EarthLink finds rampant spyware, trojans

[spy1]

"Internet service provider EarthLink and Webroot Software released a report on Thursday that said an average of almost 28 spyware programs are running on each computer. More serious, Trojan horse or system monitoring programs were found on more than 30% of all systems scanned, raising fears of identity theft.

The report presents the results of scans of over a million Internet-connected computers. Many of the 29 million spyware programs that were found were harmless "adware" programs that display advertising banners or track Web surfing behaviors. However, the companies also found more than 300,000 instances of programs that are capable of stealing personal information or providing unauthorized access to computers, the companies said."

Read the full article HERE (http://www.nwfusion.com/news/2004/0415earthfinds.html) . Pete

[Paul Wilders]

Pete,

Sad to say - but I for one didn't expect otherwise. Smaller reports indicate an even higher infection ratio, especially in regard to trojans/backdoors...

regards.

paul

[Detox]

Yeah, but also keep in mind that if they scanned those internet-connected computers, that means they only scanned visible machines 8)

[Pretender]

I use Earthlink and now I'm real curious. How did they obtain this information? Did users get scanned without their knowing by Earthlink? I believe my system is pretty secure. Wouldn't care too much for my ISP scanning me without my knowledge. The article really didn't say how the info was gained.

[Mele20]

I didn't know about this thread earlier today and I started one on Webroot's spyware analyzer.
http://www.wilderssecurity.com/showthread.php?t=28274

This site is claimed to be a privacy invader by the analyzer after I ran it on my XP computer. The analyzer also claims my ISP is a privacy invader and that is true...they ram tons of advertising down the throat of someone paying $45 a month plus .04% tax for their connection. That is wrong. Supposedly Wilders is a privacy invader because it uses banner ads. I don't think this site belongs in the same category with my ISP. This site doesn't charge any fees like my ISP charges me so I think ads are ok here but not on my ISP's site.

[Robyn]

I am puzzled as I run Ad-aware and Spybot which removed the Alexa key quite some time ago. I run both these programs daily and have clean results everytime yet when I went to the Earthlink scan it shows Alexa Toolbar ??? I don't even know what it looks like to remove it as I thought Ad-aware and cleaned the bit which spies in IE.
I have looked for removal instructions but all indicate Ad-aware etc or via add/remove - it is not listed there and I have never downloaded this myself ???

I have SpywareGuard / SpywareBlaster / IE Spyad & TDS - even Hijack this does not show anything to do with Alexa ??? I don't want this but I do not no where to find it to remove it :-\

[spy1]

-{ Quote: "Yeah, but also keep in mind that if they scanned those internet-connected computers, that means they only scanned visible machines 8)" }-

If EarthLink is your ISP, trust me - you're
visible (to them, anyway). Pete ;D

[Detox]

Ahhh well Pete I'll certainly keep that in mind if I move in the next few years, as I may well wind up doing. I'll avoid them folks at all costs ;D

[Pieter_Arntz]

[sarcastic mode]I am very impressed by this online scanner that found 9 pieces of AdWare on my computer. ::)
And that within 5 seconds where all my other scanners need at least minutes. [/sarcastic mode]

Robyn,

To answer your question, this scanner does not make any difference between active or inactive. In that regard it was accurate on two counts on my computer Alexa and BackWeb which came with IE and my Kodak camera software. But trust me that both are disabled.

This reminds me of tactics used by some supposed SpywareRemovers that try to trick you into buying your product by finding "things" like:

Spy #a7c44 -- Research In Progress
Spy #79943 -- Research In Progress
Spy #66eae -- Research In Progress
Spy #137c3 -- Research In Progress

Adware Cookies

Spy #ec5aa -- Research In Progress
Spy #91517 -- Research In Progress

and then they tell you the paid version will get rid of it for you. :lurking:
Oh wait, they are offering .... errrrmm

Regards,

Pieter

[Robyn]

Thanks Pieter, I noticed the research in progress ones too!!! After the scan I ran HijackThis and guess what they were in there too ::) I will keep my computer clean with Ad-aware and Spybot plus the anti-spyware army I have. It just makes me cross when they stated toolbar as when I searched on Spybot forum there is an actual toolbar which I have never downloaded. I know Ad-aware took care of Alexa for me and even did this again when I had a fresh install of IE.

[Riverwind]

-{ Quote: "Pete,

Sad to say - but I for one didn't expect otherwise. Smaller reports indicate an even higher infection ratio, especially in regard to trojans/backdoors...

regards.

paul" }-

Let's see there are dozens of excellent free antispyware apps and counter measures out there, and people still don't borther to use them.

On the other hand There are NO good free trojan scanners , so wouldn't it be even more likely such malware are not detected?

I would bet many of the people here like myself have trojans,backdoors in our computer and we don't know it.

[Mele20]

Am I the only person who had Wilders Security listed as spyware/adware by this tool?

[dvk01]

no it says it to me too

I used to think that webroot made good software and I'm sorry to see rthe, go down the path of making a quick buck by scaring people
and using the same unscrupulous tactics as other applications we do not approve of

[Jen]

Hello, I was just searching and I landed right on this page. I wanted to take a
minute to tell the Earthlink subscriber that When Earthlinks spyware blocker in Total Access 2004 is enabled and you use it to scan I think theres someplace in the settings to submit the logs if you want to. (I dont think it does it on its own)
HTH

[voleman]

Re. Alexa

Same here... tried 7 or 8 scanners, no luck...
finally, this [Spy Sweeper 2.6] worked:
http://www.spychecker.com/program/spysweeper.html

[Pretender]

-{ Quote: "Hello, I was just searching and I landed right on this page. I wanted to take a
minute to tell the Earthlink subscriber that When Earthlinks spyware blocker in Total Access 2004 is enabled and you use it to scan I think theres someplace in the settings to submit the logs if you want to. (I dont think it does it on its own)
HTH" }-


Think you may have meant me? Anyhow, I have "privacy tools" turned off in Total Access 2004. Guess you're indicating that Earthlink obtained the information from those users who allowed the submission of that info to them?

[ronny]

-{ Quote: ""...average of almost 28 spyware programs are running on each computer. .. Trojan horse or system monitoring programs were found on more than 30% of all systems scanned.
...more than 300,000 instances of programs that are capable of stealing personal information or providing unauthorized access to computers.."
. Pete" }-

Finally , now i have some proof :D
My friends said that i overdo it by installing anti-trojan- & spywarescanners.

One of them works in the social sector.At her work they only have Norton antivirus installed.NO firewall (only XPbuild in) anti-trojan nor spywarescanner, although their comp are connected to the internet 24hours ,7days ADSL.All the private info of their clients and financial info of their organization is on that pc.Everyone of her co-workers has administrator rights although they aren't "pcliterate"
I finally convinced here to install S&D : it found 196 malaware!

[craigbass76]

Doesn't spybot put in dummy alexa files so that whatever program installed it still runs? Isn't that why other spy scanners will pick it up on subsequent scans?

[Robyn]

Spybot does put a dummy file in but Ad-aware will remove Alexa - I found out the culprit when mine was scanned at earthlink and not found by Ad-aware or Spybot. I use Avant and was shocked when looking at the various tools to discover one of their quick search bars was the Alexa toolbar - I have removed all of their quick search bars now. Thankfully I had never used their quick search or any of their search engines but I was shocked when I found this hidden in the tools :( Anyone who uses Avant should check the settings to see this >:( I use the browser because I like the tabs but it has certainly made me very wary now with any upgrades to this browser!

[gt0159c]

There were a couple of posts earlier asking how EarthLink and Webroot arrived at these numbers that sparked my curiosity, so I did a little looking around. If you go to the original EarthLink press release, it says: “The results from the SpyAudit report are culled from EarthLink's and Webroot's SpyAudit detection programs that run analyses of Internet users PCs and provide audited reports of spyware residing on the machines.” Spy Audit is a quick scan that anyone can run to check out what is on their system.

The press release is here:
http://www.earthlink.net/about/press/pr_spyAudit/

Spy Audit is here:
http://www.earthlink.net/spyaudit/

and here:
http://www.webroot.com/services/spyaudit_03.htm

EarthLink and Webroot tallied the results from all the scans.