You are here

OPEN SOURCE SPYWARE PROTECTION??

12 posts / 0 new
Last post
Nathan9222
Nathan9222's picture
Offline
Last seen: 2 years 12 months ago
Developer
Joined: 2007-12-06 22:35
OPEN SOURCE SPYWARE PROTECTION??

I was wondering if there was any open source spyware protection, cause it would be nice to have on a usb, since if u have seen my previous forum, https://portableapps.com/node/11390 then u will know y this would be usefull to me. it would help me feel more secure, because our school computers have been infected with DARKUSB and who knows what else there might be that comes with it. Anywho any links or names of spyware protecting software would be appreciated.

rab040ma
Offline
Last seen: 3 months 6 days ago
Joined: 2007-08-27 13:35
Spyware (which in my mind is

Spyware (which in my mind is any software that installs itself without your permission or is hard to remove, even if it isn't otherwise malicious) is pretty close to virus or trojan or other malware behavior. It might only want to pop up advertising, and thus it might not be terribly efficient at infecting everything that plugs into the machine. But that doesn't mean it couldn't be just as efficient at spreading as a virus. Which means that everything we said about virus or trojan applies to spyware.

If machines at your school continue to be infected, and you have already reported it without effect, I think there might be a political solution: ask parents or other taxpayers to join you in requesting that the machines be cleaned up and properly secured. It may even be illegal for the owners of those machines to knowingly allow them to infect other devices or machines, which means the school administration really needs to get its act together.

One usual way that spyware gets installed on the machine is through web browsing to untrustworthy sites, where you are enticed to do something. It may be to install software to scan your machine for viruses (which also installs software to pop ads up at you); it may be a postcard that you can view (which also installs software to pop ads up at you). Those things can be reduced if the person using the web browser has limited permissions on the computer, since most of those things don't work unless the user is running as an administrator. One can also use "run as limited user" or sandboxie to achieve the same thing. So if the computer is not already infected with spyware, adware, trojans, and viruses, that might be one thing that could help.

Of course, write-protecting the drive can keep it from being infected. Not many drives have a write protect switch (and it has to be a hardware switch).

At any rate, if you plug your drive into an untrusted machine, it can get compromised.

MC

Aciago
Aciago's picture
Offline
Last seen: 11 months 3 weeks ago
Joined: 2007-01-24 14:23
.

Nathan9222, you can install SpyBot Search & Destroy and/or Spyware Terminator and/or Sophos Anti-Rootkit and/or Ad Aware on your computer and then just copy the installed folder onto your USB Drive and uninstall the App. Now you can use any of those programs on the computer you want.

ClanWin Portable also detects most spyware.

rab040ma, are you sure you gave an answer? Wink

If a packet hits a pocket on a socket on a port,
and the bus is interrupted as a very last resort,
and the address of the memory makes your floppy disk abort,
then the socket packet pocket has an error to report Biggrin

rab040ma
Offline
Last seen: 3 months 6 days ago
Joined: 2007-08-27 13:35
Your answer gives helpful

Your answer gives helpful instructions for running anti-spyware software.

I only have a few reservations about your answer:

  • In my opinion, real protection doesn't allow spyware to be installed in the first place.
  • The solution you describe permits detection after the spyware has been installed on the USB drive (in many cases).
  • I think the OP was looking for something to prevent spyware from being written to his USB while on the school computer, and I don't think your solution accomplishes that ... does it?
  • Some spyware that has been installed can be removed by some anti-spyware software.
  • If the spyware signature or behavior is not yet included in the anti-spyware program, the anti-spyware program won't detect it let alone remove it after the fact.
  • I tend to lump spyware in with all malware -- the lines get blurred

Perhaps I'm missing something ...

MC

Aciago
Aciago's picture
Offline
Last seen: 11 months 3 weeks ago
Joined: 2007-01-24 14:23
well

in this case, he can´t install any software at teh school's PC so he needs a portable solution... and of course it will check (and clean) after the infection have ocurred... the only way to prevent an infection without inserting the USB first and without installing any software in the host computer is not using any usb... Wink

What I do is, I have an old and small (256mb) USBDrive that I call "securymovil", it have every portable antispyware and antivirus I have found, when I don´t trust a computer I run this USB drive first (just checking with fast scan or memory scan) to clean any possible infection, then I use my main 4Gb loaded with many many apps usb drive... Blum

BTW, I keep an up to date backup of SecuryMovil on my computer, so if my USB drive get infected and can´t be cleaned I just format it and reinstall everything... I´m sorry if this is more complicated and time consuming but it´s is the most secure option I have found (and it works... twice)... Smile

EDIT: My menu in SecuryMovil is Toolbox.

If a packet hits a pocket on a socket on a port,
and the bus is interrupted as a very last resort,
and the address of the memory makes your floppy disk abort,
then the socket packet pocket has an error to report Biggrin

rab040ma
Offline
Last seen: 3 months 6 days ago
Joined: 2007-08-27 13:35
Let's for the sake of

Let's for the sake of argument assume that when you insert your securymovil drive into the school machine it doesn't get compromised or corrupted. (If it does, and you notice it, you can always wipe it and reinstall from your backup when you get home, using safe techniques to keep it from infecting anything else.)

You'd have the most confidence in detecting one of the older, common malwares, either with a memory scan or doing a quick scan of obvious locations on the PC. (Newer or 0-day viruses would be problemmatic.)

If you are running with Administrator privileges at that point, your kit of tools might be able to disable and remove the malware. This works with the least noxious virus/trojan/spyware programs. The more nasty versions are hard to remove once they are firmly installed. Yes, there are tools for that, but the only way to be quite sure you have removed all the baddies is to reformat the drive and reinstall everything from scratch. Usually to remove one of the nastier malware programs takes much more time than one study hall for a student -- just scanning the C drive can take that long.

I'd be concerned to give the OP a false sense of confidence, although it sounds like he has been wrestling with the DARKUSB trojan enough to lower his confidence.

Got a list of the tools on that SecuryMovil USB drive? It might be good to compare notes.

MC

Aciago
Aciago's picture
Offline
Last seen: 11 months 3 weeks ago
Joined: 2007-01-24 14:23
list

AdAware 2007
ClamWin Portable
Astra32
CCleaner
Disk Defrag
TuneUp Utilities
Spyware Terminator
StartUp Run
Elistara
Flash Disinfector
KillBox
Avast
Free Registry Defrag

and of course ToolBox

If my USB get infected I format it under Kubuntu... Smile

If a packet hits a pocket on a socket on a port,
and the bus is interrupted as a very last resort,
and the address of the memory makes your floppy disk abort,
then the socket packet pocket has an error to report Biggrin

RMB Fixed
Offline
Last seen: 14 years 8 months ago
Joined: 2006-10-24 10:30
How ?

.. do you clean a host that you do not have admin-rights on ?

mstinaff
Offline
Last seen: 14 years 7 months ago
Joined: 2006-10-01 10:58
Easy

With a Shotgun!

Key ID: 0xDAE3095F
Fingerprint: 5D98 65D2 1844 21A5 76C1 F0F6 4BE6 D689 DAE3 095F

ZachHudock
ZachHudock's picture
Offline
Last seen: 1 year 9 months ago
Developer
Joined: 2006-12-06 18:07
gotta love the

gotta love the SBemails.

"Scroll buttons and the lappy together at last, how'd you ever learn to scribbie scroll so fast?"

The developer formerly known as ZGitRDun8705

Jimbo
Offline
Last seen: 4 years 8 months ago
Joined: 2007-12-17 05:43
I always found

that nice warm soapy water, such as a bathtub, is a very effective way too - just remember to leave the power on, since it can only clean the memory if the virus is actually running at the time Wink

JayPel
Offline
Last seen: 12 years 1 month ago
Joined: 2007-10-27 10:28
VM Solution for Malware?

-- One solution for your school system administrator may be to check out the possibility of setting up VMware Players for the school system users (see the free player available at http://www.vmware.com/download/player ). Available for free to run on VMware players is a Virus-safe Internet Browser Appliance that runs Firefox on a Linux (Ubuntu) virtual machine (VM). The VM runs as a file and avoids infecting the computer, on which the VM is running. The VM can be loaded as a copy of a known clean VM file. After running during the user's session the copy is destroyed upon shut down taking along with it any particulars such as cookies, spyware, virus, trojans, etc. that may have somehow been downloaded.

-- I'm not sure where P-Apps currently stands with making available VM appliences like the Linux/Firefox VM described above. I'm aware that there has been some discussion related to Linux, but I haven't followed it closely yet.

---eom

Log in or register to post comments