11 replies to this topic

[snissen]

In a couple of weeks, I'm teaching a class where I work on spyware recognition and removal. Next week, I set up a VMware virtual machine I want to infect with several different spyware programs, so I can demonstrate different removal techniques and packages.

So, I want a recommendation of several spyware programs to infect the virtual machine with! I'm starting, I think, with KaZaa, Grokster, Morpheus, and maybe BearShare. I also need something persistent enough that it takes a Safe Mode boot, or even booting from a CD, to remove it (CoolWWWSearch?). Any other recommendations?

Finally, I need one or more Web sites where, using Internet Explorer without popup protection, I know I can get a "drive by" spyware infection. (I'm looking for benign stuff, not pornography.) I have no ideas on this; any recommendations?

I'm a Windows expert, but have been careful enough not to experience any spyware infections myself, so this is new territory for me. Any help will be appreciated. Sande

[jedi]

If you want 'drive-by-download' infections and don't (understandably) want to look at porn sites, try music lyric download sites, they are loaded with them. (If I remember right this is one of them, www.lyricsdownload.com, but Googling around should get you there)
If you want specific Adware, Zilla Connection Accelerator comes bundled, will load registry entries, files, the full set.

For Coolwebsearch try this domains list, http://users.skynet..../CWSdomains.htm
but although you can avoid the obvious porn ones, there's no guarantee you won't have to look at questionable sites.

Edited by jedi, 21 November 2004 - 01:37 PM.

[OSC]

Hmmm. I know there was a link that Budfred used in another thread for "spyware sites" but I can't find where it is. A good non-porn one is "hxxp://www.nodq.com" (link removed). Pushes out Gator, internet optimizer, bargains, etc. The rest of the ones I have are mostly porn related.

Hope that helps a little.

[Budfred]

There is a thread in Boot Camp where there are many links and ideas about this... Since you are a Trainee, you can access that, but I do not want to post the link here since this is a public forum and most people can't access it...

[snissen]

Thanks to you all. This is very helpful.

[Captain]

DAP, Downloaad Acclerator Plus is a program packed with spyware, just a suggestion

[Tuxedo Jack]

Read the report that Eric Howes just put out - he shows where you can get some massive, massive infections.

[mpfeif101]

Tuxedo Jack - Link please

[fredvries]

Goto: www.crackz-serialz.com/list/l/2 and choose "lady sonia". <--link disabled so no one clicks it accidentally - copy it into your browser if you really want that infection. Note that we do not endorse cracks of any sort. cnm

Edited by cnm, 30 November 2004 - 06:37 PM.

[LineOFire]

Tuxedo Jack - Link please

I was thinking the exact same thing.

[mpfeif101]

Found Tuxedo Jack and forced him to talk

http://spywarewarrio...-test-guide.htm

[LostAccount]

There is this thread by the Internet Storm Centre on how a man goes to a site and is infected by malware.

This is a link:

Follow the bouncing malware part 1

Follow The Bouncing Malware Part II

Follow The Bouncing Malware Part 3