What in general constitutes malicious or criminal distribution of harmful
and uninvited code/programs? Such is generally clear in situations like the
Swen virus which is a crime and arrests are made.
Here's one I dealt with recently which I'll indict the BackWeb folks. And
F-Secure because of their un-natural association therewith.
Suddenly one afternoon at a small company an XP Pro(fully patched and Nav
latest defs protected) workstation was unable to find/bring-up
www.google.com on the web. Each time a specific IP address would appear
instead. So I started investigating. The first thing of course was to
suspect a virus, trojan or worm. The fact that Google and only Google had
stopped working seemed to me to constitute a malicious interruption of
service/operation so something that NAV would find was what I started
looking for. So I double checked NAV defs to be the latest and NAV found
nothing. A search at Symantec found nothing so I decided to try another AV
program and downloaded F-Secure trialware and it found nothing. I could
find nothing wrong but just Google wouldn't work. I ran the latest Adware
6.181 + latest defs and it found a usual few things which got removed but
still NO Google operation.
So I asked myself what that strange IP was and striking out finding
anything, I simply submitted that IP to Goolge-Web and then Google-Group
on another unaffected workstation.
Soon I found that what this was is a form of "BROWSER HIJACKING".
Something that started by those sites that overwrote your homepage setting
in IE. A behavior that I consider nearly illegal when done without user
approval which is often that case. However MS seems to do it so that
implies legal acceptability.
So I downloaded SpyBot which is more agressive and more tedious than AdWare
and ran Spybot which found a ton of stuff and started removing the crap it
found. Soon I had a machine that was frozen and wouldn't complete a boot.
This was rather unexpected as I've used SpyBot before with no problems.
This new hijacking behavior involves overwriting the Windows HOSTS file and
apparently it's BackWeb code. It hijacks all searches to some brand-X
search site and apparently BackWeb contains some anti SpyBot code also.
Overwriting the HOSTS file destroyed user data as the HOSTS file was in use
at this company and of course Google operability was maliciously
interrupted. The fact that this is a file and was maliciously over written
constitutes a felony in my opinion. My Google research found that
apparently some code by the BackWeb folks, which is immediately attacked by
SpyBot and less so be AdWare, is the culprit.
Anti-Virus folks need to be lilly white and avoid all appearances of nasty
involvements. The freeze up of that XP Pro machine was due to the
interaction of SpyBot and ANOTHER VERSION of BACKWEB THAT F_SECURE FOLKS
EMBED IN THEIR TRIALWARE. That interaction caused me hours of hand
debugging and uninstalling in safe-mode to regain operability on that XP Pro
workstation.
The fact that F-Secure installed BackWeb, which attacks Spybot, on that XP
Pro machine without user permission constitutes a complete impeachment of
F-Secure as a reputable security company.
BLACKLIST if not prosecute F-SECURE.
Prosecute anyone over-writing the file HOSTS without premission.
Reply With Quote