Are You and Your Friends Fine — Virus Spam

By Paul | Mar 22, 2009

Comments Off

Logged into my Google Email and was checking my spam to see what I see and this one draws my attention:

I think I know where this is leading me but I click the link and this website with the Reuters logo pops up:

Now as you can tell this looks authentic but when I did go to this site, AVG detected some trojan.  It blocked it, but  the file that it is downloaded called “save.exe” and I have talked about flash player fake updates.  I have seen other blogs talking about dirty bomb news report leads to malware.  I don’t know about you but if I wanted to update my flash player, I go to the source and not use any links.  It is wise not to download any programs or files and run them without properly checking them out for viruses and Trojans.  You should have a firewall and anti-virus running at all times and that will help but it is your actions that help your prevent from getting viruses or Trojans.

Is Google the ultimate news source?

By Paul | Mar 12, 2009

Comments Off

As you know We had a big problem Monday Night and All day Tuesday. If you are a regular reader of this blog, you would of noticed either a 503 or lag. It was due to an article that I released late Monday night about the PIFTS.EXE and the so call conspiracy.

At the time, I was wondering and quite disturbed about what Norton Symantec was doing to the forums. So I blogged about this and wouldn’t you know my site was Held Hostage by Google. I kid you not, I had so many people come to my site in under an hour it wasn’t even funny.

I got hit hard by Slashdot, Reddit.com, and Google.  In truthfulness, It was more of searches and people coming from Google than anywhere else. I would say Google was the 90% and and Slashdot and Redidit was 8% and the rest was from other websites for this one article. Now don’t get me wrong the 2% of people was my normal amount of people for the day. So you can imagine how many people actually came to my site over this fiasco.

Fake Scareware Sites Popup after the Pifts.EXE Conspiracy

By Paul | Mar 10, 2009

Comments Off

There Seems to Be a Fake site that are popping up today right after what happened with PIFTS.EXE. I just happen to Google it to see what people are talking about and this appears on the front page.

As you can see this leads to a server in Poland and once you go to it you see:

I will be reporting this to Phishtank. This is scareware which means  there is no real VIRUS because and you
Should never believe the screens when you see something like this. According to Wikipedia:

Conspiracy theories run rampent due to PIFTS.EXE

By Paul | Mar 9, 2009

View Comments

(Looks like some of this was a 4chan gag, check my other post about it)

All of the sudden people around the World are seeing PIFTS.EXE popping up. Norton Antivirus is asking users if they want to accept it. Here what I do know:

Here’s some information I pulled from my Zone Alarm Logs. Does this make sense to anyone?

2009/03/09 18:26:44 — New Program — PIFTS.exe — Destination IP: 67.134.208.160:80 — outgoing — blocked — Destination: ping.lifecycle.norton.com

2009/03/09 18:47:52 — Program Access — PIFTS.exe — Destination IP: — outgoing — blocked — Destination:

2009/03/09 18:48:28 — Changed Program — Windows Explorer — 207.46.248.249.80 — outgoing — blocked — Destination: sa.windows.com
[Via The Symatec Forums]

This indicates that the program tried to change tactics to go out on the net.  I look a look for this and it is SwapDrive.  So this must be an update to Swapdrive but I am unsure as to why it pops up that way.  The other ip is in Africa or at least take the .80 out of the equation and it points to an Africa IP.  (It looks to my mistake in that little part, “to error is human” Check out this  post about it)  Although just recently Norton Decides to Delete that thread and people are really worried about why?  Is this a cover up of some sort because there is a exploit in the Wild that we don’t know about?  These are good questions that need to be answered.   Here is what one posted about this just after they deleted the forum thread:

Fake Emails about Windows Support spam!

By Paul | Mar 9, 2009

Comments Off

According to Trend Micro, Some malicious software is being sent to unsuspecting users about Windows SP1 andSP2 having a error that could damage software or even hardware.  See Trends blog with the photos of the fake spam.

Microsoft sends e-mail messages to subscribers of our security communications when we release information about a security software update or security incident. Unfortunately, malicious individuals can and have sent fake security communications that appear to be from Microsoft.

[Via Microsoft]

So if you get an email from Microsoft you’ll probably want to delete it.  Any Microsoft communications will be sent from the Update center.  You should never install software that is from an untrusted website.    If you are concerned you should check the web and find out what people are saying about the situation and see if it is a scam or true!!  Remember only you can prevent a virus or Malware!

Microsoft Releases the Patch Information for March

By Paul | Mar 4, 2009

Comments Off

Microsoft Has Released the Patch information For march and This is what is expected to be patch on March 11, 2009:

• Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution (Kb949029) — This security update resolves several privately reported and publicly reported vulnerabilities in Microsoft Office Excel that could allow remote code execution if a user opens a specially crafted Excel file. An attacker who successfully exploited these vulnerabilities could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.  (affected System : Microsoft Office)

Facebook Goes Phishing again

By Paul | Mar 1, 2009

Comments Off

In one of my Previous articles about the Koobface Worm, I talked about the way they were infecting the systems and what you need not do.

It seems that Trend Micro has seen an even more rise in people downloading the WORM_KOOBFACE.AZ and Seems to be on the RISE. This is all done with a Social engineering and Has had some attempts before with this little worm on Facebook.

This seems to be a social engineering Nightmare for these websites and as yet are unsure what else it does but it says the same thing it did before by saying “This is a Video of You on the Street.” Which is bogus but none the less people click and think they have to download a codec or update their Flash. Social Engineering is on the rise and will be taken seriously. You should read the full report from Trend on what it does but you also should have an anti-virus and Firewall installed to prevent this from happening in the first place. The only true way of preventing this is not to be fooled, you should NEVER Download from a site you don’t know or trust. See all the Facebook articles for more information.

PDF Zero Day Vulnerability in the Wild

By Paul | Feb 20, 2009

Comments Off

From sources all over the internet, Adobe made a sent out a Security bulletin yesterday:

APSA09-01 (Buffer overflow issue in versions 9.0 and earlier of Adobe Reader and Acrobat)

A critical vulnerability has been identified in Adobe Reader 9 and Acrobat 9 and earlier versions. This vulnerability would cause the application to crash and could potentially allow an attacker to take control of the affected system. There are reports that this issue is being exploited.

Adobe Plans on patching this March 11, 2009

and According to some other reports are saying:

Symantec Security Response has received several PDF files that actively exploit a vulnerability in Adobe Reader. We are continuing to remain in contact with Adobe on this vulnerability in order to ensure the security of our mutual customers.

[via Symantec]

Figuring out the Hole for The USB Cricket Card? UM100C

By Paul | Feb 11, 2009

Comments Off

So you bought and you see:

You probably wondering what that can be used for? Here’s what I know and from what I found out. That little can be used as an external Antenna. You could also use this to boost your signal and be able to use this for places that might not be getting a better speed upward and downward bandwidth. You see it all depends on where the Cell Towers are. Although this will likely help those who are either 1 to Almost Zero signal, it will not help those who are outside of the network. It might help and it might not, it depends on the location your at and the closest coverage area. If your on the edge of the coverage area and you buy this antenna it Should boost your signal and get you a better speed. I will not say it will help but in theory it could help. If you want to find out the other post that I have done on this subject please check my Cricket tag for more information.  Although it varies on person to person, and region to region this is going to be a variable that will always remain in the grey.   Only way to find out is to try it.

Fix Shutdown Problems in Vista!

By Paul | Dec 10, 2008

Comments Off

In the Patch Tuesday update, Microsoft quietly released the patch to fix Windows Vista machine shut problems. This patch should of came sooner.

KB957388

Update for Windows Server 2008 and Windows Vista

Install this update to resolve a set of known application compatibility issues with Windows Server 2008. After you install this item, you may have to restart your computer.

This was not a critical update and it seems to resolve so many issues with compatibility.  One thing it seemed to fix on my system has been the shutdown time.  It is now quite fast, it would normally take me 2 to 3 mins to shutdown, now it does it in less than a Minute.   So if you’ve not installed this update please install it soon.   I would like to know if people are seeing the same thing I am.   I’ve found a great resource on fixing it if you are still having problem, it talks about how to check your system performance. Although this is been doing it lately with these programs not loaded or even running, they still seem to cause problems so now I get the feeling it has to do with legacy programs.  This should fix most of the problem with older programs.

Google let your work from home with Task Lists!!

By Paul | Dec 9, 2008

Comments Off

As the day go by we have all have tasks, and that means we have to keep a way to remember them.  Google decided to add that to there Google Mail.  Pcworld said it the right way:

[Via Pcworld]

Facebook: Virus Variant comes back from the dead!

By Paul | Dec 8, 2008

Comments Off

In my recent post, I talked about a Virus that is circulating around on Facebook.  It is know as the Koobface virus and has been changed a little by the programers.   So I what is Techworld saying, just this:

In fact, Koobface is now using one of Facebook’s own features against it, Lovet said. The latest variant uses Facebook’s ability to redirect web links to drive users to malicious websites, often hosted on Geocities.com, Lovet said.

[Via Techworld]

If you have been victim to this little virus, you should check out my Virus removal page and download the programs that should fix this little virus for good on your system.  You should also check out my Previous post I also have some good tips and tricks to prevent the user(YOU) from getting hit by this virus in the first place. This virus is a Good social engineered virus, so please be careful.

Facebook : Beware Spam for breakfast. (Virus)

By Paul | Dec 7, 2008

Comments Off

In today’s society, we’ve been to complacent with people with people clicking links for the social group. In one such article on Channel Web, a nice little blog, says this:

The worm was discovered by IT security provider Kaspersky Lab, which said the threat, Net-Worm.Win32.Koobface.b, is targeting Facebook users by creating spam messages and sending them to the infected user’s friends via the site.

“Unfortunately, users are very trusting of messages left by ‘friends’ on social networking sites,” said Alexander Gostev, senior virus analyst at Kaspersky Lab, in a statement. “So, the likelihood of a user clicking on a link like this is very high.”

[Via Channel Web]

This seems to be a problem people thinking that a link someone sends them is a real good link but actually is a link to a video site. According to this article the links people are sending are actually a fake video link, telling you have to download some update to flash player, by downloading this program. The user gets involved with the virus and the fun begins. So how can you prevent this from happening, two ways one is a very good group of software to make sure you have the latest and greatest video codecs. That too can be something they’ll say you need and if you’ve already installed this list of codecs then you know they’ll not telling the truth and you can quickly get away from the site laughing.

trojan.zlob removal tricks!!

By Paul | Dec 6, 2008

Comments Off

Aliases:
Trojan-Downloader.Win32.Zlob.qyl (Kaspersky)
Trojan-Downloader.Win32.Zlob.qzs (Kaspersky)
Trojan-Downloader.Win32.Zlob.qzn (Kaspersky)
Trojan.Zlob.CPP (BitDefender)
Puper (McAfee)
SystemDefender (Symantec)

Trojan:Win32/Zlob.G is a component of Win32/Zlob that downloads rogue security programs, adware, and additional Win32/Zlob components.

[Via Windows Live OneCare]

Trojan.PWS.ChromeInject.A is not a Firefox plugin.

By Paul | Dec 5, 2008

Comments Off

A new type of malware designed to harvest web passwords has been detected in-the-wild by BitDefender’s antivirus research labs. This latest e-threat – called Trojan.PWS.ChromeInject.A – is intended to be delivered onto a compromised computer system by other malware for subsequent download into Mozilla Firefox’s Plugin folder. Once installed it gets to work every time Firefox is started.

[Via Bitdefender]

The key to this virus protection is just be cautious of where you go and keep all you system update to date to prevent all this from happening.  It is also advisable to not have your passwords saved on Firefox, you should use something like Roboform, it is free  to download and try.  It will encrypt your passwords so if they don’t know the master password then they are out of luck.  Roboform is also good for coming up with some strong passwords.  Just some suggestions to prevent from people seeing your sensitive data, you don’t want anyone to get that data.

Vista Sp2 Beta Still not up yet!

By Paul | Dec 4, 2008

Comments Off

Is this Windows 7?

By Paul | Dec 4, 2008

Comments Off

As you can see that looks to be the final release of the start screen. In the past they haven’t change the start screen, it looks to be really polished and ready for use with Windows 7. If anything, I think the boot screen will be permanent and definitely not temporary. On a Side note, I found this video as well:

I also found one more little Video that looks to be promising, it’s called Windows 7 Super bar. This little Video looks convincingly like this will be kept in Windows 7 but you know how Microsoft is on beta’s. Any how, Here’s this one:

Windows 7 Super Bar from Paul Jenkins on Vimeo.

Apple’s Immunity, Botnet sanctuary.

By Paul | Dec 3, 2008

Comments Off

But is Apple projecting a false sense of security just to save face? Many experts repeatedly warn that all operating systems are susceptible to viruses, and as the Mac becomes more popular OS X will inevitably become a bigger target for malicious attacks.

[via Pcworld]

Having said that I feel the notion that Apple is trying to keep there reputation as a virus free system. I can only hope that they stay that way. Which as much as I know, Apple will most like start to be the main source for botnets, because of the lack of security.

Is this Hardcore PC Falcon Northwest Mach V Extreme or not?

By Paul | Dec 3, 2008

Comments Off

• Silverstone Temjin TJ03 full tower case
• Intel Core i7 965 Extreme processor — Overclocked to 3.8 GHZ

12GB of DDR3-1066

7200-rpm Hitachi Deskstar 7K1000 hard drive

dual 2GB ATI Radeon HD 4870 X2 graphics

• 22-inch Samsung 2243 LCD

All these are links are for those who would like to make this computer yourself.   The links are where you could go to buy the parts. The price after you buy the parts are estimated at $7395 price and I think you could get that down to 5000$ if you look for rebates and other incentives.   I wouldn’t mind having this computer for gaming myself.   It sure would be nice to give for someone on the holidays.  This would be good for people wh o are looking to computer game developers or people who are into 3D rendering.  Just though I share this little  review with you.   They really did a fantastic review of this product on there site.

GTA 4 Causes fatal error mma10, how to fix it!!

By Paul | Dec 3, 2008

Comments Off

Windows 7 will sport Direct X 10 Compliance!

By Paul | Dec 2, 2008

View Comments

The new feature is called WARP10, for “Windows Advanced Rasterization Platform,” and it’s essentially a DX10-compliant, software-only rasterizer that was written by Microsoft; it runs directly on the CPU. In a situation where a DX10 app needs to run but can’t find DX10-compliant hardware, it will run on WARP10, albeit very, very slowly. Ultimately, you can think of WARP10 as a “software DX10 GPU” that will exist as a fallback in Windows.

[via Arstechnica]

Stop botnets in its tracks With a Firewall!

By Laforge129 | Nov 30, 2008

View Comments

According to PC World and I’ll quote:

According to FireEye chief scientist Stuart Staniford, detection rates are so poor that, on average, only around 40 percent of security software can detect binaries during the period of greatest infectivity and danger, namely the first few days after a particular variant starts being used by botnet builders.

[via PC World]

In a recent virus storm, We have people finding my site because of a Good Firewall.   No if he didn’t have anything but Windows firewall then it would of gotten through and you would not of known about it.  So let’s talk about how to prevent botnet attacks.   This is relatively easy and if you follow some common rules.   You to could be less likely to be infected.  I will say this most people don’t do these common tips and they should do them.

Some good CyberMonday Sites to look at for 2008!

By Laforge129 | Nov 28, 2008

Comments Off

I was just getting done with that story about the Walmart Stampede, and thought I would encourage people to check these good sites for people to check out for great deals.   I have been looking through sites combing for some great sites to find the best deals and here they are:

• Dealio — Dealio will not only show you sneak peaks at Cyber Monday ads, but we will also send you directly to the store so that you can purchase the often limited inventory Cyber Monday deals before they disappear. Best of all, there is no need to hop from site to site – Dealio has all your Cyber Monday shopping covered.
• CyberMonday – Shop hot holiday deals from more than 500 merchants. All of Shop.org’s proceeds from CyberMonday.com support the Ray Greenly Scholarship Fund.
• Cybermonday Mahalo Deals — This Mahalo page collects links to websites offering information and discounted merchandise for Cyber Monday.
• Best Cyber Monday Sales –Well, I finally put together a list of the top retailers throughout the country with links directly to their Cyber Monday deals.

Black Friday gets way out of hand!!! (No JOKE)

By Laforge129 | Nov 28, 2008

Comments Off

OK, Black Friday has officially gotten out of hand. A 34-year-old WalMart employee was trying to hold back the crowds at a Long Island store this morning at 5am, when they took the doors off their hinges and stormed the store. The man fell down and was trampled by over 200 people as he gasped for air. It’s sad and despicable, and it’s equally the fault of the dehumanized shoppers and the WalMart store it happened at.
[via Gizmodo]

Microsoft issues Vista patches out of Monthly Patch Cycle!

By Laforge129 | Nov 26, 2008

View Comments

Kb957321

An update rollup is available for the Microsoft Windows Imaging Component (WIC) in Windows Vista or in Windows Server 2008. This update rollup resolves the problems that are documented in the following articles in the Microsoft Knowledge Base:

954708 An update to add support for the serialization of complex Extensible Metadata Platform (XMP) data types in the Windows Imaging Component

945060 There may be inconsistencies in the Extensible Metadata Platform (XMP) and Exchangeable Image File (EXIF) values for an image file in Windows Vista and in Windows XP

KB959108

The Windows Portable Device (WPD) API collects and transfers Software Quality Metrics (SQM) data to Microsoft servers. The SQM data is collected only on an opt-in basis through the Microsoft Customer Experience Improvement Program. An update is available that disables the collection and transfer of SQL data to Microsoft servers.

This update affects Windows Vista-based computers, Windows Vista Service Pack 1 (SP1)-based computers, and Windows Server 2008-based computers that are in the Microsoft Windows Media Player Customer Experience Improvement Program.

Podcasters are in up in arms over Ustream.tv

By Laforge129 | Nov 25, 2008

View Comments

REVISED:

• Mogulus
• Stickam
• Ustream.tv
• Blogtv

Technorati Officially laysoff 6 people!!

By Laforge129 | Nov 25, 2008

Comments Off

Technorati released today they are going to Lay off 6 people and I will quote:

Unfortunately, this means sacrifices. Technorati’s management team members are taking pay cuts ranging from 15-25% and employees are taking 10% cut. This also includes the reallocation of staff. We’re laying off six employees today – including two executives — and there are two additional departures we won’t replace. These are high performers who have worked long hours to get us where we are now. They’re also friends, and we’re very sad to see them go. We simply need a leaner and reconfigured mix to get us through 2009.

[via Technorati Weblog]

They will also be taking pay cuts all through the company.  So the recession is hitting them also.  I am sure CEO Richard Jalichandra has the company interest in mind.  According to Techchunch, they have added these recent layoffs ticker.   You can also search my blog for other layoffs that have happened or will happen.

Some program Vulnebilities Detected!!

By Paul | Nov 25, 2008

Comments Off

Just got done looking at some of my security sites and according to SecuriTeam there are are several programs that have vulnerabilities. here are the Ones that I’ve found:

Google chrome is vulnerable to URI Obfuscation vulnerability.
An attacker can easily perform malicious redirection by manipulating the browser functionality. The link can not be traversed properly in status address bar.This could facilitate the impersonation of legitimate web sites in order to steal sensitive information from unsuspecting users. The URI specified with @ character with or without NULL character causes the vulnerability.

iPhone Configuration Web Utility for Windows Directory Traversal
iPhone Configuration Web Utility lets “you easily create, sign and distribute configuration profiles using a web browser”. A vulnerability in iPhone Configuration Web Utility allows remote attackers to access files that reside outside the bounding root directory of the program’s files folder.

Streamripper Multiple Buffer Overflows
Streamripper “records Shoutcast and Live365 MP3 streams to a hard disk, creating separate files for each track. Runs under Unix and Windows.” Secunia Research has discovered some vulnerabilities in Streamripper, which can be exploited by malicious people to compromise a user’s system.

Microsoft kills a fake antivirus tool from 994,061 computers!

By Paul | Nov 25, 2008

Comments Off

According to Arstechnica and I’ll quote:

Win32/FakeSecSen has gone by various names, including Micro Antivirus 2009, MS Antivirus, Spyware Preventer, Vista Antivirus 2008, Advanced Antivirus, System Antivirus 2008, Ultimate Antivirus 2008, Windows Antivirus, XPert Antivirus, Power Antivirus, and Ultra Antivirus 2009. Furthermore, it is skinnable, so each of these variants has a different GUI, although the basic functionality is the same: bother users with warnings of malware until they pay up.

The Microsoft Malware Protection Center recently released some data on how the removal tool performed this month: FakeSecSen was removed from 994,061 machines. That number isn’t the highest Microsoft has recorded before, and the number of removals depends on which malware Microsoft adds each month and how widespread it is.

[via Arstechnica]

This seemed to of happened this month with the usual Windows update.  If you haven’t updated your system just yet you should.   This troublesome fake virus seems to have been killed  from several systems.  This could effectively make it harder for these guys who ever designed this program to make money.  I hope microsoft does even more virus removals in next month.  If you still want to try to get rid of these viruses don’t forget to check out my tips on Virus removal.

Google SearchWiki dies after two days!!

By Paul | Nov 22, 2008

Comments Off

According to Techcrunch Google Pulls the Google SearchWiki.  Unsure as to way  but here’s what they said:

Users are reporting that the recent changes to Google’s search engine, called SearchWiki, have simply disappeared from the site. It’s certainly gone from my account.

User reactions were mixed but weighted heavily towards “this is lame,” and there was no way to turn off the features other than to conduct Google searches without being logged in. Another way to turn it off was to switch search engines.

[via TechCrunch]

I’ve got my theory on this, and it’s quite a good theory.   I think it was a making search results come up wrong or not at all.   The last two days they’ve had that going my page views have drop BIG time.    According to my Stats I’ve had 236 Unique Visits for Thursday, and 232 Wednesday.   My Friday stats show that I only got 185 Unique Visits, dropping 40 to 50 people.  My stats for today which is incomplete shows that I’ve only gotten 136 unique visits.  Although that is complete you can see where I dropped drastically.   I think Google was getting yelled at by websites due to the stats dropping.   I am guessing people could tell if they wanted to go to a site just by reading the comments.  This will hurt every site, including TechCrunch.   I will say this is only a theory and this might or might not be the case.

Next Page »