Tech: 'Save Your Strokes In This Site'???

Subject: Tech: 'Save Your Strokes In This Site'???
From: Uncle_DaveO
Date: 21 Aug 06 - 11:26 AM

Every so often (maybe 8 times a week?) in one or another site I'll get a popup inquiry message, something to the effect of, "Do you want to save your strokes in this site? Y/N".

Frankly I don't know what that might mean. Sometimes I've said yes, and sometimes I've said no, and I don't see any operational difference. I have not been aware of any point at which such a site might ask for me to call back or refer to such strokes which were saved.

Note that I'm NOT talking about saving my user name or password. I understand both the utility and the possible dangers of that, and I'm not asking about that.

But what is this "save your strokes"?   Is it saved on my hard disk, a la cookie? Is it only retained in memory while I'm still on that site? Is it more or less permanently recorded at that site?

Anybody?

Dave Oesterreich

Subject: RE: Tech: 'Save Your Strokes In This Site'???
From: Bill D
Date: 21 Aug 06 - 11:58 AM

since I don't allow pop-ups, I've never seen that...

Ihave no idea what that means..."keystrokes" are saved in certain programs, but that is an intrusive way of spying..

Subject: RE: Tech: 'Save Your Strokes In This Site'???
From: The Fooles Troupe
Date: 21 Aug 06 - 07:47 PM

I would be suspicious Dave.

You should get your system 'disinfected'. Since I don't know what the cause is, I can't suggest what will fix it.

Sometimes it doesn't matter what you do, yes or no, that software will 'save' them anyway - and probably send them anywhere too.

Subject: RE: Tech: 'Save Your Strokes In This Site'???
From: GUEST,Jon
Date: 21 Aug 06 - 07:50 PM

Like the others, I don't know but would be wary.

I would guess at it reffering to keystrokes. At worst, it could be some keylogger program that sends these on to a 3rd party like for when you do your Internet banking...

Subject: RE: Tech: 'Save Your Strokes In This Site'???
From: JohnInKansas
Date: 22 Aug 06 - 02:23 AM

Virus: A program or code inserted into a program that attempts to send itself to other places on an individual computer and/or to other computers on a network, through email, or on the internet, invariably for malicuous purposes.

Since the methods used by viral programs use fairly specific (although numerous) "code sequences" a good antivirus program can detect most such infections and usually can remove the viral component. Sometimes it's possible to remove just the virus and recover the remainder of the file that was infected, but sometimes the entire file must be quarantined or deleted. A good AV program, with regular updates of viral signature files, and with regular full system scans is imperative for anyone using the internet.

Worm: A program or code that is placed on a computer, usually without the users permission, that is intended to perform some (usually malicious) action at some time after the initial placement of the code. Since many worms have characteristic "signatures" they usually can be detected and removed or inactivated by AV programs in the same way as viral code. There are unfortunately a number of worms that can be detected by AV programs but that require user interaction for removal; but being informed that there is a need is essential, and usually good removal programs specific to the offending worm are generally available from any competent AV program supplier.

Spyware: A program that records information about your machine and/or your personal information and/or your browsing activities on the internet.

               a.) Since there is no universal definition of what constitutes "spyware" various "antispyware" programs produce vastly different results.

                   a.1) Example: AdAware SE, which has been a popular AS program generally considers anything that sends any information to any source as spyware. Tracking Cookies that say that you've been to a website, but that can be read by another site that subscribes to the tracking service, that record only that "a computer that visited site a has now come to site b" are reported as spyware by AdAware. MOST other AS programs ignore this type of cookie, since it does not identify what specific machine provided the information, hence it didn't really "spy on you personally." AdAware SE, the free program, consistently reports finding more spyware on your computer than any other AS program, but most of the "more" that it finds simply isn't consider "really spyware" by most other AS programs. A top rated program a few months ago (especially among free versions), it remains almost a "must have" for general users, although other (usually not free) programs have displaced it somewhat from the frequent reviews. This is a program everyone should have, and should update and run frequently, unless you find a purchased program justified and are able to pay for one that's more inclusive.

                   a.2) Example: Spybot S&D limits its definition of "spyware" generally to programs that reveal information traceable to your individual machine or to you personally. The free version still appears fairly frequently in reviews of "best AS programs" although the popularity of the program appears to be creating some difficulties for the providers in keeping up with the demand for downloads and updates. This is a program everyone should have, and should update and run frequently, unless you find a purchased program justified and are able to pay for one that's more inclusive.

                   a.2) Example: Trend Micro has received very high ratings in recent reviews, and seems able to detect some kinds of spyware that are "difficult" for other programs to find. The site linked offers a free online scan, and should be worthwhile for anyone with questions about their computer's "cleanliness" but so far as I've seen there is no free program one can download to use on a regular basis. If you feel justified in purchasing an AS program, recent reviews indicate this is one of the better ones you should consider. It is worth noting that Trend Micro has been cited as the discoverer of several recent exploits, and has been among the leaders in counter measure for new threats.

Phishing: The attempt to get you to click on a link or to reply to an email in order to execute a malicious purpose. A "phishing" email may claim to be from a trusted source, but may disguise the link to which you reply to actually send information solicited to an unknown server. Popup ads that say "Your computer may be infected" are a common and almost trivial example. If you click the link, and if you give "permission" to scan your machine, you may actually be "giving permission" to install malware of almost any kind. A popup that asks if you want to "remember keystrokes" could actually give your permission to download a program that provides the abilitity to keep track of every key you press on your machine. (There is no known valid reason why an individual site should need to have your keystrokes recorded.) The downloaded program could also include the abiltity to send that record, and the record of all your other keystrokes, to unknown places.

IF YOU GIVE YOUR PERMISSION TO INSTALL A PROGRAM ON YOUR COMPUTER, NO ANTIVIRUS, ANTISPYWARE, OR OTHER ANTI-MALWARE PROGRAM CAN PREVENT INSTALLATION OF THAT PROGRAM, OR PREVENT ITS RUNNING "AT WILL" ON YOUR COMPUTER. Defensive programs cannot determine that you were "tricked" into giving permission. The "dispayed" result of anything on the web can be easily falsified so that the actual result is not what you might casually assume, so in any instance in which all of the results of clicking a button are not clearly and explicitly given, your ONLY ANSWER should be to IMMEDIATELY EXIT THAT WEBSITE.

Your next response should be to use every available AV, AS, and Anti-Malware resource at your disposal to verify that unknown malware has not been installed on your computer.

There are several known and extant malware methods that are NOT DETECTED by most anti-malware programs and that are extremely difficult to find and remove. Several of these cannot be found by any commonly available anti-malware programs, and are generally of the kind that result from "accepting" something that's "offered" without clear definintion of why it's needed and what it will do.. PARANOIA IS JUSTIFIED, but extreme measures probably should be only "considered" if other evidence suggests an infection. Unfortunately the other evidence can be rather subtle and difficult for the casual user to observe.

John

Subject: RE: Tech: 'Save Your Strokes In This Site'???
From: The Fooles Troupe
Date: 22 Aug 06 - 09:21 AM

Running 'System Monitor' will show you if there are large amounts or bursts of data being sent from your PC when nothing much is happening while you are on-line. Even if they have managed to hide the process from the process list - if they are using the uplink, there will be data flow.

Look under

Programs
Accessories
System Tools
System Monitor

Subject: RE: Tech: 'Save Your Strokes In This Site'???
From: JohnInKansas
Date: 22 Aug 06 - 10:46 AM

Robin -

System monitor may give you some indication with Win98 or WinME, but with Win2K and especially with WinXP there are a lot of "system idle" maintenance processes going on whenever there's some slack. It's almost impossible to tell that an "extra" process has been added in.

John

Subject: RE: Tech: 'Save Your Strokes In This Site'???
From: Paul Burke
Date: 22 Aug 06 - 11:57 AM

It might be worth getting hold of something like Ethereal, which you can use to monitor all or any of your network ports. You can then see if, while you are on line, anything is being transmitted that you don't expect.

And of course make sure your firewall is in place, and that only programs you know about are allowed access to the internet. Zone Alarm is good.

Subject: RE: Tech: 'Save Your Strokes In This Site'???
From: The Fooles Troupe
Date: 22 Aug 06 - 08:02 PM

'It's almost impossible to tell that an "extra" process has been added in.'

I'm not looking at 'processes' - the 'system monitor' is C:\WIN\SYSMON.EXE - gives pretty little displays of percentages, etc

look at 'Dial up Adapter: Bytes Transmitted"

Subject: RE: Tech: 'Save Your Strokes In This Site'???
From: JohnInKansas
Date: 22 Aug 06 - 10:19 PM

Foolestroupe -

The file SYSMON.EXE does not appear on WinXP machines. WinXP help files on Performance Monitoring imply that the situation is the same for Win2K.

Performance monitoring in Win2K and WinXP is a "Management Console" function, run primarily under an Active-X script (sysmon.chm). The "Performance" function cannot generally be opened by clicking a file: to open Performance, you usually would click Start | Settings | Control Panel, Double-click Administrative Tools, and then double-click Performance. Administrator authority is required to set up what is to be monitored, although once set up Users without Admin authority may view some of the information being monitored.

The principle and intended use is to provide log files that can be analyzed in detail, rather than real-time display. Some "intelligence" about what needs to be monitored is required, since setting up an excesssive number of monitored functions with frequent update - as required for real-time display - can literally take over processor and memory capacity.

The "processor" is one of 53 different functional areas that can be logged, and for the processor alone there are about 17 different functions that can be chosen. The 17 detail choices seems about typical for the few of the 53 functional areas, giving something on the order of 1,000 different "things" that can be monitored. Each of these can be logged as a simple count of activity (the usual) or in at least a couple of other forms. An individual "process" can have a "threshold level" set, and an "Alert" will be sent - and/or recorded in the log - if the threshold is exceeded.

The point is that the vastly more capable "Performance Monitor" available to WinXP and Win2K is not a simple way for an "average user" to watch for a "suspect operation" unless the person using the tool has "more than average" knowledge of what to look for and is willing to study a bit on how to turn on the right features.

For most users a Firewall that monitors and reports outgoing connections/activities in addition to blocking incoming traffic is probably the best way of monitoring for unwanted/unauthorized communications by malware that might be on a machine. Not all otherwise good firewalls have this ability, and most that can monitor outgoing connections require user action to specifically turn on the feature.

John

Subject: RE: Tech: 'Save Your Strokes In This Site'???
From: catspaw49
Date: 22 Aug 06 - 10:33 PM

Seems to me that more strokes are more fun. Why would you want to be premature? I knew a guy who was though and he told the Doc about his problem. The Doc gave him a cream to use but he came rubbing it on.

I think I'd just ignore it Uncle Dave.

Spaw (well somebody HAD to make the joke......)

Subject: RE: Tech: 'Save Your Strokes In This Site'???
From: Amos
Date: 23 Aug 06 - 12:05 AM

Spaw:

You should save your strokes for someone who needs them more than you do.


A

Subject: RE: Tech: 'Save Your Strokes In This Site'???
From: The Fooles Troupe
Date: 23 Aug 06 - 08:46 AM

99, 100

change hands...

sorry, I couldn't wait another 90 messages...