Archive for the ‘Security’ Category

“Koobface” Virus Attacks Facebook

Monday, December 8th, 2008

A virus identified as “Koobface” is using Facebook and its messaging system to infect users’ PCs and obtain their credit card information. “Koobface” main target are the 120 million users of this social networking site. This is by the far the most recent attack of hackers online. They are generally keeping an eye on users of social networking sites.

Barry Schnitt, Facebook spokesperson had already responded regarding the issue. He said that there had been a lot of viruses that attempted to use Facebook to disseminate themselves. However he made it a point that only a very small portion of the whole Facebook population had been directly affected.

Furthermore, Craig Schmugar, McAffe’s researcher added that the virus is still actively infecting PCs together with email threats.

How does “Koobface” work? If your PC has been infected with the virus, it sends notes to your friends and families who also have a Facebook account. The message is headed with an inviting title: “You look just awesome in this new movie.” Of course your friend or family would be tempted to open the message. They will then be redirected to a website which features a free system update download of Adobe’s Flash Player. (more...)

Unable to connect to any antivirus site

Wednesday, August 27th, 2008

Just yesterday my computer got infected by nasty virus/spyware, the virus hijack my browser when going to any AV site or known support forum. The virus is preventing me to access those site and instead it redirected me to my localhost/127.0.0.1 . I am using windows XP Pro and was using AVG Free.

I tried to scan using AVG but it does not find anything either. I noticed that the virus definition was not updated, and keep failing to update. The virus is preventing me to access the updates, so what I did is used web proxy to visit the AVG site and luckily I got in and download the updates manually. I scan again and still no virus was found.

So then I went and tried all other free antivirus softwares out there: BitDefender, Avira Antivir, Spybot, and still no luck to find any virus/spyware.

I also tried to checked my HOSTS file and it looked normal. I keep on looking/searching on the net until I found the solution on a cnet forum.
(more...)

Remove Win32/Glenwiry.P virus

Wednesday, June 18th, 2008

Win32/glenwiry.p is a new virus which affects computer especially from USA. Win32/glenwiry.p is a dangerous virus that spreads through security holes and infects network computers. After Win32/glenwiry.p will infect your computer it may download additional malware (trojan horses, spyware, adware, hijackers and keyloggers). Moreover, Win32/glenwiry.p can change system settings and slow your PC.

From Yahoo Answers

CA a/v reported wextract.exe infected with WIn32/Glenwiry.P in 3 locations (all \windows folders, from \system32 through \servicepack1 and \servicepackfiles\i386). First 2 quarantined and the 3rd just listed as infected. XPSP2 popped up a hard request (no redirect to a folder name) for the SP2 disk, which I don't have either, being updated/upgraded via MS Update all along.

I searched the CA support and av center site and got ZERO results on either the filename or the glenwiry name, really surprising! Did a quick update check and my CA AV is fully up to date.

I'm not doing anything until I find out some more information. Going to check the MS site and run another full scan...

Update from CA Antivirus....

This from CA:
Thank you for using CA Security Advisor.

This is to notify you of the results of your submission, issue number 1386780. Please keep this issue number for future reference.

With regards to the file "wextract.exe" submitted by you on 13 Jun
16:58:23 (Australian Eastern Standard Time), we have updated our signature files to resolve the false positive problem.

The Windows PE (I386,EXE) file "wextract.exe" has been determined to be clean. Our researchers have analyzed the file and found nothing suspicious.

So if you are using CA anti-virus and detected the wextract.exe as Win32/Glenwiry.P virus you should update you signature files to resolved the false positive problem.

If you have been infected Win32/Glenwiry.P, here is a software that may help you remove it from your computer. Download NOD32 trial Anti virus form this website: http://www.softpedia.com/get/Antivirus/NOD.shtml .

Make sure to update the virus definition before using it :D

Free Online Virus Scanner

Thursday, May 29th, 2008

Looking for the best free virus removal tool to help cure your computer system of infections? Now look no more, here's the list of free online scanner you can use.

Trend Micro HouseCall
Offers a free online virus and spyware scan. This is the service you'll most likely see recommended in first place on many PC security related forums. It is indeed that popular! TrendMicro scan goes far beyond bare virus detection, supports Windows and Mac based computers, Mozilla and Internet Explorer browsers. Important: you can choose from either ActiveX engine or Java engine. These set of options make this online scan very versatile. Currently there's a new version available for testing .

Go to Trend Micro Housecall.

BitDefender Online Scan
BitDefender Online Scanner is an on-demand virus scanner which incorporates the award-winning BitDefender scanning engines. You can use it to scan your system's memory, all files and drives' boot sectors, and to automatically clean infected files. As to cons, it requires IE 4.0+.

http://www.bitdefender.com/scan8/ie.html

McAfee FreeScan
Offers a browser window with real-time statistics - number of files scanned, infections, name of detected virus. The scanning service is solid as everything produced by the brand, the drawback is that it supports IE browser only.

Go to http://us.mcafee.com/root/mfs/default.asp

F-Secure Online Scan
F-Secure Online Virus Scanner (version 3.3) is a free service. Use it to find out if your computer is infected, and disinfect your computer if needed. The product will automatically download the necessary components and virus definition databases as it is started. As to cons, it requires IE 6.0+ and works with ActiveX controls only. If ActiveX is disabled, than you can't use the service. Javscript need to be enable.

Go to http://support.f-secure.com/enu/home/ols.shtml

ESET NOD32 Online Antivirus Scanner
ESET's Online Antivirus Scanner uses its patented ThreatSense technology which is featured in company's desktop and server products. Initial download of antivirus signature database takes under a minute if you're on a broadband. ESET offers to remove the detected infections - for this you need to check the proper boxes (see screenshots below). Spyware is removed as well! NOD32 Scanner works only with ActiveX so it requires Internet Explorer.

Go to http://www.eset.com/onlinescan/

Kaspersky Online Scanner
Kaspersky claims its Online Scanner to have the highest detection rate. To some extent, it is true. It's antivirus database is updated hourly which may be considered to be the fastest response to emerging online threats. It uses Microsoft ActiveX technologies to scan your computer for malicious code and offers the same exceptional detection rates as other Kaspersky Lab products.

NOTE: The online virus scanner will not remove the malware from your machine if it finds it - installing Kaspersky software is required to do this. You can try our antivirus software (full product) for FREE by downloading and installing a free trial.

Go to http://www.kaspersky.com/kos/english/kavwebscan.html

Panda ActiveScan with TruPrevent
Panda security vendor offers anyone to try out its TruPrevent technology. With a database of 185,000 threats its online scan can not only detect, but also remove the infections. Additionally scans for spyware modules (like dialers, jokes, rootkits, etc). Panda claims to be able to desinfect the known spyware, and thanks to its heuristic engine, it detects even unknown types of malware.

Go to http://www.pandasecurity.com/homeusers/solutions/activescan/

Avast! Online Scanner
Online virus scanner gives the possibility to check your files quickly and free of charge. All you need to do is just browse for the target file on your PC, enter the captcha and press 'Scan' button and it will begi scanning.

Go to http://onlinescan.avast.com/

DrWeb Online Scan
DrWeb is another PC security product from Russia. Dr.Web scanner successfully detects Win32.Ntldrbot (aka Rustock.C) and cures system files infected by the rootkit. Currently no other anti-virus can detect this malicious program. It offers to scan single files - the webpage is as simple as possible, there's nothing on it except the "browse" button to specify the path to the target file.

Go to http://online.drweb.com/

VirusTotal
Virustotal is a service that analyzes suspicious files and facilitates the quick detection of viruses, worms, trojans, and all kinds of malware detected by antivirus engines.

Virus Total receiced a PC World Magazine Award in 2007 as one of 100 best products of the year

VirusTotal is not substitute any antivirus software installed in a PC, as it only scans individual files on demand. It does not offer permanent protection for the user's system either.

http://www.virustotal.com/

Anti Keylogger and Anti-Screen Capture software

Wednesday, May 21st, 2008

The internet is filled with malicious Trojans and keyloggers that can steal your confidential information such as password and even your credit card info. This is particularly dangerous to people who have Paypal and other similar accounts because you keep your money through these online “banks”.

Finding the best software to block these privacy intrusions is not easy and there’s really no perfect software that could block all types of keyloggers and screen capture. Everyday there are new types of keylogger and Trojans being developed by these hackers who got nothing better to do with their lives. Because of these hackers, software developers are constantly updating their software to detect and block these new Trojans and keyloggers but none are really perfect.

To find the best software, here are a couple of best software that blocks most keyloggers and screen capture software.

  1. Defense Wall HIPS - It’s not a free software and it costs only $29.95. For this software you are protected against adware, spyware, rootkits and keyloggers and it blocks some (but not all) screen capture. For just $29.95, the Defense Wall HIPS is a great tool to keep those malwares out without ripping you off.
  2. Privacy Keyboard - Again, this one is not a free software either. It’s a lot more expensive than the Defense Wall HIPS but it’s a lot more effective in protecting your PC. It costs $119.95 which is kind of expensive but it’s definitely worth it. For the type of protection it offers, $119.95 is still a bargain. It blocks almost all types of keyloggers and screen capture but it’s still not a perfect tool but it’s definitely close to it. Like what is stated above, everyday new types of malwares, adwares, spywares and keyloggers are created so software developers should constantly be on the look out.
  3. Anti Keylogger - Windows only: Freeware application Anti Keylogger Shield blocks keyloggers from tracking the passwords and other personal information you type on your computer. Unlike other similar tools, Anti Keylogger Shield does not detect existing keylogger software; it just disables the mechanisms they use to record your typing.