Archive for the ‘Bad Things in General’ category

« Older Entries

McAfee Security Software Rebooting PCs

April 22nd, 2010

Computers worldwide suddenly went into simultaneous rebooting loops as a result of a legitimate Windows file being mis-identified as a virus.  According to McAfee, a software update posted at 9 a.m. Eastern time on April 21, 2010 is the culprit, affecting corporate users of McAfee’s security software around the world.

Hospitals, schools and government offices were impacted by the glitch, causing a third of the hospitals in Rhode Island to curtail non-trauma ER and elective surgery treatment until the problem was resolved.

McAfee spokesmen said it appears consumer versions of their products were not affected by the update.

Instructions for restoring the quarantined files can be found here.

McAfee has released a SuperDAT remediation Tool to restore the svchost.exe file quarantined during this debacle.

Article:  False positive detection of w32/wecorl.a in 5958 DAT (for Corporate/Business users) – VirusScan Enterprise

Download the tool and follow these instructions to recover your OS.

No comments »

Posted in Bad Things in General, News, Tech Tips, URGENT

Tags:

Chuck Norris Says Change Your Router Password… or He’ll Kick Your Butt

March 30th, 2010

Recently, a new botnet (group of devices working together to attack or distribute infections to other systems) was discovered infecting everyday routers as well as enterprise routers worldwide.  This cleverly crafted infestation attacks even Linus-based devices.  Egads!  How is this possible?  Isn’t Linux immune to infection?

Not if you don’t change the default username and password combination your system shipped with, it’s not.  This is how the Chuck Norris infection attacks a system – buy guessing common username / password combinations it has in it’s database.  Incredibly simple, as most people don’t change the login security on their routers.  Most don’t even change the SSID (name that’s broadcast by your router) which makes it really easy to guess the security login if you have even rudimentary knowledge of popular routers.

Windows-based computers are inherently insecure.  Almost all viruses are engineered to attack Windows systems, as they constitute the largest percentage of computers worldwide.  That being said, it is a lot easier to infect any device if you can bypass it’s login security.  This is what makes the Chuck Norris infection to clever.  It is OS-independent.

So if you’re infected, what do you do?

Reboot your router?  Since Chuck Norris is memory resident and doesn’t alter any code – or actually “infect” your router, just reboot it.  Not sure how?  Just pull the plug.  Wait a couple of minutes and plug the power back in.  You’re now un-infected?

Want to stay that way – and keep from being hacked by every neighbor kid with a laptop?

  1. This infection also exploits a known vulnerability in D-Link routers.  If you have one, check for updates to your router and install them.
  2. Login to your router as administrator.  Find your router documentation if you don’t know how
    (whoever setup your router should have provided you with this information – we do.)
  3. Change the SSID on your router to something that does NOT give away your name, location or street address.
  4. Change the administrator user name and password for your router
  5. WRITE THIS DOWN SOMEWHERE!
  6. Reboot your router.
  7. Reconfigure all your wireless devices to talk to the new SSID.
  8. You’re secure.

1 comment »

Posted in Bad Things in General, Information, Malware, Viruses and Bugs Galore, News, Recommendations, Tech Tips

Tags:

Facebook Infections Continue

February 24th, 2010

Several times a day we get people bringing in badly infected computers with the current variety of the Fake Antivirus family of Trojan Horse bug in circulation.  These infections are all the same, look similar in spite of having different names (because they’re all created with the same toolbox) – and have the same goal:  Their purpose is to extort money from you under the pretense of “protecting” you from the infections they tell you they’ve found — AND to run your credit card over it’s limit with worldwide purchases galore — AND to harvest your personal identity information from your computer so they can open accounts under your name and empty them, thereby destroying your credit rating while lining their pockets nicely.

As we have said since June of 2008:

STAY AWAY FROM FACEBOOK unless you’re using a Mac or a Linux-based computer.  PCs CANNOT be protected from these infections.  The authors of these pests discovered about a year ago, that they could circumvent most of the internet Security products (Norton, McAfee, Trend Micro, Kaspersky, Avast, AVG, etc.) by updating their code so frequently that NO Antivirus product can keep up with them.  Brilliant.  And impossible to protect against using the current popular mechanism.  We have disinfected over 300 computers since June of 2008 so far and the number grows every day.  Two years ago we would clean these computers, install AVG AntiVirus and send folks on their way telling them they were protected.  Not Any More!  Now we tell our clients, after cleaning (or more likely reinstalling) and installing AVG, that they are NOT 100% protected – and if they do what they did prior to infection, they will likely be infected AGAIN.

So for now:

Whatever AntiVirus / Internet Security product YOU think is the best, employing it will NOT protect you.  Period.

STAY AWAY FROM FACEBOOK

and MySpace

and be Very Careful what you click on in a Google or Yahoo search.  A growing percentage of search results (even the sponsored (yellow background ads at the top of Google’s listings) are infected and the second you click on the link, it’s OVER.  Even hovering over the link with Google’s page preview turned on will infect you.

The Internet is no longer safe and you need to be very careful how you use it.

If this scares you…  Good.  Maybe you will be careful enough to remain infection-free.

No comments »

Posted in Bad Things in General, Information, Malware, Viruses and Bugs Galore, Recommendations

Tags:

Are You A Victim of (or a Participant in) Software Piracy?

February 12th, 2010

We have seen a growing number of computers coming into our shop that have been serviced by other shops or unaffiliated independent technicians where the computer contains pirated software / Operating Systems.  This has been done without the owner’s knowledge or consent — but that does not make them innocent of the crime.

We had one computer in recently where a local shop had reinstalled the OS to fix a virus problem.  When the owner picked it up, the shop proprietor informed him they had “given him” Microsoft Word so he could write letters.  In point of fact, they had installed Microsoft Office 2007 Ultimate edition, which sells for $679.95.  In addition, they had removed the licensed version of AVG 9 Antivirus the customer owned and installed the Free version, improperly configured.  The shop owner fabricated a story about having a license for AVG which allowed him to “give” the full version away.  Simply not true.  We are AVG Gold Resellers and no such program exists.  He simply installed the free version of AVG anyone can download from their website. This is outright theft.  It is also piracy and the owner is culpable, albeit an unwilling participant in the crime.

We had another machine, serviced by the same shop, which was actually built by them, and came in for performance issues.  The computer was a good combination of hardware, but contained a pirated /bogus version of Vista with no COA (the sticker you find on the outside of legit computers with the OS license key) and a hacked version of McAfee antivirus.  In addition, this computer also had Microsoft Office 2007 Ultimate edition installed, which the customer had not requested, nor paid for.

Recently we had another machine come in, where a local tech reinstalled the OS and when the owner received the computer back, her Windows XP machine now had Windows Vista installed.  She was not happy.  The Microsoft Office she owned and had previously installed was missing (as it should be unless she supplied the disks), but she was not consulted or informed of any of these changes before, during or after repairs.  This is outright piracy in addition to being a bad business practice.

Legitimate businesses will not engage in this kind of behavior.  It is illegal, immoral and reprehensible — and most of us are smart enough not to risk our businesses, reputation and freedom to install pirated software.  If  this has been done to you, look for a new tech and report the people who engage in this pattern of theft and piracy.

If you feel you have been a victim of such software theft or piracy, pick up your phone and call 1-800-R-U-LEGIT to report the people who did this to you.

No comments »

Posted in Bad Things in General, Information, Recommendations

Tags:

Search Engine Infections on the Rise

February 5th, 2010

The bulk of the Fake Antivirus infections making up the viral epidemic spreading like wildfire since June of 2008, had been coming from Facebook and Myspace web pages until recently.  Lately, we have seen a shift in the source of infection to web search results.  Both Google and Yahoo searches have been bringing up infected results.  These infections show up not only in the actual main search results, but in the Sponsored search results (on Google, these show up at the top of the list with a yellow shaded background).  Sponsored search results are ads that Google receives vast sums of money to place at the very top of search results for certain keywords or phrases.  In other words, the criminals responsible for the infection on your computer are paying good money (to Google) to effect this result.  They do this because they know the end result is well worth their investment.

Also, over the last year we have seen a change in the methodology implemented by the miscreants distributing these infections.  Around this time a year ago, someone realized they could permanently circumvent all of the Internet security products that exist today, by simply updating the code to their little “pets” on a very rapid basis (say every 30 minutes).  Since even the most advanced Antivirus products only update their definitions every 4 hours, there is no way they can keep up with the new virus code being distributed.  We fine-tune our AVG antivirus install to update every Hour.  That is still inadequate.  We have lost the battle.  Period.  Until the methodology employed by the people protecting us changes to a hardware-based solution that simply does not allow viral behavior, we are all screwed.

What does all this mean to you?  It means, regardless of the Internet security product you think is the best, implementing it will NOT protect you 100%.  Nothing will protect you 100%.  If you are not extremely circumspect about where you go on the Internet and what you click on, your computer WILL be infected and you will NOT be able to resolve the problem yourself.  Even attempting to fix it yourself will likely make the problem worse, resulting in an un-bootable computer after all your personal information has been stolen and while your identity is being compromised.

What’s the solution?

  1. Buy an Apple computer. (I am typing this on a Mac Pro)
  2. Use a computer with a Linux Operating System.
  3. Stay off of Facebook and Myspace. (No, it doesn’t matter that you “don’t click on anything”)
  4. Be VERY careful what you click on when searching, reading emails or using IM.
  5. Use our recommendations for AntiVirus / Internet Security.  We know what we’re talking about.  We disinfect dozens of computers a week.
  6. Keep your computer backed up every single day so you can restore the Operating System (and your data) in case of infection.

No comments »

Posted in Bad Things in General, Information, Malware, Viruses and Bugs Galore, News, Recommendations

Tags:

Facebook Security Warning

September 20th, 2009

We’ve been telling people this for over a year, even published a security bulletin from AVG to this effect, but apparently never published an actual warning regarding the real risks associated with using Facebook (and MySpace).

Both of these Social Networking sites have been under attack since May 2008 by criminals intent on extorting money from individuals they infect with their Malware (also known as HostageWare, FakeAlert Software).  When your computer produces a warning screen or popups in the lower right corner warning you of infections and an offer to “fix” the problem for $49.95 (up to $89.95 in some cases) it is TOO LATE.  You are infected. You will not be able to fix this yourself.  If you gave them your credit card information you will quickly find your card canceled due to fraudulent activity.  (Call your credit provider card immediately if you have fallen prey to this scam)

This has been the pattern with these brilliant criminals working out of Eastern Europe for over a year now and there are no signs of the problem getting better.  Many people ask “why do they do this?”  ”Money” is the obvious answer.  No legitimate product will EVER pop up on your screen and ask for money to “fix” something wrong with your computer.  These Fake Security / AntiVirus / Performance Tuning / Registry Repair tools are all infections, plain and simple.

  • Just working with very small, easy to calculate examples at the low end of probability for these schemes, let’s say that one of these virus authors gets only 1000 people a day to “bite” on the offer to “protect” their computers.  At $49.95 each, that’s Fifty Thousand Dollars a day.  Pretty good money for sitting around eating Cheetos in your underwear in an (very nice) apartment in Kiev (Moscow, etc).
  • Now factor in the bonus as a result of having all the victim’s credit card information entered during this transaction.  Can you spell SHOPPING?  Our resourceful virus writer is spending your credit card limit in a heartbeat – so fast your credit card company won’t be able to stop it before this thief cashes in nicely on your plastic.
  • But the big payoff is gaining access you your personal identity information stored on your computer.  Credit card numbers, social security numbers, user login information - anything stored or cached on your computer from previous transactions or for your own records can now be in their hands to use as they please.  Identity theft is big business and can ruin your life.

We have disinfected over 250 computers since June of 2008 with one variety or another of these nasty infections.  (Refer to our Bad Bugs List here in the blog for the growing collection of these pests)  Absolutely nothing stops them, as these bugs are reinvented on an hourly basis.  The best antivirus you can buy (AVG) will still not provide 100% protection against these thieves.

We have been recommending to everyone since this problem surfaced to AVOID FACEBOOK AND MYSPACE unless you are using a Mac or Linux-based system, as they are immune to this infection (for the time being).  If you do not heed this warning, YOU WILL BE INFECTED.  Period.  Even the New York Times website was hacked and infecting their readers earlier this month, so it’s not just a Social Networking issue, but they are the primary focus.

“But I never click on anything.  I just check my messages…”  Great.  But no protection.  Most of these infestations are distributed by infected banner ads.  As soon as the ad displays on the page you’ve loaded, IT’S OVER. YOU’RE INFECTED.  It is NOT necessary to click on one of these ads for it to deliver it’s payload.  The criminals actually pay for advertising so they can infect your computer and extort money from you, steal your identity, etcetera.  They also hack user accounts so they can send messages that appear to be from your friends, but actually contain infected links.  It has happened to my friends.

Why isn’t Facebook doing more to protect it’s users?  We recommend you ask them exactly that.  Also, send them the bill for cleaning or reinstalling your computer the next time it gets infected.  See what happens.

And another thing.  Be careful what surveys or “tests” or other cute features or add-ons you participate in on Facebook.  Anything that requires a phone number to be involved will possibly start charging you every month for some infernal news feed while you get junk text messages you didn’t want.  If you are getting these already, simply reply with STOP or QUIT – and they should remove you immediately.  Also, dial 611 (assuming it’s your cell phone) and ask your provider to cancel the service you “signed up for” and refund the charges.  If you get a decent rep, it should be no problem.  If they are not being helpful, demand to speak to a Supervisor.

[Oh, and Google... Did you know these same miscreants are paying for top Google ad placement to sell you infected, fake AntiVirus products?  We've seen them time and again at the very top of the sponsored links in Google search result pages...]

Panda Labs recently uncovered a website that offers to hack any Facebook account for $100.00.  Once they have successfully gained access to your account, everything you have posted in that account is THEIRS.  The result:  Identity theft — YOURS!  According to this website, only 1% of all Facebook accounts cannot be hacked!  Once they have hacked an account, they have full access to your Friends’ contact information and now they can send them infected links or images, ostensibly from YOU.  Nice.

Just say “NO” to Facebook!

Unless you’re using a Mac…
(I know, you NEED your Facebook fix…  I use it all the time, just never from the office where we use all PCs.  Only from home where I use an Apple OS x based computer.

Now for the serious part…

If you have given these clever criminals the money they ask for, call your credit card company immediately so they can start the process of issuing you a new card.  If you have logged into any financial institution within a few days either side of the date when you first noticed the infection or during the infection period, CALL these institutions and have your password changed IMMEDIATELY.  This is a good idea from time to time anyway, but after your computer has been infected it is mandatory.

No comments »

Posted in Bad Things in General, Information, Malware, Viruses and Bugs Galore, News, Recommendations, URGENT

Tags:

LightScribe Drive Warning

September 15th, 2009

Something we’ve recently discovered with more computers outfitted with LightScribe drives is corrupted writable CDs as a result.  We use CDR disks for our diagnostics and tools in the shop, since the latest (since mid-2008) viruses started infecting USB drives when they were inserted.  On three different occasions, we have had every disk inserted into LightScribe drives in Hewlett Packard computers rendered unreadable by any computer afterward.  It seems the firmware permanently damages these disks, which we find curious, as the OS is not loaded during this process.  The damage is occurring at a hardware / firmware level – before any OS or software can be involved in the process.  Keep in mind, these are CD-R, not CD-RW disks, they should not be WRITABLE.  Yet these LighScribe drives are altering the disks and making them unreadable.  Just don’t do the same thing to any disks you may have that you care about.

No comments »

Posted in Bad Things in General, Information, Tech Tips

Tags:

Avoid Internet Explorer 8 at All Costs!

July 17th, 2009

We commented on IE8 in an email blast awhile back, but now that it’s at the top of the Critical Updates list in Windows Updates, you need to take steps to protect yourself.

Internet Explorer 8, Micro$oft’s replacement for the almost equally-buggy IE7 is responsible for absolutely CRASHING large numbers of Windows XP computers.  We probably get 5 machines a week that are non-functional, won’t load Windows, are completely locked up or just plain S.L.O.W. as a direct result of an IE8 installation.

“But I can just uninstall it if there’s a problem, right?”

Maybe.

And maybe not.

We have found a high percentage of systems where there is no “easy fix” for the IE8 install.  IE is welded into Windows.  This is the basis for the EU suit against the Beast from Redmond.  Anyone who is running the Windows Operating System has Internet Explorer whether they want it or not — and you cannot get your Windows Updates without it.  So removing this very unstable browser from your OS is a very risky proposition and you just might have a high-tech doorstop on your hands…

So we recommend, as usual, only installing Security Updates and un-checking all other updates from Microsoft.  If you have Windows XP, stick with IE6, install Firefox 3.5, or even 3.0.1 — and Have a Nice Day.  Firefox 3.x gives you all the functionality of IE7 with a better interface and full access to all the tools and functionality you’ve come to know and love in IE7.

(08/21/09 Update:) On Windows XP, “upgrading” to IE8 (listed as a Critical Update by Microsoft) frequently results in a completely unbootable system. We had 3 of these in one week and the only solution was to reinstall the OS. On one machine, all the user profile folders had been relocated to the root directory. On another machine the drive was unreadable, requiring Data Recovery to retrieve their precious documents, email and photos. 

Do NOT install Internet Explorer 8! 

If you find you have Internet Exploder 8, give us a call…

No comments »

Posted in Bad Things in General, Information, News, Recommendations, URGENT

Sysguard.exe Infection at Record Levels

July 16th, 2009

Over the last 2 weeks we’ve seen a dramatic rise in the infection rate from Sysguard.exe.  This infection masquerades as an Antivirus / System Security Center interface, reporting dozens of infections allegedly from an assortment of fake viruses, trojans and worms.  Whatever you do, DON’T give in to the threats and intimidation to pay them for protection.  The indicator you’re infected by this bug is twofold.

1: You will see a diagonally tiger-striped shield in your system tray.

2: Your Windows Desktop wallpaper will be replaced with a black or blue background with bright red lettering stating “Your’re” computer is infected.  Note the misspelling of “your”.

Don’t try to remove this infection.  It’s impossible for even most of the best computer techs.  We can do it, but it’s expensive.  We generally backup your data and restore your system, as it is less expensive and faster than “cleaning”.  All your system tools will be disabled.  You will not be able to edit your registry, manipulate the Windows startup applications or launch Task Manager when this pest strikes.

No comments »

Posted in Bad Things in General, Information, Malware, Viruses and Bugs Galore, News, Recommendations, URGENT

1 2 3