Panda Labs AV
Alert: BlackHat SEO attack targeting Google Nexus One (Updated) (From Panda Labs Blog)
Jan 17th
From the Panda Labs Blog (BlackHat SEO attack targeting Google Nexus One (Updated) (http://pandalabs NULL.pandasecurity NULL.com/blackhat-seo-attack-targeting-google-nexus-one/))
A few days ago Google presented their brand new phone, called Nexus One:
(http://www NULL.rj-diamond NULL.com/alex/wp-content/uploads/2010/01/google NULL.jpg)
And some days later we find out that if a user searchs for “buy Nexus One” he will obtain around 4,000 malicious links:
When clicking on any of these links, you will see some of the typical fake antivirus sites:
It will try to infect your computer with a rogueware called LivePcCare. Be careful while searching, and use at least some free web filtering tools (http://www NULL.mywot NULL.com/). (Like Web of Trust)
Update: 5 out of the 6 first results are malicious, including the 1st and the 2nd one.
Update 2: Now the same crew is using the Haiti earthquake
Alert: Rogueware with new Ransom Technology (This takes it up to a whole new level!)
Oct 19th
The challenge these days seem to be to try and stay ahead of the criminals who try and steal from you via your computer. I get asked almost daily “Why do I keep having to update my anti-virus, anti-spyware or my anti-malware solutions?” “Can’t I just update it once and get it over with?” Well the simple answer is NO!
Let me ask you this, why do you listen to the traffic every morning on the radio on the way to work? Isn’t finding that route to work, where you can stop and get breakfast or your coffee at Starbucks good enough? Won’t that get you what you need? Well……of course the answer is no. We all listen in case that one day we hear about a traffic accident or police action or broken water main or …… well you get the idea. We want to know this so that we can get a different route and try and avoid getting stuck in a traffic mess. Your route may never be affected, but you listen anyways everyday because that 1 time you don’t listen, you know will be the 1 time that your 30 minute commute will become 4 hours (I did have that once, it was a nightmare). Ok so if you know put that analogy to why you update your software (Operating System, Software, and your Anti-Virus/Anti-malware protection), its basically so that you can hope that you never run into that “nightmare situation”.
Now let me tell you a little about the latest nightmare that the bad guys have started releasing on to the internet that you and I travel. This one is called TotalSecurity2009 (From the same people that brought you AntiVirus2008, AntiVirus2009, and many others http://techgeekandmore.wordpress.com/2009/08/29/alert-another-fake-anti-virus-program/ (http://techgeekandmore NULL.wordpress NULL.com/2009/08/29/alert-another-fake-anti-virus-program/)). This one does the same things as the others, you go to an infected website and you see a pop up that says “Your computer is infected, click scan now to clean your machine” (or something to that effect depending on which one you get).
(http://www NULL.rj-diamond NULL.com/alex/wp-content/uploads/2009/10/personalavfakeinstallmessage NULL.jpg)
Then all of a sudden you start getting these pop-ups that look official and legit and even look like they my be part of your operating system, telling you that “the sky is falling” and that you need to buy (insert Rogue Malware name here), and that you can pay $XX amount of dollars (of course by major credit card) and they will clean your pc for you. That’s like having a burglar walk up to your house and say, sorry I just robbed your house, may I now install your new security system to keep me from robbing you again!
Ok back to TotalSecurity2009, this one has a new wrinkle. An extra level of sophistication, like we haven’t really seen before. In the past when you go infected you suffered thru allot of pop-ups and messages, but for the most part all functions of a pc still worked (OK except maybe web browsing to a legitimate web Anti-Virus website which previous ones would redirect your webpage so that you would only see Antivirus site pages they wanted you to see). In TS2009, its different, TS2009 actually locks all your applications and files, except for Internet Explorer and that is basically so that Internet Explorer can keep giving you messages that you need to pay $79.99 to get the unlock code for TotalSecurity2009 and then be able to use TotalSecurity2009 to clean your system. So in essence, if your a non-technical person and don’t know any better, you will feel like you have no choice but to pay them to release your pc from malware jail.
Here is the biggest problem with paying them, because to me it really isn’t about the $79.99, you will probably never get billed that amount. What you will have done is given a criminal your name and information and your credit card number and in fact what it will cost you will probably be more than $79.99 with your information out in the open for the bad guys to use (and charge your card) at will until you have to close and change your accounts.
The following Video comes from Panda Labs (A maker of legitimate Anti-Virus / Anti-Malware software) that shows how the rogue malware works and what effects it will have on your pc.
[vodpod id=Groupvideo.3686216&w=425&h=350&fv=]
more about “From Panda Labs: Rogueware with new R… (http://vodpod NULL.com/watch/2362304-from-panda-labs-rogueware-with-new-ranson-technology?pod=techgeekandmore)“, posted with vodpod (http://vodpod NULL.com?r=wp)
Additional information from Panda Labs can be found at http://pandalabs.pandasecurity.com/archive/Rogueware-with-new-Ransomware-Technology_2221_.aspx (http://pandalabs NULL.pandasecurity NULL.com/archive/Rogueware-with-new-Ransomware-Technology_2221_ NULL.aspx)
Panda Labs has also cracked the Rogue Anti-Virus so that you can unlock your machine if you get infected with this Rogue malware. Once you unlock your machine, you can download a 1 month free trial of the Panda Global Protection software that you can then use to clean your pc http://www.pandasecurity.com/usa/homeusers/downloads/register?Tipo=1&CodigoProducto=60&Idioma=2&TipoUsuario=12&Country=US&TipoLead=2&Ref=WWUS-GP10-DWN (http://www NULL.pandasecurity NULL.com/usa/homeusers/downloads/register?Tipo=1&CodigoProducto=60&Idioma=2&TipoUsuario=12&Country=US&TipoLead=2&Ref=WWUS-GP10-DWN)
Additionally you can also download Malwarebytes http://download.cnet.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html?part=dl-10804572&subj=dl&tag=button (http://download NULL.cnet NULL.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572 NULL.html?part=dl-10804572&subj=dl&tag=button) and SuperAntiSpyware http://superantispyware.com/ (http://superantispyware NULL.com/) to do additional scanning of your machine to make sure everything is clean.
Remember, all 3 of these products plus all other PC security software that is from a legitimate software company still needs to be updated by you the user before scanning or attempting to clean any malware from your pc, because you don’t know if your infection was created weeks ago or 1 hour ago and all security software needs to have the latest updates from its maker in order to give you the best chance and cleaning your pc.
Alert: How malware / viruses can ruin your day
Sep 15th
From the Panda Labs Blog ( http://pandalabs.pandasecurity.com/ (http://pandalabs NULL.pandasecurity NULL.com/) ), shows how malware and viruses can make small changing to your online banking screens and fool you into giving up information that can then be used to make unauthorized charges or clean you bank account out. (Click on the link below “Live Demo” or look on the sidebar under VodPod Videos)
Live Demo: Banking Trojan (http://vimeo NULL.com/6491332) from Panda Security (http://vimeo NULL.com/pandasecurity) on Vimeo (http://vimeo NULL.com).
I had a client a couple of days ago who asked me to clean her pc of viruses, during the conversation, she mentioned to me that on top of having to deal with the virus on the PC that she was dealing with her bank because someone got her info and drained her bank account in one evening. She mentioned that she didn’t know how they did it because she knew she followed all the rules people know for keeping her information private……
- She would shred old documents
- Had a very difficult sign on passwords
- Only thing she did online was banking at her bank, she would never buy anything online because she was afraid that somehow her info would be compromised (which it was anyways).
I unfortunately had to explain to her that the virus I was cleaning from her PC was the reason she had her information compromised and her bank account drained. The panda labs demo in this post shows how normally going to a banking site (they use Bank of America in the example, however, I should point out that B of A was not the bank my client was using) you get prompted for your Online ID and Online password for your bank. However, as shown once the machine is infected, the entire site looks normal to an untrained eye except for the fact that your sign on suddenly wants you to enter your pin #. Considering your at your banks website by all appearances most people would not think twice in entering that information. However, in fact, as shown in the video the information is on the sign in is actually being sent to criminals who can then use it to steal from you without ever meeting you in person.
Just another example as to why you need a good anti-virus, a good anti-malware (and yes these are 2 different functions) on your machine and that both programs need to be updated regularly and run regularly on your machine to try and keep your PC secure. Also if you do get infected, you should either directly address the issue and make sure to clean your machine if you know what your doing, or make sure that a trained professional cleans your machine before doing any sensitive work on your pc.
Alert: Another Fake Anti-Virus program
Aug 29th
If anything can get under my skin, this will do it. It seems we have another “Anti-Virus” program out there who’s only goal is to scare the user (who probably doesn’t know any better) into believing that the “sky is falling” and then requiring them to give up their credit card number in order not to get hit with the “falling sky”. I’ve have had to spend a lot of my time this past week cleaning this one up because a couple of clients didn’t know any better. There have been numerous versions of this malware scam over the past few years, some examples are
A* Ad-Protect B* BraveSentry C* CmdService |
D* DeluxeCommunications E* ErrorSafe M* MalwareWipe P* PestCapture |
S* Seekmo |
T* Toolbar888 U* UnSpyPC V* VirusBlast W* Winfixer Z* Zango Search |
and now joining the list is a Rogue Anti-Virus programs comes SaveSoldier. Here is information on the malware from the Panda Website ( http://www.pandasecurity.com/homeusers/security-info/212755/SaveSoldier (http://www NULL.pandasecurity NULL.com/homeusers/security-info/212755/SaveSoldier) ).
Effects
SaveSoldier is an adware (http://www NULL.pandasecurity NULL.com/glossary/glossary NULL.aspx#ADWARE) program that carries out the following actions:
- It reaches the computer downloaded from the following website:
- When the file is run, it is installed in the affected computer and starts scanning the system in search for possible malware.
- Once ended, it displays a warning message like the following, informing users that their computer is infected:
- If the button "Remind me later" is clicked, the interface of the program is displayed, which is like the following image:
- If users decide to follow the program’s instructions and remove the threats, the program will require a registration code:
- This code is obtained after purchasing the antivirus solution. Therefore, the user will be redirected to a website where it can be purchased:
- On the other hand, if users do not follow the program’s recommendations, it will display warning messages like the following to make them think their computer is infected:
<?xml version="1.0" encoding="utf-8"?>
Infection strategy
SaveSoldier creates a directory called SaveSoldier in the folder SaveSoldier Software (created by itself) of the Program Files directory and a group of programs with the same name in the Start menu.
SaveSoldier creates the following files in the folder SaveSoldier Software\SaveSoldier of the Program Files directory:
- SAVESOLDIER.EXE, which is a copy of itself.
- SAVESOLDIERSVC.EXE
- UNINSTALL.EXE
SaveSoldier creates the following entries (http://www NULL.pandasecurity NULL.com/glossary/glossary NULL.aspx#CLAVE) en el Windows Registry (http://www NULL.pandasecurity NULL.com/glossary/glossary NULL.aspx#REGISTRO):
- HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
SaveSoldier = C:\Program Files\SaveSoldier Software\SaveSoldier\SaveSoldier.exe – min
By creating this entry, SaveSoldier ensures that it is run whenever Windows is started.- HKEY_LOCAL_MACHINE\SOFTWARE\SaveSoldier
Install_Dir = C:\Program Files\SaveSoldier Software\SaveSoldier
By creating this entry, SaveSoldier creates a new directory.- HKEY_LOCAL_MACHINE\ SOFTWARE\ Microsoft\ Windows\ CurrentVersion\ Uninstall\ SaveSoldier
DisplayName = SaveSoldier- HKEY_LOCAL_MACHINE\ SOFTWARE\ Microsoft\ Windows\ CurrentVersion\ Uninstall\ SaveSoldier
UninstallString = C:\Program Files\SaveSoldier Software\SaveSoldier\uninstall.exe- HKEY_LOCAL_MACHINE\ SYSTEM\ ControlSet001\ Enum\ Root\ LEGACY_SAVESOLDIERSVC\ 0000
Class = LegacyDriver- HKEY_LOCAL_MACHINE\ SYSTEM\ ControlSet001\ Enum\ Root\ LEGACY_SAVESOLDIERSVC\ 0000
ClassGUID = {8ECC055D-047F-11D1-A537-0000F8753ED1}- HKEY_LOCAL_MACHINE\ SYSTEM\ ControlSet001\ Enum\ Root\ LEGACY_SAVESOLDIERSVC\ 0000
DeviceDesc = SaveSoldier Security Service- HKEY_LOCAL_MACHINE\ SYSTEM\ ControlSet001\ Enum\ Root\ LEGACY_SAVESOLDIERSVC\ 0000
Service = SaveSoldierSvc- HKEY_LOCAL_MACHINE\ SYSTEM\ ControlSet001\ Enum\ Root\ LEGACY_SAVESOLDIERSVC\ 0000\ Control
ActiveService = SaveSoldierSvc- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SaveSoldierSvc
DisplayName = SaveSoldier Security Service- HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\SaveSoldierSvc
ImagePath = C:\Program Files\SaveSoldier Software\SaveSoldier\SaveSoldierSvc.exe- HKEY_LOCAL_MACHINE\ SYSTEM\ ControlSet001\ Services\ SaveSoldierSvc\ Enum
0 = Root\LEGACY_SAVESOLDIERSVC000- HKEY_LOCAL_MACHINE\ SYSTEM\ ControlSet001\ Services\ SaveSoldierSvc
Start- HKEY_LOCAL_MACHINE\ SYSTEM\ ControlSet001\ Services\ SaveSoldierSvc\ Security
Security<?xm
l version="1.0" encoding="utf-8"?>
Means of transmission
SaveSoldier can be voluntarily downloaded from the website belonging to the company that has developed it.
<?xml version="1.0" encoding="utf-8"?>
Further Details
SaveSoldier is 712,704 bytes (http://www NULL.pandasecurity NULL.com/glossary/glossary NULL.aspx#BYTE) in size.
As additional information, a website that promotes another fake antivirus has been detected. In this case, it is called TrustNinja. The interesting thing is that both the format and content of this website is the same as the website of SaveSoldier . Only the references to SaveSoldier have been replaced with TrustNinja.
The file downloaded from this website is called TRUSTNINJA.EXE and once run, a program with the same interface and functions as SaveSoldier is installed on the computer. Even the fake results displayed when the scan is finished are the same. The only thing that changes is the name of the program.
As always, the 1st line of defense is to not click on every pop up that you see without reading it 1st. Additionally, if your not sure what the message or the pop up is for, its always better to click on deny or no on a pop up if your not sure what its for or at least take the time to run a quick search on Bing or Google with the name of the pop up. There are many sites out there that will tell you what the pop up is and if it is safe.
Software: Panda AV offering FREE USB Vaccine to help stop malware from spreading via external drives
Aug 29th
As a tech, one of the biggest headaches involves someone bring there USB key (or external hard drive) from home, full of malware infections because the user doesn’t know how to protect their home pc. They go to the office and start “Copying that Excel sheet” or even better “The cute pictures of their kids” so that it can be seen on every pc. Unfortunately as that drive keeps getting plugged in, every machine it goes into get infected with malware because of what is know as the autorun feature.
Panda Labs is offering a FREE download (http://www.pandasecurity.com/usa/homeusers/downloads/usbvaccine/ (http://www NULL.pandasecurity NULL.com/usa/homeusers/downloads/usbvaccine/) ) that can be used on your external drives and on each pc, which will basically disable the autorun feature. With the feature disabled, you should be able to scan your external drive, and make sure its ok, prior to it being able to cause malware havoc.
********************************************************************
From the Panda Website
There is an increasing amount of malware which, like the dangerous Conficker worm, spreads via removable devices and drives such as memory sticks, MP3 players, digital cameras, etc. To do this, these malicious codes modify the AutoRun file on these devices.
Panda USB Vaccine is a free solution designed to protect against this threat. It offers a double layer of preventive protection, allowing users to disable the AutoRun feature on computers as well as on USB drives and other devices:Vaccine for computers: This is a ‘vaccine’ for computers to prevent any AutoRun file from running, regardless of whether the device (memory stick, CD, etc.) is infected or not.
Vaccine for USB devices: This is a ‘vaccine’ for removable USB devices, preventing the AutoRun file from becoming a source of infection. The tool disables this file so it cannot be read, modified or replaced by malicious code.
This is a very useful tool as there is no simple way of disabling the AutoRun feature in Windows. This provides users with a simple way of disabling this feature, offering a high degree of protection against infections from removable drives and devices.
*********************************************************************
Just remember that this needs to be used both on the external drives and PC. Even if you don’t have an external drive yourself, its a good thing to run it on your pc, in case some one visits (or your kids or co-workers) and brings an external drive with them.
(http://www