The Scourge that is Kazaa
|
|
And it must be said that this is a difficult time for families who compute. Never in my career as a computer consultant have I seen computers get so mucked up with parasites by people who have done so little to deserve it. Most of the time, potential clients who call me have absolutely no idea what has happened to them; they are brought to their electronic knees with sluggish performance and incessant pop-ups and they never saw it coming. I am not talking about the simple type of spyware that you can remove with Ad-Aware and SpyBot. I am talking about the type of self-spawning trojans that bury themselves deep into the operating system and require thorough Registry scrubs and forays into Safe Mode in order to eradicate. I have become adept at fixing these machines but I remained in the dark about the direct cause. Most of my clients run firewall software or use routers; most of them exhibit responsible email practices. But there were three persistently common elements that I observed:
There was just too much smoke not to have some fire, so I decided to become the George Plimpton of spyware. I just had to find out what was creating such drek on my clients’ computers.
|
| SynTPLpr.exe | Driver for notebook touchpad |
| SynTPEnh.exe | Second driver for notebook touchpad |
| drivesub.bat | Batch file I wrote for creating drive letters |
| qttask.exe | Quicktime module |
Within one business day, these additional entries were added:
| rundll16.exe | Virus that allows remote system control |
| cdaEngine0400.dll | The WildTangent gaming engine installed by AIM |
| SpywareStormer.Exe | Installed by AIM (I think I might have said yes to this) |
| kazaa.exe | The file-sharing program |
| P2P Networking.exe | Peer-to-peer component (Installed by Kazaa but NOT required by Kazaa) |
| updmgr.exe | Updater for eUniverse, one of the "Gain Gang" of programs installed with Kazaa |
| Points Manager.exe | Tracks Kazaa points earned for number of files shared |
| CMESys.exe | Part of the Gain Gang |
| mtsoemon.exe | The My Search toolbar that cannot be removed by conventional means |
| orbitupdate.exe | The trojan that hijacked my browser’s default page and inserted all of the links into my Favorites. |
| srchupdt.exe | A randomly-generated and self-spawning executable placed in the Windows folder that becomes an ad server. If you delete it, another one appears with a different name the next time you boot. |
So, are we having fun yet? It is no wonder that my boot time went from 45 seconds to over four minutes. And this is after just one day.
Unfortunately, many of these parasites are not the kind that can be eradicated with the reputable spyware removal programs. Ad-Aware found 346 suspicious objects and removed them all. SpyBot found 123 more. But while these programs can remove most parasites from memory and eliminate their entries in the Registry, they are unable to detect the engines that are capable of restoring the parasites the next time the system starts. When Ad-Aware and SpyBot were done, the search bar, P2P Networking, and CMEsys were still running on the system. To SpyBot’s credit, it did eliminate permanently Orbit, arguably the nastiest of the parasites I contracted in this brief period.
But this was a lab experiment; in the real world, you would probably go days, maybe weeks, and sometimes months, before garnering the strength to do battle with your system. And removing this grade of infestation requires careful, deliberate, and deft handling of files and operating system resources that normal users are not expected to know about and would have no business tinkering with. Removing these parasites is akin to removing the engine of a car, repairing it, and then putting it back.
What can you do?
Believe me, I know how hard it is to tell your 11-year-old that she can no longer use AOL Instant Messenger. Wage that battle and you’ll wonder if having a computer in the house is even worth it. Here are our recommendations:
-
If you can afford it, buy your kids their own computer. They might still muck it up, but at least they’re not mucking up the system that you need for more important matters. And because they might still muck it up, follow these other points...
-
Update Windows XP aggressively. The new major maintenance update includes several significant measures for safer computing.
-
Short of that, set AIM to not start automatically (from Preferences | Sign On/Sign Off). You will save almost two minutes of downtime when the system starts and you won’t be bothered by unwanted buddy lists, sounds of doors opening and closing (a popular WAV file used to signify when others log on and off), the decidedly Gen-Y welcome screen with news about celebrities you have never heard of, and the intermittent popups that AIM produces. When your kids want to IM, they can click the Desktop icon to start the service.
-
Coach them vigorously on never answering any pop-up ad. "Just Say No" is not good enough—often times, answering No is the same as answering Yes. Don’t answer at all. They should click the X at the extreme top-right of the browser window, and if you they are not sure which X to click (some windows try to fool you there, too), they should right-click the ad’s icon in the Task Bar and choose Close.
-
Do not allow ActiveX controls to run without your permission. From Internet Explorer, go to Tools | Internet Options | Security | Custom Level. From there, find Download signed and unsigned ActiveX controls and set them to Prompt or Disable.
-
Prohibit any peer-to-peer networking applications, including Kazaa. Teenagers in the house might rebel as vociferously as the pre-teens do about AIM, and all parents draws their own lines in the sand of the family beach. That’s where I draw mine: absolutely no Kazaa. Today, you can buy a song from iTunes for 99 cents, and I’d be happy to give my kid a song allowance to make up for the free downloading they have to give up on. Or maybe I should just inform them that using iTunes insures against their being arrested for illegally downloading music...
In early September, the New York Times reported on the sharp increase observed in use of instant messaging, as a direct consequence of spam reducing the effectiveness of email. We sincerely hope that these people are not trading one poison for another, and far worse, one. I do not include myself among the proponents of instant messaging as an email replacement, as I think it degrades communication in several significant ways:
-
IM’ing invites cryptic speech, clipped expressions, and poor grammar. I know I sound like an old fogey here, but as a writer, I believe that written communication should exist on a higher plane than spoken communication.
-
Setting grammar aside, you are not capable of composing your thoughts in a live chat session as articulately as in an email. Taking the time to compose an email (a luxury you do not have with IM) is crucial to good business correspondence. There are things that I would not say over the phone, preferring to collect my thoughts first, and that is precisely the same for IM.
-
Most IM software does not have the capability of your email client for keeping a history of your correspondence. No Sent Items, no folders to organize correspondence, no ability to forward messages.
Instant messaging is an evolutionary step in communication, no doubt. But replacing email? Get serious. And is spam so bad that you are willing to compromise the security of your computer and invite popup swarms? If so, you need to change your email address periodically as I do. Otherwise, I think that your treatment is worse than the condition you are trying to treat...