Pre-installed spyware?

[petermeachem]

I've been helping someone out with their new dell pc. It doesn't currently have any sort of internet conenction as he is waiting for BT to sort the exchange.
He has had the computer for a week and has not installed anything at all, it's just as it came from dell. He did copy some word files from a backup of his old pc, or rather I did.
So I went round today and he said that whilst he was writing a letter in Word when a message popped up.
This said it was aol spyware? and announced that it had found Alexa and Coolwebsearch and would he like them blocked.

Is there any way at all that these could have turned up other than via an Internet connection?
Is this aol spyware thing duff, and why did it only pop up yesterday?
Were these 'features' pre-installed?

Anyway, I'm claiming a record.

http://www.accuflight.com

http://www.lettersdirect.co.uk

http://www.ourhouseinportugal.co.uk/

 

[2ffat]

Is IM running? Could it be an IM pop-up? Spammers can use IM as easily as email.

Which brings up another point, did the user open an email that may have loaded something on the machine?


James P. Cottingham
-----------------------------------------
[sup]To determine how long it will take to write and debug a program, take your best estimate, multiply that by two, add one, and convert to the next higher units.[/sup]

 

[petermeachem]

The pc is not connected to the internet at all.

http://www.accuflight.com

http://www.lettersdirect.co.uk

http://www.ourhouseinportugal.co.uk/

 

[Salem]

Perhaps the old word files were already infected with some macro virus.
What macro security does the new version of word run with?

> Were these 'features' pre-installed?
Could be - all sorts of crud could come with "pre-installed" systems, hoping you'll take the path of least resistance and sign up with AOL, MSN or whoever else has bought a place on the desktop.

Being suspicious, I trash the existing installation when I get a machine and try and reinstall it from the ground up. Not only does this prove that you have been given all the correct disks, it also means there is no crud.
Having a spare HD around makes this a pretty easy and safe thing to do.

> It doesn't currently have any sort of internet conenction as he is waiting for BT to sort the exchange.
Which BT exchange doesn't allow at least a dial-up connection?

--

 

[petermeachem]

I wouldn't expect spyware from Dell.
Adsl is being enabled tomorrow.

http://www.accuflight.com

http://www.lettersdirect.co.uk

http://www.ourhouseinportugal.co.uk/

 

[2ffat]

Many PC makers ship PCs with eval or "free" software. Maybe one of those included something.



James P. Cottingham
-----------------------------------------
[sup]To determine how long it will take to write and debug a program, take your best estimate, multiply that by two, add one, and convert to the next higher units.[/sup]

 

[rockerfellerz]

ALEXA" is part of internet explorer, it is microsoft's very own built in spyware. It's not needed, so trash it.

If you're going through Hell...keep going... (Winston Churchill)
RocKeRFelLerZ

 

[Xemus]

The Alexa "what's related" link does come built-in to Internet Explorer. It is safe to remove, as rockerfellerz said.
As far as CWS being detected, that should not be appearing on a system that hasn't been connected.
HP and Emachines do install some spyware (Wild Tangent and others), so it's possible, tho unlikely.

http://www.closedsocket.com