Manual Removal of W32/Spyprotector.R Trojan

Manual Removal of W32/Spyprotector.R Trojan

W32/Spyprotector.R is a trojan. The trojan will infect Windows systems.
This trojan first appeared on February 20, 2009.
Other names of W32/Spyprotector.R Trojan:
This trojan is also known as FraudTool.Win32.Spyprotector.r, Troj/FakeVir-IP

Damage Level : Medium/High
Distribution Level: Medium

No Removal Tool for W32/Spyprotector.R Trojan
W32/Spyprotector.R Trojan Manual Removal Instructions
Recommend Removal from Safe Mode:
How to Start in Safe mode:
Restart your Computer, Press F8 Repeatedly, when your Screen turns on, Select Safe mode, press enter.

The Infected Files Can be Seen in these folders and names also Running in Tasks
End the Following Active Process Before Removal

• [ Kill the Process, Use Killbox if your Access Denied ]

Add Comment if you Want the Remover

Download W32/Spyprotector.R Trojan Known Files Removal Tool

[In Windows Vista Run As Administrator, After Execution System Will Restart]

• %Documents and Settings\Default User\Application Data\lsascs.exe
• %Documents and Settings\Default User\Application Data\windll32.exe
• %Documents and Settings\Default User\Application Data\shellex.dll
• %System\drivers\windll32.exe
• %System\windll32.exe
• %Windows\windll32.exe
  If you have any of these files in running process from task manger, end the process before removal.
  Note: if task manager is disabled, Download the following file, Click to Download - Enable Registry.reg [ Right Click - Save Target As/Linked Content As ]
  Open it with Regedit.exe [%system32\regedit.exe], then it Confirms Add to registry Yes or No, Confirm Yes, then click Ok.
  

W32/Spyprotector.R Trojan Entries Manual Removal From Registry

Click Start, Run,Type regedit,Click OK.

Note: If the registry editor fails to open the threat may have modified the registry to prevent access to the registry editor.

• Download this UnHookExec.inf, [ Right Click - Save Target As/Linked Content As ]
  and then continue with the removal. Save it to your Windows desktop. Do not run it at this time, download it only.
• After booting into the Safe Mode or VGA Mode
• Right-click the UnHookExec.inf file and click Install. [This is a small file. It does not display any notice or boxes when you run it.]

The W32/Spyprotector.R Trojan modifies registry at the following locations to ensure its automatic execution at every system startup:

Delete The Entries
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Microsoft\Windows\CurrentVersion\App Paths\lsascs.exe

Delete run=winDLL32.exe

Search Registry For W32/Spyprotector.R Trojan File Names listed above to remove completely,
Edit Menu - Find, enter Keyword and remove all value that find in search.

Exit the Registry Editor,

Restart your Computer.

Recommended Removal Tools:

Kaspersky Antivirus or Internet Security (Shareware)
Spyware Doctor (Shareware)
AVG Antivirus (Freeware)

Killbox (Freeware)

Ultimate Links PC Tips™

Manual Removal of Bling.exe

Manual Removal of Bling.exe W32.Spybot.Worm - Removal

Terminating the Malware Program

winnt.exe
bling.exe

Open Windows Task Manager.
On Windows NT, 2000, and XP, press
CTRL+SHIFT+ESC, then click the Processes tab.

• In the list of running programs*, locate the malware file(s).
• Select one of the detected files, then press either the End Task or the End Process button, depending on the version of Windows on your system.
• Do the same for all detected malware files in the list of running processes.
• To check if the malware process has been terminated, close Task Manager, and then open it again.
• Close Task Manager.

Delete the following malicious folders:

X:\Windows\System\kazzabackupfiles\
X:\documents and settings\all users\documents\
[x denotes your windows installed Drive]

Open Registry Editor
Click Start>Run, type REGEDIT, then press Enter.

Delete the following malicious registry entries and\or values:

• Key: System\ControlSet001\Services\Win32 USB2.0 Driver
• Key: System\CurrentControlSet\Enum\Root\LEGACY_WIN32_USB2.0_DRIVER
• Key: System\CurrentControlSet\Services\Win32 USB2.0 Driver
• Key: software\microsoft\windows\currentversion\runOnce Value: Configuration Update
• Key: software\microsoft\windows\currentversion\runOnce Value: nodriver
• Key: software\microsoft\windows\currentversion\runOnce Value: NvCpl28Deamon
• Key: Software\Microsoft\Windows\CurrentVersion\Runonce Value: OEM32 Tools
• Key: software\microsoft\windows\currentversion\runOnce Value: PopUp Stopper
• Key: software\microsoft\windows\currentversion\runOnce Value: TaskManager Load Module
• Key: software\microsoft\windows\currentversion\runOnce Value: UpdateCheck
• Key: Software\Microsoft\Windows\CurrentVersion\RunOnce Value: Win startup
• Key: Software\Microsoft\Windows\CurrentVersion\RunOnce Value: Win32 USB2.0 Driver
• Key: software\microsoft\windows\currentversion\runOnce Value: Winampa Agent
• Key: software\microsoft\windows\currentversion\runOnce Value: Windows Logon
• Key: software\microsoft\windows\currentversion\runOnce Value: Winsock2 driver
• Key: software\microsoft\windows\currentversion\runOnce Value: winsockdriver
  

These files are also infected, to remove you need to use any antivirus program like Kaspersky, Nod32, Bitdefender, Avg or any other.

0bfe88af511af8????1426ed3158de0c.exe 0f0????d1be50b4b04f28cb0c3f6bf0c.exe 0facec44e61f248cd65b1ec3f????3cb.exe 142efb7a7cf????a0d3d7da308ee6e9c.exe 1c8467b3d3b????e770b34683aa834fc.exe 1fcc????04af6f0484dd0a10ea317b2d.exe 287b93f27195b664b7f6d????848dd10.exe 2ce4b9d369b51be7ce????9f6e25e020.exe 2d6a1e49a1d17990c6f3724b????296c.exe 326210a48b8ae????c4dae6d20fe921d.exe 33604b93dd6254892572????12dc41c3.exe 36b184????63cd65a002cc31065e4e45.exe 36b5c5de76cedd4f72c0890????85aac.exe 39863834360409913ccb8670f9????f8.exe 3b0????31ff59868657dfcee37d82642.exe 42c9f9????893d2005a62e151b7c1575.exe 4ae5d594bff????82bd18956bc500a7b.exe 4aeebc5056522dbe5b95????354d2b78.exe 4eb3a4f964b13e09ad7????e0f231c97.exe 51df311f3b5360973275f????576788d.exe 5b50bab4afbd76d180ef5????ce6e37f.exe 709b055a????a05fd4c5fbc20c798c3f.exe 7247be51????e4b71aaa9bf22fd09169.exe 729552ad51eeec0????21e5b84c5474d.exe 76ff839cc1785dddf5????f33ab4f89b.exe 77553a4544b0a47986195????3bfa598.exe 79f8b8????7894d24391f445fb8637d6.exe 7b459c739bdb83f6ce????a5a9e4202b.exe 885d0f9a33208ed13????30888e4e50e.exe 88a034dcfc4a5bca1????28a34c81a78.exe 891????e09f2d9d9aa27a268604255eb.exe 8dba0ffe????eef9d27ec4e3017246d6.exe 9183013a????4f857948d7b299d1c2bc.exe 92a1ad5bb921d59d5537????a2bde798.exe 93f6c8cb294????32bdbae5755530ba8.exe 998ea3f85e937f2cb91c08517????ea9.exe 9b5d25fb343e8c2108a????be03802e9.exe a410ca36a2b97214e29a????a6a0fe7a.exe a93776ce2d3ad361d8aea2????0aab7f.exe aa1395349d19c3c00????e3fc0ee060b.exe aa88162e????22e9a18df61563974e1e.exe ab5234ea993????2ffb0a9d6ced65661.exe acbce1436d2795a3980????d062a6879.exe b1ba7b54????3b8dc784b0b49d3f8bcb.exe b6d1f1bf5d????7f5b7e7481a62770cc.exe b9e4a2411381????e45ba03161984593.exe bd04dea1effe5c1340b3e549e2????32.exe d12213fd5f946????a0e5c191c13c7cc.exe d2c73b589336af6????5cf150c961f01.exe d4deabaacf7d0b82fb47????697e13c3.exe d5205d683f8eda61f????f974d1a268b.exe dcc48b????1e27f67443576a79d96ac3.exe ddba39e4e6f2????6e4e58879b699965.exe e2dd82cbabe2????b9543868ea1d7c88.exe e74c3e1212389c35df82????a06c8a6f.exe e88450528????4a2ad22d0690d35483c.exe e9b8c8cfa3e6641c38247????fcd1581.exe ed4e11e7784d7????4f4810663f7a7bd.exe efea2a6506391145f83????9eb465c18.exe f0d2b32723052048c????ce12643ca10.exe f27fed8c2057bb3c7b3012e3????bcdb.exe f2b4ed????e600a5485c149ab8944785.exe f4aa????319191f99c42d94dd4b4881d.exe f604b64d79????98476c9a5b6ce63851.exe f76f6b059e1f7????d1ab10278ee9626.exe fb220e0d3975c10????ba8f1ffd3e1ca.exe fd3488d1a6b98460c9d655b1c????fb3.exe

Removing Autostart Entries from the Registry
Removing autostart entries from the registry prevents the malware from executing at startup.


Open Registry Editor.


Click Start > Run. Type regedit Click OK.

Note: If the registry editor fails to open the threat may have modified the registry to prevent access to the registry editor. Download and run this UnHookExec.inf, and then continue with the removal.

Right-click the UnHookExec.inf file and click install. (This is a small file. It does not display any notice or boxes when you run it.)

Click OK.

In the Registry Editor, navigate to the following subkeys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
RunOnce
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
RunServices
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
RunServices
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\
RunOnce
HKEY_CURRENT_USER\Software\Microsoft\OLE

In the right pane, delete any values that refer to the file names that were detected.

Navigate to the subkeys:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\TlntSvr
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\RemoteRegistry
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Messenger

In the right pane, reset the original value, if known:

"Start" = "4"

Navigate to the subkey:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa

In the right pane, reset the original value, if known:

"restrictanonymous" = "1"

Navigate to the subkey:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanserver\
parameters
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\lanmanworkstation\
parameters

In the right pane, reset the original values, if known:

"AutoShareWks" = "0"
"AutoShareServer" = "0"

Navigate to the subkey:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate

In the right pane, reset the original value, if known:

"DoNotAllowXPSP2" = "1"

Navigate to the subkey:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\OLE

In the right pane, reset the original value, if known:

"EnableDCOM" = "N"

Navigate to and delete the following subkeys, if present:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\BoolTern
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\Root\LEGACY_BOOLTERN
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\rdriv
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Enum\Root\LEGACY_RDRIV

Exit the Registry Editor.


Windows XP Service Pack 2
If you are running Windows XP with Service Pack 2 and are using the Windows Firewall, the operating system will alert you when the SharedAccess service is stopped, by displaying an alert balloon saying that your Firewall status is unknown. Perform the following steps to ensure that the Windows Firewall is re-enabled:
Click Start > Control Panel.

Double-click the Security Center.
Ensure that the Firewall security essential is marked ON.

Note: If the Firewall security essential is marked on, your Windows Firewall is on and you do not need to continue with these steps.

If the Firewall security essential is not marked on, click the "Recommendations" button.
Under "Recommendations," click Enable Now. A window appears telling you that the Windows Firewall was successfully turned on.
Click Close, and then click OK.
Close the Security Center.

Recommended Removal Tools:
Kaspersky Antivirus or Internet Security (Shareware)
Spyware Doctor (Shareware)
AVG Antivirus (Freeware)

Computer Threats Top 10

The nature of computer crime has changed over the years as the technology has changed and the opportunities for crime have changed. Although thrill-seeking adolescent hackers are still common, the field is increasingly dominated by professionals who steal information for sale and disgruntled employees who damage systems or steal information for revenge or profit.

1. Number of password-Stealing Web sites will increase using fake sign-in pages for popular online services

More attacks that attempt to capture a user's ID and password by displaying a fake sign-in page, and increased targeting of popular online services will become more evident in 2007. As evidenced by the phishing attacks that followed natural calamities last year, McAfee Avert Labs also expects more attacks that take advantage of people's willingness to help others in need.

In contrast, the number of attacks on ISPs are expected to decline, while those aimed at the financial sector will remain steady.

2. Volume of spam, particularly bandwidth-eating image spam, will rise

In November 2006, image spam accounted for up to 40 per cent of the total spam received, compared to less than 10 per cent a year ago. Image spam has been significantly increasing for the last few months and various kinds of spam, typically pump-and-dump stocks, pharmacy and degree spam, are now sent as images rather than text.

Image spam is typically three times the size of text-based spam, so this represents a significant increase in the bandwidth used by spam messages.

3. Popularity of video sharing on the Web makes it inevitable that hackers will target MPEG files

The increasing use of video formats on social networking sites such as MySpace, YouTube and VideoCodeZone will attract malware writers seeking to damage a network. Unlike situations involving email attachments, most users will open media files without hesitation. Furthermore, as video is an easy-to-use format, functionality such as padding, pop-up ads and URL redirects become ideal tools of destruction for malware writers.

The W32/Realor worm, discovered in early November 2006 by McAfee, is a recent incident of media malware. The worm could launch malicious Web sites without user prompting, potentially exposing users to bots or password-stealers loaded onto these sites. Other media malware such as Exploit-WinAmpPLS could silently install spyware with very little user interaction.

4. Mobile phone attacks will become more prevalent as mobile devices become smarter

Mobile threats will continue to grow as platform convergence continues. The use of smartphone technology has played a pivotal role in the threat's transition from multifunction, semi-stationary PCs to palm-sized 'wearable' devices. With increased connectivity through BlueTooth, SMS, instant messaging, email, WiFi, USB, audio, video and Web, there are more possibilities for cross device contamination.

2006 saw efforts by mobile malware authors to achieve PC-to-phone and phone-to-PC infection vectors. SMiShing, which involves taking the techniques of phishing by email and porting them to SMS (SMiShing instead of phishing), is also expected to increase in prevalence.

In addition, for-profit mobile malware is expected to increase in 2007. Late 2006 saw a flurry of spy-ware offerings in the mobile world. Most are designed to monitor phone-numbers and SMS call-logs, or to steal SMS messages by forwarding copies to another phone.

One spyware in particular, SymbOS/Flexispy.B, is able to remotely activate the microphone of the victim's device, allowing someone to eavesdrop upon that person. Other spyware can activate the camera. McAfee expects that the offerings of commercial spyware targeting mobile devices to grow in 2007.

5. Adware will go mainstream

In 2006, McAfee saw an increase in commercial Potentially Unwanted Programmes (PUPs), and an even larger increase in related types of malicious Trojans, particularly keyloggers, password-stealers, bots and backdoors. In addition, misuse of commercial software by malware with remotely controlled deployment of adware, keyloggers and remote control software is on the rise.

However, despite the social, legal and technical challenges, there is so much commercial interest in advertising revenue models that McAfee expects to see more legitimate companies using or attempting to use advertising software in ways (hopefully) less objectionable to consumers than most current adware.

6. Identity theft and data loss will continue to be a public issue

According to the US Federal Trade Commission, about 10 million Americans are victims of identity fraud each year. At the root of these crimes is often computer theft, loss of backups or compromised information systems. While McAfee expects the number of victims to remain relatively stable, company disclosures of lost or stolen data, increasing incidents of cyberthefts and hacking into retailer, processor and ATM systems and reports of stolen laptops that contain confidential data will continue to keep this topic of public concern.

McAfee also predicts the unauthorised transmission of information will become more of a risk for enterprises in the area of data loss and noncompliance. This includes loss of customer data, employee personal information and intellectual property from possible data leakage channels -- applications, networks, and even physical channels, like USB devices, printers, fax and removable storage.

7. The use of bots will increase as a tool favoured by hackers

Bots -- computer programmes that perform automated tasks -- are on the rise, but will move away from Internet Relay Chat (IRC)-based communication mechanisms and towards less obtrusive ones. In the last few years, there has been increasing interest within the virus-writing community in IRC threats. This was due to the power afforded by the IRC scripting language and the ease of coordinating infected machines from a chat-room type of structure.

'Mules' will also continue to be an important aspect in bot-related money making schemes. These are work-at-home type jobs which are offered through very professional-looking Web sites, through classified ads, and even through instant messaging (IM). These are a crucial part of the reason so many bots are able to be run from places around the globe. In order to get merchandise (often to resell) or cash with stolen credit card credentials, the thieves have to go through more strict regulations if the goods are going to another country. To get around these regulations, they use mules within those originating countries.

8. Parasitic malware, or viruses that modify existing files on a disk, will make a comeback

Even through parasitic malware accounts for less than 10 per cent of all malware (90 per cent of malware is static), it seems to be making a come back.

Parasitic infectors are viruses that modify existing files on a disk, injecting code into the file where it resides. When the user runs the infected file, the virus runs too. W32/Bacalid, W32/Polip and W32Detnat are three popular polymorphic parasitic file infectors identified in 2006 that have stealth capabilities and attempt to download Trojans from compromised Web sites.

Also important to note is that 80 per cent of all malware is packed, encrypted, or obfuscated, in some attempt to disguise its malicious purpose. Examples of parasitic infectors that are obfuscated include w32/Bacalid and w32/Polip.

9. The number of rootkits on 32-bit platforms will increase

Rootkits will increase on 32-bit platforms -- but protection and remediation capabilities will increase as well. On 64-bit platforms, particularly Vista, malware trends are difficult to predict pending uptake rates for the 64-bit platform, but in general McAfee expects:

A reduction in kernel-mode rootkits, at least in the short-term, while malware authors invent new techniques designed to subvert PatchGuard.

An increase in user-mode rootkits, and user-mode malware in general, or at least higher impact of 64-bit malware, as more advanced heuristic and behavioral techniques provided by most advanced security software is itself hindered by PatchGuard. This state will persist at least until Vista service pack 1, when new APIs are introduced by Microsoft, and likely longer, depending on the amount of re-engineering required by security vendors and the uptake rate of SP1.

10. Vulnerabilities will continue to cause concern fueled by the underground market for vulnerabilities

The number of disclosed vulnerabilities is expected to rise in 2007. Thus far in 2006, Microsoft has announced 140 vulnerabilities through its monthly patch programme. McAfee expects this number to grow due to the increased use of fuzzers, which allow for large scale testing of applications, and due to the bounty programme that rewards researchers for finding vulnerabilities. This year, Microsoft has already patched more critical vulnerabilities than in 2004 and 2005 combined. By September 2006, the combined 2004 and 2005 total of 62 critical vulnerabilities had already been surpassed.

Different Types of Spyware

In this internet World many viruses and spying softwares were introduced and get hacked the users system, So You need to know about the the viruses and other programs to Protect your computer.

ParasiteWare

ParasiteWare is the term for any Adware that by default overwrites certain affiliate tracking links. These tracking links are used by webmasters to sell products and to help fund websites. The controversy is centered on companies like WhenU, eBates, and Top Moxie, a popular maker of Adware applications. These companies have release their software to assist users in getting credit for rebates, cash back shopping, or contributions to funds. To the end user ParasiteWare represents little in the way of a security threat.

Adware
Adware, also known as an Adbot, can do a number of things from profile your online surfing and spending habits to popping up annoying ad windows as you surf. In some cases Adware has been bundled (i.e. peer-to-peer file swapping products) with other software without the user's knowledge or slipped in the fine print of a EULA (End User License Agreement). Not all Adware is bad, but often users are annoyed by adware's intrusive behavior. Keep in mind that by removing Adware sometimes the program it came bundled with for free may stop functioning. Some Adware, dubbed a "BackDoor Santa" may not perform any activity other then profile a user's surfing activity for study.

AdWare can be obnoxious in that it performs "drive-by downloads". Drive-by downloads are accomplished by providing a misleading dialogue box or other methods of stealth installation. Many times users have no idea they have installed the application. Often Adware makers make their application difficult to uninstall.

A "EULA" or End User License Agreement is the agreement you accept when you click "OK" or "Continue" when you are installing software. Many users never bother to read the EULA.

It is imperative to actually read this agreement before you install any software. No matter how tedious the EULA, you should be able to find out the intent BEFORE you install the software. If you have questions about the EULA- e-mail the company and ask them for clarification.

Spyware

Spyware is potentially more dangerous beast than Adware because it can record your keystrokes, history, passwords, and other
confidential and private information. Spyware is often sold as a spouse monitor, child monitor, a surveillance tool or simply as a tool to spy on users to gain unauthorized access. Spyware is also known as: snoopware, PC surveillance, key logger, system recorders, Parental control software, PC recorder, Detective software and Internet monitoring software.

Spyware covertly gathers user information and activity without the user's knowledge. Spy software can record your keystrokes as you type them, passwords, credit card numbers, sensitive information, where you surf, chat logs, and can even take random screenshots of your activity. Basically whatever you do on the computer is completely viewable by the spy. You do not have to be connected to the Internet to be spied upon.

The latest permutations of Spyware include the use of routines to mail out user activity via e-mail or posting information to the web where the spy can view it at their leisure. Also many spyware vendors use "stealth routines" and "polymorphic" (meaning to change" techniques to avoid detection and removal by popular anti-spy software. In some cases Spyware vendors have went as far as to counter-attack anti-spy packages by attempting to break their use. In addition they may use routines to re-install the spyware application after it has been detected.

Read More on Spyware

Malware

Malware is slang for malicious software. Malware is software designed specifically to disrupt a computer system. A trojan horse , worm or a virus could be classified as Malware. Some advertising software can be malicious in that it can try to re-install itself after you remove it.

For the purpose of simplicity Malware is software specifically engineered to damage your machine or interrupt the normal computing environment.

Read More on Malware

Examples of Malware include:

Page Hijackers

Hijackers are applications that attempt to usurp control of the user's home page and reset it with one of the hijackers choosing. They are a low security threat, but obnoxious. Most Hijackers use stealth techniques or trick dialogue boxes to perform installation.

Dialers

A dialer is a type of software used by pornographic vendors. Once dialer software is downloaded the user is disconnected from their modem's usual Internet service provider and another phone number and the user is billed. While dialers do not spy on users they are malevolent in nature because they can cause huge financial harm to the victim.

Tips for Securing your Computer

1. Update / patch ALL your software every now and then!

2. Check / adjust ALL your settings so they are safe, since they AREN'T by default!

3. Use firewall, like Zone Alarm!

4. Use good passwords: at least 13marks long, containing both letters and numbers. Remember to chance your password every few months at least!

5. Get a good anti virus program: F-Secure or Norton Anti virus and keep it updated!

6. Don’t open or execute files that you are not 100% sure are absolutely safe no matter where or how you get them.

7. Wipe your history files (like cookies, internet history and temporary files, etc.), logs and personal files, with specific wiping program (like Eraser) instead of just deleting them.

8. Use encryption to enhance your privacy! Use encrypted email (like Hushmail or Ziplip) and encrypt sensitive files on your computer (PGP).

9. Don’t use public computers for anything you need to type in your logins, they usually have Trojan horses that capture your passwords.

10. Don’t assume anything. If you don’t know, find out! If you cant or don’t understand, ask someone who knows! There’s nothing more dangerous than doing something you don’t really know anything about. That’s the best way to cripple your system or get a Trojan horse on your computer!

How to Detect Spyware Programs

There are different levels of Spying. For example, Alexa, popular software owned by Amazon.com, would be called a “BackDoor Santa” it doesn’t actually log your keystrokes or take system snapshots but it does record some surfing activity. However, programs like Spector are very skilled at stealthily gathering information including passwords, surfing history, and even chat logs and e-mails. If you haven’t done so already take a moment to read the Introduction to Spyware and Malware located here.

Who is Spying your System? How to monitor your system and check for the signs of spy softwares.

1) Work Environment: Assume you are being monitored. Most workplaces have the right to do this so by default get used to the fact that someone is monitoring you. There are several ways employers can monitor employees. Some use activity logging software to see what programs are being accessed and for how long. Naturally many will use spy software programs also known as “snoop ware” or a key-logger to take snapshots and log all keystrokes. An employer may actually monitor internet traffic as it moves across an intranet.

2) Anti-Spy Programs: A popular way to find out if someone is spying on you. Anti-Spy programs look for signatures or traces that are specific to certain spy software. Some simply do text string scanning to find them, and others i.e. (X-Cleaner from Xblock) actually extract and attempt to remove the Spyware. Be careful of the ones that use only text string scanning. Text string scanning can give false positives and in some cases it actually it can accidentally target anti-spy software! You can try a free online scanner.

Anti-Spy software can be a double-edged sword! Many spies will actually buy anti-spy software to scan and check to make sure their Spyware is not being detected. There is a hidden arms race that rages between Spyware vendors and anti-spy companies.

3) System Resources: Poorly written spy software will almost always put a drag on system resources. Watch out for poor system resources, running out of memory, lots of hard disk activity or a screen that “flickers”. This is caused by some spy software programs as they take snapshots of the computer screen that requires system resources.

4) Machine Access: Watch for people trying to gain access to your machine. Many software programs that are designed for spying require physical access to the target machine.

5) Installation Monitors: Currently on the market are software programs that will log every installation that occurs on your machine. It is best to leave these hidden on the system. It is possible to catch the installation of many spies in this way.

6) Anti-Virus: Many anti-virus programs can catch prolific spy software because they are often classified as “Trojan Horses”. Keep spy software up to date and make sure it is running in the background. This might not protect you against from some spy software but it will let you know if any re purposed Trojan horses are installed. Keep in mind that Trojans like NetBus or DeepBO are also classified as spy software because they open up a system to outside connections. Don’t be lulled into a false sense of security because you have one installed. They are helpful but there is no such thing as 100% fool proof protection.

7) Personal Firewall: In today’s treacherous Internet it is very helpful to also run a personal firewall. Firewalls will alert you to both inbound and outbound activity. You can control what is allowed in and out of your system. Watch for suspicious programs you do not recognize trying to send data out of your system.

8) Downloading Smarts: Simply put use common sense when downloading and avoid sources you cannot trust. If you are someone who frequents “warez” or crack sites you will more than likely encounter a Trojan or virus.

9) Common Sense: Be careful about what you install on your system. Don’t run e-mail attachments and read the EULA (end user license agreement). Keep an up to date anti-spy package on your machine.

10) Spy Software: Ironically you can monitor for spy software by installing spy software on your system first! Since spy software can record all keystrokes it can monitor and record the installation of another spy software. Again this turns into a virtual arms race, but keep in mind that many spy programs are vulnerable to anti-spy attacks.

Related: Secure Computer

Optimize your system for Gaming

Install computer games and running smoothly by following these tips. This how to was written with Windows 98 in mind. The tips will work on other operating systems, however you may find that the locations of the utilities are in different locations.

Disk Defragmenter
ScanDisk
Disk Clean Up
Keep Operating System Software Updated
Check Hard Drive Space
Get Rid of Spyware
Minimize Number of Programs Running
Clean Out Add-on Game Files
Shut Down Properly
Antivirus Program

Disk Defragmenter
The defragmenter will organize your files so the computer can use the files you are accessing faster, since it won't have to search as long. Run this program with as few programs running in the background as possible. I suggest defragging your drive(s) every couple of weeks, before you install a program, or after you uninstall a few programs.

Find it here: Start -> Accessories -> System Tools -> Disk Defragmenter

ScanDisk
This system utility checks for surface, folder and file errors and corrects them. Run this program if you computer was not shut down properly, creating a lot of error messages, or if programs seem to functioning abnormally. I suggest using scandisk about once a week to keep your drive(s) in top shape.

Find it here: Start -> Accessories -> System tools -> Scandisk

Disk Clean Up
You can find a useful function in your drive properties that will clean up your hard drive. It will get rid of Internet files (if you use Internet Explorer), temporary files, and files in the recycle bin. If you another browser, like Netscape, you will need to find the cache or temporary files folder within Windows Explorer to delete the unnecessary files. Delete cookies in your Internet folder. You don't need them, and after awhile you may have a lot of cookies just hanging out on your drive. Uninstall programs you don't use anymore. You're just wasting drive space, when you could be using it for something else. Do this after you delete lots of files; use the Internet for a long time, and/or at least once a week.I do three times in a week.

Find it here: My Computer -> Right Click on C Drive Icon -> Disk Cleanup

Keep Operating System Software Updated
Use the Windows Update in the start menu to keep your system updated. New security patches are always being released. Occasionally check for driver updates for your video card.Take the Drivers from the video Card homepage.

Check Hard Drive Space
Keep clutter off your drive. If you don't need it, get rid of it. Save files you won't be using for a while to a CD or DVD. Not only does it give you more disk space for new files, you won't have to go sift through so many files.

Clean Spyware
Spyware is a cookie that you get by visiting websites. Most spyware will not harm your computer, but the information that save may bother those who like their privacy. Spyware can eat up system resources making your computer run slower.
Download Spyware Detection & Removal Tools
http://rahulmg.blogspot.com/2008/07/what-is-spyware-and-malware.html

Minimize Number of Programs Running
If you are trying to play a game, surf the Internet, work on your report, read email, and listen to mp3 files, you are using to much of your system resources. If your computer is trying to run too many programs when also trying to play a graphic intensive game, the graphics will be choppy, and figures will move slowly. Whenever possible play with only the game open.

Clean Out Add-on Game Files
If game allows for add-in files, like The Sims, clean out the files you don't absolutely need. If you don't play a particular saved game, save it to a disk or CD and delete it from the hard drive. If you play The Sims, you probably have tons of wallpaper and objects that you rarely use, get rid of them. You'll be amazed by the space you'll recover, by moving saved games, cities, and other custom files to CDs.

Shut Down Properly
Always shut your computer off using the shutdown option in the start menu. If you don't you will cause errors and sometimes lose data and losses computer's life.

Find it here: Start -> Shutdown -> Shutdown

Antivirus Program
Sometimes your anti-virus program will slow down the loading and playing of games. So if you are not on the Internet, go ahead and disable it. But remember to turn it back on if you logged back on to the Internet.

How to fix the 10 Internet Explorer issues

Issues viewing Web pages

1. "Page cannot be displayed" errors

2. Red x instead of pictures

3. View, Source doesn't work

To address the issues above, you may need to try one, some, or all of the following three procedures.

Empty the cache

The first thing to do when Internet Explorer is misbehaving is empty your Internet Explorer cache. Often the cache is not corrupt or damaged – it is simply too large.

1.Click Tools, then Internet Options, and then click the Delete Files button.

2.A Delete Files window will appear. Select the option to Delete all offline content, and then click OK.

3.Click Settings and reduce the size of your cache to, say, 50 to 100 MB (more if you routinely download very large files).


This will invariably fix the dreaded red x, View, Source, and sometimes "Page cannot be displayed" errors.

Emptying the cache will not be sufficient to fix things if a hidden file in the cache folders, called index.dat, is corrupt. Our best alternative in such a situation is to delete the cache folders in their entirety, but this cannot be done from within Windows under normal circumstances.

Index.dat is a system file, and any attempt to delete it while Windows is running or while the user is logged on will be blocked. Therefore, we need to reboot into DOS mode or, when running later versions of Windows that support user accounts, we need to log in to Windows using a different Administrator account to that which is affected.

Issues related to default browser settings

4. Error messages when attempting to send a page or link by e-mail

First, reset your default e-mail client from within Internet Explorer. To do this go to Tools, then Internet Options, then Programs, then select your e-mail program of choice.

To re-register your e-mail program:
1.
Click Start, then click Run, and then type the appropriate command based on the following e-mail programs:

Outlook Express:
"C:\Program Files\Outlook Express\Msimn.Exe" /reg

Outlook:
"c:\program files\microsoft office\office\outlook.exe" /checkclient


Make sure the path to msimn.exe or outlook.exe is correct for your machine. Type the command line exactly as it appears, including quote marks and spaces.

If using a non-Microsoft e-mail program:

A program must be Internet Explorer aware to automatically list itself as a default program option. If the program does not appear, there are a couple of things you can do. First, you can right-click the executable file for the program, and see if Register appears as an option, (which should cause the program to be listed on the drop box on the Program Tab)

Otherwise, there's a manual method, but it involves editing the registry and adding the program under:

HKEY LOCAL MACHINE\Software\Clients\mail
-or-
HKEY LOCAL MACHINE\Software\Clients\news

You will need to contact your program's vendor for the appropriate syntax.

5. Hyperlinks not working

Hyperlinks will not work if a computer system does not know which Web browser is set as the default, which happens if the settings that control this choice are damaged or incorrect. The easiest way to fix the problem is to allow your preferred Web browser to rewrite the appropriate settings by resetting your default browser. Rather than walk through the steps required to achieve this in this column, I refer you to my previous column about how to set up your browser as the default.

6. "Open in new Window" doesn't work

Sometimes resetting our default browser is not enough to get hyperlinks to work again, especially if they trigger a new window. Open in new window is dependent upon several system files, therefore you should ensure they are correctly registered.

Click on Start, then Run, then run the following commands. After you run each command, a small window should appear stating that the command was successful.

regsvr32 Shdocvw.dll (if that doesn't work, try shdoc401.dll)
regsvr32 Oleaut32.dll
regsvr32 Actxprxy.dll
regsvr32 Mshtml.dll
regsvr32 Urlmon.dll

Some programs that control pop-up windows and advertisements can stop hyperlinks from working. Also, some third-party add-ins are known to cause a problem and must be uninstalled when misbehaving in this way. Disable all third-party Internet related programs (not your firewall) and test.

7. Internet Explorer freezes, shuts down without warning, or the computer reboots.

This problem is often caused by out-of-date video drivers. Go to the Web site run by the manufacturer of your video card and download, then install, the latest (non-beta) drivers for your video card.

Alternatively, you can try the following:

1. Click Start, and then click Control Panel.

2. Click Display (in classic view of Windows XP), click the Settings tab, and then click Advanced.

3. Click the Performance or Troubleshooting tab (depending on your operating system), and then reduce hardware acceleration a notch at a time until your system stabilizes.

8. Internet Explorer opens off screen, or tiny, or minimized, or the window will not move

If your taskbar is set to Autohide, turn the setting off and then maximize the problem window. While the window is maximized, increase the height of your taskbar from one row to two. The maximized window will automatically resize itself to fit into the smaller area available with a taller taskbar. Then, return the taskbar to its normal single row and allow the maximized window to resize once more. This will make Windows re-calculate window size and boundaries, overwriting registry keys that may be damaged.

If the affected window is partially off screen, so that the Minimize, Maximize, Restore, and Close buttons are hidden, you can access the same options by clicking on the Internet Explorer icon on the far left edge of the Internet Explorer title bar, or by right-clicking on the Internet Explorer button on the taskbar.

If resizing your Taskbar does not work, run Regedit and remove the following registry key values which are most likely corrupt. Do not delete the entire key, just the last word which will appear in the right hand pane.

HKCU\Software\Microsoft\Internet Explorer\Main\window_placement

HKCU\Software\Microsoft\Internet Explorer\Desktop\OldWorkAreas\OldWorkAreaRects

Then reboot.

9. The computer keeps disconnecting from the Internet

This one can raise suspicions of malware. But, before you reformat your computer, do the following.

1. In Internet Explorer, on the Tools menu, click Internet Options, and then click the Connections tab.

2. Under Dial-up or Virtual Private Network settings, click the Settings button.

3. Under Dial-up settings, click the Advanced button and make sure that Disconnect when connection may no longer be required check box is cleared, and that the Disconnect if idle check box is cleared as well.

1. In Outlook Express, on the Tools menu, click Options, and then click the Connection tab.

2. Turn off the option to Hang up after sending and receiving, and then close the Options window

3. On the Tools menu, click Accounts, and then click the Mail tab.

4. Make sure that each connection is set to use Any Available. If not, highlight the account then click on Properties.

5. Click the Connection tab and ensure that the option "Always connect to this account using" is turned off.

10. "A runtime error has occurred. Do you wish to debug?"

This is another symptom that tends to raise suspicions of Malware or Spyware.

1. In Internet Explorer, on the Tools menu, click Internet Options, and then click the Advanced tab.

2. Make sure that Disable Script Debugging (Internet Explorer) and Disable Script Debugging (Other) are both enabled.

3. Make sure that Disable a Notification about ever script error is disabled.

Related:

What is Spyware and Malware ?

Spyware is computer software that is installed surreptitiously on a personal computer to intercept or take partial control over the user's interaction with the computer, without the user's informed consent.Malicious software goes by many names: Spyware, worms, viruses, Trojans, Adware, keystroke loggers, pests, and more. "Spyware" often is used to mean all malicious software other than viruses. I prefer the term "malware" as it's a bit more descriptive. This page is for removing any type of malware.

Unlike viruses and worms, Spyware does not usually self-replicate. Like many recent viruses; however, Spyware by design exploits infected computers for commercial gain.

Typical tactics furthering this goal include delivery of unsolicited pop-up advertisements; theft of personal information (including financial information such as credit card numbers, other account Details); monitoring of Web-browsing activity for marketing purposes; or routing of HTTP requests to advertising sites.

Spyware can also come bundled with Shareware or other Downloadable software, as well as music CDs. The user downloads a program and installs it, and the installer additionally installs the Spyware. Although the desirable software itself may do not harm, the bundled Spyware does. In some cases, Spyware authors have paid shareware authors to bundle Spyware with their software. In other cases, Spyware authors have repackaged desirable freeware with installers that add Spyware.

A third way of distributing Spyware involves tricking users by manipulating security features designed to prevent unwanted installations. Internet Explorer prevents websites from initiating an unwanted download. Instead, it requires a user action, such as clicking on a link. However, links can prove deceptive: for instance, a pop-up ad may appear like a standard Windows dialog box. The box contains a message such as "Would you like to optimize your Internet access?" with links which look like buttons reading Yes and No. No matter which "button" the user presses, a download starts, placing the spyware on the user's system. Later versions of Internet Explorer offer fewer avenues for this attack.

How Affects, Effects and behaviors

A Spyware program is rarely alone on a computer: an affected machine can rapidly be infected by many other components. Users frequently notice unwanted behavior and degradation of system performance. A spyware infestation can create significant unwanted CPU activity, disk usage, and network traffic, all of which slows the computer down. Stability issues, such as application or system-wide crashes, are also common. Spyware, which interferes with networking software commonly causes difficulty connecting to the Internet.

In some infections, the spyware is not even evident. Users assume in those situations that the issues relate to hardware, Windows installation problems, or a virus. Some owners of badly infected systems resort to contacting technical support experts, or even buying a new computer because the existing system "has become too slow". Badly infected systems may require a clean reinstallation of all their software in order to return to full functionality.

Many spyware programs display advertisements. Some programs simply display pop-up ads on a regular basis; for instance, one every several minutes, or one when the user opens a new browser window. Others display ads in response to specific sites that the user visits. Spyware operators present this feature as desirable to advertisers, who may buy ad placement in pop-ups displayed when the user visits a particular site. It is also one of the purposes for which spyware programs gather information on user behavior.

Many users complain about irritating or offensive advertisements as well. As with many banner ads, many spyware advertisements use animation or flickering banners which can be visually distracting and annoying to users. Pop-up ads for pornography often display indiscriminately. Links to these sites may be added to the browser window, history or search function. When children are the users, this could possibly violate anti-pornography laws in some jurisdictions.

Anti-spyware programs often report Web advertisers' HTTP cookies, the small text files that track browsing activity, as spyware. While they are not always inherently malicious, many users object to third parties using space on their personal computers for their business purposes, and many anti-spyware programs offer to remove them.

It is recommended that users DO NOT INSTALL any Freeware claiming to be anti-spyware unless it is verified to be legitimate. Some known offenders include:
AntiVirus Gold
ContraVirus
Errorsafe (AKA system doctor)
MacSweeper
PAL Spyware Remover
Pest Trap
PSGuard
SpywareStrike
Spyware Quake Spydawn
Spylocked
SpyShredder
Spy Sheriff
Spy Wiper
UltimateCleaner
WinAntiVirus Pro 2006
WinFixer
WorldAntiSpy

How To Remove Spyware

Spyware Removal
Magoo's Guide to Eliminating Spyware
Spyware Doctor

Secure Your Internet Browser

Related:

Virus, Worms and Trojans

A destructive program that masquerades as a benign application. Unlike viruses, Trojan horses do not replicate themselves but they can be just as destructive. One of the most insidious types of Trojan horse is a program that claims to rid your computer of viruses but instead introduces viruses onto your computer.

The term comes from the a Greek story of the Trojan War, in which the Greeks give a giant wooden horse to their foes, the Trojans, ostensibly as a peace offering. But after the Trojans drag the horse inside their city walls, Greek soldiers sneak out of the horse's hollow belly and open the city gates, allowing their compatriots to pour in and capture Troy.

Trojan horses are broken down in classification based on how they breach systems and the damage they cause. The seven main types of Trojan horses are:
Remote Access Trojans
Data Sending Trojans
Destructive Trojans
Proxy Trojans
FTP Trojans
security software disabler Trojans
denial-of-service attack (DoS) Trojans

what is known as a Trojan horse is a destructive program disguised as a simple application or useful program. The program contains additional hidden code which allows the unauthorized collection, exploitation, falsification, or destruction of data. Though lumped in with viruses, it doesn't propagate itself like a virus does.

One of the worst kinds of Trojans is a program that claims to rid your computer of viruses but instead puts them on your computer. Another common type will open a security hole for a hacker to get into your system and do all kinds of nasty stuff

You can prevent getting a Trojan Horse by having up-to-date anti-virus software, not opening unsolicited attachments, and scanning freeware and shareware you download before you unzip.

A computer virus attaches itself to a program or file so it can spread from one computer to another, leaving infections as it travels. Much like human viruses, computer viruses can range in severity: Some viruses cause only mildly annoying effects while others can damage your hardware, software or files. Almost all viruses are attached to an executable file, which means the virus may exist on your computer but it cannot infect your computer unless you run or open the malicious program. It is important to note that a virus cannot be spread without a human action, (such as running an infected program) to keep it going. People continue the spread of a computer virus, mostly unknowingly, by sharing infecting files or sending e-mails with viruses as attachments in the e-mail.

A worm is similar to a virus by its design, and is considered to be a sub-class of a virus. Worms spread from computer to computer, but unlike a virus, it has the capability to travel without any help from a person. A worm takes advantage of file or information transport features on your system, which allows it to travel unaided. The biggest danger with a worm is its capability to replicate itself on your system, so rather than your computer sending out a single worm, it could send out hundreds or thousands of copies of itself, creating a huge devastating effect. One example would be for a worm to send a copy of itself to everyone listed in your e-mail address book. Then, the worm replicates and sends itself out to everyone listed in each of the receiver's address book, and the manifest continues on down the line. Due to the copying nature of a worm and its capability to travel across networks the end result in most cases is that the worm consumes too much system memory (or network bandwidth), causing Web servers, network servers and individual computers to stop responding. In more recent worm attacks such as the much-talked-about .Blaster Worm., the worm has been designed to tunnel into your system and allow malicious users to control your computer remotely. Key Terms To Understanding Computer Viruses:

Virus
A program or piece of code that is loaded onto your computer without your knowledge and runs against your wishes.

Trojan Horse
A destructive program that masquerades as a benign application. Unlike viruses, Trojan horses do not replicate themselves

Worm
A program or algorithm that replicates itself over a computer network and usually performs malicious actions

Blended threat
Blended threats combine the characteristics of viruses, worms, Trojan Horses, and malicious code with server and Internet vulnerabilities .

Antivirus program
A utility that searches a hard disk for viruses and removes any that are found.


A Trojan Horse is full of as much trickery as the mythological Trojan Horse it was named after. The Trojan Horse, at first glance will appear to be useful software but will actually do damage once installed or run on your computer. Those on the receiving end of a Trojan Horse are usually tricked into opening them because they appear to be receiving legitimate software or files from a legitimate source. When a Trojan is activated on your computer, the results can vary. Some Trojans are designed to be more annoying than malicious (like changing your desktop, adding silly active desktop icons) or they can cause serious damage by deleting files and destroying information on your system. Trojans are also known to create a backdoor on your computer that gives malicious users access to your system, possibly allowing confidential or personal information to be compromised. Unlike viruses and worms, Trojans do not reproduce by infecting other files nor do they self-replicate.

Added into the mix, we also have what is called a blended threat. A blended threat is a sophisticated attack that bundles some of the worst aspects of viruses, worms, Trojan horses and malicious code into one threat. Blended threats use server and Internet vulnerabilities to initiate, transmit and spread an attack. This combination of method and techniques means blended threats can spread quickly and cause widespread damage. Characteristics of blended threats include: causes harm, propagates by multiple methods, attacks from multiple points and exploits vulnerabilities.

To be considered a blended thread, the attack would normally serve to transport multiple attacks in one payload. For examplem it wouldn't just launch a DoS attack — it would also install a backdoor and damage a local system in one shot. Additionally, blended threats are designed to use multiple modes of transport. For example, a worm may travel through e-mail, but a single blended threat could use multiple routes such as e-mail, IRC and file-sharing sharing networks. The actual attack itself is also not limited to a specific act. For example, rather than a specific attack on predetermined .exe files, a blended thread could modify exe files, HTML files and registry keys at the same time — basically it can cause damage within several areas of your network at one time.

Blended threats are considered to be the worst risk to security since the inception of viruses, as most blended threats require no human intervention to propagate.

Combating Viruses, Worms and Trojan Horses

The first steps to protecting your computer are to ensure your operating system (OS) is up-to-date. This is essential if you are running a Microsoft Windows OS. Secondly, you should have anti-virus software installed on your system and ensure you download updates frequently to ensure your software has the latest fixes for new viruses, worms, and Trojan horses. Additionally, you want to make sure your anti-virus program has the capability to scan e-mail and files as they are downloaded from the Internet. This will help prevent malicious programs from even reaching your computer. You should also install a firewall as well.

A firewall is a system that prevents unauthorized use and access to your computer. A firewall can be either hardware or software. Hardware firewalls provide a strong degree of protection from most forms of attack coming from the outside world and can be purchased as a stand-alone product or in broadband routers. Unfortunately, when battling viruses, worms and Trojans, a hardware firewall may be less effective than a software firewall, as it could possibly ignore embedded worms in out going e-mails and see this as regular network traffic. For individual home users, the most popular firewall choice is a software firewall. A good software firewall will protect your computer from outside attempts to control or gain access your computer, and usually provides additional protection against the most common Trojan programs or e-mail worms. The downside to software firewalls is that they will only protect the computer they are installed on, not a network.

It is important to remember that on its own a firewall is not going to rid you of your computer virus problems, but when used in conjunction with regular operating system updates and a good anti-virus scanning software, it will add some extra security and protection for your computer or network.

What is a Virus? How it Affect your Systems?
A program or piece of code that is loaded onto your computer without your knowledge and runs against your wishes. Viruses can also replicate themselves. All computer viruses are manmade. A simple virus that can make a copy of itself over and over again is relatively easy to produce. Even such a simple virus is dangerous because it will quickly use all available memory and bring the system to a halt. An even more dangerous type of virus is one capable of transmitting itself across networks and bypassing security systems.

Related: