled upon what appears to be a massive identity theft ring hijacking confidential data from millions of infected computers.
Sunbelt Software Inc., makers of the enterprise-grade CounterSpy spyware protection product, made the discovery during an audit of "CoolWebSearch," a program that routinely hijacks Web searchers, browser home pages and other Internet Explorer settings.
During the research, Sunbelt researcher Patrick Jordan deliberately installed the "CoolWebSearch application on a machine and immediately noticed that the infected system became a spam zombie that was placing callbacks to a remote server.
When Jordan visited the remote server, he was shocked to find that it was being used to distribute sensitive personal information from millions of PC users infected by the spyware application.
"We found the keylogger transcript files that are being uploaded to the servers. We're talking real spyware stuff…chat sessions, usernames, passwords, bank account information, full names, addresses," said Sunbelt president Alex Eckelberry.
In an interview with Ziff Davis Internet News, Eckelberry said the sophistication of the operation suggests it's the work of a "massive identity theft ring" that used keystroke loggers to grab confidential information that could be used to create fake online identities.
"I'm not being dramatic. This is the most repulsive thing I've ever seen. It's very painful to see what's in these log files that are being uploaded in real time. We're seeing a lot of bank information and usernames and passwords to get in," Eckelberry said.
He said the log files included logins to one business bank account with more than $350,000 and another small company in California with over $11,000, readily accessible.
"There are lots of eBay account information and names and addresses of the people owning those accounts. Names, passwords, all matched up," Eckelberry added.
He said the server, which is hosted out of a data center in Texas, was effectively a "massive repository of stolen data" that was being replenished in real time.
"As the [log] file gets to a certain size, it gets taken down and a new file starts generating. This goes on nonstop. We've been watching it for a few days while trying to get to the FBI, and it just keeps growing and growing."
While the site is being hosted in the United States, Eckelberry said the domain name is registered to an offshore company.
Eckelberry said the huge size of the log files is a clear indication that thousands of machines are pinging back daily.
In some cases, where users appeared to be at immediate risk of losing a considerable amount of money, Sunbelt has contacted the affected individuals.
Eckelberry said the "CoolWebSearch" payload included a typical adware download that immediately scanned the infected machine for e-mails to use for spam runs. It then sets up a "very intelligent keylogger" that looks for very specific information.
"This won't get caught by a typical anti-spyware application," he said, noting that the keystroke logger was able to pick up identity-related data for delivery to the remote server.

Browntoa

which forum ??

Coolwebsearch has been around for ages....and all my adware packages remove it ??

deary65

http://www.annoyances.org/exec/forum/winxp/t1123566984

Browntoa

take it back...just google news it and it comes up everywhere....

drlight_2

Sounds like a trojan horse. These things usaully target people with broadband and a firewall should stop it sending any information back to the hacker. This is why a firewall is important with broadband.

blinky

It can be quite tricky to remove as it has blacklists of antispyware software and tools. CWSShredder (might be spelt with one S) is the best tool to get rid of it.

Browntoa

I feel sorry for all those people who think Windows Xp firewall is enough....it only blocks incoming traffic

might be worth pointing out to anyone worried about this that there is a "sticky" thread in this section linking to articles about installing firewalls, antivirus and anti- spyware, link below

http://forums.moneysavingexpert.com/showthread.html?t=3356

sra

blinky wrote:

It can be quite tricky to remove as it has blacklists of antispyware software and tools. CWSShredder (might be spelt with one S) is the best tool to get rid of it.

CWShredder has moved (again) and is now run by Trend:

http://www.trendmicro.com/cwshredder/

It's tiny and doesn't need installing so it's well worth a quick scan.
Trend now also have an online spyware scanner:

http://uk.trendmicro-europe.com/smb/products/spyware_scan.php

deary65

Here is the link to the keylogger:
http://forums.tomcoyote.org/index.php?act=announce&f=89&id=5

Browntoa

if anyone wants to check for that line of text in their registry then they need to download Hijack this

http://www.majorgeeks.com/download3155.html

and thanks to deary65 for that info ...the forum he has posted will also help remove it if you find it