Farsighter Spyware on MY PC (OT)

[ewile]

This afternoon I ran spysweeper and furned up this Farsighter which they describe as a system monitor. It seems to stream a video of your computer usage to a remote computer and all the descriptions imply a survellance device of some sort.

So, I removed it with spysweeper. Just for the heck of it I decided to runspysweeper again, and it turned up Farsighter again.

Only 2 people use this PC, me and my wife. I've been using firefox for a couple of weeks and my wife does all her internet with AOL.

How alarmed should I be. Is it time to change all the passwords?

[ewile]

From the doc: 'Farsighter monitors a remote computer invisibly by streaming video to a viewer on your computer. You will know exactly what is happening on the remote computer as you see it in real-time. Farsighter consist of two parts, a server and a client. The server is installed on the target computer to be monitored. The server can be run invisibly in the background. The client is installed on your computer to watch the target computer. The client will connect to the server and receive streaming video. Basically, install the server on the computer you want to monitor and the client on the computer where you want to watch the monitored computer.'

Category:
Commercial RAT: Any commercial product that is normally used for remote administration, but which might be exploited to do this without user consent or awareness.

Group:Sureshot

By This Group:Ghost Keylogger · Ghost Keylogger 3.0 · Ghost Keylogger 3.53 · Ghost Keylogger 3.73 · Ghost Keylogger Lite · Surf Spy · Surf Spy 1.0 · Surf Spy 2.10 · Windows Remote · Windows Spy

[GrannyMae]

i'm not joking here, but are you sure your wife did not install this to monitor you?

[liquidboss]

[ QUOTE ]
i'm not joking here, but are you sure your wife did not install this to monitor you?

[/ QUOTE ]

Lol, I was thinking the same thing... sounds less like a virus or trojan and more like a commercial product someone installed.

[GrannyMae]

correct.

this is much more likely to have been installed on your pc than implanted

[ewile]

[ QUOTE ]
i'm not joking here, but are you sure your wife did not install this to monitor you?

[/ QUOTE ]

There's no way. I don't think that she even knows how to download a program.

[ewile]

I'm now running spysweeper for a 3rd time to see if this crap is gone.

I'm feeling pretty paranoid right about now [img]/images/graemlins/frown.gif[/img]

[JAque]

I hope this helps, see removal instructions below.

JAque

Spyware.Farsighter
Last Updated on: August 06, 2004 10:43:07 AM





No Damage.



Type: Spyware

Name: Farsighter
Version: 2.0
Publisher: Sureshot
Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP
Systems Not Affected: DOS, EPOC, Linux, Macintosh, Macintosh OS X, Novell Netware, OS/2, UNIX

Removal: Low
Damage: Low




Intelligent Updater Definitions*
July 19, 2004


LiveUpdate™ Definitions **
July 21, 2004


*
Intelligent Updater definitions are released daily, but require manual download and installation.
Click here to download manually.

**
LiveUpdate definitions are usually released every Wednesday.
Click here for instructions on using LiveUpdate.





This threat can be detected only by Symantec products that support expanded threats. For more information on expanded threats, please go here.




Behavior
Spyware.Farsighter consists of two components: server and client. The server component allows the running computer the client component to remotely view the computer screen, which is running the server component.

Symptoms
The files are detected as Spyware.Farsighter.

Transmission
Spyware.Farsighter must be manually installed.




File names: Serverconfig.exe; Fserv.exe; Farsighter.exe

Server
When the installer for the server component of Spyware.Farsighter is run, it does the following:


Displays the End-User License Agreement.


Creates the folder, %ProgramFiles%\Farsighter Server. (This path is configurable.)


Creates the following files:

%ProgramFiles%\Farsighter Server\Serverconfig.exe: Main configuration file. Detected as Spyware.Farsighter.
%ProgramFiles%\Farsighter Server\Manual.html: Documentation.
%ProgramFiles%\Farsighter Server\faq.html: Frequently Asked Questions.
%ProgramFiles%\Farsighter Server\Uninstall.bat: Uninstaller.
%ProgramFiles%\Farsighter Server\System\Config.cfg: Configurations settings.
%ProgramFiles%\Farsighter Server\System\Fserv.exe: Server. Detected as Spyware.Farsighter.


Adds the value:

"fsserv" = "%ProgramFiles%\Farsighter Server\.\system\fserv.exe"

to the registry key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Run

so that the Spyware runs when you start Windows.


Client
When the installer for the client component of Spyware.Farsighter is run, it does the following:

Displays the End-User License Agreement.


Creates the folder, %ProgramFiles%\Farsighter Client. (This path is confugurable.)


Creates the following files:

%ProgramFiles%\Farsighter Client\farsighter.exe: Used to monitor remote computers. Detected as Spyware.Farsighter.
%ProgramFiles%\Farsighter Client\Uninst.isu: Used for uninstalling.
C:\Documents and Settings\All Users\Start Menu\Programs\Farsighter Client\Farsighter.lnk: Start Menu link.
%ProgramFiles%\Farsighter Client\manual.html: Documentation.
C:\Documents and Settings\All Users\Start Menu\Programs\Farsighter Client\Manual.lnk: Start Menu link.
C:\Documents and Settings\All Users\Start Menu\Programs\Farsighter Client\Visit Sureshot.url: Start Menu link.
%ProgramFiles%\Farsighter Client\faq.html: Frequently Asked Questions.
C:\Documents and Settings\All Users\Start Menu\Programs\Farsighter Client\Faq.lnk: Start Menu link.


Removal Instructions

Server
The following instructions pertain to all Symantec antivirus products that support Expanded Threat detection.


Update the definitions.
Restart the computer in Safe mode.
Run a full system scan and delete all the files detected as Spyware.Farsighter.
Delete the values that were added to the registry.

For specific details on each of these steps, read the following instructions.

1. To update the definitions
To obtain the most recent definitions, start your Symantec program and run LiveUpdate.

2. To restart the computer in Safe mode
Shut down the computer and turn off the power. Wait for at least 30 seconds, and then restart the computer in Safe mode. For instructions, read the document, "How to start the computer in Safe Mode."

3. To scan for and delete the files
Start Norton AntiVirus and make sure that it is configured to scan all the files. For more information, read the document, "How to configure Norton AntiVirus to scan all files."
Run a full system scan.
If any files are detected as Spyware.Farsighter, click Delete.


Note: If your Symantec antivirus product reports that it cannot delete a detected file, write down the path and file names. Then use Windows Explorer to locate and delete the file.

4. To delete the value from the registry

Important: Symantec strongly recommends that you back up the registry before making any changes to it. Incorrect changes to the registry can result in permanent data loss or corrupted files. Modify the specified keys only. Read the document, "How to make a backup of the Windows registry," for instructions.

Click Start > Run.
Type regedit, then click OK.
Navigate to the key:

HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Curr entVersion\Run


In the right plane, delete the value:

"fsserv" = "%ProgramFiles%\Farsighter Server\.\system\fserv.exe"


Exit the Registry Editor.

Client
The following instructions pertain to all Symantec antivirus products that support Expanded Threat detection.

Update the definitions.
Restart the computer in Safe mode.
Run a full system scan and delete all the files detected as Spyware.Farsighter. Delete the values that were added to the registry.

For specific details on each of these steps, read the following instructions.

1. To update the definitions
To obtain the most recent definitions, start your Symantec program and run LiveUpdate.

2. To restart the computer in Safe mode
Shut down the computer and turn off the power. Wait for at least 30 seconds, and then restart the computer in Safe mode. For instructions, read the document, "How to start the computer in Safe Mode."

3. To scan for and delete the files
Start Norton AntiVirus and make sure that it is configured to scan all the files. For more information, read the document, "How to configure Norton AntiVirus to scan all files."
Run a full system scan.
If any files are detected as Spyware.Farsighter, click Delete.


Note: If your Symantec antivirus product reports that it cannot delete a detected file, write down the path and file names. Then use Windows Explorer to locate and delete the file.

[GrannyMae]

There's no way. I don't think that she even knows how to download a program.

good. then just get that bugger off there, and make sure you tell us where you think you got that thing. it sounds like it is not just a regular keylogger type thing, but a much more active monitoring program. any clues where you got it?

[ewile]

I truly don't have the slightest idea where this came from.
I am completely certain that nobody else has used this computer. My kids are 2&1/2 and 9 months. Their friends aren't into hacking yet.

It seems like this needs to be actively installed on your computer and that you need to accept the user agreement etc.

I don't get it. Unless there are other ways that this can be installed.