Elamb Cybersecurity

Category: Malware

  • Spy Sheriff Removal

    I was doing some testing on my Windows XP system surfing about some
    sites of “ill repute” with IE6 and got hit with something called Spy
    Sheriff    .

    Spy Sheriff is like a watered down version of PS Guard or Smithfaud.  Like PS
    Guard    , Spy Sheriff claims to want to remove all the malware it infects
    you system with.  Both of these horrible bits of malicious code
    are what I like to call scareware.  The get loaded on to your
    system along with about 100 other viruses, worms and trojans and take
    over you desktop with a message like “Spyware Infection”.  The
    application then “scans” your system.  And tells you that you must
    activate the Spy Sheriff or PS Guard in order to clean your
    system.  When attempt to remove Spy Sheriff using Add/Remove programs, it simply adds itself again once you reboot.

    In the background, all the malware they loaded on your system are
    collecting data and send status report to a parts of the world. 
    The scareware will usually make sure you know this to convince you to
    buy their product.  DO NOT GIVE THEM YOUR CREDIT CARD INFO!

    Here is how to remove Spy Sheriff.

  • Are you getting email from the FBI or CIA? (new malicious code)

    Dear Sir/Madam, We have logged your IP-address on more than 30 illegal Websites.

    Sober worm pretends to be an email from the FBI or CIA. 

    read more | digg story

  • Security Testing on my Window 2000 system

    I've surfing on my Windows 2000 system while completely exposed to the Internet on my DMZ.  No firewalls, no anti-virus, not even a pop-up blocker.  The box is exploited immediately. 

    Many of the default configuration on a fresh Windows 2000 box are just plain ridiculous.  For example, the C$, and parts of the root are shared out on earlier versions of Windows 2000.  Message services, port 139 and other very easy to exploit applications and services are turned on by default on Windows 2000. 

    It is no wonder Windows systems are always getting taken down.  Just turning off some of those services do quite a bit to close some of the holes on Windows boxes.  With broadband getting more popular, the combination of unprotected systems and the viral marketing of malicious code are creating a storm on the Internet.  An unprotected system is rendered completely useless in a matter of weeks (days and hours if you surf porn or serial sites).

    Here are some of the vulnerabilities on Windows systems at SANS.org.

    In all honesty, if you have a good firewall, virus protection, maybe a pop-up stopper and a good security configuration you could have a Windows 98 machine and NEVER get a virus.  

  • PS Guard Removal

    PS Guard is viscious scareware that loads itself each time you attempt
    to unistall it.  It is malware that claims to be malware
    remover.  It disables your Task Manager, informs you that your
    system is infected and doesn't allow you to exit from it while it scans
    your computer for viruses.

    Removing PS Guard
    it is a bit tricky.  Adaware and Hijack this will do nothing to
    remove it.  Noahdfear over at GeekstoGo.com wrote a sweet little
    script to remove it called smitrem.  It does the trick in removing PS Guard. 

    I picked it up at some Russian warez site on my Honeypot sytem.

  • Anti-Spyware Gets HIP

    Anti-spyware software is expected to
    transition from threat-specific technologies to Host-based Intrusion
    Prevention Systems (HIPS) as vendors deploy proactive solutions that
    block new and unknown spyware programs from PCs. Such solutions are
    likely to be increasingly compelling for security.

    Its about time this more proactive approach to malware and spyware is
    put right on desktops.  Eventually the masses will get so fed up
    with malicious code that there will be a huge market for behavioral
    based intrustion detection type software. 

    With the amount of money that is being made by virus and spyware
    makers, malware is developing faster than computer security could ever
    dream.  Proactive methods such as HoneyMonkey servers and HIPS
    products will no doubt be a big hit.  It is about time that
    Information Security had more of a proactive response and not as
    reactive. 

    With corporations more interested in protecting there ASSets then with
    developing a good product and protecting the customers, its time that
    we security professions get aggressive an proactive with our
    methods.  That will be the only way to fight malware in the future.

    read more | digg story

  • Malicious code could trick ZoneAlarm firewall

    Malicious code masquerading as a trusted application could trick a
    ZoneAlarm firewall into letting it connect to the Internet, security
    experts have warned.

    The notice was given on 28 Sept 05 by Debasis Mohanty.  Here is the official word from Zone Alarm.  This exploit affects the popular default install of Zone Alarm 5.5 and not 6.0.  

    LIST OF PRODUCTS UNAFFECTED:

    ZoneAlarm Pro, ZoneAlarm AntiVirus, ZoneAlarm Wireless Security, and
    ZoneAlarm Security Suite version 6.0 or later automatically protect
    against this attack in the default configuration.

    ZoneAlarm
    Pro, ZoneAlarm AntiVirus, ZoneAlarm Wireless Security, and ZoneAlarm
    Security Suite version 5.5 are protected against this attack by
    enabling the “Advanced Program Control” feature.

    Check
    Point Integrity client versions 6.0 and 5.1 are protected against this
    attack by enabling the “Advanced Program Control” feature.

    AFFECTED PRODUCTS:

    ZoneAlarm free versions lack the “Advanced Program Control” feature and are therefore unable to prevent this bypass technique.

    Recommended Actions:

    Subscribers should upgrade to the latest version of their ZoneAlarm product or enable the “Advanced Program Control” feature.

    In my oppinion Zone Alarm is still a great product.  This is yet
    another example of a highly exposed product getting tested to its
    limits like every version of Windows and Internet Explorer.

    read more | digg story

  • Hackers Step Up Attacks on IM Networks

    This is an interesting article on eWeek penned by Gene Koprowski
    adressing the virus portal known as Internet Message chat (AIM, MS
    messenger, ICQ etc).  

    “One security research outfit on
    Wednesday reported the highest monthly total ever of new IM viruses…
    some 25 viruses were reported on IM networks during September alone.”

    Great point but the article speaks as if IM is some sort of NEW
    target.  IM is one of the biggest holes in home computer
    systems.  There are MANY hacker tools that exploit these swiss
    cheese, foolishly trusting apps.  Do a scan on your ISP's Network
    and you will see scores of ports open on AIM and ICQ and others. 

    “We started doing this report about four months ago. What we're
    seeing is that there could be a new phase of IM viruses emerging. In
    the past, IM viruses were variants of e-mail-borne viruses. That's not
    exclusively the case anymore.”

    Jaros said that his company's research demonstrates that there
    is an average of at least one IM virus attack being conducted every day
    now.

    One of the most popular techniques that truly dark hackers use is to
    connect an “owned” box to an IRC (Internet Relay Chat) room from which
    many unholy acts can be done.

    read more | digg story

  • Mobile viruses could get nasty fast

    Dan Nystedt's article on PCWorld tells of the good, the bad and the
    ugly about connecting mobile systems to home system to the Internet:

    “The dream of a connected world where
    PCs and mobile phones can communicate with the digital home and other
    devices is supposed to make life easier. But it could instead make life
    far more dangerous if malware developers have their way.”

    And my favorite part:

    “For example, mobile phone services in some countries let people see
    what's going on inside their house via a Web cam connected to motion
    sensors, snapping a picture and sending to the homeowner if anything
    seems awry. But a hacker could use that same Web cam to see if anyone's
    home, and perhaps break in. Or invade people's privacy by taking
    pictures of what's going on in the house. And could a marauder hack
    into a driver's mobile phone use it to shut down certain automobile
    systems, like the brakes?”

    The article goes on to mention something very interesting, 3G phones
    are online all the time.  This feature make them HIGHLY
    vulnerable to attacks.  I won't be surprise if one day soon these
    phones will have to have little built in mobile firewalls.

    “F-Secure, another vendor of antivirus tools,
    says the current total count of known mobile malware stands at 87, up
    from less than 10 early last year. A total of 82 of those viruses were
    written to run on the Symbian series 60 operating system.”

    Symbian is a very popular mobile phone operating system.  Much
    like the Microsoft OSes and apps, Symbians popularity makes it a huge,
    juicy target to mobile phone black hats.

    read more | digg story

  • First potential virus risk for Windows Vista found

    “Virus writers are targeting a new Microsoft tool that will be part
    of Windows and is set to ship as part of the next Exchange e-mail
    server release.” – C|Net

    F-Secure has already found a possible flaw in the Windows Vista
    (code named Longhorn) command Shell called Monad also know as MSH.

    Representatives of F-Secure stated that if Microsoft released Windows
    Vista with MSH enabled, it could cause and outbreak of scripting
    viruses.  Examples of Scripting viruses include Macrovirues, the
    ILOVEYou VB scripting virus and the Melissa virus.

    The exploit aiming at MSH is discussed here.

    Microsoft my chose to disable MSH by default or simply add it as a plugin. 

  • Zotob.A Worm pandemic

    The Zotob Worm has spread across three continents and has brought down systems at CNN, ABC and other networks.  It is a decendant of Mytob.  Zotob exploits the “plug and play” features of unpatched Win 2000 systems and earlier versions of Windows XP. 

     

    The Zotob Worm, like most worms, slows down network connectivity, can shut down/reboot a system, attempts to spread to other systems on the network and ultimately will connect with a remote server to allow downloads of more destructive malware such as virus’ and Trojans.

     

    Zotob Worm Variants:

    http://securityresponse.symantec.com/avcenter/vinfodb.html

     

    Summary:

    http://singe.rucus.net/blog/archives/510-MS05-039-and-the-Zotob-summary.html

     

    http://singe.rucus.net/blog/archives/510-MS05-039-and-the-Zotob-summary.html