Spyware found on a work PC - Tilted Forum Project Discussion Community

God of Thunder · 02-13-2004, 07:28 AM

Has anyone heard of spyware called I Am Big Brother?

Running a check on a pc at work found it, but here's the kicker, it was found to be in a registry key associated with Novell

HKLM\software\Novell\NetWareWorkstation\CurrentVersion\ServicePackFiles

Here's the question, would this be a false-positive?

Has anyone else heard of it or come across it? I did a Google search and came up with nil.

Please help.

Redlemon · 02-13-2004, 07:36 AM

Which spyware checker found it?

God of Thunder · 02-13-2004, 09:10 AM

Spykiller

Redlemon · 02-13-2004, 09:20 AM

Try something else; and, good luck on uninstalling Spykiller:

Quote:

Google Groups:
> I wanted to get a free scan from spykiller.com and
> thought that it would be like pestscan.com (that it would
> do a scan and thats ALL)-
> but I followed the steps and I got the 30 day trial
> installed on my pc of spykiller- I decided to uninstall
> it and clicked on the uninstall part- But for the last 5
> days, the icon on desktop is still there- wont go away- I
> cant do the scan but I want ALL of that erased- any help
> would be great-

I had the same problem. Had to manually delete the folder from
C

rogram files\
And delete the registry entry that launches it on boot from
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
It appears to me that this is just Spyware in sheeps clothing and
shame on Download.com for posting such a piece of crap in their
downloads.
Get "Spybot Search and Destroy". I do this for a living. So far, there
is nothing better and it's truly free.

Also, from some guy's blog, although I've seen it elsewhere:

Quote:

Patrick Kolla, author of Spybot Search & Destroy (a highly recommended tool for deleting malware) is having a problem with unscrupulous advertisers on Google using his trademark. It appears that these adverisers actually provide software that installs spyware on your machine which they then charge you to remove!

News - The home of Spybot-S&D!

Big fake warning

For the past two weeks, I got massive complaints from people who saw recommendations for Spybot-S&D on some TV show or heard about it on TV, and tried to go for it through the TV/radios website. Somehow, a bad link to Spybot-S&D is on its way and leading people to think that SpyHunter or SpyKiller would be the recommended Spybot-S&D. People downloading these two are forced to pay to remove spyware, and in the case of SpyKiller are even directed to us for support!

So my warning: please double-check what you've got before you pay anything!

Also, if you were mislead to SpyHunter or SpyKiller through Google AdWords, please contact Google. Google promised me some weeks ago they wouldn't do any more advertisement on my trademarked name "spybot", but I again receive complaints that they do, and this struggle with Google is going on for 4 months now.

At the moment, I can't even get to the Spybot site, so get Lavasoft Ad-Aware for now.

losthellhound · 02-13-2004, 09:39 AM

I am Big Brother is definatly not a Novell product, but it may piggyback off of the protocol and they thought best to place it where people won't look...

Get Adaware

God of Thunder · 02-13-2004, 10:06 AM

I use ad aware and Spybot and neither one found it. One of the tech guys in the Fire Dept. was using Spykiller and it is the one that caught the spyware, so that's why I'm curious if it is a false positve.

btw, redlemon, http://safer-networking.org is where Spybot S&D lives now.

Redlemon · 02-13-2004, 10:25 AM

It looks like "I Am Big Brother" is a legit keylogger/tracker, and that's a grey area when it comes to spyware.

If this is a work computer, I'm thinking that the boss installed it. If the boss checks for results later and finds out that his keylogger was deactivated, that's just as bad as discovering that you've been on TFP all day.

02-13-2004, 07:28 AM	#1 (permalink)
God of Thunder Talk nerdy to me Location: Flint, MI	Spyware found on a work PC Has anyone heard of spyware called I Am Big Brother? Running a check on a pc at work found it, but here's the kicker, it was found to be in a registry key associated with Novell HKLM\software\Novell\NetWareWorkstation\CurrentVersion\ServicePackFiles Here's the question, would this be a false-positive? Has anyone else heard of it or come across it? I did a Google search and came up with nil. Please help. __________________ I reject your reality, and substitute my own -- Adam Savage

02-13-2004, 07:36 AM	#2 (permalink)
Redlemon Devoted Donor Location: New England	Which spyware checker found it? __________________ I can't read your signature. Sorry.

02-13-2004, 09:10 AM	#3 (permalink)
God of Thunder Talk nerdy to me Location: Flint, MI	Spykiller __________________ I reject your reality, and substitute my own -- Adam Savage

02-13-2004, 09:39 AM	#5 (permalink)
losthellhound Thats MR. Muffin Face now Location: Everywhere work sends me	I am Big Brother is definatly not a Novell product, but it may piggyback off of the protocol and they thought best to place it where people won't look... Get Adaware __________________ "Life is possible only with illusions. And so, the question for the science of mental health must become an absolutely new and revolutionary one, yet one that reflects the essence of the human condition: On what level of illusion does one live?" -- Ernest Becker, The Denial of Death

02-13-2004, 10:06 AM	#6 (permalink)
God of Thunder Talk nerdy to me Location: Flint, MI	I use ad aware and Spybot and neither one found it. One of the tech guys in the Fire Dept. was using Spykiller and it is the one that caught the spyware, so that's why I'm curious if it is a false positve. btw, redlemon, http://safer-networking.org is where Spybot S&D lives now. __________________ I reject your reality, and substitute my own -- Adam Savage

02-13-2004, 10:25 AM	#7 (permalink)
Redlemon Devoted Donor Location: New England	It looks like "I Am Big Brother" is a legit keylogger/tracker, and that's a grey area when it comes to spyware. If this is a work computer, I'm thinking that the boss installed it. If the boss checks for results later and finds out that his keylogger was deactivated, that's just as bad as discovering that you've been on TFP all day. __________________ I can't read your signature. Sorry.