Like That's Gonna Solve Your Problem

[tropicsgoddess]

A Little Background: I work in a tech support call center for a big DSL provider, and before the customer gets to speak to a tech support rep, they get through the sales department since it's a fee-based service (there's plenty of suck on both sides of the spectrum: Techs get the morons while the sales agents get EW's that feel that they shouldn't have to pay a dime for tech support). Today my co-worker K had this little gem for me.


K: Hey TG, I got a question?

Me: What's up?

K: I have a customer that says that she's been having issues where it seems like her computer is being controlled by somebody else and that somebody is stealing her information and spreading around her files. She was asking if she can change her IP Address.

Me: She wants to change her IP address?!! Like that'll solve her problem! She just needs to download and run an anti-virus/anti-spyware scan and look out for programs like LogMeIn (and uninstall if she finds it on her computer) that are used to spy on computers and disable the remote assistant. But change her IP address?!! No way. *It was a residential customer*

[SilverOrb]

Hahahahaha. Is she one of those people that would just moooooove without a fight if one of her neighbors starts harrassing her? Why not just moooooooove.

I love people that glom onto a solution for a problem that, whether possible or not, is ten times harder to make happen than the simple fix to it! My sympathies.

*offers a glass of wine and a sandwich cookie*

[cawaker]

well most the time residential services has dynamic IPs anyway so they are constantly changing.

[wraiths_crono]

UH Logmein... is actually a legit program, the only way to even get it on others computers is to log into their website on that machine, and add it to your list.

[tropicsgoddess]

UH Logmein... is actually a legit program, the only way to even get it on others computers is to log into their website on that machine, and add it to your list.

It is, and I've had a customer call in because her little shit of a step-son installed it on her computer and sent out tons of malicious letters to friends, family and acquaintances that believed it was the customer.

[MrSmiley]

UH Logmein... is actually a legit program, the only way to even get it on others computers is to log into their website on that machine, and add it to your list.

A lot of viruses/malware over the years (but by no means all of them) have started out life as completely honest tools and utilities before becoming abused and installed unto people without their knowledge (or full knowledge). I'd put in a link to an example if I could think of one off the top of my head, but unfortunately all that's coming to mind is Back Orifice which is kindof the opposite situation in that it was designed to point out security holes... but ended up being used by many as a legitimate remote administration tool on a network. It's late

[otakuneko]

Some versions of mIRC, which is pretty much the most popular Windows IRC client, are flagged by security software as either "riskware" or downright malicious. This is because some loser malware author(s) decided it was easier to hack mIRC so that its window is hidden than to roll their own or modify a different client.

For example if you have anything older than 6.34, and you have Threatfire, then you must add mIRC to your exception list before you launch it. Otherwise, Threatfire will kill and quarantine not only mirc, but possibly your file manager and shell as well, which, for most, is explorer, but for me at the time was freecommander and bblean. Yeah, that was not fun. That earned Threatfire an immediate removal for its unforgivable behavior.

WinVNC, same story. Cain&Able, JohnTheRipper, same story there.

It's not the tool that's malicious.

[MrSmiley]

seriously good examples otakuneko!

Like you say, it's not the program that's "bad". It's some "bad" program that happens to be part or whole of another program for it's own ends. And then because that program is known to be abused, security software examines it a bit more critically.

Plus, normally I'd say that anything that tries to stay hidden is already suspicious... but I have so many applications like HP Print Master or the fan program for my laptop that try to do the same thing :P

[technical.angel]

Malware doesn't kill computers, people kill computers.

[PepperElf]

and for my own 2 cents... it never hurts to look at the list of processes running and check them out online to see what each one is. I prefer this page for that... pretty good list for most programs, and for some of them, it also says if it's safe to turn the program off.

and sometimes when i was bored i'd open the command window to see what online links i had up. .. i forgot the dos command tho, been a while since i've had to do it.

[otakuneko]

That'd be netstat.

TcpView is much easier to read though.