Archive for October, 2007

Malware – Spyware – Adware – Virus – Worm – Definitions and ways to protect

Malware – Spyware – Adware – Virus – Worm – Definitions and ways to protect

Now, it’s common on Internet or even at work for those of you who work close to IT people to hear these words. Damn I got infected with a virus or a worm or a spyware. So, what do these words mean exactly? and how do we minimize the infection?

First I will start with defining these words:

Malware: refers to a large variety of software which all has one thing in common: it is unwanted software which someone else wants to run on your computer. This software “infects” your computer, making it behave in a way which you do not approve of. Malware can include:

  • Viruses: which are computer programs that can copy itself and infect a computer without permission or knowledge of the user.
  • Worms: which are self-replicating computer program. It uses a network to send copies of itself to other nodes (computer terminals on the network) and it may do so without any user intervention. Unlike a Virus, it does not need to attach itself to an existing program. Worms almost always cause harm to the network, if only by consuming bandwidth, whereas viruses almost always corrupt or modify files on a targeted computer. are usually destructive in some way – these can delete files, wreck the operating system, etc.
  • Trojan Horses or Trojans: which are software which purports to do a certain type of action, but in fact, performs another. The trojan is not harmful by itself but it usually opens a backdoor in the infected machine for an attacker.
  • modern viruses and worms, which give control over your computer to an attacker – they can then use your computer to send spam or launch attacks on other computers
  • Spyware: which monitors what you do on your computer – this can lead to credit card or identity theft
  • Adware: which shows you unwanted advertising – this typically shows up as pop-up ads or an unwanted homepage
  • a combination of the above

How do I secure my PC?

There are three major steps to securing your PC.

Read the rest of this entry »

Share this article: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • StumbleUpon
  • Digg
  • del.icio.us
  • Technorati
  • Netvouz
  • Reddit
  • feedmelinks

If you enjoyed this post, make sure you subscribe to my RSS feed!

W32.Beagle.GM

W32.Beagle.GM

Discovered: September 14, 2007

Updated: September 14, 2007 2:28:50 PM

Type: Trojan

Infection Length: 765,154 bytes

Systems Affected: Windows 2000, Windows NT, Windows Vista, Windows XP

This threat may be downloaded by Trojan.Lodear or Trojan.Lodeight variants. It has been reported to appear in file-sharing networks pretending to be an illegal crack or license key generator program.

The Trojan may copy itself as any of the following file names:

  • Alt-TabReplacement1.0.exe
  • Alt-Tab Thingy 3.3.exe
  • DVR-Studio Pro 1.64 Key2.exe
  • Video Edit Magic Express 4.11.exe
  • Colasoft Capsa Professional 6.4 Build 1083.exe
  • NIS 2007_readme.exe
  • goodsync 6.2.1.exe

When the Trojan is executed, it displays the following message:
Title:
Error


Message:

Incorrect file version

The Trojan then creates the following registry subkey as an infection marker:
HKEY_CURRENT_USER\Software\FirstRRRun

Next, the Trojan searches inside the following registry subkey for security programs that execute when Windows starts:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

If any of the following programs is found in the above registry subkey, the Trojan replaces the file with a copy of itself so that it executes whenever Windows starts:

Read the rest of this entry »

Share this article: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • StumbleUpon
  • Digg
  • del.icio.us
  • Technorati
  • Netvouz
  • Reddit
  • feedmelinks

If you enjoyed this post, make sure you subscribe to my RSS feed!

Remove Restrictions Tool – RRT v2.0

Remove Restrictions Tool – RRT v2.0

Source: Sergiwa.com

RRT
You may not believe this but there still are lots of computer users that have no anti-virus program installed because they erroneously think that they will be spared from infection. Some don’t even know what a computervirus is!

Well they are clearly wrong and the result is that I needed to clean, repair or dismantle lots of computers to get rid of all the malware that had infected their systems.

When someone asks for my assistance, the first thing I always do is an offline anti-virus scan and clean.

But when I boot the computer, I am often faced with the same problem; the virus has made some changes to the system restrictions in order to hide itself from easy detection. These restrictions are most often:

Read the rest of this entry »

Share this article: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • StumbleUpon
  • Digg
  • del.icio.us
  • Technorati
  • Netvouz
  • Reddit
  • feedmelinks

If you enjoyed this post, make sure you subscribe to my RSS feed!

W32.Gammima.AG

W32.Gammima.AG

Discovered: August 27, 2007

Updated: August 27, 2007 11:08:32 AM

Type: Worm

Infection Length: 75,520 bytes

Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP

W32.Gammima.AG is a worm that spread by copying itself to removable media. It also steals passwords to various online games.

When the worm executes, it creates the following files:

  • %System%\kavo.exe
  • %System%\kavo0.dll

The file kavo0.dll is then injected into all running processes.

It also creates the following file, which is a copy of Hacktool.Rootkit:
%Temp%\[RANDOM FILE NAME].dll

The worm then copies itself to all drives from C through Z as the following file:
[DRIVE LETTER]:\ntdelect.com

It also creates the following file so that it executes whenever the drive is accessed:
[DRIVE LETTER]:\autorun.inf

Next, the worm creates the following registry entry so that it executes whenever Windows starts:
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\”kava” = “%System%\kavo.exe”

It then modifies the following registry entries:

Read the rest of this entry »

Share this article: These icons link to social bookmarking sites where readers can share and discover new web pages.
  • StumbleUpon
  • Digg
  • del.icio.us
  • Technorati
  • Netvouz
  • Reddit
  • feedmelinks

If you enjoyed this post, make sure you subscribe to my RSS feed!