How to: What to do if you get a virus or malware via a pop up message

There have been many posts on TechGeekandMore concerning viruses, spyware, malware, and scareware. If you wonder why, its because as a tech, the number one question and the number one support call that I will take involves pc’s that have already been infected (because the user didn’t know any better) and what to do to clean up the pc.

Sometimes the infection isn’t really bad and a simple scan and delete will clean things up, other times, its a matter of recover/save what you can from the pc and format/reinstall everything (and yes that could mean saying goodbye to important documents or a long downtime). On top of everything else keep in mind that hiring someone like me to clean up your pc could cost $100 / HR or more, and in some cases it may be more cost effective to buy a new pc.

So where do we start, we start at a couple of common things that are DO’s and DONT

1) If your on any website and see a messages like the following

DO NOT CLICK ON YES OR OK, it is a trick used by the writer of the virus or malware (known as social engineering) to get you to install the malware or virus. Since the message will probably pop up as part of the page your on, you may just think that its a natural part of Windows and agree to it, at least that’s what the bad guy hopes you will believe.

Additionally, when online, DO READ WHAT THE POP MESSAGES SAY AND DONT JUST CLICK ON THEM TO GET THEM OUT OF YOUR WAY. ADDITIONALLY DONT BELIEVE EVERYTHING THAT POPS UP (I know this is a hard concept for most). The following are just some of the MILLIONS of possible messages that you could see

Now lets talk about how these happen, they can happen because the website your visiting has been infected by a virus. These days its not just pc’s that get infected it can also be websites both minor and major (Scareware Pop-Ups Target Google, New York Times (http://www NULL.waco NULL.bbb NULL.org/article/scareware-pop-ups-target-google-new-york-times-13118)), so DONT think that because the only sites you visit are major sites (Google, NY Times, Twitter, Facebook, etc) that your entirely safe. You MUST always stay alert.

What if you machine is under attack from a Virus or Malware

Take immediate action as soon as the message or popup comes up. The majority of viruses and malware is written in such a way that not only will your machine get infected, but the infection will go out to the internet (completely automatically) and download additional files and infections to reinforce itself. So the longer you take to address the issue the harder (and probably more expensive) it will be to clean your machine. Image your self getting the flu, you take care of yourself and in a few days your body recovers and everything is normal again. However, if you get the flu and ignore it and just let it continue without doing anything about it, you could get sick enough to end up in a hospital or even dead. (Sorry to make it so over dramatic, but really that’s what it boils down to).

As soon as you receive a one of these type of scareware/malware/virus pop up windows, you need to use the task manager to close whatever program your using to get to the internet (You should NEVER try and close the program with the ok or cancel button on the program as all the buttons no matter what they say will download unwanted files on to your pc). You can access the task manager 1 of 2 ways

Task Manager via Ctrl Alt Del key

Hold down ctrl, alt, and delete at the same time.

If your on WindowsXP you will see this box. Just select task manager.

If your on Windows Vista or 7, then you will see this window. Select Start Task Manager from here.

Task Manager via Right Click

Use an empty space on the task menu (that’s the bar on the bottom where you see your programs) right click, you will see Task Manager as a choice. Select Task Manager from there.

Once you have opened the Task Manager, you will see the following window.

From the applications tab you will see all programs that are currently running. You should highlight any program that is connected to the internet (Internet Explorer, Firefox, Chrome, etc and Anything email) and select End Task. You will be prompted with

and select End Now. Continue doing that until you remove everything that is connected to the internet.

Once you have closed the Window – what next?

This may take a little time, but its best to check you pc and make sure nothing stayed on it that shouldn’t be there. There are 4 things you need to do at this point.

Step#1 -

If you use Internet Explorer

Go to Tools –> Internet Options –> select delete in the browser history section and delete all

If your using Firefox

Go to Tools –> Options –> Privacy and select clear your recent history and remove individual cookies ( you may need to change the setting to remember history to get to the settings)

If you use any other browser look for the area to remove, cache, temp or cookies and remove all.

***Also make sure you empty your recycling bin.***

Step# 2-

If you don’t already have a copy on your pc, download Super Antispyware (LINK: http://superantispyware.com/ (http://superantispyware NULL.com/)) and install Super Antispyware. **There is a Free and Pro edition, all you will need is the free edition.**

- During the install you will see the following screens. Make sure you say YES to “Would you like Super Antispyware to check for the latest updates….” then select the default or recommended setting for the remaining screens. On the screen asking for email address you do NOT have to enter anything, you can just select the next button.

Once installed you will see the following screen, just make sure that the definition date (on the bottom right) is current (shouldn’t be more than a day or two old, if not click on check for updates) then select scan your computer (on top left)

You will then see

At which point, select all your hard drives and select “Perform complete scan” and hit next.

Once the scan completes,

You will see the list of items found. I would recommend that all shown items remain with checks and then select next.

The lastly once the clean up completes. You will be prompted to reboot. I recommend you close anything that is still open and select yes to reboot.

Step# 3

If you don’t already have Malwarebytes, download and install (LINK: http://www.malwarebytes.org/ (http://www NULL.malwarebytes NULL.org/)). **There is both a free and paid version, home users just need to get the free version.

– During the install you will see the following screens, you can select the default choices. Toward the end of the install you will see a choice for “Update Malwarebytes Anti-Malware” make sure you have a check next to that choice.

As soon as it is installed, you will see the following screen. Make sure to select “Perform full scan” and select all your drives and run your scan.

Once completed you will see a list of all items found. Select all and remove. Then reboot pc.

Step# 4

Lastly, whatever Anti-virus you have, make sure you update it to the latest updates or signature file (depending on which one you have) and run a full scan of all your drives. If it finds anything select removal and then reboot.

If you don’t have an Anti-Virus program or yours is expired, TGM recommends Microsoft Security Essentials which is free. (LINK: http://www.microsoft.com/Security_Essentials/ (http://www NULL.microsoft NULL.com/Security_Essentials/) )

I know this was a long post, but the steps listed above would be exactly the steps I would take if you called me (and probably most other techs) to take care of your pc. Hopefully this information helps you stay informed and helps you save a headache and some money in the future.

Tech: You can’t change or save the Windows Power settings. How to fix it.

A situation recently occurred with one of my clients this past week where they couldn’t change the power settings on their pc’s from Power save to any other choice. No matter what they tried as soon as they hit ok, the setting would go back to power save mode. There are a couple of reasons why you would not want power save mode. In there case, the PC’s were actually cash registers (Running Windows XP), and in power save mode, if the pc did not have any activity for a period of 3 minutes (Screenshot below is not from the affected terminals), the pc would go into sleep mode (as XP was turning off, the screen and the hard drive). This setting is not good for Point of sale software, as the pc going to sleep tends to corrupt the point of sale software.

The solution I came up with involved taking a copy of the power management registry entries from a functional machine and then installing the good registry files in the corrupt machine. The process worked very well and everything ended functional again.

Another possible problem one can face with the power management settings is that you have nothing listed. The same bug that would allow the settings not to save, can just as easily remove all the settings within the power management function.

With that all being said, I now share the .reg file I used to restore the settings on all the broken machines.

Just click on the download button below to start the file download. Keep in mind that the file you will be downloading is a registry file (.reg) so your Windows software or Antivirus software may prompt for a message about it being unsafe to download this type of file. The file itself is fine, you can ignore the messages (for this file, however, when surfing the internet that is a message you should not normally ignore), download the file to your desktop and then double click the file to enter the info into the registry.

Any questions drop me a line.

download (http://cid-8804db538b4de88c NULL.skydrive NULL.live NULL.com/self NULL.aspx/ NULL.Public/Winodws%20Power%20options%20fix/XP%20PowerCfg%20Fix NULL.reg)

Keep in mind that this file is use at own risk, as neither I nor anyone else at TGM know exactly what your configuration is and this file is being offered as best effort help only.

Software: Organizing web sites, it’s all in the Icon. A Tweak for your web browser. (Works with Firefox and Chrome)

Like a lot of people I belong to a few Social Networking websites (Linkedin, Facebook, MySpace, etc..) and a lot of times when you want to check on one you want to check up on all of them. The issue I had was that I didn’t want to change my home pages. I say pages because I take advantage of the multiple tab feature of today’s browsers, and with the click of an icon I’m up to date on several blogs that I follow.

So I don’t want to change my favorites but I want to open up multiple pages, what to do? After a quick search on the internet I found that with Mozilla Firefox you can make a quick addition to the short cut to open up a different set of web pages.

Keep in mind these directions are only for Firefox, but will work similarly for Google Chrome. If you are using Internet Explorer 7 or 8 these instructions are not going to work for you.

The first step involves adding a short cut to your desktop. To do this;

1. Right mouse click on a blank portion of your desktop.

2. From the menu choose “New”. A Sub-menu will be generated.

3. Choose “Shortcut” from your list of options.

4. The following Dialog box should appear.

5. Click the Browse button and navigate to the following directory, c:\Program Files\Mozilla Firefox. From the list of files choose the Firefox.exe, and then click the Okay button.

6. Finish by choosing the “Next” button and then the “Finish” Button. This will add the Firefox icon to your desktop.

These steps also work for putting a short cut to Google Chrome on your desktop, but the path to the Chrome.exe is different.

7. Once the Shortcut has been created right mouse click on it and from the menu choose “Properties”. The Properties dialog box should appear. Select the Shortcut tab.

8. You will see the “Target:” field and in the field should be the path to the Firefox executable. Eg. “C:\Program Files\Mozilla Firefox\Firefox.exe”. At the end of the statement add any and all websites you want, just add a space between each address.

I repeat the process grouping the websites with common functionality to a different Icon

As an example:

Let’s look at the Firefox Icon I’ve set up to follow some video games I’m interested in. I edit the Target: field to read as the following,

“C:\Program Files\Mozilla Firefox\firefox.exe” http://www.starcraft2.com http://www.commandandconquer.com http://www.bungie.net

In the properties this will appear as one long line without line breaks. As you can see though there are spaces in between each web site I want to open.

If I open my regular Firefox Icon I see the home page that I’ve set up.

If I double click the Icon I’ve set up for my favorite video games, you’ll see that my browser now only opens up those web sites I’ve told it to in the target path.

Keep in mind I am opening multiple web sites, it will take longer to open up because I’m asking the web browser to do more work.

I didn’t have a chance to test out doing this for any other browser, so if you use Netscape, or Safari or any other browser, drop us a line and let us know if you tried it and how it turned out.

TGM Q&A: Cisco VPN Error 56 – VPN wont start (Update from 6/9/09 post)

The post from June 9th, Software : Cisco VPN software / Error 56 (http://techgeekandmore NULL.com/2009/06/06/software-cisco-vpn-software-error-56/), talked about what to do if you got Error 56 when trying to start the Cisco VPN software. Since then I have received a number of reports that the post was a solution but not for everyone, that a few people still had the problem even after making the recommended changes.

So here is some additional information that I hope helps resolve the issue for those who are still battling with this.

Vista/Windows 7

1st thing if you are trying to install the VPN software on Windows Vista or Windows 7, you need to install this signed in on an account with administrative rights and additionally with the UAC (User Account Control) settings in the off position.

To do this you need to go to Start –> Control Panel –> User Accounts –> in the user account screen (select your sign-in name if you see more than one 1sted). Look at the line directly under your name make sure it says administrator (If it doesn’t click where it says change your account type and select administrator), then select the User Account Control settings selection in the middle of the page

Then from The UAC move the selection to Never notify.

The UAC “aims to improve the security of Microsoft Windows by limiting application software to standard user privileges until an administrator authorizes an increase in privilege level” or in other words, makes you just a user on your machine, unless you tell it (each time the prompt appears) that its ok to be admin by entering your password. The problem with Cisco VPN software is that the versions that exist require full administrative rights (The Cisco software was designed before the UAC existed).

Once you have made the change you must reboot (The change in the UAC only takes place after reboot).

Once you have rebooted and signed back in. Uninstall the Cisco VPN software using Programs and Features which is located at start –> Control Panel –> Programs and Features. Select the CiscoVPN software and select uninstall. Once the uninstall completes, reboot again.

Once you have signed back in from this reboot, you can then reinstall the VPN software. At the end of the reinstall, reboot 1 more time and then try and use the Cisco VPN Software.

All Users

Another thing to try involves setting the ICS (Internet Connection setting) to disabled. In the original post I said that you could set ICS to manual. For some setting ICS to disabled seems to work as well.

If this helps let me know, if the issue still continues please provide as much detail as possible as to the type of pc and versions of software installed (OS, Version of Cisco VPN, Type of Anti-Virus) and I will continue to work on a solution.

************************************************************************

June 6, 2009

Software : Cisco VPN software / Error 56 (http://techgeekandmore NULL.com/2009/06/06/software-cisco-vpn-software-error-56/)

Filed under: Cisco (http://en NULL.wordpress NULL.com/tag/cisco/), Computer (http://en NULL.wordpress NULL.com/tag/computer/), Software (http://en NULL.wordpress NULL.com/tag/software/), Tech (http://en NULL.wordpress NULL.com/tag/tech/), VPN (http://en NULL.wordpress NULL.com/tag/vpn/) — techgeekandmore @ 8:13 am Edit This (http://techgeekandmore NULL.com/wp-admin/post NULL.php?action=edit&post=260)
Tags: Cisco (http://en NULL.wordpress NULL.com/tag/cisco/), Cisco VPN, Error 56, VPN (http://en NULL.wordpress NULL.com/tag/vpn/)

If you use the Cisco VPN software you may get a message that says “Error 56: The Cisco Systems, Inc. VPN Service has not been started”.

The problem is as a result of the windows service ccvpnd.exe (Services are in Control panel – Administrative tools – services) which may be listed as automatic start but will not start. Even if you manually attempt to start it, it will shut down just seconds after starting.

The solution is actually a simple one. The problem is caused by Internet connection sharing (ICS) service also being set to automatically start. So in the same service area look for Internet Connection Sharing service, turn it from Automatically starting to Manual (By right clicking – select properties – and the select manual in the drop menu where it says automatic, and also press the stop button just above the drop menu before hitting ok) , and then go back and start the Cisco service on the list. Cisco service will not be killed again.

ICS set to manual does not affect internet services, it just means that it will not start at pc boot up, it will start at the point that the service is needed. In the majority of cases that will be never unless you connect to the internet via another pc, most everyone connects to the internet via a modem connection or a wireless or wired router (Linksys / D-Link) connection.

Software: Showing hidden files, folders and extensions in Windows Vista and Windows 7.

My preference has always been to set up Windows to show the hidden files, hidden folders and the extensions to files and programs. I prefer to have control and see exactly what I have on the PC. Microsoft hides these on the basis that these are normally Windows operating system files and folders or that the extensions are just not needed to be seen.

I can see the point if you have a pc that is used by many people (like small kids) or a complete new pc user who wouldn’t know any better, since you cant see the file or folder then you cant delete it. The problem with that is, the many of the Virus and Malware writers use that same feature to hide the files that infect your pc.

Additionally, I guess it assumed that hiding the .exe or .jpg (etc) from files would be for the benefit of users who don’t know any better and would get confused by it. However because the extensions are hidden by default in Windows, the setting allows virus writers to distribute executable files (files that can be installed on your pc causing you to get infected) disguised as something non-executable (like a picture or . For example, an .EXE file might appear to be an innocuous text file.

So as a recommendation here is how to unhide files, folders, and extensions in Windows Vista and Windows 7.

Close all programs so that you are at your desktop.

Click on the Start button.
Click on the Control Panel menu option.
When the control panel opens you will be either in Category View or Large (or Small) Icon view:
*In either case change the setting to Large Icon View to make the following steps easier (See examples below – Where arrow Points)

Category View

Large Icon View

4. Click on Folder Options in the Window

5. Click on the View tab.

6. Under the Hidden files and folders section select the radio button labeled Show hidden files and folders

7. Remove the checkmark from the checkbox labeled Hide extensions for known file types.

8. Remove the checkmark from the checkbox labeled Hide protected operating system files.

(After you have done the steps your window should look like the example below)

Windows Vista Folder Options

**With that you will now see all files on your pc and see the extension for all files and programs. Note that most of the hidden files are Windows files and are required for your computer to operate correctly, so as always NO DONT DELETE ANYTHING UNLESS YOUR ABSOLUTELY SURE YOU KNOW WHAT IT IS AND THAT YOU DONT NEED IT.

Alert: Another attempt to trick you into installing Fake/Rogue Anti-Virus software

The bad guys are at it again, attempting to trick users to install another version of fake/rogue Anti-virus software. This time they are going back to a classic format, email. Emails are now circulating that claim to be from the “Microsoft Windows Computer Safety Team” and look very legitimate, I have seen a couple in my own email. The emails (example below) claim that Conflicker is back and is infecting pc’s and that Microsoft received a notification from your internet provider and is sending you a “fix” to clean your machine. The “fix” is actually Antivirus Pro 2010, one of the many scareware files that Tech Geek and More has talked about in the past (http://techgeekandmore.wordpress.com/category/spyware/ (http://techgeekandmore NULL.com/category/spyware/)).

Please be aware that Microsoft (or any other software company) does not just randomly send out emails asking you to install things or asking for your information. Microsoft uses its many software pages like Bing.com or MSN.com (http://www NULL.msn NULL.com/) or Microsoft.com if it wanted to pass along an official notice, and it uses Windows update service (http://windowsupdate NULL.microsoft NULL.com) (Windows Update.Microsoft.com (http://windowsupdate NULL.microsoft NULL.com) for users of XP or earlier, built into Windows for Vista and Win7 users) for its downloads. It would never just randomly send you a file to install.

*******Example of Letter not from Microsoft************

“Dear Microsoft Customer,

Starting 18/10/2009 the ‘Conficker’ worm began infecting Microsoft customers unusually rapidly. Microsoft has been advised by your Internet provider that your network is infected. To counteract further spread we advise removing the infection using an antispyware program. We are supplying all effected Windows Users with a free system scan in order to clean any files infected by the virus.

Please install attached file to start the scan. The process takes under a minute and will prevent your files from being compromised. We appreciate your prompt cooperation.

Regards,
Microsoft Windows Agent #2 (Hollis)
Microsoft Windows Computer Safety Division

**********************************************

I have highlighted (In Bold) some of the clues in the email that should tell you that this is a fake
Date: 18/10/2009 – This is not U.S. Standard

Microsoft has been advised by your Internet provider that your network is infected – When Microsoft is advised by its partners or even by technology geeks in the general public who find ways that a Microsoft Product can be exploited, they issue press releases thru the media or thru there own web pages (as noted above) and all fixes are issues there Microsoft sites for all users of the affected Microsoft Product.

We are supplying all effected Windows Users with a free system scan in order to clean any files infected by the virus. – Again Microsoft would never do this as this would be the most counter productive measure, most people have more than 1 email address and many don’t use the email provided by the internet provider (How many of you use @Comcast or @Fios email versus @Hotmail or @Gmail), how do you think Microsoft would actually know what emails to use.

Microsoft Windows Agent #2 (Hollis)
Microsoft Windows Computer Safety Division – At least in my email conversations with Microsoft, the name of the person sending me the email appears in the signature. Additionally, if you do a search online for the “Microsoft Windows Computer Safety Division”, you will find that Microsoft does not have a division by that name.

(Soapbox) The bottom line, is that its up to you the user to USE YOUR BRAIN when your online. When you go out, you make sure you lock your door, set your home alarm, set your car alarm, pay attention to your surroundings when you go to a public place, you don’t just leave your wallet or purse on a table or counter in a restaurant or store (or at least I hope you don’t). In cyberspace just because you are not physically there, doesn’t mean that you don’t need to take the same precautions than what you do in real life. (End of Soapbox)

TGM: Q and A – iPod Not loading music bought on iTunes or from CD

One of the questions I did receive this week involves not being able to add new music (either from the iTunes store or from CD) to an iPod.

I didn’t get to many details on what version of iTunes or what kind of iPod or if this was Windows or Mac, which made this answer a little difficult. Using the idea that it involves a new(or newer) version of iTunes, and taking a stab at it based on previous history with iTunes, here is what I think for both Windows and Mac. (**If this is not correct, I just ask the person who sent in the initial question to send me a follow up message with as much detail as possible and I’ll see what I can do).

In Windows:

Sometimes the iTunes updater does not properly update. The updater is supposed to update the version on your pc and then update iTunes on your iPod, however, sometimes if you disconnect your iPod before the update is complete or if the PC froze or any of a 1000 “Acts of Nature” occurred, then it could be that your iPod never got its part of the update.

So this is what you do -

From your PC – Open My computer –> The on the address bar on top type c:\Documents and Settings\All Users\Application Data\Apple\Installer Cache. If you typed it correctly you should end up with a page that looks similar to the picture below.

The reason you will type this in is that by default in Windows the Application Data folder is considered a hidden folder and you wont find it unless you unhide your folders in Windows.

Within this Installer Cache folder you may see more than one Apple Software Update folder, if that is the case select the folder with the highest number (2.1.1.116 is the number in my case) or the newest folder if you are looking at the window via details view

Now double click on the file marked AppleSoftwareUpdate.msi.

You will now see the Repair function, select that and the system will reinstall the update you selected.

Once that update is completed. Click on finish, and try again, and that should correct the issue.

From a Mac:

This is from Apple Support (http://support.apple.com/kb/TS1461 (http://support NULL.apple NULL.com/kb/TS1461))

Certain models of single processor Power Macintosh G5 computers may show iPod nano mounted in the Finder but not recognized in iTunes. If this happens to you, try restarting your computer and Setting Energy Saver to highest performance and turn off hard disk sleep. If you have an iPod nano, but don’t have a G5, then follow the other steps below.

Mac OS X 10.5.x

Insert your Mac OS X 10.5 install disc.
Open the “Optional Installs” folder.
Double-click Optional Installs.mpkg.
On the Custom Install window of the Installer, select the option to install iPod Support.

Mac OS X 10.4.x

Install the latest available Mac OS X 10.4.x update. If you are already using the latest version of Mac OS X 10.4, or if updating does not help, perform an archive installation (http://www NULL.info NULL.apple NULL.com/kbnum/n107120) of Mac OS X 10.4.

Mac OS X 10.3.x

Navigate to /System/Library/Extensions.
Drag the iPodDriver.kext file to the Trash (you will be required to enter an administrator account password).
Download and install the Mac OS X Combined Update 10.3.9 (http://www NULL.apple NULL.com/support/downloads/macosxcombinedupdate1039 NULL.html).
Restart the computer when prompted to do so by the installer.
Connect the iPod.

Mac OS X 10.2.8 and earlier
To resolve this issue with earlier versions of Mac OS X, you’ll need to delete one file and reinstall iTunes. Follow each of the steps below.

Step 1
Delete the file using Terminal

Warning: The steps below describe how to remove a file by entering commands in the Terminal application (located in the Utilities folder inside of the Applications folder). Users unfamiliar with Terminal and UNIX-like environments should proceed with caution. The entry of incorrect commands may result in data loss or unusable system software.

Open Terminal (/Applications/Utilities).
Type: sudo rm -R /System/Library/Extensions/iPodDriver.kext
Press Return.
Enter the administrator account password when prompted.
Quit Terminal.
Restart the computer (From the Apple menu, choose Restart).

Step 2
Reinstall iTunes

Download the latest version of iTunes from the iTunes download page (http://www NULL.apple NULL.com/itunes/download).
Install iTunes.
Restart the computer after the installation has completed.
Connect iPod.

Step 3
Delete the iPod.plist file

Remove the following file in the your home directory and open iTunes again.
~/Library/Preferences/com.apple.ipod.plist\

*****As always I am just making suggestions based on information give. If the information I receive is incomplete, the suggestion my not work. It is up to you to make sure you take backup your software (or files or Music) before trying any repair solutions, in case a restore is required.

How To: Removing people from Facebook wall

I haven’t focused much on social media sites (Facebook, My Space, etc) because that is not a side of technology that I find all that much interest in (I guess I’m showing my age). Don’t get me wrong, I can do Skype or hold a long conversation on Instant Messenger, but leaving sticky notes for someone (plus everyone on that page) just isn’t that appealing to me.

However, by request (of multiple people), I keep getting asked if I know how to remove someone from a Facebook wall. If there is someone who you just rather not see any posts from or messages from, this is most likely the case if someone is on based on being a friend or a friend type of thing. So for all those who requested this how to……here is the how to -

1) From the top bar in Facebook, go to settings –> Privacy settings

2) In the box that opens you will see Block list with a choice of Person or Email.

*You can choose either option

3) once you fill in one of the to ways to block and click on the Block button you will see a window that will show you the picture of the person you are attempting to block (If there is more than one person with same name you will see more than one choice)

4) Just select the person you wish to block and hit ok.

From that point on just click on the refresh button (F5 on Internet Explorer / Ctrl-R on Firefox) and the person you blocked will no longer be seen on your page.

Alert: “See Who Blocked You on MSN” Phishing Attacks

This specific story came out a couple of weeks ago on the TrendMicro blog. This involves an email that says “(Name of someone you know) has invited you to check who has deleted you or blocked from their contact list on MSN Messenger.

In the past couple of days I’ve actually had 2 customers who have received this email and fortunately for them, they asked me about it before clicking on the email. With that said, here is the post from the TrendMicro website concerning this current Phishing Attack.

******************************************************

From http://blog.trendmicro.com/see-who-blocked-you-on-msn-phishing-attacks/ (http://blog NULL.trendmicro NULL.com/see-who-blocked-you-on-msn-phishing-attacks/)
11:22 am (UTC-7) | by Merianne Polintan (Anti-spam Research Engineer)

We have received samples of a new phishing mail targeting users of MSN Messenger inviting them to see who deleted or blocked them from their contact list. Users would be interested to know who among their friends have deleted them from their lists.

Figure 1. Phishing email

Clicking on the link displays the following fake login page asking the user to input his or her password:

Figure 2. Phishing website

It is obvious that the intention of the cybercriminals is to harvest the user’s MSN Messenger login credentials. Afterwards, they can then continuously sends spam messages to the account or, worse, they can use the account for their malicious intent.

Getting in touch with friends is now much easier than before. Because of the growth of social networking sites, we can stay connected with our old friends, or even find new ones. This may include reading the profile pages of other members, sending and receiving invitations to fun games, videos and other applications. However, users must be on guard when interacting within online social networks. Spammers are now abusing these in their phishing attacks.

Always be mindful in accepting “invitations”, especially when it concerns your personal information. This particular spam message, and the associated website, are already blocked by Trend Micro products via the Smart Protection Network.

*********************************************************

Now lets go over what the Trendmicro blog said – By Phishing – The bad guys try and get your information so that they can then get access to your account. Once on your account they can use your “legit” account to help spread the malware in addition to possibly get account information to banking or other financial information, considering these days its very common for people to keep emails or other notes that may have account information.

In a related note, another news story posted today (10/5) by Neowin.net concerning the fact that over 10,000 Windows Live User Names/Passwords were posted online in the past few days most likely means that the bad guys got that information via a phishing scheme like the one explained by Trendmicro. The compromised accounts affect Hotmail, Windows Live Messenger, Zune, Xbox accounts to name a few as most people share the same sign in throughout the various Microsoft online sites and offerings. the complete store on the password posting can be seen at http://www.neowin.net/news/main/09/10/05/thousands-of-hotmail-passwords-leaked-online (http://www NULL.neowin NULL.net/news/main/09/10/05/thousands-of-hotmail-passwords-leaked-online)

Some of the most important things to keep in mind when using email or instant messaging or twitter or any social networking site or basically anything on the internet.

1) Regularly change your passwords. I know this one drives most people nuts, but changing your passwords can prevent someone else who knows your password access to your account. (If you currently use any Microsoft online passwords like Hotmail, Messenger, Xbox, Zune, etc it is highly recommended that you change your password and your secret access code immediately due to that breach)

2) Do not use the word “password” or admin or bank or “your name” or anything that anyone over the age of 5 can guess. Passwords should be what is called alpha-numeric including caps and symbols which means that it should look something like this Pa55w0rd@ (which is the word password with a capital P followed by the number 5 twice instead of the letter s and a zero instead of the letter o and the @ symbol at the end).

3) If you receive an email from “a friend or relative or your bank or the IRS or anyone at all” asking you to click on a link or enter any private information, before doing it, check with them and ask if they sent it and confirm why they are asking. Those few minutes lost verifying if this is legit will say you a ton of head-aches and save you from paying me a ton of money (Not that I don’t want you to pay me a ton of money but I’m here to help you so this is your warning – No matter how much you really really want to don’t do it, or at least verify that your bank account has enough money to pay me when i have to go out and clean up your mess).

How To: Activating a Corporate, Business, Enterprise edition of Windows

**UPDATED: October 4th.

One of the versions that Microsoft sells of Windows is known as the Corporate Edition (XP), Business Edition (Vista), Enterprise Edition (W7). In a nutshell, all there of these versions are same version level with just a name change depending on the flavor of Windows that you speaking about. These versions are not sold in the store and activate slightly differently (Called Volume License) than what users of other flavors of Windows are used to.

Normally Volume License versions can activate against a KMS-enabled machine in your corporate environment or against Microsoft online servers using a MAK. MAKs are special keys that are installed after your Vista installation is complete.

I have had a couple of customers with Volume License versions that have had issues activating the installed version of Windows because of error 0X8007232B / DNS Name does not exist and clicking on Activate now or change product key did nothing.

I did a lot of searching online for a solution and most solutions pointed to a Microsoft Document about “How to Activate Volume License” which did not actually had a solution for the issue. I finally discovered a solution that worked for me:

***You need to go to Control Panel –> User Accounts –> Change User account control settings –> and move the level to Never notify….security will block the steps below unless you drop the UAC control. **NOTE: If you change this to Never notify you will not receive the security prompts built into Windows. Advance user will probably like that but non-experienced user will want to put the setting back once you complete the activation process.

Once you change the User Account Control setting do the following

1) At a command prompt (Start –> Run –> CMD), type slmgr.vbs –ipk XXXXX-XXXXX-XXXXX-XXXXX-XXXXX (With a space between vbs and –ipk and Where the XXXXX is your assigned Volume License number). You will need to show a little patients as it will take a little bit (1 to 2 minutes usually) but you will get the response that “The product key was successfully changed”.

2) Now at the same command prompt, type slmgr.vbs –ato (a space between .vbs and –ato) and after a few seconds (This one will be much faster)a message that “The product had been activated” will appear.

That’s all there is to resolving this issue.

Tech Geek and More

Technology Explained for All

Category Archives: Solutions