» Virus Scan

Malware sites for July 30, 2009

Paul Sylvester — Thu, 30 Jul 2009 11:42:08 +0000

Malware sites for July 30, 2009

I just got some news about a few sites:

husger.info (Scareware, Rogue Antivirus)
antivirus-quickscanv5.com (Personal Antivirus)
safe-online-scanner.com (Personal Antivirus)

These sites are either claiming you have a virus and are considered either URL Redirects or URL Hijackers. If these sites keep appearing on your web browsing maybe it is time to do a complete system scan and get that spyware off your system. Some of these Rogue Antiviruses may even have a security adviser claiming random sites are infected with viruses or Trojans and claiming they are unsafe. These sites are either wanting you to isntall the software or trying to sell you the fake product, which will do nothing but harm your system.

Threat to System : Moderate

Rating:

Advice : Do a Complete system scan and make sure you don’t have any more hidden malware.

I recommend :

Download SUPERAntiSpyware

Download Malwarebytes

SUPERAntiSpyware now has an ONLINE Scanner that you can use to help get rid of some of the malware that keeps you from running your anti virus. You should give it a try....

If your current Anti Spyware software let an infection through, you may want to consider buying SuperAntiSpyware Pro for $29.95 or Buying Malwarebytes for $24.95 are two of the best anti-virus software in my opinion which features highly advanced Real-Time Protection to ensure protection from installation or re-installation of potential threats as you surf the Internet.

(Both Malwarebytes and SuperAntiSpyware are trusted Vendors by CCSS Forums).

Have you tried my toolbar?
It has some great Security Resources to help fight malware. You will find it very resourceful.

New spam Campaign — Casino Anyone?

Paul Sylvester — Wed, 25 Mar 2009 02:33:11 +0000

New spam Campaign — Casino Anyone?

Looks like there is a new Campaign going on with regards to having VIP access.

So I go to the site:

I decide to have a little fun and download the file. The Filename is “Smartdownload.exe“. Now you shouldn’t install any software or programs from sites you don’t know about or have any idea of what changes are going to be made. I use CWSandbox to better understand this file. Here are a few thinks I’ve found:

This program connects to three different IP’s [Your broadband Modem,200.122.168.237, and 212.201.100.136]
It also Changes your Autoexec.bat file. (Not good)
Changes access flags on several different program (not good either)
It also tries to be Anonymous. If you checks the logs out your self you will find it very interesting.
It looks like it connects to the servers every time you boot up!! (Not good either)

I don’t know what it is trying to do but everything I see about this file makes me think this is trying to avoid virus detection. I ran Kasperky and Avast file check, it came up clean. I think what happens is you download the virus after you install this software. I wouldn’t download this or install it, even though it advertise you 800% free that has to be scam or just a flat lie to get you to install software. Everything about this program doesn’t make me want to to install this software, although it doesn’t seem to be a virus. It however does make me want to delete the file. Remember to use Anti-virus and Firewalls, that is your first line of defense.

Facebook Virus strikes again

Paul Sylvester — Thu, 04 Dec 2008 20:07:00 +0000

Facebook Virus strikes again

“Look you were filmed all naked!” read the subject header on one iteration of the virus-spreading message, which is being sent automatically from infected accounts to the “friend” list for that account. Clicking the link usually takes users to a page that looks like YouTube, and a pop-up message advises the user to download a Flash plug-in. The download contains the virus, which replicates by contacting everyone on the victim’s Facebook friend list and advancing the hoax.

[Via Boston Media]

This is a good social engineered attack, they seem to have you download a virus into your system. I Keep talking about how you need to be careful with emails. I also suggest that you do a complete Virus scan if you think you’ve been hit with this. There is only one way to prevent yourself from getting this little facebook virus and that is not to click it. Some other things to consider if you found out this was a virus is to contact the person who sent this to them so they to could do a virus scan on their system.

It is always going to be something to be hard, because these people are using social engineering. It seems they are trying to prove a point, even Macintoshes can be vulneble to this attack. If you get anything through you email from people saying they seen you naked or got pictures of your butt, I’d suggest, not clicking those links.

AVG Detected a False Positive

Paul Sylvester — Tue, 11 Nov 2008 10:19:12 +0000

AVG Detected a False Positive

According to Security and The Net:

An update for the AVG virus scanner released yesterday contained an incorrect virus signature, which led it to think user32.dll contained the Trojan Horses PSW.Banker4.APSA or Generic9TBN. AVG then recommended deleting this file; this causes the affected systems to either stop booting or go into a continuous reboot cycle. So far, the problem only appears to affect Windows XP, but there is no guarantee that other versions of Windows don’t have the same issue.

[Via Security and The Net]

I bring this up because this is a false positive according to AVG. AVG since sent out another update to there Database and you can go and update the database to get rid of this problem. If you need to restore that DLL check out the article Security and The Net, they got some excellent suggestions on fixing the problem.

If you’ve not been affected by this yet, you probably won’t be. It is yet unknown how many people have been affected. I’m blogging about this to tell people about this and to warn people that not all of warnings from AVG are true and that is why you should always ask before you delete or do anything to your system. I always USE google when it comes to these types of questions

Sites that you need not Visit:

Paul Sylvester — Sun, 02 Nov 2008 23:45:36 +0000

Sites that you need not Visit:

I’ve had some Anti-virus problems in the past few weeks and have been trying to see if it is my system or if it was just luck of the draw. So I did some research and found some sites that you should not go to, or download from. These sites have been know to spread the fake anti-virus malware software. So I wanted to warn people of some common websites that have been known to have viruses on them:

hxxp://movieportal2008q.com/freemovie/Movie/xxxx/x/ — this site usually tries to send you the “Trojan.HTML.Zlob.AG” Virus.

hxxp://porntubedot.com/xxxxxxxx/WatchFreeMovie.php –This site usually tries to send you the “Trojan.Dropper.SMN” Virus.

hxxp://handballfondi.it/xxxxxx1.php — This site is one of the new Malware sites that looks like Youtube, When you go to this site they say you need a special to play a video clip. Most of the time when you get something like this, it is going to try to install Malware. A good broad set of Codecs that you may want to download is called Klite Mega Codec, which if you us that you should never need to download any other codec to play a movie clip from any site online.

hxxp://0scanner.com/—censored—/ – This site usually tries to send you the “Adware.FakeAntiVirus.L” virus. Another site trying to install malware.

If you want to check your system, here are some places to go to get a free Anti-virus check:

If you have any other ways sites that we should avoid by all means comment about it. I would love to hear sites that you know are bad!!

Some Important programs to prevent yourself from having viruses and Malware!!

Paul Sylvester — Sat, 14 Jun 2008 18:59:32 +0000

Some Important programs to prevent yourself from having viruses and Malware!!

This post is in response to Alertscan.net and how many people have seen my page. If you would like to protect yourself from the possible hi-jacking of your internet or Computer there are some programs to consider using:

If you would like to scan your system right now without downloading any files go to:
Kaspersky Lab Free Virus Scan

Firewalls:

Now these are free but I tell you. You will only need one firewall even though windows has a firewall this helps as a better protection to know what is coming in and going out.

Anti-Virus:

Again these files are free but you will only need one of these. If you install more than one you will most like start slowing your system down to much!!

Spyware Removal:

If these load automatically in windows when you set these up unselect them. I only use one or two of these when I think I need to. You can download more than one of these programs to do the job. The only warning I have is make sure when you install them to unselect the startup when windows starts.

Rootkit Removals:

What is a Rootkit?

Other Utilities:

CCleaner
HiJackThis
FireFox Mozilla – Safer than IE 7

Now if you start using these programs that I suggest you will be a far better off then when you started. I will not say you are a 100% protected but will say you are like 50% protected or something to that nature. It is how you explore the web, that causes the most problems some tips to remember:

Never Click links directly – Always go there manually typing in the address(Some links can be phished or Hidden from site!!)
Anything you get in emails Consider who it is from and how much you trust them(Remember though people still can send viruses to you in a multitude of ways)
If in doubt Google search to see what the web has to say about a particular idea or website. If they are a serious website there will be good reviews, and you know the opposite of that.
Be kind, Don’t forward emails when someone says please forward. Most of them are either scams or just trying to clog up the email servers.

I hope all this helps you to be a better user on the internet. If you have any questions, please feel free and go to the miketechshow forums and post your questions. Someone there will be more than glad to help!!