Celtica's Computer Club > Webscape > Stop Internet Abuse!
Stop Internet Abuse!
Updated January 25th 2007

Stop Internet Abuse! is intended to focus attention on the numerous abuses on the Internet and to help the Internet community combat them. We aim to do is identify spyware and other unacceptable software and generally seek to thwart attempted intrusion into our computers. The Internet user should not rightly be landed with all this hassle, abuses should be tackled at source. But until such time as the police and the internet authorities get their fingers out and start taking their responsibilities more seriously Internet users will have to continue to be extraordinarily vigilant. Internet abuse can take numerous forms e.g.

  • Persistent and systematic spamming by fraudsters, spoilers, and other parasites
  • Hijacking email addresses and then using those addresses to send out spam
  • Fraudulent or offensive get-sex-quick and make-money-fast schemes
  • Emails pretending to come from eBay and others intended to fool users into parting with their banking or other personal details
  • Hacking into other users' computers and distributing bugs and viruses
  • The use of spyware and information-gathering robots
USEFUL RESOURCES
Gibson Research Corporation   Can anyone crawl into your computer while you're connected to the internet?  You may be very surprised to find out, says Steve Gibson, creator of the 'ShieldsUP!' tests. Free. RECOMENDED.
ZoneAlarm   Combining the safety of a dynamic firewall and control over applications' internet use, ZoneAlarm gives protection against thieves and vandals. Free version available. RECOMENDED.
AVG Antivirus  Free version. RECOMMENDED.
SpyBot Search and Destroy   Free, donations accepted. RECOMENDED.
AdAware   Free version
Privacy.net  Web site concerned with issues of privacy and security on the Web
InternetScams.info   Web site for domain owners to report internet fraud, internet scams, totalnic fraud, ICANN fraud, capital networks fraud
Composing Abuse Reports   Composing a Useful Abuse ReportWhat to include, what to omit, and who to send it to
Hacker Watch This site allows individual users to pool their information together in attempting to stop hacking attempts and includes real-time hacker activity mapping
WebGuardian   A very big problem, that still exists is the large amount of spam emails that find their way into our email boxes. Be aware DO NOT OPEN any email from anyone you do not know, no matter what the heading reads or how curious you are
Ad Blocking Resources   The IE-SPYAD and AGNIS block lists are updated at least once a month. You can download both from here
Top-Rated Firewalls   The top firewalls' ratings updated
IMPORTANT  Some of the following programmes can guess at the source of an e-mail message. But most spam now has forged headers with faked To:, From:, Reply-To: and other message headers so do not just mail off a complaint to every domain that appears in a message - that will just annoy system managers who had nothing at all to do with the problem. You should learn a little about interpreting message headers so you can be sure you're complaining to the right place
Sam Spade is a multi-function analysis program that can decode a message's headers and make a fairly good guess about where it came from. It can take a little while to learn, but it's very useful for the spam fighter who's stuck with Windows 95 to XP
DoxDesk  is an excellent expose of all kinds of Internet parasites and detailed info for avoiding and removing them
Adoko  Excellent resource of links about Spyware, Hijacking, Spam and lot of other threats
SpamAssassin is a popular open source filtering system written in perl for Unix systems. You generally run it from procmail, as mail is being delivered to your inbox. I use it, and find it quite effective although I had to adjust its rules and settings to match the spam I get. It's a spam filter, not a spam reporting system, although you can tell it to report the spam it finds to collaborative filtering systems like Vipul's Razor and DCC
SpamCop  is a very popular web-based system that attempts to diagnose where an unwanted message came from and send off complaints. Some system managers welcome reports from Spam Cop, others have gotten so many false alarms that they reject all mail from it
Trace.bat  is an MS-DOS batch process which uses standard network query utilities to work up a handy report on a given Internet address. It does so automatically and fairly quickly, in a simple format and in a logical sequence. It provides a report in plain text which it opens in Notepad when done. It gives some screen feedback while in process. All the user needs is one of the following: an IP address, a hostname, an email address or a URL
Intrusion Detection and Prevention Resources   Provides a place to report intrusion attempts, exploits, hacks and portscans. Has a large list of software/hardware protection which is sectioned by operating system, and one of the largest trojan port/exploit port databases online.

ROGUES' GALLERY
Here are details about some of the most prevalent abusers at the present time
Note:- CWS™ Internet Explorer™ Xupiter™ Microsoft™ LOP™

'EU' Domain Scam
Some three years ago I paid an American guy ( http://www.registereu.com/ ) 60 euros to reserve the domain 'planetnetwork.eu'. This month the real eu registry came online and I found that 'planetnetwork.eu' had been allocated not to me but to a guy in Holland and hosted by a firm called 'godaddy' (which appears to be associated with registereu.com). Be warned!

CoolWebSearch aka CWS
CWS has more than three dozen variants, with new variants being frequently released. It is thought that CWS is part of a new strain of trojans that have recently been identified that all have one thing in common: they install through the ByteVerify exploit in the MS Java VM and change the IE homepage, search page, search bar, etc. Entering incorrect or incomplete URLs results in users getting redirected to adult sites or obscure search sites. CWS programme code is remotely updated, apparently from a server in Russia. Some variants add CWS servers to Internet Explorer's Trusted Sites list, enabling programme code - not limited to CWS code - to be installed or altered without permission. Some variants collect and transmit personally identifiable information back to CWS servers. CWS severely impacts infected computers' performance. Software may freeze or crash, especially Internet Explorer. IE performance is noticeably slowed, particularly page scrolling. Microsoft tech support has had reports of computers locking up, crashing, and rebooting repeatedly due to CWS issues. More than 1,000 domains are known to be affiliates of CWS. Affiliates get paid per referral/click-through to coolwebsearch.com. Users visiting any one of the affiliate sites may install CWS software by careless clicking on a pop-up or other ad. CWS has apparently been installed without user knowledge or permission via unpatched IE security holes.

Xupiter aka OrbitExplorer (latest variant)
Xupiter launches pop-up ads, changes default home pages, redirects mistyped or incomplete URLs to affiliate sites, redirects search requests to off-brand search sites, and adds Xupiter links to bookmarks/favorites. Xupiter blocks any attempts to restore the original browser settings or to delete Xupiter favorites. Xupiter's privacy policy notes that Xupiter - or its partners - may deliver programming fixes, updates, and upgrades via automatic updates. Users are also advised that conflicts may occur with other applications and that Xupiter will determine what those applications are so that the company can resolve these conflicts whenever possible. Several versions of Xupiter appear to download other programs such as gambling games onto affected computers. Technical support representatives at Microsoft's help center say Xupiter has odd effects on Windows XP, making it impossible for some users to open directories such as My Computer on infected computers. Xupiter is installed via an Internet Explorer toolbar program. Some users claim toolbar was installed without their permission on unpatched versions of IE. Toolbar may be downloaded via Web sites, links in spam advertising a Free Christian Toolbar or a pop-up blocker program, or via links in pop-up ads.

Gator Advertising Information Network (GAIN) aka Gator, Claria, OfferCompanion
Gator overlays ads onto Web pages, tracks what Web sites are visited by users, transmits information about products and services users are interested in, and monitors response to Gator-produced ads. This information is made available to advertisers. May automatically fill in passwords and other information on Web forms. Its main purpose is to load an advertising module called OfferCompanion that displays pop-up advertisements when you visit some Web sites. According to its privacy policy, Gator transmits information on system settings and configuration information - software installed on the computer, and more - as well as first name, country, city, five-digit ZIP code/postal code, and non-personally identifiable information entered into Web page forms, such as the first four digits of credit card numbers, which identifies the issuing bank but not the cardholder. Gator also auto-installs and/or updates other software components, such as rich media player applications, browser plug-ins, virtual machines, and run-time environments. Gator distributor Claria insists Gator is not spyware and has been involved in several court cases in attempts to prove this claim. Users report computers with Gator exhibit slowed performance and/or software crashes. GAIN offers half a dozen applications that contain Gator, such as a desktop weather forecast program, a calendar, a computer clock synchronization program, the Gator e-wallet, and a program called Websecure Alert, which Gator documentation says helps to protect your browser security by monitoring for unauthorized tampering with Internet Explorer's security settings, and can help to protect your privacy by deleting your web surfing history on a regular basis.

Live Online Portal (LOP) aka C2
This family of spyware applications reset users' default start and search pages to lop.com or one of 200 Live Online Portal (LOP) affiliates such as ifiz.com, iguu.com, samz.com, sckr.com, scrk.com, and sfux.com. LOP resets start and search pages back to lop.com if user attempts to change them, adds shortcuts to advertisers' sites on desktop and links in favorites/bookmarks, and adds new IE toolbar called Accessories, with yet more advertising links. LOP can download and execute arbitrary code from its server. Overall performance is slowed. Mobile users may get frequent dial-up connection requests if their computers are not online when LOP wants to perform some action. Computers may freeze for a few minutes after these connection requests are refused by user. LOP program may demand answers to series of riddles before allowing itself to be manually uninstalled. LOP program may demand answers to series of riddles before allowing itself to be manually uninstalled. LOP's most infamous installation method is to create pop-up loops (pop-ups opening pop-ups) featuring ads for MP3 search and download tools. One false or frustrated click in the midst of the pop-up plethora and the machine is infected. LOP has also been bundled as a legitimate music/software download search tool with various freeware software offerings.

Cydoor
Cydoor produces the usual complement of pop-up ads and many pop-under ads. No security issues are known with recent versions of the software. Programme seems to confine its connections with the mothership to updating ad cache, not programming code. Little if any personal information not directly supplied by user is captured. The most recent versions of Cydoor are nearing the point where they can no longer quite be considered spyware. Other issues: Users do not have to be online to view Cydoor-produced ads. Programme pulls ads from cache (C:\Windows\System\adcache\) within affected computers. Cache is updated each time user goes online. Anti-spyware vendor PestPatrol reports numerous complaints of Cydoor causing system errors in Windows XP. Cydoor is widely distributed as a component of p-to-p programmes, some freeware games, and other applications. Not offered as a stand-alone download.

Look2Me aka AllAboutSearch.com
Look2Me primarily displays pop-up advertising for clients. Pop-ups - some full-window size - can appear on screen every minute or so. Look2Me also installs shortcuts on desktops and changes default browser settings. Some users of infected machines report that applications linked to shortcuts have been installed without permission. But tests of Look2Me on patched Windows 2000 and XP systems did not exhibit any capability of self-installing programs. Look2Me monitors Web sites visited and then submits this information to its home server. Look2Me auto-updates its code, and programme components could run arbitrary code during this procedure. No significant performance issues have been noted, besides users being pelted with pop-up ads. IE may slow down. Look2Me will not show up as a running process or application as it tightly integrates itself with Internet Explorer, making it difficult to monitor and manage its activity.

BrilliantDigital
BrilliantDigital displays multimedia advertisements. Adware in which data about a user's habits are tracked and sent back to a server for analysis without knowledge or consent.

eXact.ISEXEng aka BargainBuddy, CashBack
eXact.ISEXEng is a Trojan Windows service installed by BargainBuddy and CashBack. Severe threat - Severe threats typically are remotely exploitable vulnerabilities, which can lead to system compromise. Successful exploitation does not normally require any interaction and exploits are in the wild. There exists a high possibility of potential system damage or security flaw. Attacker has complete control over your computer or install new software on your machine. BargainBuddy is a Browser Helper Object (BHO) that watches the pages your browser requests and the terms you enter into a search engine web form. If a term matches a preset list of sites or keywords, BargainBuddy will display an ad.

AdDestroyer
AdDestroyer is promoted as a spyware remover. However, it sets itself to run when you start the computer and remains memory-resident. When it runs it periodically attempts to contact a server to download updates and instructions.

DownloadWare
DownloadWare downloads and installs software from advertisers. It runs at Windows startup, and, if a network connection is available, it connects to its servers. It can be installed through an ActiveX control.

NetworkEssentials
Network Essentials is an IE browser helper object that monitors URLs being viewed in the Web browser.

CafeCup aka services.exe
A persistent server-type programme, extremely difficult to remove.

Virtual Bouncer
Virtual Bouncer claims to be a spyware remover and it actually detects a few. May profile users online habits or broadcast data back to a server with 'opt-out' permission.

GIVE SPYWARE A HARD TIME
Here are some simple but effective tips for covering your tracks and making it more difficult for spyware to function on your machine ...
Switch off the AutoComplete feature in Internet Explorer 5 (Tools Menu\lnternet\Options\Content\Personal lnformation\AutoComplete). This stops the browser trying to fill in web addresses as you type - a useful shortcut but one which reveals the sites you’ve frequented in the past
Empty your browser’s cache regularly. In Internet Explorer, go to Tools\lnternet Options\General and select Delete Files in the Temporary Internet Files area.
Cache clearing doesn’t affect your cookies. In the same area as before, click Settings and then View Files. Now you can see which sites have left a little memento of themselves on your system. Search and destroy any that you would rather keep secret.
In the Security section of Internet Options, you can also instruct your browser not to accept any new cookies in the future. If certain websites throw a wobbly at such impertinence, you can decide for yourself whether you care to proceed,
Your browser’s History folder keeps a semi-­permanent record of your surfing. Go to Tools\lnternet Options\General and click the Clear History button.
If you click Start and then Documents, you can see and access the files you most recently opened. To prevent others from sharing this privilege, click Start\Settings\Task Barand Start Menu\Start Menu Programs and clear.
Contrary to appearances, deleting a file doesn’t permanently remove it from your hard disk. The only way to do that, short of destroying the disc itself, is to overwrite it with fresh data. Password protect everything!

- Acknowledgements to ComputerActive