Spyware
Alert: Another Fake Email install Rogue Software (From Panda Labs Blog)
Mar 6th
One of the biggest reasons why TechGeekandMore started came from how many customers I had (and still have) to visit every week to either clean Viruses of PC or (even worse) recover as many files as possible and then reinstall Windows. I wanted a way a to try and alert and educate my customers about how …..
- No African Prince was going give you millions
- Emails that say that they are from a friend or family with that weird looking attachment could actually be fake
- Hot College Girl……well this one just really doesn’t have much beyond “Don’t do it”.
ETC ETC ETC…….
In those lines a new email starting this week, that has only 1 goal, to trick you into downloading and installing some really nasty software (more of the fake antivirus software). This new email says that “You have received a postcard”……
The following information comes from PANDALABS blog ( http://pandalabs.pandasecurity.com/the-thousand-faced-rogue/ (http://pandalabs NULL.pandasecurity NULL.com/the-thousand-faced-rogue/))
******************************************************************************************************************
The Thousand-Faced Rogue
Mar 5
- Posted on 03/5/10 by Olaiz (http://pandalabs NULL.pandasecurity NULL.com/author/olaiz/)
We want to inform you of a new flood of email messages that seem to contain a postcard but are actually distributing malware. Concretely, we’ve seen several thousands in a few hours.
It’s not the first time we see emails like this in circulation, as subjects like “You’ve received a postcard” are very recurrent.
The message is like the following:
The message seems to have been sent by a member of your family through a legal website to download and send postcards, so that users don’t suspect. In order to view the postcard, you have to open the attached file. It’s a file compressed with zip and if you run it, a rogueware program will be installed in your computer, which is different depending on the message and the operating system you have.
The following are some of the names of the fake antivirus that can be installed in your computer if you run this file:
% Antispyware 2010
Antivirus % 2010
% Guardian 2010
% Guardian
% Defender 2010
% Antivirus
% Antivirus 2010
% Antivirus Pro
% Antivirus Pro 2010
% Internet Security
% Internet Security 2010
where % stands for the operating system of the computer in which it is going to be installed. Some examples: XPAntispyware2010, Vista Guardian, Win 7 Antivirus Pro.
Let’s take as an example Antivirus XP 2010 and see the actions it carries out once it has been installed in the computer.
As every rogueware, it starts scanning the system to check if the computer is infected.
Once finished, it displays a list with the malware that has detected in your computer to make you believe that you’ve got a problem and that this program will offer you the solution:
However, all the malware it has detected makes reference to unexisting files, so the only threat you have is the own rogue.
Additionally, it prevents the execution of programs whose window title makes reference to the following programs:
Internet Explorer
Firefox
Several security suites.
When you try to run any of these, a message is displayed informing you that these programs are infected and recommending you to install the fake antivirus to solve the problem.
The following image belongs to the message that is displayed when Firefox is run:
It also contains code to uninstall different security solutions. This way, the computer would be unprotected and the real antivirus programs could not detect it.
Alert: BlackHat SEO attack targeting Google Nexus One (Updated) (From Panda Labs Blog)
Jan 17th
From the Panda Labs Blog (BlackHat SEO attack targeting Google Nexus One (Updated) (http://pandalabs NULL.pandasecurity NULL.com/blackhat-seo-attack-targeting-google-nexus-one/))
A few days ago Google presented their brand new phone, called Nexus One:
(http://www NULL.rj-diamond NULL.com/alex/wp-content/uploads/2010/01/google NULL.jpg)
And some days later we find out that if a user searchs for “buy Nexus One” he will obtain around 4,000 malicious links:
When clicking on any of these links, you will see some of the typical fake antivirus sites:
It will try to infect your computer with a rogueware called LivePcCare. Be careful while searching, and use at least some free web filtering tools (http://www NULL.mywot NULL.com/). (Like Web of Trust)
Update: 5 out of the 6 first results are malicious, including the 1st and the 2nd one.
Update 2: Now the same crew is using the Haiti earthquake
Alert: Criminals using Haiti Tragedy for new online scams
Jan 16th
Unfortunately, the bad guys seem to try and use anything that is current in an effort to take advantage of the situation and unsuspecting people, many of which may have their guard down because of the circumstances. The tragedy in Haiti is the latest way for the bad guys to attack.
The FBI released the following warning this week after the earthquake (LINK: http://www.fbi.gov/cyberinvest/escams.htm (http://www NULL.fbi NULL.gov/cyberinvest/escams NULL.htm))
HAITIAN EARTHQUAKE RELIEF FRAUD ALERT
01/13/10—The FBI today reminds Internet users who receive appeals to donate money in the aftermath of Tuesday’s earthquake in Haiti to apply a critical eye and do their due diligence before responding to those requests. Past tragedies and natural disasters have prompted individuals with criminal intent to solicit contributions purportedly for a charitable organization and/or a good cause.
Therefore, before making a donation of any kind, consumers should adhere to certain guidelines, to include the following:
- Do not respond to any unsolicited (spam) incoming e-mails, including clicking links contained within those messages.
- Be skeptical of individuals representing themselves as surviving victims or officials asking for donations via e-mail or social networking sites.
- Verify the legitimacy of nonprofit organizations by utilizing various Internet-based resources that may assist in confirming the group’s existence and its nonprofit status rather than following a purported link to the site.
- Be cautious of e-mails that claim to show pictures of the disaster areas in attached files because the files may contain viruses. Only open attachments from known senders.
- Make contributions directly to known organizations rather than relying on others to make the donation on your behalf to ensure contributions are received and used for intended purposes.
- Do not give your personal or financial information to anyone who solicits contributions: Providing such information may compromise your identity and make you vulnerable to identity theft.
MSNBC has released a list of charitable organizations that are active in Haiti, to help you know that your donation is going to the right place. The list can be found at http://www.msnbc.msn.com/id/34835478 (http://www NULL.msnbc NULL.msn NULL.com/id/34835478)
——————– o ——————–
In addition to the the financial scams, there are now also web scams which will cause your pc to get infected with Rogueware (Things like fake anti-virus messages), while visiting sites that appear to be legit Haiti Support or Information sites.
In the latest attempt to use a news making event, into a way to spread Rogueware, those running what are called SEO (SEO = Search Engine Optimization) are targeting keywords related to the earthquake in Haiti. Running searches on terms such as ‘Haiti’, ‘RT (re-Tweet)’, ‘Wyclef Jean’ and his charity, ‘Port-au-Prince’, Haiti donations, just to name a few are bringing up sites on major search engines pointing users to what they believe to be legitimate news and images related to the tragedy. When in fact, these sites, because the criminals were able to manipulate results of the search engines, are showing fake sites mixed in with real sites.
(http://www NULL.rj-diamond NULL.com/alex/wp-content/uploads/2010/01/haiti_20fraud_201_thumb NULL.jpg)
(Picture from http://sunbeltblog.blogspot.com/2010/01/dangerous-web-search-haiti-earthquake.html (http://sunbeltblog NULL.blogspot NULL.com/2010/01/dangerous-web-search-haiti-earthquake NULL.html))
If you encounter one of these fake site, 1st thing that you should NOT DO is click on any pop up or link that says you need to install something to see the site. 1st thing you SHOULD DO is attempt to close your browser by selecting either the X on the top right or by selecting CNTR-ALT-DEL on your keyboard, going into Task Manager, highlighting your browser, and selecting END TASK (Never attempt to use any of the actual “Close” or “exit” buttons that will appear with the pop up as most of the time the “yes” and “no” button will both do the same thing which is install the Rogue program on your machine).
In addition, as soon as you reopen your browser (after closing it for the pop up), you want to make sure that you go in and clear your Temporary Internet Files and your Internet Cookies (In Internet Explorer its Tools –> Internet Options –> then under browsing history –> delete and then delete all. In Firefox its Tools –> options –> privacy –> clear your recent history / clear your recent cookies). That is in addition to making sure that your Anti-Virus software is up to date, that your Updates for your operating system (Windows, MAC, Linux) are up to date.
(Soapbox**) I continue to point out the need to update, and yet I still regularly get called out to clear infected machines, that are missing updates (Had a Windows PC last week on XP service pack 1 and Norton AV 2004 with updates from September 2005). Not that I don’t want to work, and get paid, but if you really want to make sure you don’t suffer thru the down time and expense of waiting for a tech like myself, UPDATE UPDATE UPDATE. Will updates protect you 100%, no, unfortunately in the age of the internet, new and more innovative ways to beat a system come up 100’s of times every day, seven days a week. However, keep in mind, when you leave your house, you lock your door. Why? Will locking your door, protect your house from being robbed? You hope so, and 99% of the time it will. So updating your system is like locking your door, if you don’t lock your door you will eventually get robed. (End Soapbox)
**Lastly – To the people of Haiti and those readers of TGM with family and friends in Haiti. You have our thoughts, during this difficult time.**
Software: Adobe Acrobat and Adobe Reader – Can be used to infect your pc
Dec 22nd
(http://www NULL.rj-diamond NULL.com/alex/wp-content/uploads/2010/01/adobelq NULL.jpg) Adobe has sent out an alert (LINK: http://www.adobe.com/support/security/advisories/apsa09-07.html (http://www NULL.adobe NULL.com/support/security/advisories/apsa09-07 NULL.html)) concerning all versions of Adobe Acrobat and Adobe Acrobat Reader (v9.2 and earlier) advising that Acrobat and Acrobat Reader can be used to “Crash and potentially allow an attacker to take control of the affected system”. "There are reports that this vulnerability is being actively exploited in the wild”.
What does this mean to you-
- As of now if you have either Acrobat Reader or Adobe Acrobat installed, you could get your computer infected by clicking on specifically designed pdf document that you receive via email. It’s also likely that the email you receive would appear to be from someone you know, who would have opened the email and clicked on the pdf, infecting themselves and forwarding it to everyone in their email lists.
- As of now, the infection rate for this is still considered to be low but as with any other vulnerability that is known and “in the wild” (meaning that bad guys can go online and find out details on how to use this), it is expected that within time, you will see this vulnerability used in more ways by the bad guys.
- “Adobe plans to make available an update to Adobe Reader and Acrobat by January 12, 2010 to resolve the issue”
- In the mean time you have a couple of options
Option #1) Using the recommended steps by Adobe
disabling JavaScript in Adobe Reader and Acrobat using the instructions below:
1. Launch Acrobat or Adobe Reader.
2. Select Edit>Preferences
3. Select the JavaScript Category
4. Uncheck the ‘Enable Acrobat JavaScript’ option
5. Click OK
Option #2) You can go to Add/Remove Programs (Control Panel –> Add/remove programs or Programs and features depending on your version of Windows) and uninstall Adobe Acrobat or Adobe Acrobat Reader and then install one of the many PDF alternatives. TechGeekandMore recommends the Foxit Reader (LINK: http://www.foxitsoftware.com/pdf/reader/reader-interstitial.html (http://www NULL.foxitsoftware NULL.com/pdf/reader/reader-interstitial NULL.html)) which is not currently affected by this vulnerability.
- Additionally, it is also recommended as always, to make sure your Anti-Virus, Anti-Malware software is current and updated to protect your pc.
Software: Microsoft Malicious Software Removal Tool
Dec 6th
(http://www NULL.rj-diamond NULL.com/alex/wp-content/uploads/2009/12/microsoft NULL.jpg) I ran into a situation recently with a client who clicked on a link they shouldn’t have, causing their pc to get infected with what is commonly known as nagware/scareware. This is when your pc pops up messages saying its infected (With official looking screens that make you believe that its part of your operating system) and if you “buy” their product that your machine will be cleaned for you.
(http://www NULL.rj-diamond NULL.com/alex/wp-content/uploads/2009/12/personalavfakeinstallmessage NULL.jpg)
One of the many tools you can use to check/clean your pc is called the Microsoft Malicious Software Removal Tool. Every month when Microsoft releases its updates for Windows, they also include this tool, so as long as you have been doing your Windows Updates on a regular basis you should have the latest version of this software installed.
The MS Software Removal Tool is overlooked many times, even by tech’s because MS does not have it install in your start menu and unless you know how to get to it, it isn’t easy to find (Not sure why this is done, MS should make this software easier for users to find, but that’s just my opinion).
So if you need to run the Software Removal tool, how do you get to it? Here are some simple steps for the MS SRT.
1) From your Start Button – Click on Start –> Run –> and type MRT in box and click ok
(http://www NULL.rj-diamond NULL.com/alex/wp-content/uploads/2009/12/image10 NULL.png)
2) You will see the Malicious Software Removal Tool Window open. Here is a Key (BIG KEY), make sure that on the top it says the current month (The new version comes out on the 2nd Tuesday of the Month with the standard Updates normally).
(http://www NULL.rj-diamond NULL.com/alex/wp-content/uploads/2009/12/srt1 NULL.jpg)
If you are in November and the Window says June (Example) then we have 2 things going.
-> Your Malicious Software Removal Tool is seriously out of date and will probably not be updated to cover all the new versions of Malicious Software.
-> You probably haven’t been doing your Windows Updates or your updates are not installing properly. In either case you need to address that.
If your MS Malicious Software Removal Tool is out of date, you can directly download the updated version from the Microsoft Website (32bit Windows LINK: http://www.microsoft.com/downloads/details.aspx?FamilyID=ad724ae0-e72d-4f54-9ab3-75b8eb148356&displaylang=en (http://www NULL.microsoft NULL.com/downloads/details NULL.aspx?FamilyID=ad724ae0-e72d-4f54-9ab3-75b8eb148356&displaylang=en)) (64bit Windows LINK: http://www.microsoft.com/downloads/details.aspx?FamilyId=585D2BDE-367F-495E-94E7-6349F4EFFC74&displaylang=en (http://www NULL.microsoft NULL.com/downloads/details NULL.aspx?FamilyId=585D2BDE-367F-495E-94E7-6349F4EFFC74&displaylang=en)) or by running your Windows Updates and making sure all updates are selected.
3) If your Malicious Software Removal Tool is up to date, then just click on Next, where you will get 3 choices. If your pc is not showing any signs of infection and you are just running this as part of a regular maintenance program, you can select Quick Scan. If your PC is showing signs of trouble (Infection, slowness, unable to access specific websites), then you will want to run a Full Scan.
(http://www NULL.rj-diamond NULL.com/alex/wp-content/uploads/2009/12/image11 NULL.png)
4) Once you select the type of scan you want and click on Next you will see the scanning window.
(http://www NULL.rj-diamond NULL.com/alex/wp-content/uploads/2009/12/image12 NULL.png)
5) Once completed, you will either be told your pc is clean or a list of the infections that were found and cleaned will appear. Just hit finish. If anything was found, then I would recommend rebooting and then running the Malicious Software Removal Tool again after the reboot as many times, infections can reappear on reboot.
(http://www NULL.rj-diamond NULL.com/alex/wp-content/uploads/2009/12/image13 NULL.png)
Since the MS Malicious Software Removal Tool has a limited number of malware that its designed to clean (It focuses on the most common types) and because it does NOT have a live monitor feature, this software should only be considered an additional tool in the fight against the bad guys (Malware, Spyware, Scareware, Viruses). This software is not a replacement for an anti-virus product. If you need an anti-virus product Microsoft offers Microsoft Security Essentials (LINK: http://www.microsoft.com/security_essentials/ (http://www NULL.microsoft NULL.com/security_essentials/)), in addition to the many offerings both paid and free from other vendors (LINK: http://techgeekandmore.com/2009/11/05/software-what-every-windows-pc-user-should-have-installed-to-secure-their-pc-part-1-anti-virus/ (http://techgeekandmore NULL.com/2009/11/05/software-what-every-windows-pc-user-should-have-installed-to-secure-their-pc-part-1-anti-virus/))
(http://www