It all started this Saturday as I was trying to get my computer to read the DVD-RAM drive off my new digital camera. I was searching for a tool to help me decode the .vro files on the disk (the bundled software that came with the camera is not working right, but that's another story). I saw an article about ULead that said their software would read this file type, so off on a search for ULead. What I found was a website at http://cracks.st and I clicked on it --- bad mistake! For those of you who do not know, a "crack" is a term used to describe software code that will make copy protected software available for use freely (that means without registration or payment required). Sometimes is a piece of code that unlocks the copy protected software or sometimes it's the software itself.

I know what a crack is, before I clicked on this dastardly link. And I know that ULead software would not be found at this site (I found the right site). But being a computer weenie and always interested in what's going on elsewhere, my curiosity made me click on this site. I will tell you right up front that this website does contain code that will unlock software, but the penalty associated with going to this site would be disastrous for any novice. It caught me and it would catch you. So with one click, began my decent into computer hell.....

I've talked about this before in some earlier post to GrayScales, the drive-by installation of scumware software. If you're using MS Internet Explorer, you are vulnerable to this happening. All that is required, is that you get linked to a website that has these malicious scripts installed. Sometimes they'll warn you and ask permission to install themselves, but most of the time the bad guys don't ask, they install themselves with no warning from Internet Explorer nor from Microsoft Windows. The infamous Gator (now known a Claria) is a good example of a program that uses this type of installation method. This is downright unacceptable behavior (I'm really inclined to use more colorful language here) in regards to Microsoft. This type of attack installs dangerous programs, makes changes to your computer's critical registry files, and can literally take over your computer, violate your privacy, and right out piss you off! (okay, a little colorful... but I AM). This should be considered a virus, but it's not. A well updated anti-virus program will not protect you from this type of attack. 

The result of my encounter with this drive-by scumware attack was that I had a program call "FavoriteMan" installed. At least this is what I believe was the first one installed, mainly because it's categorized by my SpyBot program as code that will install other scumware after it has installed itself. What (but not all) that I got hit with was Ezula (hijacks the keywords on your websites), SaveNow (popup adware galore), PurityScan (supposedly searches for adult content but really serves ads), PopNav (hijacks your browser homepage), MySearch (hijacks your search sidebar and installs a toolbar), eAnthology (supposedly a popup stopper, but results are worse that any popup), Bargain Buddy (another ad server), BackWeb Lite (software that auto-updates your computer, normally used by OEMs but can serve popups & ads), 2nd Thought (another homepage hijacker), DyFuCa (a dialer program that connects you to pornographic websites) and the worst yet XXXToolbar Pornographic IE Toolbar (it will redirect homepage and searches to slotch.com. (http://www.xxxtoolbar.com). This thing installed 119 porno site links into my Favorites folder in Internet Explorer. There was much more that got installed on my computer and I won't go into all the details, but for almost the entire weekend my computer was out of commission. It seemed like every time I restarted it, these program would get reinstalled.

It took a combination of tools and techniques to clear this junk out and I'm not 100% sure it's all gone (I'm really considering doing my annual reformat and reinstall now). I ran my Spybot program (http://www.safer-networking.org), Adaware (http://www.lavasoftusa.com) and bought SpyHunter (http://www.enigmasoftwaregroup.com/) for $29.99. Additionally, I manually searched my computer's registry file, my computer's hard drive and tried to ferret out all instances of this scum. I did discover another program that may help in preventing such attacks in the future. There's a registry file that blocks all known "bad" ActiveX controls from running inside Internet Explorer by setting the "Kill bit". http://www.spywareguide.com/blockfile.php show several methods, but the RegBlock file looks like a good alternative for the non-technical folks. It allows you to select which program you want to block from your system (for example, the Alexa ToolBar is considered to be spyware among some circles). RegBlock is currently priced at $19.95 and you can reach their order form at http://www.regnow.com/softsell/nph-softsell.cgi?item=4353-4&affiliate=20229 It's pretty simple to use, just download, install, run and select which programs you want to block. I bought it and installed it myself. I'm crossing my fingers that it will help against future attacks, but from a technical perspective it made sense to me.

This is not something I'd like to see others go through, but I expect we'll be hearing a lot about this kind of attack this year. Happy New Year...... Jim