Topic: semi-OT: Ad-Aware no longer detects Gator/GAIN spyware. (Read 4401 times)

Sirgod · « **Reply #20 on:** August 06, 2004, 06:10:56 am »

Good work On your site there Pesty. I'll send the Link to a few other People who have been Having Problems.

Stephen

Bonk · « **Reply #21 on:** August 06, 2004, 07:26:22 am »

Cool, thanks Pestalence! I missed that.

Quote

...as for Gator (GAIN), I have had no problems with Ad-Aware detecting it.. you have to keep the definitions updated just like Anti-Virus...

I did update it, the day I ran it. Still no detection of GAIN. This was on a machine at work that I found Kazaa on (which I promptly removed). There are a number of varieties and generations of gator out there now, perhaps they missed one? I'm still awaiting a conclusive response from lavasoft.

Quote

PCPitstop has an online system scan, however their Active X controll (plug in) for IE executes malicious code and adds spyware to your system.. if you disable Active X controlls as stated on my page I just listed, and say no to Active X at PC Pitstop (in XPSP2) a menubar will appear from IE stating that an Active X controll has been blocked from executing malicious code on your system... as such PCPitstop is not a safe place to go to.. it actually installs a "Hide me" code that will prevent Adaware and Spybot from detecting the Active X controll and from detecting the spyware it installs (www.coolsearch.com)..

WHOAH!!! I have never gotten "coolsearch" from there... that I know of. Are you sure about that? Have you confronted them about it? If it's true I'll give them a piece of my mind alright, complain about gator on one hand and slip in coolsearch with the other eh? Nasty buggers...

Max Power · « **Reply #22 on:** August 06, 2004, 04:14:50 pm »

The nice thing about all of these is that many of these exploits are designed to attack IE. Joy to all of us netscape users that are therefore immune. Plus, netscape comes with a pop up blocker. It works great. As for Kazaa, when you hit the install button you are actually saying "I'm dumb. Please install 500 tons of spyware crap on my system". Morpheus isn't any better, however, when you delete the spyware it still runs, unlike Kazaa. Needless to say though, don't upgrade when it prompts you to do so, since this reinstalls the spyware again (and getting rid of it can be a pain in the rear).

Bonk · « **Reply #23 on:** August 06, 2004, 05:46:12 pm »

Yup, I use Mozilla now as it is maintained where Netscape is not. Finding that copy of Kazaa installed by a user at work had me just steamin!

zerosnark · « **Reply #24 on:** August 07, 2004, 10:04:32 am »

Yeah, this is Important info Keep us updated on the adaware thing.

A friend's PC recently became totally unusable because it was *overloaded* with spy/ad ware. After doing various tricks, the system if functional, but there is still something masking itself in the "explorer" process. Chewing up about 25% of processor time. => I think I will be asked to reload the operating system in the near future.

Also, don't underestimate the importance of firewalls such as zone alarm.

Pestalence_XC · « **Reply #25 on:** August 07, 2004, 07:29:47 pm »

Quote from: Max Power on August 06, 2004, 04:14:50 pm

The nice thing about all of these is that many of these exploits are designed to attack IE. Joy to all of us netscape users that are therefore immune. Plus, netscape comes with a pop up blocker. It works great. As for Kazaa, when you hit the install button you are actually saying "I'm dumb. Please install 500 tons of spyware crap on my system". Morpheus isn't any better, however, when you delete the spyware it still runs, unlike Kazaa. Needless to say though, don't upgrade when it prompts you to do so, since this reinstalls the spyware again (and getting rid of it can be a pain in the rear).

In XPSP 2, Internet Explorer gains the function of viewing PNG files as well as having a built in pop up blocker which automatically updates so long as you have auto updates enabeled.. Also in the new Internet Explorer properties, it gives you controll of your browser plug ins and Active X controlls by adding an enable and disable command plus in the Internet Explorer Securtiy tab. they added about 18 new controlls for people to specify exactly how their system should operate on the net.. Add on top of this the fixed Windows firewall which now work spretty good.. (not as wel las Panda Firewall)... plus your Internet Explorer will notify you when a program tries to install by giving you a notification if the software is signed or not and if the signature is valid or not.. plus it alerts you of attemtped *.asp,*.net, and Active X controlls trying to add itself into your system.. however you have to adjust your Internet Securities section the InterNet Explorer properties in order for this to function 100%.. in XPSP 1, i give instructions on how to get Active X programs and self hidden installers to show themselves before they invade your system... just refer to the link posted above...

Any of you not sure on your systems and have HijackThis, run a scan and save the log file.. do not alter anything.. email it to me at starbase001@hotmail.com and put the title as D.NET HIJACKTHIS HELP. keep it as a zip file attachment and I will look through it with my Windows source files that work with HijackThis and let you know for the most part what is safe to keep on your system and what should be removed.. If i am not sure on an object, i will email you back asking what program it is referring to and give steps on how to check it out.. although I can 99% of the time find the program online with a simple file search...

Anyhow, hope that this helps.

likkerpig · « **Reply #26 on:** August 07, 2004, 07:41:56 pm »

A side track...
Question: I have Norton AV, my live update (connect to the symantec site for updates) does not connect. It used to, doesn't any more. I go to the symantec site, any page to do with updates comes up with that IE page: not available, try refresh, change your security settings, etc.
The other computer in the house has no problems with live update, I download the updates and put them on this comp.
There is a licensed, seperate version of norton on each computer.
Any ideas?
I've screwed around with my security settings since this started, nothing I have tried has helped.

KBF-Dogmatix_XC · « **Reply #27 on:** August 07, 2004, 07:53:26 pm »

Quote from: Max Power on August 06, 2004, 04:14:50 pm

The nice thing about all of these is that many of these exploits are designed to attack IE. Joy to all of us netscape users that are therefore immune. Plus, netscape comes with a pop up blocker. It works great. As for Kazaa, when you hit the install button you are actually saying "I'm dumb. Please install 500 tons of spyware crap on my system". Morpheus isn't any better, however, when you delete the spyware it still runs, unlike Kazaa. Needless to say though, don't upgrade when it prompts you to do so, since this reinstalls the spyware again (and getting rid of it can be a pain in the rear).

ROFL....that must be why I've never once bothered to download or install Kazaa or any of that sort of file sharing software. I don't think I've ever had Gator on any of my systems. Well, that's not true...when I was out of town, some friends of mine who were house sitting for me installed AudioGalaxy on my business computer a few years back. A clean reinstall of the OS ensued....heheh...

About the only P2P I use is SoulSeek. Completely clean...good stuff.

KBF-Dogmatix_XC · « **Reply #28 on:** August 07, 2004, 09:03:19 pm »

Oh yeah...and bye-bye, AdAware...hello Spybot S&D. I've been using Mozilla for a while, too. Once I heard about browser hijacking, I gave IE the boot.

likkerpig · « **Reply #29 on:** August 07, 2004, 09:18:50 pm »

I wouldn't give AdWare the boot doggy, it still picks up things spybot s&d doesn't.

KBF-Dogmatix_XC · « **Reply #30 on:** August 07, 2004, 09:29:41 pm »

Really?

Hmm...I ran Spybot and found I had 88 items to deal with after just having run AdAware 6 with the latest update the other day. The tracking cookies 9which were most of the items) I'd expect. There were some other items I'm sure aren't new that AdAware missed.

I guess I'll keep using both and see how it goes. It never seemed like AdAware did anything but find tracking cookies, though.

.

Bonk · « **Reply #31 on:** August 08, 2004, 07:15:58 am »

Quote from: Pestalence on August 07, 2004, 07:29:47 pm

In XPSP 2, Internet Explorer gains the function of viewing PNG files...

That will help the webmap out nicely. (depending on how they do it...)

I haven't given up on AdAware yet, either. They have responded to my email, just not to my satisfaction. They say they scan for Claria (the latest name), but it did not detect the copy of gator that I came across. Hopefully they will modify their detection.

Strat · « **Reply #32 on:** August 09, 2004, 07:59:36 pm »

I continue to use Ad-Aware and SpyBot in conjunction. Like others have stated, one catches what the other misses. Now-a-days, it's almost more important to have these than AV software! So now I put all 3 on any computer I touch.

Also, I have noticed that AdAware will catch older versions of GAIN, but miss certain others.

I worked on a mans computer that had not touched it for about 2 years or so, and it had every piece of Ad-Aware I had ever seen -plus more! So I installed Ad-Aware and updated it. Intrestingly, Ad-Aware found GAIN and removed it, among everything else. However, I have seen it pass over other installations of GAIN before.

I see no reason it should discriminate over certain installs of GAIN. Mabey Lavasoft did something recently? I don't know. But I do know that is inconsistantly detects GAIN.

-Strat

CM.E.Kehakoul_XC · « **Reply #33 on:** August 10, 2004, 12:22:13 am »

I would say we should handle spyware spreaders like they are treating thieves in Africa.
Those retarded jerks even got the nerves to run sites on the net advertising for this.
I located such a company..and i think baseball bats arent made for games...

CM.E.Kehakoul_XC

News: