PC security - Caution is the parent of safety

Alexa Spyware

Wed, 20 Apr 2005 22:38:30 -0700

Spyware details:

Alexa works as an Internet Explorer toolbar and may track your web browsing and search information.

Creats files:

alxres.dll alxtb1.dll alxres.dll alexa65.inf

Add records in registry:

{0F3332B5-BC98-48AF-9FAC-05FEC94EBE73} {3CEFF6CD-6F08-4e4d-BCCD-FF7415288C3B} popmenu.menu {9D74677A-E227-40fb-9511-F7E92EA4083A} SoftwareMicrosoftInternet ExplorerMenuExtGet Alexa Data\ {7FB04DE1-4340-4002-9D9E-3B6913AE6953} SOFTWAREMicrosoftWindowsCurrentVersionInternet Settings5.0User AgentPost PlatformAlexa Toolbar {A6A08CBD-6673-41B1-B997-3F83A25B45B0}



What Are Browser Helper Objects?
Wed, 13 Apr 2005 02:21:22 -0700
From this point of view, Internet Explorer is just like any other Win32-based program with its own memory space to preserve. With Browser Helper Objects you can write components—specifically, in-process Component Object Model (COM) components—that Internet Explorer will load each time it starts up. Such objects run in the same memory context as the browser and can perform any action on the available windows and modules. For example, a BHO could detect the browser's typical events, such as GoBack, GoForward, and DocumentComplete; access the browser's menu and toolbar and make changes; create windows to display additional information on the currently viewed page; and install hooks to monitor messages and actions.


EliteBar
Wed, 13 Apr 2005 00:12:18 -0700
Summary:
This spyware installs an Internet Explorer toolbar to redirect search requests. Also EliteBar creates popup windows and change MS IE home page and settings.


123Messenger
Wed, 13 Apr 2005 00:13:01 -0700
Spanish Shopping Portal Dialer
Creates the following files:


123messenger.per

licencia.txt

msa64chk.dll

msapasrc.dll

telefonos.txt

textos.txt


123Messenger adds in the registy run section 
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
following file: rundll32.exe


00d Dialer
Mon, 11 Apr 2005 01:57:24 -0700
Details

 Dials a phone number
 Registers as BHO
 Runs in stealth mode



Dials a phone number. Creates the following registry keys:




KEY:HKCR\clsid\{ffff0001-0002-101a-a3c9-08002b2f49fb}

KEY:HCLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ffff0001-0002-101a-a3c9-08002b2f49fb}




The list of known spyware and adware
Wed, 13 Apr 2005 00:11:24 -0700
Just some names of spyware processes RegFreeze cures from


RegFreeze
Mon, 11 Apr 2005 02:00:36 -0700
Program overview
RegFreeze primary goal is prohibition of many critical data changes without your demand, such as your browser's start page and so forth.




Starting Windows in Safe Mode
Mon, 11 Apr 2005 02:05:19 -0700
 Many times in order to remove a piece of spyware or for troubleshooting and diagnostic purposes, you'll have to start Windows in Safe Mode. While in Safe Mode, only specific programs and files needed to run the operating system are loaded. Some functions, such as connecting to the Internet, will not be active in Safe Mode and a standard video driver will be loaded causing a washed out look and a possible change in resolution. However, because just the essential programs and files are loaded in Safe Mode, this allows us to remove some spyware, adware, viruses and such that cannot be removed in Normal Mode. Follow the instructions below to Start Safe Mode for your specific version of Windows.