PDA

View Full Version : Ad-Ware Browser Hijacking is out of Control



greeneagle
07-06-2004, 02:59 PM
Ad-Ware Browser Hijacking is out of Control

Seems like everyone we know is being “Browser Hijacked” these days.

For those of you who do not yet know what Browser Hijacking is, it comes in many forms, but almost always includes taking over your browser in different ways using ad-ware, spy-ware, or a combination of both.

Our company runs XP-Pro, maintains our OS and McAfee updates regularly, but we were recently hit by many. We actually found and cleaned approximately 300 instances on 2 computers that we only use to do research and normal browsing for clients. We are working with clients and family to get theirs cleared up, so they can use their computers productively again.

These malicious software intrusions are the absolute worst kind of SPAM. It has become so rampant that after downloading and running SpyBot and Ad-Aware recently that we found 500 instances of problematic files and registry changes on a family members computer. They were going to toss the 1-1/2 year old computer in the trash and get another. It was completely bogged down.

“DSO Exploit” seems to be one of the nastiest at the moment. It changes your registry, sets up Hkeys for activation and even embeds itself for the next startup after reboot.

There are many good forums that get right to the point of the problem, such as this one:
http://forums.net-integration.net/index.php?showtopic=15308

Several claim that SpyBot will fix this problem in a near update. I already made the 6/24/04 SpyBot update and the current status seems to be:

That after booting your system, run Spybot and you are good to go without interruptions by garish IE full window ads with no way to close except “control-alt-delete”, until you boot again. Currently the consensus is run SpyBot again at every reboot, until they fix the problem.

We feel that these browser hijackings are worse than e-mail SPAM and would like to see legislation as strict as virus design and commissioning against users of these type of malicious ad-ware agents. The lost productivity from these perpetrations are mounting daily. It’s time to prosecute or include in law where prosecution or the threat thereof will be effective.

We also believe that there may be a direct link to the passing of and loopholes in the Can-Spam Act allowing the proliferation of these practices. It may be time to include other practices such as “Browser Hijacking” in the Can Spam Act, giving prosecutors more bite.

Microsoft, “Where are my Windows XP-Pro” updates to eliminate or at least minimize these threats?

SpyBot –HELP!

Thanks,
Ken

mikmik
07-06-2004, 03:58 PM
“DSO Exploit”

You too?
Hundreds.

wenwilder
07-07-2004, 08:48 PM
The great guys over at Spywareinfo.com have an article about BHO's that I refer to from time to time. Here it is complete and unedited!! I'd give credit where credit is due, but I don't know who wrote it. If anyone knows please let me know and I'll see if I can pester them enough so they'll tell me :)


BHO's- Browser Helper Objects.

A "Browser Helper Object" is a DLL that allows developers to customize and control Internet Explorer. When IE 4.x and higher starts, it reads the registry to locate installed BHO's and then creates them. Created BHO's then have access to all the events and properties of that browsing session. The APIs for building BHO's are very cool -- they give developers almost complete control over Internet Explorer.

Applications which install BHOs are becoming more and more popular because BHOs allow application developers to control Internet Explorer. For example Alexa uses a BHO to monitor page navigation and show related page links. GetRight and Go!Zilla use BHO's to monitor and control file downloading. Flyswat, Quiver, Blink, iHarvest, etc use BHOs to extend and control Internet Explorer. BHO technology has allowed the development of some very powerful (and cool) applications.

BHOs don't require a user interface per se, though many install Internet Explorer toolbars. Therefore, its possible that there are BHOs installed on your system that you don't know about. What this means is that while there are some really good uses for these things, they may not necessarily need your permission to install and they can be used for malicious purposes like gathering info on your surfing habits.

A lot of spyware and BHO's are written quickly and poorly. This can cause anything from incompatibility issues to corrupting important system functions making them not only a threat to your security but to your systems stability. The programmers of spyware applications obviously do not care about you or your system other than as a source of marketing information so they do not error check most of their products.

Some companies go out of their way to hide the presence of the spyware BHOs that they install. They go so far as to find ways around the most popular detection tools by changing their product regularly just enough to avoid detection until the next version of the detection software comes out.

To see what BHOs you have installed on your machine right now, You can install BHODemon from Definitive Solutions (http://www.definitivesolutions.com/). BHODemon will tell you about any BHO installed and allows you to disable it and re-enable it if you wish.

List of all known BHOs (http://www.spywareinfo.com/bhos/)




Hope that helps.