Spyware

Spyware "infects" your PC but does not have the same intent as a traditional virus. Spyware usually collects information from your cookies for advertising purposes, launches pop-ups and changes your default homepage. If your startup web page changes and you reset it but it changes back on reboot, you may have spyware.

Some spyware is legitimate, meaning it is part of something you intentionally downloaded. For example, you may have installed RealPlayer. RealPlayer checks your version for updates and upgrades and prompts you when new versions are available. They also launch popups for advertising. However, you are getting their product for free and if you uninstall it, the spayware goes away too.

It is important to note that these attacks are conducted by random hackers looking to damage personal PCs, but rather a targeted attempt by entities to control how you use the Internet and force advertising on you. They are doing this for money and it is not a prank.

The not-so-nice ones are very hard to get rid of sometimes. There are many free programs that can help:
SpyBot - Search and destroy
Spyware Blaster
Hijackthis
CWShredder


Lavasoft Ad-Ware, recomended purchase product for protection and removal

ZQuest

More "It's Not Spyaware" Claims - SurfSideKick

NewDot Saga

Not only is NewDot difficult to remove, but they will sue you if you talk about it. NewDot installs very easily by simply opening an email or web page. NewDot's registry entry will try to launch this DLL on start-up: C:\PROGRA~1\NEWDOT~1\NEWDOT~1.DLL. If you delete the DLL and registry entry it will reinstall. It may only be removed completely in safe mode. Hijack this can help. But NewDot is not done with you yet! They insist that their hidden-install-forced-download-impossible-to-remove-browser-hijack is not "spyware" but simply a new type of marketing and they will sue you if you say that it is "spyware"(some call it "Foistware"). They have even filed a lawsuit against the Internet Corporation For Assigned Names and Numbers for discussing NewDot's business practices.

Letter to ICANN from NewDot
ICANN Response to NewDot


NewDot Sues Lavasoft (LavaSoft is a recommended PC security tool)


Here is a case of someone from NewDot going into a spyware discussion blog a telling users that NewDot is not spyware(see post #3): pcreview.co.uk

NewDot has a large amount of information on the subject at their site, but since we cannot guarantee that the site is safe we will not link to it directly.

Removal and Information
Removal Discussion Thread
spywaredata.com
cexx.org
cnet.com
Analyze your PC for threats
Lavasoft suit(pdf)

MIRAR

Fake Spyware Scans

oneclicksearches.com and psguard.com

• Sets default homepage to: oneclicksearches.com
• Turns on Active Desktop and defaults the page to %SystemRoot%\system32\\wppp.html which is psguard.com
• Installs these programs in c:\winnt\system32\
  down1.exe
  hhk.dll
  hpF443.tmp
  intell32.exe
  intmon.exe
  msmsgs.exe
  oleext32.dll
  shnlog.exe
  uninstIU.exe
  wppp.html
  
• Sets up a fake "Virus Alert" in your task bar. Clicking on the "alert" brings you to psguard.com where they try to sell you anti-spyware software.
• The oneclicksearches.com home page uses hijacked microsoft.com icons so the site looks like a Windows security page.
• Sets hundreds, possibly thousands of registry keys pointing to oneclicksearches.com

1. If you don't already have anti-virus software, get some. If you do have it, update the definitions lists. There are free anti-virus packages available from symantec and mcafee. Download stinger.exe.
2. Disconnect from the Internet/Network
3. Reboot in Safe Mode with Network support(reboot and hold F8)
4. Run the anti-virus software in Safe Mode
5. Disable Active Desktop(Control Panel, Folder Options)
6. Do a search for the files listed above and delete them
7. Open the Registry editor(Start, Run, regedit) and do a search for all keys with "oneclicksearches.com" and delete them. Do the same for "wppp.html" and "psguard.com"
8. If you know approximately when you got the virus, do a search on your PC for any file created since that time. More than likely you will see recently created EXEs in the system32 folder. Rename these files rather than delete them just in case they are not part of the virus.
9. Open a browser(while stil off-line!) and delete all cookies, cache, temp files, bookmarks that were added by the virus and change your home page back to what it was.
10. Reboot your PC and test to see if the viruses are gone
11. oneclicksearches.com psguard.com are registered through ESTDOMAINS, file a complaint with estdomains.com.
12. Email the admins for oneclicksearches.com psguard.com at dep@sexpicsporn.com and psguard@ua.fm and tell them how disgusted you are with their tactics.
13. File a complaint with the BBB
14. File a complaint with FTC

Gator/GAIN

Xupiter

fastsearch.cc