Security Shenanigans – May 2010

-

I’ve noticed a few irritating trends in the virus/spam/spyware world recently.  Here are some things to watch out for:

Web Nasties
  • Steer clear of downloading screensavers, they can often be infected with viruses
  • Steer clear of apparently free tools that contain irritating adware, e.g. freeripmp3 which contains “Adware.ADON”
  • Be very careful of Online Poker sites.  These often require the downloading of software or a browser add-on which could be infected.
  • If you are browsing the web and are informed that your computer has a virus or infection treat this message with a healthy degree of scepticism.  Has the message popped up from your security software?  This should be fairly obvious.
    • Here, for example is what a security pop-up from ESET Smart Security looks like:
    • image
    • E.g. here is what a security pop-up from Norton Internet Security looks like:
    • image
    • It’s very common for spyware to infiltrate your PC by pretending to be legitimate software which tells you that you have a security problem on your PC which can magically be fixed by downloading a product such as AntiVirus 2010.  When this software is unwittingly downloaded it can really get medieval on your computer!  Here are some examples:
    • image
    • image
    • image
    • So, look at the title of the warning pop-up message.  Is it coming from your security software?  You do have security software (AKA anti-virus) yes?  Is the message popping up as window in your web browser?  If so then shut down all web browser windows.  Can’t close them all?  Try using the Alt+F4 keyboard combination.  Failing that, save any changes to any documents you might have open elsewhere and restart your computer.
Email Nasties

As always, be really careful with email attachments.  It’s amazing how often we can forget this.  Do you know the sender?  If not I’m inclined to just delete the email if it has the attachment.  If you know the sender then ask yourself if this is expected.  If not, email them and ask them if they meant to send you an attachment.  If they say yes, even then it pays to be cautious…

  • Email from security@facebook.com
    • Subject is: Facebook Password Reset Confirmation!
    • Contains Kyrptik.BKR trojan
  • Email from invitations@twitter.com
    • Subject is: Your friend invited you to Twitter
    • Contains Merond.AA worm
    • You are asked to look at an attachment (Invitation Card.zip)
    • You have to ask why you would need to do this and not just click a link to go to their website?
  • Email from greetingcard.org
    • Subject is: You have Received a Greeting Card
    • Contains Kyrptik.CEJ trojan
  • Email from various different addresses
    • Subject is: UPS Delivery Problem Number...
    • Contains Wigon.KQ trojan (rather nasty)
  • Email from various different addresses claiming to be DHL
    • Subject "Please get your parcel NR..."
    • Contains TrojanDownloader.Bredolab.AN trojan (rather nasty)
  • Email from Facebook Team
    • Subject "updated account agreement"
    • Contains an attachment such as “Facebook_Password_4cf91.zip”
    • Contains TrojanDownloader.Bredolab.AN trojan (rather nasty)
  • Email from Microsoft Team
    • Subject is: "Conflicker.B Infection Alert"
    • Contains Kryptik.CJT trojan

Comments

Post a Comment

Popular posts from this blog

Where are SCANPST.EXE and/or SCANOST.EXE?

-
Image
I sometimes have to deal with customer computers whose Outlook PST or OST files have become corrupted.  Very often the fix is to run SCANPST.EXE on the offending PST/OST file.   However, every time I go to do this I forget where the two executable files are.  Here is where they are on a Vista machine running Office 2007: C:\Program Files\Microsoft Office\Office12 I hope this helps.
Read more

APC PowerChute Network Shutdown - Authentication Phrase

-
Image
​Was installing  APC PowerChute Network Shutdown (PCNS) on a customer’s server and couldn’t find a record of the Authentication Passphrase that I set ages back on their Smart UPSes Network Management 2 Card. So I went to reset it on the card and start anew… it took a lot of digging to find it on their particular release of firmware: Go into the UPS tab, then into “shutdown” inside the “Configuration” category: You may then need to change the passphrase being used on other servers. To do this, open up PCNS in your browser and click into the area shown below:
Read more

WSUS Issues

-
Image
Was configuring WSUS on a Server 2016 VM for a customer recently and found the performance to be very sluggish and most of the time the client PCs would time-out and throw an error message when trying to check for updates. After much digging on different forums I came across a fix that worked nicely: Open Internet Information Services (IIS) Manager and click on Application Pools Then Right-Click on your WsusPool instance and choose Advanced Settings Scroll down to Private Memory Limit (KB) and change it from the default of 1843200 to 0 which means unlimited. Then right-click and stop the WsusPool and then start it again. Hope this works for you.
Read more