Are You and Your Friends Fine — Virus Spam
Comments OffLogged into my Google Email and was checking my spam to see what I see and this one draws my attention:
I think I know where this is leading me but I click the link and this website with the Reuters logo pops up:
Now as you can tell this looks authentic but when I did go to this site, AVG detected some trojan. It blocked it, but the file that it is downloaded called “save.exe” and I have talked about flash player fake updates. I have seen other blogs talking about dirty bomb news report leads to malware. I don’t know about you but if I wanted to update my flash player, I go to the source and not use any links. It is wise not to download any programs or files and run them without properly checking them out for viruses and Trojans. You should have a firewall and anti-virus running at all times and that will help but it is your actions that help your prevent from getting viruses or Trojans.
Malicious Spammers target Bank of America
Comments OffI’ve saw two different security firms talking about Bank of America and I wanted to share with you:
Picture from F-secure
It is also been known to be floating around in Facebook this spam. So if you get a link going to a site you don’t know about to see a video and it says you need a codec or the Adobe update you should turn right around and leave site. You should always type in the url of Your Bank and not go there through links.
From what they are saying it monitors Network traffic and Steals ICQ, POP3, and IMAP passwords. If you find network traffic going to Hong Kong IP, then it is time to check to make sure all your Virus definitions are up to date and you’ve installed an Anti-virus and Firewall. I would encourage users to report it to Phishtank so that any other unsuspecting user or person going to that site will be warned.
Is Google the ultimate news source?
Comments OffAs you know We had a big problem Monday Night and All day Tuesday. If you are a regular reader of this blog, you would of noticed either a 503 or lag. It was due to an article that I released late Monday night about the PIFTS.EXE and the so call conspiracy.
At the time, I was wondering and quite disturbed about what Norton Symantec was doing to the forums. So I blogged about this and wouldn’t you know my site was Held Hostage by Google. I kid you not, I had so many people come to my site in under an hour it wasn’t even funny.
I got hit hard by Slashdot, Reddit.com, and Google. In truthfulness, It was more of searches and people coming from Google than anywhere else. I would say Google was the 90% and and Slashdot and Redidit was 8% and the rest was from other websites for this one article. Now don’t get me wrong the 2% of people was my normal amount of people for the day. So you can imagine how many people actually came to my site over this fiasco.
Fake Scareware Sites Popup after the Pifts.EXE Conspiracy
Comments OffThere Seems to Be a Fake site that are popping up today right after what happened with PIFTS.EXE. I just happen to Google it to see what people are talking about and this appears on the front page.
As you can see this leads to a server in Poland and once you go to it you see:
I will be reporting this to Phishtank. This is scareware which means there is no real VIRUS because and you
Should never believe the screens when you see something like this. According to Wikipedia:
[Via Wikipedia]
Fake Emails about Windows Support spam!
Comments OffAccording to Trend Micro, Some malicious software is being sent to unsuspecting users about Windows SP1 andSP2 having a error that could damage software or even hardware. See Trends blog with the photos of the fake spam.
Microsoft sends e-mail messages to subscribers of our security communications when we release information about a security software update or security incident. Unfortunately, malicious individuals can and have sent fake security communications that appear to be from Microsoft.
[Via Microsoft]
So if you get an email from Microsoft you’ll probably want to delete it. Any Microsoft communications will be sent from the Update center. You should never install software that is from an untrusted website. If you are concerned you should check the web and find out what people are saying about the situation and see if it is a scam or true!! Remember only you can prevent a virus or Malware!
Getting to the A600 Program Files
Comments OffSo you want to see this screen when you plug in the A600 Broadband Card:
Uninstall THE USB DRIVERS for A600
C:\Program Files\Cricket\USB DRIVERS\Uninstall.EXE
Once you do that you will see need to reboot and then try to insert the A600 Modem into the USB slot. It should pop up with t hat screen or you should see the drive become available.
I’ve also took the drive and copied the program files into a sub Directory of the 4 Gig drive installed in the A600 and I decided to help everyone else out by uploading the self-extracting program to rapid share:
Cricket-A600-Program.exe Bit torrent file
This is the file I created on Memory card for when I need it. If you are uncomfortable downloading this because your worried about virus, then follow the directions on how to uninstall the software to get to your Cricket software for the A600. I did this to make it easier later on to re-install the software without having to uninstall software. Let me know if this helps. You should consider downloading Free Anti-virus Software and free Firewalls to protect your system if you haven’t already!!
Facebook Goes Phishing again
Comments OffIn one of my Previous articles about the Koobface Worm, I talked about the way they were infecting the systems and what you need not do.
It seems that Trend Micro has seen an even more rise in people downloading the WORM_KOOBFACE.AZ and Seems to be on the RISE. This is all done with a Social engineering and Has had some attempts before with this little worm on Facebook.
* facebook.com
* hi5.com
* friendster.com
* myyearbook.com
* myspace.com
* bebo.com
* tagged.com
* netlog.com
* fubar.com
* livejournal.com
This seems to be a social engineering Nightmare for these websites and as yet are unsure what else it does but it says the same thing it did before by saying “This is a Video of You on the Street.” Which is bogus but none the less people click and think they have to download a codec or update their Flash. Social Engineering is on the rise and will be taken seriously. You should read the full report from Trend on what it does but you also should have an anti-virus and Firewall installed to prevent this from happening in the first place. The only true way of preventing this is not to be fooled, you should NEVER Download from a site you don’t know or trust. See all the Facebook articles for more information.
And the Oscar goes to . . . Not these guys!
Comments OffSans Internet Storm is reporting on Anti-virus Scareware tactic. I’ll quote from them:
ISC reader Gary wrote in to let us know that searching for “oscar presenters” and “oscar winners” with Google brings up a prominently ranked result on a web server in Poland, on a subdomain of “beepl”, which – surprise, surprise – includes a malicious JavaScript. The end result currently seems to reside on stabilitytraceweb com, and is yet another incarnation of the “Fake Anti-Virus Program” malware that we have covered repeatedly. Watch out, the EXE has a meager 6/39 on Virustotal.
[Via Sans]
I did my own research and it is true they are at least 3 sites with the .pl Domain that are used to send you to these fake sites. You should consider checking your system for possible viruses if you been to these sites and are worried. You should also report any site like this to Phishtank to fight this type of scare tactics. Please remember if you are worried about your system this is the best time to install software to prevent these types of scare tactics. Remember you don’t always have to buy software to be safe. There are free anti-virus and Firewall solutions at your fingertips, use them well. It is also a good idea to make sure you have the latest updates from Microsoft while your at it.
PDF Zero Day Vulnerability in the Wild
Comments OffFrom sources all over the internet, Adobe made a sent out a Security bulletin yesterday:
APSA09-01 (Buffer overflow issue in versions 9.0 and earlier of Adobe Reader and Acrobat)
A critical vulnerability has been identified in Adobe Reader 9 and Acrobat 9 and earlier versions. This vulnerability would cause the application to crash and could potentially allow an attacker to take control of the affected system. There are reports that this issue is being exploited.
Adobe Plans on patching this March 11, 2009
and According to some other reports are saying:
Symantec Security Response has received several PDF files that actively exploit a vulnerability in Adobe Reader. We are continuing to remain in contact with Adobe on this vulnerability in order to ensure the security of our mutual customers.
[via Symantec]
Figuring out the Hole for The USB Cricket Card? UM100C
Comments OffSo you bought and you see:
You probably wondering what that can be used for? Here’s what I know and from what I found out. That little can be used as an external Antenna. You could also use this to boost your signal and be able to use this for places that might not be getting a better speed upward and downward bandwidth. You see it all depends on where the Cell Towers are. Although this will likely help those who are either 1 to Almost Zero signal, it will not help those who are outside of the network. It might help and it might not, it depends on the location your at and the closest coverage area. If your on the edge of the coverage area and you buy this antenna it Should boost your signal and get you a better speed. I will not say it will help but in theory it could help. If you want to find out the other post that I have done on this subject please check my Cricket tag for more information. Although it varies on person to person, and region to region this is going to be a variable that will always remain in the grey. Only way to find out is to try it.
Warning Signs of Hard Drive Trouble
Comments Off
For every computer there comes a time when you have a problem with hardware or software. This is for those who want to learn the signs of possible fixes for having hard drive problems. Although if you know you’re hard drive is dieing then you better back it up as quickly as possible. You will of course need to get the back up software to protect your data. If you have special drivers you will need to backup yours drivers. If you have an OEM system then you will need to backup the Hidden Partition.
So what are the warning signs of a hard drive failure:
- Unexpected freezing of Windows — When Windows Locks up and you have to reboot or getting a Blue Screen of Death. You have no choice but to restart because you can’t do anything with windows.
- Losing data files — if you seem to see files being lost or deleted without your direct input. It might be a sign of a computer virus or it could be a damaged hard drive.
Digital Convert boxes for Feburary 17, 2008
Comments OffIt being close to the change over, I’d figure I’d show you some of them and talk about them. To better help people make up there minds on what might be there choice of a Digital Converter Box. This is to help people get the most out of there products.
The Specs for this Converter is:
Zenith DTT901 Digital TV Tuner Converter Box
- Digital TV Tuner Coverter Box
- Analog Pass-Through for Low-Power TV Stations broadcasts
- On-Screen Program Information with Remote Control
- Simple Connection to TV with supplied RF Cable
- Parental Control to Manage TV Programs and advanced Closed Captioning
It could be on sale so check the link for more price options. I also found this one that is a little more expensive but supposed to be better:
GE 23333 Digital to Analog TV Converter Box
- Smart Antenna Interface
- Simple Setup
- Analog Pass Through
- Dolby(R) Digital Sound
- Receives Over-Air Hdtv Signals
$76.99 Free Shipping
Western Digital To Shed 2,500 people from the workforce!
Comments OffI saw this on Engadget and had to talk about this. If you are getting Laid off. This will be over shortly, I am sure of it!!!
[Via Engadget]
This is sad just before the holidays people will have to stay home and worry about the coming year. I hope they get some help with the government. Where is the second check that we are supposed to get?
Tools for Virus Removal : The ones I like to use!
Comments OffIn this post I want to talk about virus removal tools that I like to use when I need to remove a virus. Some thing to consider when using these tools are:
Each of these have to be dealt with differently because each requires something different. Like rootkits if you have one installed and know that it is a rootkit you only options are to download some rootkit removers like:
- Sopho’s Anti-rootkit remover – This is good for those more known viruses and can remove several types of rootkits. This isn’t the only one I use, but it is a part of group that does the rootkit removing for me.
- Microsoft Rootkit Revealer – This is good for proving there is a rootkit. I’ve not seen it not detect a rootkit. Most of the time when I find a rootkit from the other rootkit revealers this one actually dos better with information.
- Panda Anti-Rootkit Remover — This one is another one I use when the other ones can’t remove it. Each one does remove certain rootkit differently and works better than the other.
PS3 launches “HOME” so you don’t have to go anywhere for the Holidays!
Comments OffSony, Launches “Home” today and according to the Washington Post and I’ll quote:
PS3 owners will be able to download and check out the new service starting tomorrow. Home is free to Web-connected owners of the game console, though users may opt to spend money to spiff up their avatars and virtual apartments.
[via Washington Post]
It looks very much like it will be a success with the users. This should make it a lot easier to meet people and discuss what they are playing. It looks like they are trying this in BETA and should out of beta in a couple of months. Sony should start offering service for everyone as they roll out it to all parts of the world. It will take time for it to get to all the pople so please be patient.
Crafty little Trojan:W32/DNSChanger.ARNF
Comments OffSaw this post and couldn’t resist talking about it. This was talked about on F-secure. It looks like they use a program call “Homeview Installer” and after you install it you get the Trojan:W32/DNSChanger.ARNF. So how do you get that off your system? Before we talk about that, let’s talk about what it does. According to F-secure:
This malware is dropped onto the system by Trojan-Dropper:W32/Agent.FLN. It is used to change the DNS settings on a system so that information such as passwords and credit card details can be retrieved.
[Via F-secure]
What you need to do to get rid of this of this Trojan is to scan your system. You will also need to understand that this is a really good Trojan, it sees to modify your DNS and also your Registry. Once you located and destroyed it you will then want to remove all your restore points. After that you will want to check my other resources to better protect yourself. You are the only one to prevent a virus from getting on your system. If you like this one check out my other post as well.
Facebook : Beware Spam for breakfast. (Virus)
Comments OffIn today’s society, we’ve been to complacent with people with people clicking links for the social group. In one such article on Channel Web, a nice little blog, says this:
The worm was discovered by IT security provider Kaspersky Lab, which said the threat, Net-Worm.Win32.Koobface.b, is targeting Facebook users by creating spam messages and sending them to the infected user’s friends via the site.
“Unfortunately, users are very trusting of messages left by ‘friends’ on social networking sites,” said Alexander Gostev, senior virus analyst at Kaspersky Lab, in a statement. “So, the likelihood of a user clicking on a link like this is very high.”
[Via Channel Web]
This seems to be a problem people thinking that a link someone sends them is a real good link but actually is a link to a video site. According to this article the links people are sending are actually a fake video link, telling you have to download some update to flash player, by downloading this program. The user gets involved with the virus and the fun begins. So how can you prevent this from happening, two ways one is a very good group of software to make sure you have the latest and greatest video codecs. That too can be something they’ll say you need and if you’ve already installed this list of codecs then you know they’ll not telling the truth and you can quickly get away from the site laughing.
Trojan.PWS.ChromeInject.A is not a Firefox plugin.
Comments Off
A new type of malware designed to harvest web passwords has been detected in-the-wild by BitDefender’s antivirus research labs. This latest e-threat – called Trojan.PWS.ChromeInject.A – is intended to be delivered onto a compromised computer system by other malware for subsequent download into Mozilla Firefox’s Plugin folder. Once installed it gets to work every time Firefox is started.[Via Bitdefender]
The key to this virus protection is just be cautious of where you go and keep all you system update to date to prevent all this from happening. It is also advisable to not have your passwords saved on Firefox, you should use something like Roboform, it is free to download and try. It will encrypt your passwords so if they don’t know the master password then they are out of luck. Roboform is also good for coming up with some strong passwords. Just some suggestions to prevent from people seeing your sensitive data, you don’t want anyone to get that data.
Are you patched, Secunia Says NO
Comments Off
Think you’ve got nothing to worry about, according to Secunia 98% of computers are not fully patched and are vulnerable to some kinda of attack.
If you have a system that is off of the Net you could use the Clone of Autopatcher Program to do it for you. You also need to update all your secondary programs such as Audacity, Open Office, and other programs that you use weekly.
sinowal.trojan Problems.
Comments Off
Trojan-PSW:W32/Sinowal.CP drops and loads a password stealing component on the infected system and tries to steal account information from it. It also tries to steal information that is required to access certain online banks’ and online payment systems’ websites.[via F-secure]
This are the beginning steps to get rid of a Virus but it will be a really hard virus because it wants to stay in your system. You should also Restart in Safe mode and Try to remove that virus that one. You will also want to disable your system restore due to the fact that it will be in there and might come back if you restore your system. Just some simple tips to help keep you safe on the net.
Vista Sp2 Beta Still not up yet!
Comments Off
Adobe Lays off 600 people
Comments Off
Adobe might also hire new workers within Europe, he said. The cuts will be formally announced on Dec. 15 when the company releases its fourth-quarter financial report.
[via Infoworld]
Adobe also announced the implementation of a restructuring program, and has taken steps to reduce its headcount by approximately 600 full-time positions globally. The restructuring will result in anticipated pre-tax charges totaling approximately $44 million to $50 million. The Company expects approximately $28 million to $30 million of the restructuring charges to be recorded in the fourth quarter of fiscal year 2008.
You asked for it, Now it’s real — Vista SP2 Dec 4,2008
Comments Off
Beginning Thursday Dec. 4th, we will be making the Windows Vista and Windows Server 2008 Service Pack 2 Beta available to everyone through a Customer Preview Program (CPP). The CPP will launch on TechNet and be available to anyone interested in trying out this service pack. The CPP is intended for technology enthusiasts, developers, and IT Pros who would like to test Service Pack 2 in their environments and with their applications prior to final release. For most customers, our best advice would be to wait until the final release prior to installing this service pack.[Via Technet]
- It is a Beta
- It will Have Bugs
- It is for people who want to test it out
- It should only be installed for people who need to test it out
Spying on Spyware.ISpynow!!
Comments OffSpyware.ISpyNow monitors files, network traffic, and keystrokes. This Spyware gives the person who installed it a Web-based interface with summaries of logged information on the host computer.
[Via Symantec]
- Avg detected Trojan Horse Generic 12.htc? – This has a great article on how to use HiJackthis program and how to make sure you no longer have the virus.
- Some Important programs to prevent yourself from having viruses and Malware!! — This article gives you some other programs to use other than Symantec. You have a wide variety of choices on Anti-virus programs and Firewall Choices. You also have some choices on Spyware removal programs.
Some good CyberMonday Sites to look at for 2008!
Comments OffI was just getting done with that story about the Walmart Stampede, and thought I would encourage people to check these good sites for people to check out for great deals. I have been looking through sites combing for some great sites to find the best deals and here they are:
- Dealio — Dealio will not only show you sneak peaks at Cyber Monday ads, but we will also send you directly to the store so that you can purchase the often limited inventory Cyber Monday deals before they disappear. Best of all, there is no need to hop from site to site – Dealio has all your Cyber Monday shopping covered.
- CyberMonday – Shop hot holiday deals from more than 500 merchants. All of Shop.org’s proceeds from CyberMonday.com support the Ray Greenly Scholarship Fund.
- Cybermonday Mahalo Deals — This Mahalo page collects links to websites offering information and discounted merchandise for Cyber Monday.
- Best Cyber Monday Sales –Well, I finally put together a list of the top retailers throughout the country with links directly to their Cyber Monday deals.
Not so, Antivirus2008
Comments OffOK, so let’s say the user (by some stroke of luckless chance, or courtesy of a trojan downloader) ends up with the demo installer of Rogue:W32/VirusRemover2008.C on their hands and it runs
[via F-Secure]
According to them, they have many different version of this rogue antispyware. They have de, dk, es, fr, it, no, nl, and no, which are all attempting for you to buy this no so Virusremover2008 software. They talk about how it tells you have a 9 infected viruses and that you need to remove them, but in truth, they use a text file to create this lie. Check out all the details for further information.
Podcasters are in up in arms over Ustream.tv
REVISED:
Cricket USB UM100 Broadband Wireless Modem Review.
The UM100c is No Longer Available, Please check out the Cricket A600 Modem Review Or the UM185 Broadband modem. The UM185 modem might be a replacement to the UM100.
After a full week of playing around with this USB wireless, I wanted to talk about it. So let’s break it down into pieces.
- (USB Broadband A600 Modem card for Free after Instant online rebates and Mail in rebate Free shipping & first month free! Shop today.)
- Installation – The installation of the USB was not to difficult. I did have to do some more steps than this: Install the Software, then hooked up the USB device to the USB port.
- Manual Activated the Broadband – For some reason in my area they had several people have problems with the broadband activation. So I had to activate it manually!!
After that all went well, I was on the internet just a cruising along. I did however wonder why I was getting such a slow response speed. When I went traveling I thought I would share some of my local results with you to better show you my speed. All these test were done at
Microsoft kills a fake antivirus tool from 994,061 computers!
Comments Off
According to Arstechnica and I’ll quote:Win32/FakeSecSen has gone by various names, including Micro Antivirus 2009, MS Antivirus, Spyware Preventer, Vista Antivirus 2008, Advanced Antivirus, System Antivirus 2008, Ultimate Antivirus 2008, Windows Antivirus, XPert Antivirus, Power Antivirus, and Ultra Antivirus 2009. Furthermore, it is skinnable, so each of these variants has a different GUI, although the basic functionality is the same: bother users with warnings of malware until they pay up.The Microsoft Malware Protection Center recently released some data on how the removal tool performed this month: FakeSecSen was removed from 994,061 machines. That number isn’t the highest Microsoft has recorded before, and the number of removals depends on which malware Microsoft adds each month and how widespread it is.
[via Arstechnica]
This seemed to of happened this month with the usual Windows update. If you haven’t updated your system just yet you should. This troublesome fake virus seems to have been killed from several systems. This could effectively make it harder for these guys who ever designed this program to make money. I hope microsoft does even more virus removals in next month. If you still want to try to get rid of these viruses don’t forget to check out my tips on Virus removal.
How to disable autorun the easy way!!!
Comments OffI read a report from Cnet about USB devices spreading Virus and I will quote:
The bad guys are intentionally developing new flavors of malware designed to propagate through USB devices,” said Gunter Ollmann, chief security strategist for IBM’s ISS security division. “They are today’s floppy drives.”
An infected computer can spread a virus to a clean USB thumb drive that is inserted. That USB drive will then be spreading the virus onto other computers if the operating system on those machines has an AutoRun-type feature enabled. The AutoRun function in Windows launches installers and other programs automatically when a flash drive or CD is inserted. The Mac has an equivalent function, according to Ollmann.[Via Cnet]
In order to disable “autorun“, which in Vista is called Autoplay. In order to disable Autoplay from starting when you insert media into your computer here is how you do it:
You will need to be Logged in as Administrator before this can be done:
Next click start and type “Autoplay” without quotes. It will bring up a screen but all you have to worry about is this:
