Being a Bad BOT!

I had the strangest thing happen today, Seemed a Bad Bot was Crawling my pages. I was getting at least 60 page views an hour from this bad Bot!! The individual IP's of this Bad Are:

65.208.151.112
65.208.151.113
65.208.151.114
65.208.151.115
65.208.151.116
65.208.151.117
65.208.151.118
65.208.151.119

[ad#ad2-right]After the first initial hour of this going on, I started wondering what this bot was doing.   I did some more research into this little bot.   I did find out it is owned by Kintiskton LLC.  (Twitter Search)

Anyways It bothers me that when you do a Google Search for this company, it comes back with no company.  Some people have already did there research and have come up with very little.

I dug even more and some are saying this might be Homeland Security, and I have my own thoughts on this.   I might be paranoid myself but if there is no company out there and the IP keeps coming back, I assume it is BAD mojo.  Some people worry that it is a hacker probing for vulnerabilities and that worried me.

I decided with the Help from Godaddy, to ban the lot of IPs.  I figure someone is trying to get information or trying something they shouldn't, I'll stop it myself.   If you have Wordpress and are also having problems with this ip, you can ban it by adding this to your HtAccess file:

order allow,deny
deny from 65.208.151.112
deny from 65.208.151.113
deny from 65.208.151.114
deny from 65.208.151.115
deny from 65.208.151.116
deny from 65.208.151.117
deny from 65.208.151.118
deny from 65.208.151.119
allow from all

This is how you block those ip in the HtAccess file. Thanks to Wordpress for showing me how.

Zero Day For IE7 Being used in the wild.

It looks like IE7 patches are being used right now in the wild.  According to TrendMicro:

HTML_DLOADER.AS exploits the CVE-2009-0075 vulnerability, which is already addressed by the MS09-002 security patch released last week. On an unpatched system though, successful exploitation by HTML_DLOADER.AS downloads a backdoor detected as BKDR_AGENT.XZMS.

[Image from TrendMicro Blog]

[ad#ad2-right]As you can see this this can be very bad for the companies who wait a while.  Internet Explorer is still being used 1 out of 4 users and I see it it all the time on my stats.   The Good news is this isn't as hard to get rid as the Conflicker but should be taken serious because the writers might start to want to get even more malicious and make it even harder.

This is the next step to prevent yourself from getting caught with your pants down so to speak, you need to patch all systems that have internet access.  I still like the Autopatcher because it will do the job with very little input from the user.   It also makes it easier for people to patch big systems.  You should also consider installing some Free Anti-virus software to help protect the systems you do have.

From the looks of this virus, someone could easily make this into a botnet and you know how that can could affect your systems and your ISP.  So it is best to get this months patches on the floor of your company as soon as possible.

You should also consider telling your users to start using Firefox to prevent infection from even happening. Until you patch, you are vulnerable.

Uncovering a Virus/Trojan

Getting done with the first part really got my juices flowing. I was shopping looking and thinking about this next article. I came up to only one option turning this into a 3-5 length post due to all the content that I will have.  So where did we leave off?  Oh that is right figuring out if you have a virus/Trojan.  The instant I made a post about this 12 hours later someone make a comment and here is what he said:
[ad#ad2-right]

Rene Van Belzen

I can't wait to read part two of this article. I always wondered how you'd know you're infected if a virus don't want to be detected and no virus definitions are yet available, because the virus is so new.

Now the truth is anytime a Virus does something it usually leaves a footprint somewhere and somehow.   Even the hardest working hacker can't plan for all possibilities and that is where we begin.   I have been helping people for a while with viruses and know that no matter how hard the virus tries to hide you can usually find it relatively quickly and easily do to virus check here are the ways I've done to figure out if they may or may not have a virus/Trojan.

Now if this is a client's computer and you don't want to be rude to the client, there are a few indications of user error and installing a virus.   This is relatively simple, all you do is do a quick inventory of all the start menu programs.  You'd want to look for any P2P file sharing program, If they have Firefox Installed, and if they are using Window Mail and not Thunderbird.   You see 80% to 90% of virus downloaded are installed by the End USER.  They either downloading a game and installing a virus with [ad#ad2-left]a game, or not protecting themselves by using Internet Explorer or Using Windows Mail.  That is usually my first step due to the fact, I've got to be diplomatic about finding out about security ways.  Also make sure they are up to date on there Window updates, unless they are using a really old system then you will have to work even harder.  Also you can suspect a virus if the client is talking about having problem with a program recently although this isn't always true it sometimes is the case due to the fact hackers don't have a big chance to test these viruses/Trojans out before they set them into the wild.  So there are always going to be unplanned problems associated with them.

After the first initial search of desktop, you should really know the likely hood of a possible virus getting on the system and later we will talk about counter measures to prevent virus attacks in the future.   There are a few places a hacker likes to put commands.   Hackers love to put in the Registry to run a program every time Windows starts.  It usually in:

• HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run


• HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\

Usually 50% to 70% of virus like to make sure the program to runs.  This is a flaw in Windows because hackers can edit this without much effort but there isn't many places a hacker can go to make sure a program is set to run when you boot.   So this is also a benifit to finding those little programs.

Now just like the Regisitry, Hackers also like to put programs in a few areas on the hard drive.   This is also kinda hard to hide because most of the time these are consider important to the system but if you know what to look for you can pretty much figure out if it is truelly a system file.  These areas of the hard drive are:

• C:\WINDOWS\System32[ad#ad2-right]


• C:\WINDOWS


• %programfiles%\common files\microsoft shared


• %windir%\temp\

These are just a few but if you look hard enough it can be found most of the time.   Most of the time I use the registry to tell me where these programs are so I can do a further check of the program.  Some of this is not needed with some of the programs that I recommend but this is for those who want to be a through job and make sure the virus is gone.

On my next post we will talk about some good tools for the trade to help get rid of a virus/Trojan.  This little step here is used to  better help identify a virus and also give you chance to google each name on the list of registry and the hard drive  to see if you can identify the virus.

Facebook : Beware Spam for breakfast. (Virus)

In today's society, we've been to complacent with people with people clicking links for the social group. In one such article on Channel Web, a nice little blog, says this:

[ad#ad2-right]


The worm was discovered by IT security provider Kaspersky Lab, which said the threat, Net-Worm.Win32.Koobface.b, is targeting Facebook users by creating spam messages and sending them to the infected user's friends via the site.

"Unfortunately, users are very trusting of messages left by 'friends' on social networking sites," said Alexander Gostev, senior virus analyst at Kaspersky Lab, in a statement. "So, the likelihood of a user clicking on a link like this is very high."

[Via Channel Web]

This seems to be a problem people thinking that a link someone sends them is a real good link but actually is a link to a video site. According to this article the links people are sending are actually a fake video link, telling you have to download some update to flash player, by downloading this program. The user gets involved with the virus and the fun begins. So how can you prevent this from happening, two ways one is a very good group of software to make sure you have the latest and greatest video codecs. That too can be something they'll say you need and if you've already installed this list of codecs then you know they'll not telling the truth and you can quickly get away from the site laughing.

[ad#ad2-left]What's this program name, it is call the K-lite Mega Codec pack. In this Pack you will be able to play almost everything without having to go download another program. This is done by people who want you to have all the latest codecs installed so you don't have to go by a program you'll only going to use once a month.

Once you've done that, you'll no longer have to worry for the most part about codecs. There will be times when you might have to visit that site and update them but that will be far less.

The other thing you must remember is if it says you must update your player. That should be a sign that there is something. I'll always go to the site and check for example Adobe. If it says I need to update my flash I'll manually type it into my browser. This way you will know you have the latest updates, if you need to update the flash player by all means go to here and update.

If you got the virus I'd check out my Anti-virus and Anti-Spyware page and that should show you will you need to get rid of the Virus. This virus is very easy to get rid of, just download any one of the anti-virus software and install it. Don't forget to update the virus database while your at it. That should fix the problem pretty fast. Remember the only way to prevent from getting the virus is YOU.

Apple's Immunity, Botnet sanctuary.

But is Apple projecting a false sense of security just to save face? Many experts repeatedly warn that all operating systems are susceptible to viruses, and as the Mac becomes more popular OS X will inevitably become a bigger target for malicious attacks.

[via Pcworld]

Having said that I feel the notion that Apple is trying to keep there reputation as a virus free system. I can only hope that they stay that way. Which as much as I know, Apple will most like start to be the main source for botnets, because of the lack of security.


[ad#ad2-right]According to reports on this blog, people are worried Apple stance on it being the safest and having so much immunity to viruses. Apple in the past has stated they have mislead people with there firewall. Yet Apple takes down that suggestion of having an Anti-virus(Quietly).

[ad#digg-left]Everything I've seen suggest that virus writers and Malware writers will MOST likely start targeting the Mac OS X, they know Apple sense of security is Vulnerable to attack and they will exploit it more and more. So what does that mean for Apple, it just means that soon every hacker who has a botnet will want a piece of the Apple Pie and is right now.

[ad#ad2-left]As PC Trojans go, the programming features of RSPlug.E look fairly basic. PC malware is more highly evolved and usually cleverer. But a programmer - probably a Russian - with knowledge of OSX had taken time to create a Trojan that hits Macs instead of PCs, James pointed out.

[via Techworld]

Which looks like it has already begun. So what can Mac users do, get an Anti-virus and maybe Apple will have to start backing down from the Virus commercials and actually admit it. Sooner or later someone will have to challenge Apple to get them to start admitting to it.

Is this Hardcore PC Falcon Northwest Mach V Extreme or not?

[ad#ad2-right]Just saw this on PcWorld Reviews and thought I'd talk about the specs. I would love to get one of these for my self. It comes with:

• Silverstone Temjin TJ03 full tower case


• Intel Core i7 965 Extreme processor -- Overclocked to 3.8 GHZ

12GB of DDR3-1066

7200-rpm Hitachi Deskstar 7K1000 hard drive

dual 2GB ATI Radeon HD 4870 X2 graphics

• 22-inch Samsung 2243 LCD

All these are links are for those who would like to make this computer yourself.   The links are where you could go to buy the parts. The price after you buy the parts are estimated at $7395 price and I think you could get that down to 5000$ if you look for rebates and other incentives.   I wouldn't mind having this computer for gaming myself.   It sure would be nice to give for someone on the holidays.  This would be good for people wh o are looking to computer game developers or people who are into 3D rendering.  Just though I share this little  review with you.   They really did a fantastic review of this product on there site.

Black Friday gets way out of hand!!! (No JOKE)

OK, Black Friday has officially gotten out of hand. A 34-year-old WalMart employee was trying to hold back the crowds at a Long Island store this morning at 5am, when they took the doors off their hinges and stormed the store. The man fell down and was trampled by over 200 people as he gasped for air. It's sad and despicable, and it's equally the fault of the dehumanized shoppers and the WalMart store it happened at.
[via Gizmodo]

[ad#ad2-right]This is a sad day when people are more interested in deals then someone getting stampeded by other people.   This happened in the Long Island Wal-mart.    I much prefer CyberMonday, where you don't have to worry about someone getting killed.   I feel sorry for the people involved they now have to deal with there conscience.   I hope this teaches Wal-mart to do something different next year.  Next year they should have them enter one at a time in a line, every 2 seconds or so!!

Looks like a scam to me : Personal Shopping Assistant!

[ad#ad2-left]

Good afternoon!


We found your resume at _________________ and we would like to propose you a
position of Personal Shopping Assistant.

Imagine having an exciting job with incredible salary (up to $100,000/year) that
lets you use your creativity while being paid to shop. Welcome to the world of
personal shopping!

As we know shopping is the world's favorite leisure activity, but in our busy
society an increasing number of people need to hire someone to do their
shopping. Thus personal shoppers are more in demand than ever before.

There are absolutely NO START-UP FEES and NO FEES for being employed at this
position. As long as you live in the USA, and you have a credit card or any
other line of credit, have 1 or 2 free hours during the day – you are eligible
for this job!

[ad#ad2-right]This is what you will have to do in short:
• Purchase the requested goods using your credit card.
• Send us receipts.
• Wait for us to issue a credit to your credit card in the amount of purchase
plus shipping fee plus your commission which comprises 10%.
• Ship out the goods.
• You are finished, come back for a new list of goods.

If you are interested in Personal Shopping Assistant position please fill in the
form below and send it to: Open2usa.job.dep@gmail.com
Our manager will contact you within two working days.

------------------------------------------------FORM-------------------------------------
Full name ______________________
Residence country _____________________
Age _____________________
Contact phone ______________________
Availability time _______________________
------------------------------------------------FORM-------------------------------------

This letter confirms your resume has been duly processed and your skills
completely meet our requirements for Personal Shopping Assistant Vacancy.

Thank You,
John Walker

[ad#ad2-left-1]I wanted to bring this up because of two things that I saw first off that made this look like a scam. One is they want to "CREDIT" your credit card and two they use a GMAIL account. I am going to say this is looking more and more like a scam. If anyone else has any other ideas about this just leave your comment.  I don't see how this can be real.   I am thinking once they have your credit card information, they'll start using it.

Google Now lets you Video/Voice chat!!

After checking out some of what Google has been doing.  I find out that you can now Video Conference for free.  That is to say that you can conference with someone on line and do cloud computing.   According to Google:



To Get this Video and Voice chat Click this link

[ad#ad2-right]Now I might not a lot but this will be most likely be used in association with the new Google Phone, the G1. So I thought about how this will be used? This will be used in several ways. To keep in touch with family, to make it easier to telecommute and to Video Conference with associates from work. Google Model is "DO NO EVIL". There is a flaw to this I am sure, this is a Internet Protocol to Internet Protocol connection and in doing so you create so much possibility of a virus getting through. There is no doubt that this is using flash. It also is know to make the infrastructure of a business weak. The Intranet of the business would be compromised. I am sure there are vulnerabilities in this and we will hear them shortly. I'd give it a week or two, remember the problem with Google Chrome and how un-secure it is. These are just a few of what would cause security headaches to all who work in the IT field. I just want to bring that up to prove a point. Google's mantra isn't perfect, it is what it is.

Windows update is getting a revision!

[ad#ad2-right]According to Computer World, dated Oct 31, 2008 and I'll quote:

"Over the next couple of months, we'll be rolling out another infrastructure update to the Windows Update agent (client code)," said an unidentified Microsoft employee on the Windows Update team's official blog. "This update makes it possible for users to install more than 80 updates at the same time."

[via Computer World]

Now if your like me and have several computers who need to be updated at a given schedule, you sometimes worry about these updates that come along that might just break your system. I have been using a program call Offline Updater, which does what Autopatcher does really nicely. So why is Microsoft sending out this patch? Two reasons, one they want you to be able to update your operating System without hurting your system integrity.

Now lets talk about the integrity of having to reboot your system. You see, every time you reboot the system, it causes the system hardware some strain.  It is something like having starting up a car, sooner or later you will have the starter go out, because of to much start up.

[ad#ad2-left]Second reason for this is, basically the update software needs to be update yet again for any security flaws or features that might be exploitable.  I am sure there are some and Microsoft probably knows about that we do not.   So that is the second reason, which it is the most obvious reason yet to push out another revision of the Windows update.

What about stopping the update from effecting your system.  The only way that I know of is to prevent Windows from checking for updates.  Which is simple:

Windows XP Version:

[Category View and Classic View]


<Start> / Control Panel / Security / Click Windows Updates

For Windows Vista:

<Orb> / Control Panel/ Security Center/ Windows Update / click "change Settings"

With both ways, you will be able to control four ways to handle Windows updating and they are:

• Automatic - Will download all necessary updates and install them without your permission or knowledge.  Note some of the updates will automatically reboot your system.  Most commonly they are set to do this every day in the 12am to 4 am period of time.   So when you wake up you would see an log in screen.

[ad#ad2-right]

• Download updates but let me choice which ones to install and when -  This is most commonly used by people who don't want to bother having to check manually.  It will check and download, then it will let you know.




• Check for updates but don't Download them -  This is like the previous one but this will only tell you.  The rest of the decision is in your hands not the computer.  This is good for people who have limited system resources, like Hard drive space.  It still reminds you like the previous one but won't download any updates.




• Never check for updates -  This is used for people who don't want to be bothered with updates and have a way to update manually.  This is commonly used by businesses who have several systems on and don't want to risk an update causing trouble or weigh down the companies internet by downloading updates un-necessarily.   This option is not to be messed with because it leaves your system with quite a lot of vulnerabilities.  You do this one if you have a set schedule to update each and everyone system. (Extremely Dangerous to do)

With what I talked about, I am hoping you find this useful and to share your discoveries with other people who might want to be able to change how Windows updates are handled on other systems.  If you have comments or questions, please post them in the comment section and someone will be more than glad to help you out.

Microsoft Releases MS08-062 to the Public a Month Early!

Vulnerability in Windows Internet Printing Service Could Allow Remote Code Execution (KB953155)

This update resolves a privately reported vulnerability in the Windows Internet Printing Service that could allow remote code execution. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts.

[ad]

This update is rated Important for all supported editions of Microsoft Windows 2000, Windows XP, Windows Server 2003, and Windows Server 2008. For more information, see the subsection, Affected and Non-Affected Software, in this section.

The security update addresses this vulnerability by changing the way that memory is allocated within the Internet Printing Protocol (IPP) service. For more information about the vulnerability, see the Frequently Asked Questions (FAQ) subsection for the specific vulnerability entry under the next section, Vulnerability Information.

[via Microsoft Bulletin]

Now from what I understand, if you have a Network attached printer on your system this would make you more vulnerable to someone taking control over your system. So this patch is supposed to fix that. I am recommending to all to update this and fix this update ASAP. I do not know if you don't have one what that would do so just install this update, because you will undoubtedly still be runing the Internet Printer Protocol even if you don't have a printer.

Did you Recieve a Check from Shadow Shopper? (Scam)

I just got done checking my sources and here what I know and I will quote:

Will ShadowShopper.com ever send a job to me via regular mail?
Never. We will always contact you via email. If you do receive a letter in the mail claiming to be from ShadowShopper (with a realistic looking logo) and asking you to mystery shop by cashing a large check THROW THAT OFFER AWAY. It is a Nigerian check scam ring pretending to be Shadowshopper. The scam is run out of Canada and the UK, and the check will bounce. Remember, ShadowShopper provides you with hundreds of job opportunities, and for your protection, we do it only via email and our website.

[via Common Questions]

It is a Scam to send you money Via the postal mail and that is why you must not believe what you get in the mail. This is in response to someone telling me they got a check with a different name but for the same reason to cash the check and send money to them.

[ad]

If anyone has any information they would like to add about this by all means talk about it in the comments. I want to hear where the check cam from or who sent it. You should also check out my other article about Nationwide Marketing that is also a Scam.

WOW:Chamber of Secrets might have a Copyright issue on there Hands!!

[ad#ad2-right]

At any rate, the quest is called Chamber of Secrets and asks you to investigate the Servant's Quarters of Karazhan for a new NPC (possibly boss). [via Curse.com]

So I sit here thinking how interesting this could be!!!  WOW is having a quest called "Chamber of Secrets".  Now I don't know much but this might infringe on Harry Potter's Book Chamber of Secrets?  Would someone like clarify me this point.  I'm going to keep my eye on this one!!!

• The Reward can be found at Monster Slayer's Kit


• Quest is probably going to be on nod Castlevania series

What's with Google trends?

Having been going to the Google Trends and keeping watching.  I am starting to wonder something?  Take a look at this and you tell me?

[ad]Can you see how someone might use this to create a Goog-411 and use it to promote there website? It is all about the hits and getting what publishers like to say the eyes on a website. Now is that going to confuse people or make people not want to come to a site.  So how would people abuse this?

Very Simple, they'd watch what is trending and post accordingly.  Now you as a reader would click on the website expecting to see what you want to see but instead it would popup with advertisements and maybe malware?  Check these links to better understand it:

• Skype isn't always safe!


• Some Important programs to prevent yourself from having viruses and Malware!!

[ad]
Now even though these are just a few.  You can see how someone might want to abuse it and get there site up on Google trends and be able to infect several to even millions of computers before Google sees that or stops.  You could in theory take over a website high in Google rankings and do exactly that.

Then I have to ask myself, why would hackers want to do it in the first? One they'd be able to direct people to sites that they could use to phish your information, or maybe make money by you going to these sites. It is all about money, I don't say that lightly, but it seems to always be true.

So what is Google doing to prevent this? is it right to use Google for your advantage? Do we need it for anything other than to see what people are looking at? Is that a form of them tracking your every click.

[ad]
Are you comfortable with them keeping the list of what people searched for last year? if you don't believe me, go check it out yourself. These are important questions to answer and should be explored.

5 ways to improve your chance of getting hired.

Having seen the economy this week, I've come to the conclusion that it is time to redo all the important essentials and get all my ducks in the order as they say.   I've been thinking of how best to be ready in case the dreaded day comes when my employer no longer needs my assistance and what could I do to be prepared.

[ad]

• Get Someone to Critique your Resume -- This is the most important step because this is the first place employers look when they want to hire someone.  So how do you get it critiqued?   Here are some good links to help you start off with:  Careerbuilder Critique, Mind of Root Peer Critique(Last until Oct 30, 2008).


• Have your Resume Ready to upload to Resume sites --  You should always register at all the important resume sites just in case.  The Sites that I recommend are : Monster, Career Builder,  Hot jobs, Dice, US jobs, Best Jobs USA, Computer Jobs, and Nation Job.


• Use your website as a place to put your Resume -- Have your resume available in case some contacts you and tells you they know someone who is looking to hire people.  Have this resume hidden and only give it out to people you know.   This is also known as networking.
  


• Network as much as possible --  There are sites out there that have made it easier to network.  Sites like linkedin.com, this site is great because of the 6 degrees of possibility as I call it.  You know someone, they know someone, and then you will both know the same one!!   This also will greatly increase your chance of an employer finding you.


• For those who want to be Self employed --  I wanted to say that most people who want to be self employed know just how hard it is to begin with.  So I've got some interesting links to help start you on your way.   First link is Technibble.com Computer Business Kit,  This has Maintenance Sales Letter, Work Order, Marketing Analysis and Payment Overdue Letter. It is also a good idea to have an MP3 Advertisement that you can give to podcast and throw them the link to it.  You will need to market yourself to the public in ways that no one has thought of.   You will on an occasion have to spend money in order to get money, it's always been that way but it seems to work.

These are some great tips that will greatly improve your chances of landing that job or becoming even more chance of you making money.   If you have any tips or want to suggest ways to improve upon these tips please email me.   If you like what you see discuss it on the blog or click on my ads to help offset the cost of this blog.