Elamb Cybersecurity

Category: Malware/Virus

  • Detected Spyware! System error #384

    detected spyware system error #384

    This is a bogus error screen that replaces your browser's home page. The message Reads:

    Detected Spyware! System error #384

    Your IP address is XX.XXX.XX.XX. Using this address a remote computer has gained access to your computer and probably is collecting the information about the sites you've visited and the files contained in the folder Temporary Internet Files. Attention! Ask for help of install the software for deleting secret information about the sites you visited.

    You computer is full of evidences!

    More than likely, this message is just the tip of the iceberg. Using simple intrusion detection tools you will see that your system has scores of viruses, trojans, worms and other malware installed on it. The message is trying to get you to purchase some scamware.

     

    How to remove the “Detected Spyware! System error #384” message and all the malware on your system?

    There are actually a few relatively easy ways for removing this malware:

    USE FREE (LEGITIMATE) ANTI-SPYWARE

    PERFORM A SYSTEM RESTORE

    COMPLETELY RE-INSTALL WINDOWS (self explanatory, and complete overkill unless you have rootkit on your system or something crazy like that.)

    READ MORE HERE…

  • "Windows has detected spyware infection!"

    Want to know how to get rid of the “Windows has detected spyware infection!“

     

    “Your computer is infected! [tag]Windows has detected spyware infection[/tag]!
    It is recommended to use special antispyware tools to prevent data loss Windows
    will now download the most up to date antispyware for you.
    Click here to protect your computer from [tag]spyware[/tag]!”

    Here is how to delete that annoying “computer is infected” message.

    If your seeing this message your system really is infected with some [tag]malware[/tag] (virus, trojan, spyware) and that message you see is a part of the malware. This type of malware typically is trying to get you to purchase a product to clean your system. When you click on the link they provide, it takes you to the very source of the malware on your system. It is supposed to look like some of the Window system messages you can get about updates. DON’T fall for it.

    DO NOT GIVE THESE PEOPLE YOUR CREDIT CARD INFORMATION!

    This page will give your more information on what it is and how to get rid of it.

  • Spy Sheriff Removal

    I was doing some testing on my Windows XP system surfing about some
    sites of “ill repute” with IE6 and got hit with something called Spy
    Sheriff    .

    Spy Sheriff is like a watered down version of PS Guard or Smithfaud.  Like PS
    Guard    , Spy Sheriff claims to want to remove all the malware it infects
    you system with.  Both of these horrible bits of malicious code
    are what I like to call scareware.  The get loaded on to your
    system along with about 100 other viruses, worms and trojans and take
    over you desktop with a message like “Spyware Infection”.  The
    application then “scans” your system.  And tells you that you must
    activate the Spy Sheriff or PS Guard in order to clean your
    system.  When attempt to remove Spy Sheriff using Add/Remove programs, it simply adds itself again once you reboot.

    In the background, all the malware they loaded on your system are
    collecting data and send status report to a parts of the world. 
    The scareware will usually make sure you know this to convince you to
    buy their product.  DO NOT GIVE THEM YOUR CREDIT CARD INFO!

    Here is how to remove Spy Sheriff.

  • Security Testing on my Window 2000 system

    I've surfing on my Windows 2000 system while completely exposed to the Internet on my DMZ.  No firewalls, no anti-virus, not even a pop-up blocker.  The box is exploited immediately. 

    Many of the default configuration on a fresh Windows 2000 box are just plain ridiculous.  For example, the C$, and parts of the root are shared out on earlier versions of Windows 2000.  Message services, port 139 and other very easy to exploit applications and services are turned on by default on Windows 2000. 

    It is no wonder Windows systems are always getting taken down.  Just turning off some of those services do quite a bit to close some of the holes on Windows boxes.  With broadband getting more popular, the combination of unprotected systems and the viral marketing of malicious code are creating a storm on the Internet.  An unprotected system is rendered completely useless in a matter of weeks (days and hours if you surf porn or serial sites).

    Here are some of the vulnerabilities on Windows systems at SANS.org.

    In all honesty, if you have a good firewall, virus protection, maybe a pop-up stopper and a good security configuration you could have a Windows 98 machine and NEVER get a virus.  

  • PS Guard Removal

    PS Guard is viscious scareware that loads itself each time you attempt
    to unistall it.  It is malware that claims to be malware
    remover.  It disables your Task Manager, informs you that your
    system is infected and doesn't allow you to exit from it while it scans
    your computer for viruses.

    Removing PS Guard
    it is a bit tricky.  Adaware and Hijack this will do nothing to
    remove it.  Noahdfear over at GeekstoGo.com wrote a sweet little
    script to remove it called smitrem.  It does the trick in removing PS Guard. 

    I picked it up at some Russian warez site on my Honeypot sytem.

  • Surfing with an Admin account or How to Get Owned

    Martin McKeay over at mckeay.net is has good methods of securing his home network:

    I'm a strong believer in the 'rule of least privileges' as my wife and children well know; at least once a week I get called over to the kids computer to log in as administrator and install some program for them. The kids have gotten used to it, but my wife hasn't and she's forgotten that I gave her the adminstrator password.

    The reason it is a great idea to use the least priveleges possible and not go surfing the net with Admin priviledges is that if you (or anyone on your computer with admin priviledges) hit an exploit site that downloads something on your system, it will do so with your administrator permissions. 

    It is best to surf the web with an account that does not have permission to download anything from the web, with elevated security features on Internet Explorer (cookies and java scripts turned off).  In fact, just use and patched version of Firefox. 

    More Security on Internet Explorer

    You can increase security feature of IE by going to Tools | Internet Options | Security tab.  Adjust the trust you have for the Internet by adjusting the level on the slider in the “Security Level for this Zone Area.” 

    If you surf the web with an administrator account without a firewall not only will you more than likely get hit with a trojan and worms you will give the masters of these products elevated priviledges to your system as they will install code in the C:\Windows\System32 – also known as root. From root a criminal hacker can do practically anything they want with your computer (including install a keylogger that copies everything you type and send the data back to some IRC room on the Internet.)

    In layman's terms, they will OWN your ass.  

    If your really paranoid: 

    Customize your selected security levels by clicking the “Custom Level” button inthe “Security Level for this Zone Area.”  Disable Active X, and Java to completely destroy the ability of malicious mobile code to affect Internet Explorer (unless its already on your system).  This will impare your ability to expirience anything beyond text.

     

  • Win $10 million dollars against SPAMMERS, Mr. Braver did..

    I suspect that there will be more people seekings litigation against
    SPAMMERS after Robert Braver won $10 mill against a spam company.

    On Thursday the 22nd, Robert Braver, an
    Oklahoma ISP owner who is a long time activist against both spam and
    junk faxes, received a default judgment of over $10 million against
    high profile spammer Robert Soloway and his company Newport Internet
    Marketing.

    Coording to the CAN-SPAM Act of 2003:

     (Controlling the Assault of Non-Solicited
    Pornography and Marketing Act) establishes
    requirements for those who send commercial
    email, spells out penalties for spammers
    and companies whose products are advertised
    in spam if they violate the law, and gives
    consumers the right to ask emailers to stop
    spamming them.

    Robert Soloway seems like a great contributor to the Internet!

    Long-term spammer and harvested list seller. Evidence shows him hiring
    virus authors to create spam “zombies”. Commits hundreds of felony
    violations of U.S. computer crime laws daily.

    This is the kind of action that it will take to slow down the epidemic
    of SPAM and malware.  The days of reaction are done. 
    Companies that react to penetrations and SPAM are going to continue to
    get nailed in the pocket.

    read more | digg story

  • Anti-Spyware Gets HIP

    Anti-spyware software is expected to
    transition from threat-specific technologies to Host-based Intrusion
    Prevention Systems (HIPS) as vendors deploy proactive solutions that
    block new and unknown spyware programs from PCs. Such solutions are
    likely to be increasingly compelling for security.

    Its about time this more proactive approach to malware and spyware is
    put right on desktops.  Eventually the masses will get so fed up
    with malicious code that there will be a huge market for behavioral
    based intrustion detection type software. 

    With the amount of money that is being made by virus and spyware
    makers, malware is developing faster than computer security could ever
    dream.  Proactive methods such as HoneyMonkey servers and HIPS
    products will no doubt be a big hit.  It is about time that
    Information Security had more of a proactive response and not as
    reactive. 

    With corporations more interested in protecting there ASSets then with
    developing a good product and protecting the customers, its time that
    we security professions get aggressive an proactive with our
    methods.  That will be the only way to fight malware in the future.

    read more | digg story

  • Malicious code could trick ZoneAlarm firewall

    Malicious code masquerading as a trusted application could trick a
    ZoneAlarm firewall into letting it connect to the Internet, security
    experts have warned.

    The notice was given on 28 Sept 05 by Debasis Mohanty.  Here is the official word from Zone Alarm.  This exploit affects the popular default install of Zone Alarm 5.5 and not 6.0.  

    LIST OF PRODUCTS UNAFFECTED:

    ZoneAlarm Pro, ZoneAlarm AntiVirus, ZoneAlarm Wireless Security, and
    ZoneAlarm Security Suite version 6.0 or later automatically protect
    against this attack in the default configuration.

    ZoneAlarm
    Pro, ZoneAlarm AntiVirus, ZoneAlarm Wireless Security, and ZoneAlarm
    Security Suite version 5.5 are protected against this attack by
    enabling the “Advanced Program Control” feature.

    Check
    Point Integrity client versions 6.0 and 5.1 are protected against this
    attack by enabling the “Advanced Program Control” feature.

    AFFECTED PRODUCTS:

    ZoneAlarm free versions lack the “Advanced Program Control” feature and are therefore unable to prevent this bypass technique.

    Recommended Actions:

    Subscribers should upgrade to the latest version of their ZoneAlarm product or enable the “Advanced Program Control” feature.

    In my oppinion Zone Alarm is still a great product.  This is yet
    another example of a highly exposed product getting tested to its
    limits like every version of Windows and Internet Explorer.

    read more | digg story

  • Mobile viruses could get nasty fast

    Dan Nystedt's article on PCWorld tells of the good, the bad and the
    ugly about connecting mobile systems to home system to the Internet:

    “The dream of a connected world where
    PCs and mobile phones can communicate with the digital home and other
    devices is supposed to make life easier. But it could instead make life
    far more dangerous if malware developers have their way.”

    And my favorite part:

    “For example, mobile phone services in some countries let people see
    what's going on inside their house via a Web cam connected to motion
    sensors, snapping a picture and sending to the homeowner if anything
    seems awry. But a hacker could use that same Web cam to see if anyone's
    home, and perhaps break in. Or invade people's privacy by taking
    pictures of what's going on in the house. And could a marauder hack
    into a driver's mobile phone use it to shut down certain automobile
    systems, like the brakes?”

    The article goes on to mention something very interesting, 3G phones
    are online all the time.  This feature make them HIGHLY
    vulnerable to attacks.  I won't be surprise if one day soon these
    phones will have to have little built in mobile firewalls.

    “F-Secure, another vendor of antivirus tools,
    says the current total count of known mobile malware stands at 87, up
    from less than 10 early last year. A total of 82 of those viruses were
    written to run on the Symbian series 60 operating system.”

    Symbian is a very popular mobile phone operating system.  Much
    like the Microsoft OSes and apps, Symbians popularity makes it a huge,
    juicy target to mobile phone black hats.

    read more | digg story