ITCS Warning: Check computer for dangerous spyware

By Kim Cobb
ITCS

Microsoft Windows users, including University faculty, students and staff, are threatened with a serious computer security concern called spyware or adware.

Spyware is surveillance software that often is installed on a computer without the user’s knowledge. One particularly threatening version of spyware is called Marketscore.

Marketscore is a threat to both institutional and personal information because it collects Web data by rerouting the information on all incoming and outgoing web traffic through Marketscore servers. If this software is installed on computers, this routing allows Marketscore to collect and store all the information users enter or receive through a Web browser, including:

• Every keystroke entered in a browser window, which could include passwords, banking information and credit card numbers;
• All web-based e-mail, including message content and e-mail addresses;
• Every Web page accessed and all data on each Web page on both public (html) pages and secure (https pages), including the data users are authorized to view in Wolverine Access and any eBusiness they conduct on such sites as eBay or Amazon.com;
• All instant message exchanges.

Marketscore affects users of Microsoft Windows operating systems including XP (all versions, regardless of service pack); 2000/2003 (all versions); NT 4.0; 95, 98, 98 SE and ME.

U-M faculty, students and staff should test their office and home computers at http://www.itss.umich.edu/itss-bin/proxycheck as soon as possible to see if they are infected with Marketscore. Instructions for removing Marketscore can be found at http://safecomputing.umich.edu/marketscore.html, along with information about how Marketscore works and why U-M considers it a security risk. Information about how to avoid spyware and adware in the future can be found on the User Advocate Web site at http://www.umich.edu/~itua/spyware.html.

Users may be unaware that spyware is on their computers since it can be installed bundled with games, screensavers, and peer-to-peer file-sharing programs, including Bearshare, Kazaa, Imesh, Limewire, and many others that are downloadable from the Web.

“This is a very real and serious threat to personal and institutional security,” said Paul Howell, chief IT security officer. “It is something that every Windows user needs to take action against. It’s as big a threat on home computers as it is on University-owned machines, and everyone needs to check to be sure that Marketscore is not present on any of the Windows machines they use. If it is, they need to remove it immediately.”

Beginning Feb. 21, all Web traffic within the University network from computers infected with Marketscore will be redirected to a Web site that informs users that their Internet access has been disabled because the computer has Marketscore spyware installed on it. The page provides instructions on how to remove Marketscore from the computer. Anyone with Marketscore spyware on his or her computer who tries to connect to a U-M Web site or Web-based resource will be unable to do so until Marketscore is removed from the computer.