How to determine if Spector Pro Spyware is running on my computer?

[G. Morgan]

Someone Else wrote:

>>I've seen this individual trolling in several other NG's
>
>You claim this person is the same as you've seen elsewhere. You
>claim this person is not Donna. What do you see in the headers
>that matches the troll you've seen?

Do your own research if you're that interested. Use 'her' old nym for
Google's archive though.

<donna.ohl@sbcglobal.net>

http://groups.google.com/groups?as_q...=2008&safe=off
--

I kill all Google Group posts, you can too.
Take back Usenet <--> http://improve-usenet.org

[G. Morgan]

David H. Lipman wrote:

>The information I have seen "G. Morgan" post is contrary to what you state.
>
>You both have rights to your respective opinions.


Thanks David, on a side note... I bookmarked one of your pages just yesterday
on the topic of security. Thanx for that>>
http://www.claymania.com/removal-trojan-adware.html


--

I kill all Google Group posts, you can too.
Take back Usenet <--> http://improve-usenet.org

[Sebastian G.]

G. Morgan wrote:

> David H. Lipman wrote:
>
>> The information I have seen "G. Morgan" post is contrary to what you state.
>>
>> You both have rights to your respective opinions.
>
>
> Thanks David, on a side note... I bookmarked one of your pages just yesterday
> on the topic of security. Thanx for that>>
> http://www.claymania.com/removal-trojan-adware.html


If you carried these out, then... well... you spent a lot of time for
achieving absolutely nothing.

[G. Morgan]

Sebastian G. wrote:

>G. Morgan wrote:
>
>> David H. Lipman wrote:
>>
>>> The information I have seen "G. Morgan" post is contrary to what you state.
>>>
>>> You both have rights to your respective opinions.
>>
>>
>> Thanks David, on a side note... I bookmarked one of your pages just yesterday
>> on the topic of security. Thanx for that>>
>> http://www.claymania.com/removal-trojan-adware.html
>
>
>If you carried these out, then... well... you spent a lot of time for
>achieving absolutely nothing.

Ahh Sebastian, I've read your stuff. Your the one who thinks a clean
re-install is the only way to remove crapware, eh?

--

I kill all Google Group posts, you can too.
Take back Usenet <--> http://improve-usenet.org

[Sebastian G.]

G. Morgan wrote:


>> If you carried these out, then... well... you spent a lot of time for
>> achieving absolutely nothing.
>
> Ahh Sebastian, I've read your stuff. Your the one who thinks a clean
> re-install is the only way to remove crapware, eh?


Not if you have a decent backup. At any rate, this is not a matter of
opinions, but simple scientific facts.

[Kayman]

On Tue, 20 May 2008 02:24:41 +0000 (UTC), G. Morgan wrote:

> Sebastian G. wrote:
>
>>G. Morgan wrote:
>>
>>> David H. Lipman wrote:
>>>
>>>> The information I have seen "G. Morgan" post is contrary to what you state.
>>>>
>>>> You both have rights to your respective opinions.
>>>
>>>
>>> Thanks David, on a side note... I bookmarked one of your pages just yesterday
>>> on the topic of security. Thanx for that>>
>>> http://www.claymania.com/removal-trojan-adware.html
>>
>>
>>If you carried these out, then... well... you spent a lot of time for
>>achieving absolutely nothing.
>
> Ahh Sebastian, I've read your stuff. Your the one who thinks a clean
> re-install is the only way to remove crapware, eh?

Just ignore this person! He has wealth of knowledge but is incapable to
pass it on to those in need. He does not believe that newsgroups should be
used as a vehicle to provide (specific) assistance, go figure.

Reformatting of HDD is the preferred course of action!

"The only way to clean a compromised system is to flatten and rebuild.
That¢s right. If you have a system that has been completely compromised,
the only thing you can do is to flatten the system (reformat the system
disk) and rebuild it from scratch (re-install Windows and your
applications)..."
http://www.microsoft.com/technet/com...mt/sm0504.mspx

There are however a number of reasons where this may not be possible and/or
achievable. Not everybody is technically apt to so or has an 'savvy'
acquaintance who may be able to assist. There are many users who don't live
in cities but reside in less developed environments where professional help
just does not exist. They may find the procedures as per:
http://michaelstevenstech.com/cleanxpinstall.html
too overwhelming and shy away from the perceived complexity.
The procedures as per:
http://www.claymania.com/removal-trojan-adware.html
(especially David's MULTI_AV Tool) have had helped solving uncountable
users over many years. And is IMO the next best thing to flatten and
rebuild an operating system. Moreover, the best to my knowledge, David
never has never denied anybody reasonable assistance figuring out malware
challenges.

[Jim Watt]

On Tue, 20 May 2008 00:41:01 +0000 (UTC), G. Morgan <no_em@il.invalid>
wrote:

<snip>

Albeit the bitching is interesting, nobody seems to
have actually answered the original question ...
--
Jim Watt
http://www.gibnet.com

[Bill Kearney]

> Not if you have a decent backup. At any rate, this is not a matter of
> opinions, but simple scientific facts.

Your advice is bogus, at best. If this is all you have to offer perhaps
shutting up would be better.

[G. Morgan]

[alt.internet.wireless] removed from x-post

Sebastian G. wrote:

>>
>> Ahh Sebastian, I've read your stuff. Your the one who thinks a clean
>> re-install is the only way to remove crapware, eh?
>
>
>Not if you have a decent backup. At any rate, this is not a matter of
>opinions, but simple scientific facts.

Well I would have to argue that it *is* a matter of opinion. I have
personally resurrected many a machine from the brink of uselessness by
applying (freeware) solutions. The one-two punch of Adaware, and SpyBot S&D
is often all it takes to clean an infected PC.

While I do agree that a re-format/install is best, it's not always feasible to
do so. There is nothing wrong with David L's techniques as a first step.
"Flattening" the system is a last resort.




--

I kill all Google Group posts, you can too.
Take back Usenet <--> http://improve-usenet.org

[G. Morgan]

[alt.internet.wireless] removed from x-post

Kayman wrote:

>> Ahh Sebastian, I've read your stuff. Your the one who thinks a clean
>> re-install is the only way to remove crapware, eh?
>
>Just ignore this person! He has wealth of knowledge but is incapable to
>pass it on to those in need. He does not believe that newsgroups should be
>used as a vehicle to provide (specific) assistance, go figure.

Of course not, everybody knows that newsgroups are for downloading porn. ;-)

>Reformatting of HDD is the preferred course of action!
>
>"The only way to clean a compromised system is to flatten and rebuild.
>That’s right. If you have a system that has been completely compromised,
>the only thing you can do is to flatten the system (reformat the system
>disk) and rebuild it from scratch (re-install Windows and your
>applications)..."
>http://www.microsoft.com/technet/com...mt/sm0504.mspx
>
>There are however a number of reasons where this may not be possible and/or
>achievable. Not everybody is technically apt to so or has an 'savvy'
>acquaintance who may be able to assist. There are many users who don't live
>in cities but reside in less developed environments where professional help
>just does not exist. They may find the procedures as per:
>http://michaelstevenstech.com/cleanxpinstall.html
>too overwhelming and shy away from the perceived complexity.
>The procedures as per:
>http://www.claymania.com/removal-trojan-adware.html
>(especially David's MULTI_AV Tool) have had helped solving uncountable
>users over many years. And is IMO the next best thing to flatten and
>rebuild an operating system. Moreover, the best to my knowledge, David
>never has never denied anybody reasonable assistance figuring out malware
>challenges.

Agreed. Another reason not to re-build is when the client does not have the
installation media for everything needing to be re-installed.



--

I kill all Google Group posts, you can too.
Take back Usenet <--> http://improve-usenet.org

[jim]

Jim Watt wrote:
> On Tue, 20 May 2008 00:41:01 +0000 (UTC), G. Morgan <no_em@il.invalid>
> wrote:
>
> <snip>
>
> Albeit the bitching is interesting, nobody seems to
> have actually answered the original question ...
> --
> Jim Watt
> http://www.gibnet.com

This is great... alt.comp.sec... where have you been all my life?

[Sebastian G.]

Bill Kearney wrote:

>> Not if you have a decent backup. At any rate, this is not a matter of
>> opinions, but simple scientific facts.
>
> Your advice is bogus, at best.


Calling trivial facts bogus is the reason why you should better shut up.

[Sebastian G.]

G. Morgan wrote:

> [alt.internet.wireless] removed from x-post
>
> Sebastian G. wrote:
>
>>> Ahh Sebastian, I've read your stuff. Your the one who thinks a clean
>>> re-install is the only way to remove crapware, eh?
>>
>> Not if you have a decent backup. At any rate, this is not a matter of
>> opinions, but simple scientific facts.
>
> Well I would have to argue that it *is* a matter of opinion. I have
> personally resurrected many a machine from the brink of uselessness by
> applying (freeware) solutions.


No, you didn't. In fact, it's likely that they're still compromised.

> The one-two punch of Adaware, and SpyBot S&D
> is often all it takes to clean an infected PC.


Gotta laugh even more. These tools are absolutely useless, since even at
perfectly clean machines they're claiming a lot of nonsense. How should they
even provide any useful information about a system that actively lies to them?

[Kayman]

On Wed, 21 May 2008 01:48:40 +0200, Sebastian G. wrote:

> G. Morgan wrote:
>
>> [alt.internet.wireless] removed from x-post
>>
>> Sebastian G. wrote:
>>
>>>> Ahh Sebastian, I've read your stuff. Your the one who thinks a clean
>>>> re-install is the only way to remove crapware, eh?
>>>
>>> Not if you have a decent backup. At any rate, this is not a matter of
>>> opinions, but simple scientific facts.
>>
>> Well I would have to argue that it *is* a matter of opinion. I have
>> personally resurrected many a machine from the brink of uselessness by
>> applying (freeware) solutions.
>
> No, you didn't. In fact, it's likely that they're still compromised.
>
>> The one-two punch of Adaware, and SpyBot S&D
>> is often all it takes to clean an infected PC.
>
> Gotta laugh even more. These tools are absolutely useless, since even at
> perfectly clean machines they're claiming a lot of nonsense. How should they
> even provide any useful information about a system that actively lies to them?

Now, even if a certain Sebastian Gottschalk from .de is spewing snipes
proclaiming that using David's Multi-AV to clean operating systems isn't is
accord with (his) scientific facts...the pragmatic/realistic proof is in
the pudding. Users living in the Islands, Booneys, Bush, Outback, Beyond
the Black Stump etc. don't need your claptrap and don't care for your
condescending manner. As a frequent lurker in various pertinent newsgroups,
I haven't seen one post where David's Multi-AV wasn't helpful and
beneficial.

So, Sebastian Gottschalk of .de, go and stick your scientific facts in one
of your bodily cavities, save us from your snipes and keep your
grandiosities within the circle of your associates in the sophisticated
milieu of Berlin. (You are a prime example of German arrogance but your
like minded buckos wouldn't know, now would they?).

[G. Morgan]

Sebastian G. wrote:

>> Well I would have to argue that it *is* a matter of opinion. I have
>> personally resurrected many a machine from the brink of uselessness by
>> applying (freeware) solutions.
>
>
>No, you didn't. In fact, it's likely that they're still compromised.

Yes, I did. No they're not.

>> The one-two punch of Adaware, and SpyBot S&D
>> is often all it takes to clean an infected PC.
>
>
>Gotta laugh even more.

Like a mental patient I'm sure.

> These tools are absolutely useless, since even at
>perfectly clean machines they're claiming a lot of nonsense. How should they
>even provide any useful information about a system that actively lies to them?

That's not been my experience. I've run both on brand new images of XP SP2 &
3 and got -zero- false positives.

So, being the "scientist" you are I'm sure you will now be offering the proof
of your hypothesis. I will be waiting.



--

I kill all Google Group posts, you can too.
Take back Usenet <--> http://improve-usenet.org

[Sebastian G.]

Kayman wrote:

> isn't is accord with (his) scientific facts...

^^^^^
Proof that you're an idiot.

> the pragmatic/realistic proof is in the pudding.


There is none. You cannot proof that you've cleaned the system just by the
absence of obvious signs.


> I haven't seen one post where David's Multi-AV wasn't helpful and
> beneficial.


Of course, since those fools don't understand the meaning of system
integrity. It was helpful insofar that it seemed to cure the symptoms, but
it never restored the system to a well-defined state, leaving all future
work unreliable and potentially compromised.

[Sebastian G.]

G. Morgan wrote:

> Sebastian G. wrote:
>
>>> Well I would have to argue that it *is* a matter of opinion. I have
>>> personally resurrected many a machine from the brink of uselessness by
>>> applying (freeware) solutions.
>>
>> No, you didn't. In fact, it's likely that they're still compromised.
>
> Yes, I did. No they're not.


Trivial counter-proof of your statement: Universal trojan horses exist.

>> These tools are absolutely useless, since even at
>> perfectly clean machines they're claiming a lot of nonsense. How should they
>> even provide any useful information about a system that actively lies to them?
>
> That's not been my experience. I've run both on brand new images of XP SP2 &
> 3 and got -zero- false positives.


Question: What's the difference between a brand new image and a well secured
and hardened system?

> So, being the "scientist" you are I'm sure you will now be offering the proof
> of your hypothesis. I will be waiting.


Trivial: Just change
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\DataBasePath
and it will complain that something isn't right.

[G. Morgan]

Sebastian G. wrote:

>G. Morgan wrote:
>
>> Sebastian G. wrote:
>>
>>>> Well I would have to argue that it *is* a matter of opinion. I have
>>>> personally resurrected many a machine from the brink of uselessness by
>>>> applying (freeware) solutions.
>>>
>>> No, you didn't. In fact, it's likely that they're still compromised.
>>
>> Yes, I did. No they're not.
>
>
>Trivial counter-proof of your statement: Universal trojan horses exist.

Universal Trojans? What the heck are you on about now? I said AA and SBS&D
could (and does) remove a lot of malware making the system clean again. Sure,
not one size fits all. Nobody has invented a one-stop shop for cleaning
crapware.


>
>>> These tools are absolutely useless, since even at
>>> perfectly clean machines they're claiming a lot of nonsense. How should they
>>> even provide any useful information about a system that actively lies to them?
>>
>> That's not been my experience. I've run both on brand new images of XP SP2 &
>> 3 and got -zero- false positives.
>
>
>Question: What's the difference between a brand new image and a well secured
>and hardened system?

What is this, an interrogation? A brand new image of XP would be the state
the system is in as soon as Setup is complete.

A well hardened system would be that image + a good A/V w/updates and a
firewall running before the system becomes a node on the (Inter)network.



>> So, being the "scientist" you are I'm sure you will now be offering the proof
>> of your hypothesis. I will be waiting.
>
>
>Trivial: Just change
>HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\DataBasePath
>and it will complain that something isn't right.

Of course a good scanner is going to detect a change in the location of HOSTS,
I fully expect it to.


Now, what about your claim that SBS&D and Ad aware detect false positives on a
brand new XP install? <-- *brand new* meaning no editing of the registry
before scan (especially something as critical as the location of HOSTS)



--

I kill all Google Group posts, you can too.
Take back Usenet <--> http://improve-usenet.org

[Sebastian G.]

G. Morgan wrote:


> Universal Trojans? What the heck are you on about now? I said AA and SBS&D
> could (and does) remove a lot of malware making the system clean again.


And if the malware is an universal trojan horse, the system will remain
infected, albeit appearing clean. So stop claiming the contrary. Most
malware implementations are universal trojan horses.


> A well hardened system would be that image + a good A/V w/updates and a
> firewall running before the system becomes a node on the (Inter)network.


********. Not just that something like "good A/V" doesn't exist (both by
design and by availability), it's far away from being a security
improvement, and even further away from hardening.

But once again: I have setup a system that is provably clean, but not in a
fresh state. I have AdAware and Sypbot S&D run over it, and it claimed
multiple infections and security issues, which were provably nonsense. Your
example of how it behaves on a fresh systems doesn't disprove my claims at all.

>> Trivial: Just change
>> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\DataBasePath
>> and it will complain that something isn't right.
>
> Of course a good scanner is going to detect a change in the location of HOSTS,
> I fully expect it to.


Nonsense. HKEY_LOCAL_MACHINE is read-only to normal users, so this change
must have been applied by an administrator.
In fact, it was done exactly so for a better management of ACLs, grouping
together various relevant files for which one specifically limits access to
NT-AUTHORITY\SYSTEM and 'named' only.

And this was only one example. It also claims some group policy settings
(which improve security) as issues, noises about cookies with a DOMAIN
attribute (albeit the webbrowser is configured to not care about it), and
even complains about some known good software (like FlashGet).

Or did you ever try the "immunization" function? It spams the registry full
of useless CLSIDs, fails to do so on HKLM, claims success, then reports
incompleteness on next run, and tries again. WTF?

Not gonna mention AdAware. One does need a test machine just to get around
the broken installer (which tries to write some temporary files to
%SystemRoot%\system32), and then it presents you with an almost empty GUI
(since it tries to use a MSHTML style GUI without even checking if rendering
pictures is active), and then pulls of **** similar to Sypbot S&D.


> Now, what about your claim that SBS&D and Ad aware detect false positives on a
> brand new XP install?


This claim is merely a fiction of yours, or your inability to read and
understand.

Aside from that, why can't it detect the most obvious security issues of
such a fresh install?

[Kayman]

On Wed, 21 May 2008 03:48:01 +0200, Sebastian G. wrote:

> Kayman wrote:
>
>> isn't is accord with (his) scientific facts...
>
> ^^^^^
> Proof that you're an idiot.

Ah, So typical and predictable. You must be running out of arguments.

>> the pragmatic/realistic proof is in the pudding.
>
> There is none. You cannot proof that you've cleaned the system just by the
> absence of obvious signs.
>
Sure, yadda, yadda, yawn.
>
>> I haven't seen one post where David's Multi-AV wasn't helpful and
>> beneficial.
>
> Of course, since those fools don't understand the meaning of system
> integrity.

I only wish you'd meet some of them Outback "fools" face to face...

> It was helpful insofar that it seemed to cure the symptoms, but
> it never restored the system to a well-defined state, leaving all future
> work unreliable and potentially compromised.

Now we know. To quote H.L.Mencken:"Puritanism: The haunting fear that
someone, somewhere, may be happy."