(Approx. 962 words)

Stealth Spyware: The New Spyware Threat
Written by Kristofer Simon, a member of the Fox Valley PC Association, Illinois
Fox Tales, Volume 22, Issue 6, June 2009
www.fvpca.org
krisdream (at) earthlink.net

This article has been obtained from APCUG with the author’s permission for publication by APCUG member groups; all other uses require the permission of the author (see e-mail address above).

For most of us, the word spyware is not an unfamiliar term anymore. It can mean cookies that track your movements on web pages or other little programs that put garbage applications on your machine. While spyware intentions have not changed much over the past few years, their infection practices appear to be doing so. The newest kind of spyware, which I personally came in contact with a few months ago, should be referred to as “stealth” spyware. What I mean by that is that this spyware installs on your machine without you even knowing about it. You do not become aware of the spyware infection on your machine generally until the next time you reboot and the spyware program activates. In this short article, I will describe my experience with a piece of this spyware and what I had to do to get rid of it so that, hopefully, none of you have the same experience that I did. 

The piece of spyware that infected my machine was called “XP Police Antivirus.” I became infected, I believe, after visiting a third party website that provided updated information and screen shots for Nintendo Wii games that were about to hit the market and that were in development. As I said earlier, this program was a piece of “stealth” spyware and installed on my machine without my knowledge. It did not slow down the performance of my machine at all (at least not that I was able to notice), nor did any installation screens pop up during the install. The next time I booted up my machine,
an icon appeared on the lower right hand part of my screen that looked like the XP Security Center shield. When I put my cursor over it to see what it was, it said “XP Police Antivirus.” For just a split second, I wondered if maybe Microsoft had tried to install a new version of an antivirus program they created on my machine, but I quickly realized that this was a piece of spyware that had infected my machine without my knowledge.

The program tried to fool me into thinking that anonymous users from the Internet (it would put public IP addresses in the warning dialog boxes) were attempting to access my computer maliciously and it recommended that I install the full program to prevent these attacks. I wasn’t going to do this because I had the full and up-to-date version of McAfee Security Center so I knew this was bogus. When I tried to remove the program through the Add/Remove Programs option in the Control Panel, I was able to wipe out the program temporarily but the next time I rebooted my machine, the application
icon was in my system tray again and I was getting the same bogus dialog boxes about people trying to access my computer. This spyware also put another program on my machine called Security Center 2009 that also was made to look as realistic as possible.

Finally, I went on my Motorola Q Smart Phone and searched on the XP Police Antivirus program. Immediately, I got a link to a page that told me that this was a piece of stealth spyware and told me how to get rid of it. I actually had to go into the computer’s registry (kind of like the computer’s brain) and delete the entry that the spyware had made there, as well as delete a number of files the program had put on my machine. Once I did that, the spyware programs (both XP Police Antivirus and Security Center 2009) were finally gone but I still had one more hurdle to overcome from this program.
The spyware also installed a software program known as a “browser hijacker.”

For those of you who don’t know what this is, let me explain. Let’s say you launch a web browser and you want to go to www.cnn.com to see the latest news. You type www.cnn.com into the address bar of your browser and either hit “go” or hit return. The browser initially begins to go to that page, but suddenly the browser gets “redirected”
to another page. This happens every time you try to access a web page. These programs are EXTREMELY hard to get rid of but I was able to get rid of the one on my machine using a third party program that found the program and removed it.

While this may sound like a dire situation, the most important thing you can do as an end user in these situations is to remain calm and scrutinize every program that you see on your machine, that you haven’t specifically downloaded (ex. a game, a patch from Microsoft, etc.). If you do get infected by stealth spyware and can’t seem to get rid of it, go to a non-infected PC or web enabled cell phone and do a search on the program’s name. You will almost always get a link telling you how to get rid of the program. Also, never send personal information over the Internet to any site that you cannot confirm is a legitimate site that you use (ex. Amazon.com, Paypal, etc.). Using these steps you can help eliminate most of the problems caused by spyware, but you should always
remain vigilant. You can get infected with a stealth spyware program from just about any website, so be careful out there!