Let's Talk About Spyware, Baybee

[ZiggyDoodle]

pull the plug altogether.

I use the free ZoneAlarm here at my office.  Like ZAP, it has a very handy option to right-click the mouse and choose "stop all Internet activity" or "engage Internet lock."     Works quite nicely.

[OpiumGirl]

THank you so much for the advice, katenigma.  I will seek out the underworld tools for my legally owned software.
That is great advice, indeed!

[J. M. Pescado]

Network drivers are hooked in at the kernel level. That's how a firewall works. It intercepts messages sent to the network driver. This is also how kernel-level spyware works.

It isn't safe to assume that software firewalls are doing precisely what you tell them. It probably is, but I can only say that with 90% assurance.

Software firewalls are good, but only a first line of defense. You also need a second device, a physically independent machine not susceptible to influence, like a Linux machine, ALSO controlling access. Spyware has lately attempted to hijack and disrupt firewalls on system, but they cannot do this to an outside machine running an independent OS, especially if you never connect from the Windoze machine to the Linux machine, thus preventing them from catching passwords.

[migamoo]

Then save the idiot DRM one in a safe place, so you can pop it back in when you want to install the next Lies and Propaganda pack (and maybe for patches). 

  I installed new EPs with the replacement, always have. Hopefully my computer won't go boom.

[KatEnigma]

LOL and I put back the original, and my installation did go kaboom. LOL  But I just did what was suggested by the person who sent it to me. 

[Ashleigh]

Oops, #29 was me under my girlfriend's account. SHE still uses her CDs. Weirdo. Except we downloaded Pets from the installer from hell. Sorta regretting that now.

[dizzy]

Sorry, but without looking at the source code no one here can answer your questions. That's part of why spyware is such a problem. We don't know what it really does, how it gets triggered, nor what information they are transmitting. All we can do is surmise and be prepared for whatever it might be doing.

If you are equipped like Pescado or if you follow my advice (proxy w/an approved whitelist) you should be fine.

[Assmitten]

Thanks, everyone, for the info. I thought if we had one thread about this topic it might help. I feel more informed and more hopeless all at the same time. 

[sanmonroe]

Perhaps we are lucky this time and only the downloaded version of the game is spyware.

If thats true, you know they are using that as a test for future expansions.

[dizzy]

Do with that conclusion what you will.

Even with all your ports open and infected with all the worst viruses, a serious security incident will not likely happen while you watch. The threat that you need to be concerned about is the one that takes you by surprise, the one that is triggered in some unknown fashion at an unknown time.

[MyPrecious]

Like Dizzy I don't play while connected to the net; I don't feel I know enough about spywear or computers in general to add to this but Sims2 has always made me wary of playing while online.

[J. M. Pescado]

Then I loaded Eth--er, Wireshark, up and set it to monitor all traffic on the active Ethernet interface. I captured packet logs from several runs of the game, and not a single unusual packet that appeared to be from TS2 was intercepted. Which doesn't mean that none were sent; it just means that Wireshark didn't catch them. Seeing as how I did catch Google Toolbar phoning home during that time (the toolbar has since been burninated), I'm inclined to think that I had the sniffer set up correctly and can thus make some conclusions about the state of spyware in Pets

Google Toolbar is known spyware. TS2 is slightly more clever, it disguises its spy-reporting as "good" activity, transmitting its encrypted spy payload only when you are duped into letting it onto the "exchange" or allow it to "check for updates". Don't be fooled, this is still spying, it's just cleverly hidden spying. Notice how it never actually finds any updates.

[Theo]

And what about MaxisEA's Content Manager tool?

When you start scanning, it asks to connect to the internet to "get author information", which means that they have a database of the author guid fields that you can find on the packages.

Just where did they get that information?... 

[LynnMar]

I never play sims while connected to the net.  But a weird thing happened to me with the first cd or maybe it was UNI.   I ran a spyware program and it said there were two spywares in my sims auto run.

  So I ran   %temp%   and deleted that file and I thought it was gone but when I scanned the EA disc, it was on it, in the auto run.    I wrote EA about it and they never did answer.    I said "Why are you selling cd's with spyware on them?"     Very strange.   

 I use a two different spyware programs now and they never pick up on any spyware for any of my sims discs  but I know they are lurking in there somewhere.   

[KevinTMC]

How many copies of The Sims 2 and its EPs and SPs have EA sold?

And I'm supposed to be worried about them spying on me, personally?

Nah. I don't think I'm that special or important.

Nor is anyone else. Surely it's aggregate data they're after; and I personally think it's a good thing if they have accurate data on what sorts of setups their users are running. (Though it'd be infinitely nicer if they'd ask first...)

So long as they don't muck around with the core functions of my operating system, interfering with programs other than theirs, I can't bring myself to care.

[jrd]

As far as I can tell no disc version of The Sims 2 or its expansions contain spyware.
All versions do contain a user-settable option to "phone home" for updates, but this never activates unless the user choses to enable it.

I don't use DRM crippleware and can't comment on the downloader versions.

[MxxPwr]

I never play sims while connected to the net.  But a weird thing happened to me with the first cd or maybe it was UNI.   I ran a spyware program and it said there were two spywares in my sims auto run.

  So I ran   %temp%   and deleted that file and I thought it was gone but when I scanned the EA disc, it was on it, in the auto run.    I wrote EA about it and they never did answer.    I said "Why are you selling cd's with spyware on them?"     Very strange.   

 I use a two different spyware programs now and they never pick up on any spyware for any of my sims discs  but I know they are lurking in there somewhere.   

The autorun.exe and another file named something like autorungui.exe always regen if deleted.

If you use the spyware scanner to put a block on them, you'll probably notice problems starting the game up from disk.

Random thought: if these particular files are the spyware, then it's clever spyware indeed, because that would mean it's tied to the cd autorun. I wonder if you use an image, do you get the phone home?

[kathyfanclub]

Ive had the Digital DOwnlaod of Pets,and today,I got the Please Log In error And already Im sick of it 

Do you think that if I get a 'normal' Sims2EP4.exe and replace that DRM 1, that it will work?
Where did you get your .exe from?
Also, whats a HP?


Sorry for the questions :p

To get around the idiot downloader starting up, you need to happen upon the executable file that people are using who didn't dowload it quite so legally. 

Then save the idiot DRM one in a safe place, so you can pop it back in when you want to install the next Lies and Propaganda pack (and maybe for patches).  I tracked down a new executable for GLS because of that. I'd downloaded the HP, and it was fine- no DRM crap, but now they are all paranoid and pissy about it, so never again.

[jrd]

Replacing your Sims2EP4.exe may work or not. I don't have the DRM version and therefore don't know if this works. Katenigma seems to think it will work.

HP = Holiday Pack/X-Mas pack, the first stuff pack (the one that didn't pretend to be a mini-expansion).

[KatEnigma]

Ive had the Digital DOwnlaod of Pets,and today,I got the Please Log In error And already Im sick of it 

Do you think that if I get a 'normal' Sims2EP4.exe and replace that DRM 1, that it will work?
Where did you get your .exe from?
Also, whats a HP?


Sorry for the questions :p

To get around the idiot downloader starting up, you need to happen upon the executable file that people are using who didn't dowload it quite so legally. 

Then save the idiot DRM one in a safe place, so you can pop it back in when you want to install the next Lies and Propaganda pack (and maybe for patches).  I tracked down a new executable for GLS because of that. I'd downloaded the HP, and it was fine- no DRM crap, but now they are all paranoid and pissy about it, so never again.

Have you updated from the "downloader" to "EA Link"? 

Someone sent me the exe for GLS, and it worked fine, so I don't see why the same wouldn't be true for Pets. But it wasn't the normal one off the disk, I don't think. It was from a hacked version or mini-image or something. He sent it to me because I was bitching about the downloader starting up. I'll consult my source and see if I can get what you need.  I definitely didn't buy the downloader version of Pets- if I can't get the disk version of something from here on out, I won't get it at all!

[kathyfanclub]

I did update the license lastnight,with the EA Downloader,if thats what you mean..
Oh thats cool Thanks

[KatEnigma]

It's not called the  EA Downloader anymore- it's now called EA Link, and there is a completely new program that looks to be even clunkier and confusing than the downloader. I wonder if the update is what started your problems.

Anyway, my contact is using a clone, not a no-cd this time around, but check your PM box.    Just make sure to save the original exe(s) in a safe place in case you need to replace them for a patch or to install a new pack.

[kathyfanclub]

EA Link? Retarded name...
I just saw the link in my Inbox,thanks
Is that 1 like, an image,or,? lol,im not very good with all this No CD things,lol! sorry
Will all the build tools etc be there after?

Thanks lots

[ZiggyDoodle]

The threat that you need to be concerned about is the one that takes you by surprise, the one that is triggered in some unknown fashion at an unknown time.

Dizzy's comment came into play for me yesterday at my office, via an evil e-mail sent to a private account I use very rarely and only for business. Even though I read/receive in text, damn thing still attempted to download a file (presumably dealing with Windows) and it was only after I shut off Inernet access via ZoneAlarm was I able to delete the message. 

BTW, I did not open that mail and I do not use the Outlook Express preview pane, however, you have to change the layout options to completely shut off the preview pane.

Am now monitoring that account with a nifty little program I've used for years:  http://www.mailwasher.net/  It allows me to look into my inbox and even preview mail, without actually downloading it.

[KatEnigma]

EA Link? Retarded name...
I just saw the link in my Inbox,thanks
Is that 1 like, an image,or,? lol,im not very good with all this No CD things,lol! sorry
Will all the build tools etc be there after?

Thanks lots

All it does is tell the game to start without looking for the disk. It doesn't disable anything. Otherwise, who would use it? 

For mail, I've been using eprompter for almost 6 years now.  It's strictly text-only. I started using it when I weaned off of AOL so I could have something small running in the background to alert me to incoming mail.  I can delete spam and crap from the server without it ever touching my machine. Then if there's something that I need to reply to or that I can't read because it's in HTML with images and crap (rare, since no one I want to talk to is that annoying) I fire up Thunderbird, which is locked down as tight as I can manage.