Rogue Fake Codecs on the Rise

Panda Labs has been talking about Adware/VideoPlay and they are seeing a lot of variants on this.   They even play a game, find the difference in the installation screen:



Now as you can see this look to be the same agreement in all those difference installation.  Some things to consider Never install any software from a website that you don't know Nothing about about.

Panda Labs also talks about these new variants in regards to what they do:

This file spreads by making copies of itself in the removable drives and it also creates an autorun.inf in order to be run when they are accessed. This file collects the data stored in the browsers, such as cookies, passwords, profiles, email accounts, etc, and connects to a remote address to send the information.
[Via Panda Labs Blog]

[ad#ad2-right]As you can see this makes you have very little security with your system.  I talk about Identity theft, and why you should always worry about your identity.   This however will make your passwords less secure and maybe even compromise you system to the point of having a data breach.   You need to be careful when you come by this, some fake codecs have been know to be scareware.  In which, the fake codecs installs a Trojan to tell you have a virus and try to make you buy a fake program to get rid of the Virus.  In one of my recent posts about Codecs and Facebook, I talked about the K-Lite Mega Codec Pack and how that will prevent you from installing these sociable links from friends and family.  The nice thing about this pack is it install all the really good codecs that you might come across on the web.  If you have this installed and there's a website that says you need a special codec, you'd know that it is either a fake codec or the author who made the video doesn't standardize.   In which case you will be more willing to leave that site without installing that codec.

If you follow these steps and also consider installing an Anti-virus and Firewall, you will be in a much better shape then when you first started out. Remember only you can prevent from getting a virus. You should also consider doing the registry edit that will prevent Autorun. As you can tell these new variants also are spread through USB and other removable media. This is the other way these programs are using to infect other systems.

You won't make money from W32:Sality.ao

People should be cautious of the making money because there is a variant out there trying to leverage the users into thinking they can make money.

McAfee Says "W32/Sality.ao is a parasitic virus that infects Win32 PE executable files. It infects files (*.exe and *.scr files) on the local, network and removable drives by overwriting code in the entry point of the original file and saving the overwritten code in its virus body. It then appends the virus body to the host file."

Aliases for this Virus is:

• PE_SALITY.JER (Trend Micro)

• Virus.Win32.Sality.aa (Kaspersky)

• Virus.Win32.Sality.y (Ikarus)

• Virus:Win32/Sality.AM (Microsoft)

• W32.Sality.AE (Symantec)

• W32/Sality-AM (Sophos)

• W32/Sality.AE (Norman)

• W32/Sality.AH (Panda)

• W32/Sality.AK (F-Prot)

• Win32.KUKU.a (Rising)

• Win32.Sality.OG (BitDefender)

• Win32/Sality.AA (VET)

These links should help people understand it it.   You can visit my Malware Resources to help remove this virus.  Something to consider before removing this is to disable your restore points.

Remember there's no easy to make money, the only real way is to work hard.  According to my research the Anti-virus companies have ways to remove this virus and as long as you update your database.

Being a Bad BOT!

I had the strangest thing happen today, Seemed a Bad Bot was Crawling my pages. I was getting at least 60 page views an hour from this bad Bot!! The individual IP's of this Bad Are:

65.208.151.112
65.208.151.113
65.208.151.114
65.208.151.115
65.208.151.116
65.208.151.117
65.208.151.118
65.208.151.119

[ad#ad2-right]After the first initial hour of this going on, I started wondering what this bot was doing.   I did some more research into this little bot.   I did find out it is owned by Kintiskton LLC.  (Twitter Search)

Anyways It bothers me that when you do a Google Search for this company, it comes back with no company.  Some people have already did there research and have come up with very little.

I dug even more and some are saying this might be Homeland Security, and I have my own thoughts on this.   I might be paranoid myself but if there is no company out there and the IP keeps coming back, I assume it is BAD mojo.  Some people worry that it is a hacker probing for vulnerabilities and that worried me.

I decided with the Help from Godaddy, to ban the lot of IPs.  I figure someone is trying to get information or trying something they shouldn't, I'll stop it myself.   If you have Wordpress and are also having problems with this ip, you can ban it by adding this to your HtAccess file:

order allow,deny
deny from 65.208.151.112
deny from 65.208.151.113
deny from 65.208.151.114
deny from 65.208.151.115
deny from 65.208.151.116
deny from 65.208.151.117
deny from 65.208.151.118
deny from 65.208.151.119
allow from all

This is how you block those ip in the HtAccess file. Thanks to Wordpress for showing me how.

PDF Zero Day Vulnerability in the Wild

From sources all over the internet, Adobe made a sent out a Security bulletin yesterday:

APSA09-01 (Buffer overflow issue in versions 9.0 and earlier of Adobe Reader and Acrobat)

[ad#ad2-right]A critical vulnerability has been identified in Adobe Reader 9 and Acrobat 9 and earlier versions. This vulnerability would cause the application to crash and could potentially allow an attacker to take control of the affected system. There are reports that this issue is being exploited.

Adobe Plans on patching this March 11, 2009

and According to some other reports are saying:

Symantec Security Response has received several PDF files that actively exploit a vulnerability in Adobe Reader. We are continuing to remain in contact with Adobe on this vulnerability in order to ensure the security of our mutual customers.

[via Symantec]

With PDF files being used all over the business world, this will create undo problems with the IT Field.  This also could be used to make Botnets and make the network involved become sluggish.   It must be warned that there are a whole wide variety of possibilities that could be done with this exploit.  Shadowserver Foundation recommends disabling the Javascript in your Adobe Reader.  Until the patch comes out you will need to be careful on what you open up and possibly check each and every PDF with an Anti-virus.  This should help minimize the likely hood of getting a virus or Trojan, but is not going to be a 100%.  The only way you can prevent a 100% right now is not to use PDFS until they have Fixed this problem.

Careless Facebook profiling can lead to Identity Theft!

I just got in contact with a old friend from High school and another friend of mine suggest the new friend. I was looking at her profile and couldn't believe what I saw:

As you can see this is not good I was amazed at how many people are giving out there birthdays and who they are married to to friends and family. So we heard about how people are claiming they need help or are in need of desperate money. This is nothing new, as you know people are having hard economy times and people are using the social engineering to scam people out of money.

I feel that I should warn people the important necessity.   You shouldn't be broadcasting your DOB and who your married to to your friends, just in case they get hacked.

Recent activity indicates that identity thieves are hacking into trustworthy profiles before selling on the login details to interested parties. This information is used by spammers to target legitimate users, posting misleading links on their "walls" – personalized message boards.

[Via Computing.Co.UK]

This deservese a little mind and a lot of understanding.   By the spammers hacking into facebook accounts they have the chance to scam or spam people with links to possibly have a virus or trojan installer.

[ad#ad2-right]For example This one blog talks about the Virus:

Symantec's Norton Antivirus software has flagged this as a "high risk" Infostealer.Gampass virus. More info on this particular Trojan vius is here. (Note: Symantec warns the risk level is "low," since it originated in 2006, but this new Facebook email is a new iteration of the same virus.)

You might be inclined to click on this link because it's from a friend, but they did not intentionally send it to you -- and yes, their Facebook photo is attached, too.

[Via Sync-blog]

Now I went searching through my friends list and also found this little bit of information.  As you can see this one is asking for people to use there account to scam people out of money.  They could use this to find out even more information of the Other partner and make you believe your talking to the real deal.   Saying they need money because they are stuck over seas or something like that.   I've seen this on other blogs where people have sent money to "friends" but are actually people who are the scammers.  Then if you send the money you are out of luck with your money and possibly your friends to.  I am sure there are more but this is prime examples of what you shouldn't do and why.

So what can you do to prevent Identity Theft and/or being scammed?

[ad#cricket-right-ez]

• Roboform Review — A Password Manager that will help protect your passwords from key loggers and other such phishing sites.    I strongly recommend it to to all who are security minded. (Never use the same password for all your accounts)


• Are you worried about your identity? -- This is good information in checking out sites that might be questionable.  You can find out what type of site it by using your brains.


• Old Phish Become New again -- This is blog post about twitter and what may happen if you did give out your password.   This is a good example of why you never should give out your password to third party websites.


• Twitter Spammers a getting more smarter -- This is also good example of what happens when you see become friends with someone who isn't real.   You could be the next to be spammed and/or impersonated.

If you follow some common steps you to could prevent from being the victim or getting your Identitiy stolen.   Some things to remember is Never tell anyone your Birthday the whole date like someone did on twitter a few days ago.  It's nice that they are growing older but that gives people that much more information to use to steal your money or your idenitiy.   Think before you give out any personal information like Age, Married, who your married to and anything that might be used to be able to access your account or your impersonate you.  Remember only you can prevent from being scammed or lossing your identity, you wouldn't want to have to pay for your mistakes.

PolyMorphic Win32:Vitro Most Viraulent Virus

This seems to be an virus that is getting some people hit hard.   I wanted to blog about this because of the nature of Virus and Trojans.   I have read reports that this might be from Online Movies, and I have to say this is one reason why you must stay away from certain online movies.  I am going to take a guess that this virus requires a special CODEC, and you downloaded it and installed it.  It Could also be the update the Adobe Flash player idea to but still results in getting the Virus.

As I said before you take a risk when you go to sites you don't trust or know anything about.   You also should know that if you need a "SPECIAL" codec, you should just go on to another site.  These sites that claim they need this special codec means only one thing they want to install something without your Knowledge.

So what is this Virus:

The Virut family of viruses uses polymorphism to hide from all anti-virus protection, it infects executable files. File infection makes it very hard to repair a system that has been infected. W32/Vitro injects code in running processes and hooks the following functions in ntdll.dll which transfers control to the virus every time any of these function calls are made.

* NtCreateFile
* NtCreateProcess
* NtCreateProcessEx
* NtOpenFile
* NtQueryInformationProcess

[via Avast Forums]

After you get this very bad Virus you are done for.  You would need to install the Operating system from backups or even start a new.   This seems to be building this week and there isn't much you can do once your infected.  I do recommend a good Anti-virus and Firewall but that wouldn't fix the problem right now.  You will need to pull your backups out and start the process.  I suggest a complete wipe and then do the Restoring the backups.  This little virus likes to infect any .EXE it can so just restoring the Windows Directory will not help.  Remember only you can prevent from getting infected.

Tech Journalist breaks the silence -- Journalist got Pwned!!

It was another ordinary day for this tech journalist. He had just waken up from his lovely dreams and hadn't realized that he was being baited with Phish. Yes that is correct he actually gave out his password to an Phish site and didn't know it.

I have to admit that he didn't hide it, in fact he decided to post about how he got Pwned and what happened.

The Face Of A Facebook Phishing Scam
[Click Picture to see the full story]

[ad#ad2-right]As you can see the site : Facebookcom.awardspace.com is a phishing site and should never give out your information to third parties.   Some things to remember if you get an email with a link sometimes won't send you to the real link.  This can be easily done just like blogging.  You don't know where you will end up when you click an email link.   One thing to remember is if in doubt log into facebook the old fashion way and see for yourself.

You could be the next person to have your Identity taken away from you.  So what should you do to prevent this type of phishing attacks, assume any email you get from Facebook, Myspace, Twitter, and Any other Social Sites to be a possible phish email.   These are always going to be a problem for these sites.  The spammers want access to be able to spam your friends and family with links, or to make you look foolish.  This is the reason they do it for Money or just for laughs.

One thing to remember is having a strong password will make it that much harder for you to be phished because if you can't remember it you will be more careful.  I will keep preaching this having a good Firewall and Anti-virus will also prevent you from getting viruses from these type of phishing attacks.  It will also make it much more harder to go to sites that smell like Phish.  Remember only you can keep your identity a secret.

Figuring out the Hole for The USB Cricket Card? UM100C

So you bought and you see:



You probably wondering what that can be used for? Here's what I know and from what I found out. That little can be used as an external Antenna. You could also use this to boost your signal and be able to use this for places that might not be getting a better speed upward and downward bandwidth. You see it all depends on where the Cell Towers are. Although this will likely help those who are either 1 to Almost Zero signal, it will not help those who are outside of the network. It might help and it might not, it depends on the location your at and the closest coverage area. If your on the edge of the coverage area and you buy this antenna it Should boost your signal and get you a better speed. I will not say it will help but in theory it could help. If you want to find out the other post that I have done on this subject please check my Cricket tag for more information.  Although it varies on person to person, and region to region this is going to be a variable that will always remain in the grey.   Only way to find out is to try it.

Internet Security Companies Warn about Patch Tuesday and Valentines Day.

With Tomorrow being released some very highly rated Remote Code Execution to become Zero day in very short time. Some researchers are speculating about more viruses will be released in conjunction to Valentines day. According to this one post it will be likely to be E-cards being sent to try to lure you into downloading Malware.
[ad#ad2-right]

Various security vendors, including CA Inc, MX Logic Inc., Trend Micro Inc., and Panda Security, have issued alerts about new Valentine’s Day-themed spam campaigns that try to dupe users into installing the Waledec bot.

Researchers note that many websites which are affiliated to Waledac e-card scam have been recently updated with content based on the Valentine's Day theme.

Web sites distribute Trojan files which are commonly named love.exe; onlyyou.exe; you.exe; youandme.exe; and meandyou.exe and the list is not exhaustive.
[Via Express Buzz]

So which ones will likely be the exploits they will use? I have a few theories on that and One of them is the INTERNET EXPLORER vulnerability that will be patched and will try to get you to launch the link and will most likely try to launch it in Internet explorer, That would be my guess.    It seems to be Internet Explorer 7 and Below which will be patched so if you want to try out the IE 8 Beta,  You should be safe on that.  Although the best bet is to prevent users from clicking links in emails and also warning them not to open any attachments they are not expecting.    I'd also have the AutoPatcher ready to install the lastest patches for this Tuesday and schedule a time this week to update all the possible systems involved with the Databases.  Although this isn't one that tries to steal your data it is however a chance the writers to look at what you have and you know how that can be call a data breach.   So if your the IT for the department I'd suggest sending out warnings so they can keep from being caught with their pants down.   I'd also suggest having Anti-Virus and free Firewall installed on all the major systems and it wouldn't hurt to have the installed on minor systems if at all possible.

ThePirateBay might be blocked in the US

I was looking around on Google and thought I just for giggles check out the Piratebay complaints. I tried going to the site and here's what Popups:



[ad#ad2-right]I tried on OpenVPN and my Local ISP, It keeps saying that. I then tried on my Cricket Modem and it tells me the connection has been interrupted, like something stops the connection in the first place. I can ping it and I can Tracert the Site but I can't even view it. I would like to know if Anyone else is having this problem also. Although I've not checked Thepiratebay.org complaints for quite some time because I've been so busy with my website. If you want to watch your favorite shows check out these sites like Hulu, CBS, NBC, ABC, ABC FAMILY and TNT.TV for free. I am just curious as to what happened and does this have anything to do with Net Neutrality?   Anyway I wanted to talk about this and see what people are saying.  Anyone know what is going on?  Let's talk about this and help everyone by saying what you know.   I don't know if Thepiratebay.org is down but I do wonder if someone is preventing people from getting to the website.   I'll update when I have more information.

Understanding Adsense for the Beginner

So you have a website and you'd like the site to pay for itself. That can be arranged it however depends on your website performance. You see you won't make a lot of money if you don't have several things going for you. I thought I share with you my experience with making money through Adsense. As you saw, I made enough money to pay for the website for 5 years. It isn't hard to make money it is however very difficult to keep getting the money. Most people don't know the tricks to making money with Google's Adsense.

I'm here to help you out a little with understanding it and getting even more money from your adsense.   So here we are 3 months into to putting Adsense seriously on my site and let's take a look shall we:



As you can see I started off quite slowly as I figured out how to best do it but gained momentum after that.    First Month I made $17.19 and the Second Month I made $45.57, the last month I made $64.99 totaling $127.75 leaving me with 16.75$ from the few previous months that I tinkered with Adsense.   So where do you start?  I found that to be the hardest part, because of the complexity of where I could put the ads.   I tried having strips breaking up the text in my blog post that really didn't get me hardly any clicks.  Then I started to incorporate the Adsense into the posts.  I learned how to do it through a great blog post and I'll talk about that later.   Here's what you need to know right now though:

[ad#ad2-right]
• Create good content --  This goes without saying that if you don't have good content people will never find your site.   There are a multitude of ways to create content.   Some of the most useful for me is How-to, finding a Niche, and Also just blogging about what you passionate about.   These will often draw people to your website.


• Gjaylaramieet people to link to your post --  This will help with search engines because they do some math to figure out if your a real site and how trustworthy your site is on the internet.


• Use Microblogging --  It is well known people use Twitter, Friendfeed, and others a like to tell people what they post about.   It can be great place to help promote your blog and get people to come more and more to your site.


• Try not to annoy the users with Ads -- This is the most important if you want people to come back to your site you should make sure you don't send people away from your site.  People will not want to come back if you annoy them to much.   So it is essential that you keep them happy.


• Find a good blog theme -- A good theme helps bring people to your site by making it easier to read and find what they are looking for.  You might also consider making a sneeze page to keep people coming back to your site.  This will help your readers and make it more of your own.  You might also want to buy a theme for your blog sooner or later.

With These tips and tricks you too could be on your way to having a great blog.   I would be willing to bet that soon I will be triple that amount if I keep up with what I am doing.   I hope you tell people about this blog and let people know how good this blog is for you.   Remember only you can prevent virus infections.

The End of 2008 and the Beginning of 2009!

With the beginning of 2009 coming close I want to talk about what posts were the best of 2008.

Top Posts

Avg detected Trojan Horse Generic 12.htc	2,334
UPS expected to layoff people also	1,612
The Clues of the Ages Unlocked!! Aug 4-8	1,179
GTA 4 Causes fatal error mma10, how to f	972
Scam ALERT: NATIONWIDE MARKETING!!	870
Tips and Tricks to Shut down Windows Vis	747
Microsoft released KB960714 to fix THE I	657
Clues of the ages unearthed! June 28 - A	626
Rumor: GE to be the next to layoff its w	553
Cricket USB UM100 Broadband Wireless Mod	525
Ways to improve Battery Life in Vista	503
Spying on Spyware.ISpynow!!	461
Network Connectivity and Vista's TCP/IPV	445
You can do more with Steam and Half-Life	443
Some Important programs to prevent yours	429

What people searched for to find my site:

trojan horse generic 12	850
ups layoffs	656
spyware.ispynow	574
kb960714	525
ups layoffs 2009	359
a flake mop thing	315
hungry dog ado	277
win32.zafi.b	220
oh salt rag toy	195
ups layoff	186
nationwide marketing	185
win32.netsky.q	183
hulu clues	181
ge layoff	166
kb961051	143

These were just made the last few months as I kicked it into gear and have gotten so much experience in blogging. So other things that will help you in my blog are:

• Malware Resources


• My Amazon Store

Ways you can Follow me:

• Friendfeed


• Stumbleupon


• Seesmic


• Mixx


• Disqus


• Ustream.tv


• Twitter

I'd like to thank all of you for joining me in an awesome year and I can't wait for next year.   I also like to thank my all the people who have subscribed to my feed.  I am hoping in the coming year we have even better content.   If you have any suggestions by all means throw them my way and I'll consider them.

Upcoming CES 2009 -- Juicy Stories

So we are getting close to CES or Computer Electronics Show to some.  This is going to be a very interesting year, due to the depressing economy.   So I wanted to talk about some of the upcoming announcements at CES so people could get ready for the upcoming 2009 Show:

• Skype will announce free US and Canada calling to cellular numbers or land lines.  This will undoubtedly be an Ad supported service and have a limited amount of minutes per call.  This will be good for people on the road who need to make a quick call here and there without having to pay for anything.  They have given some of the tidbits out already but I can't wait to find out what else they will announce at CES.


• [ad#cricket-1-1]Windows 7 Beta -- People seem to think they will release the beta the same day they announce just like they did at the PDC(Professional Developers Conference) and also give it out to people at CES.  Although that might work to a point it will be very hard for people to get in the BETA.  There is a list brewing of people wanting to get onto the beta in the Microsoft Connection Community Site.  I can't wait for next month but I am sure it is going to be nice.


• Windows Live Beta -- Here is another Microsoft product that might also be combined with Windows 7, it is a possibility and might be intergrated into Windows 7 for some but I am not sure what will happen all to much.  I am sure they will announce something about this at CES and only time will tell.


• IE 8 Beta -- Although this isn't something unexpected.  It however will be interesting to see how they throw this one out to testers because they will undoubtedly test it on Windows 7 and they will be sending these out in the same time.   I think they will be also intergrating this into Windows 7 Beta release as if it will be on the new system.  I do not know what they are going to do but I am sure something will happen.

[ad#ad2-left]This is just a small bit of possible out comes, and there is still more to come.  I wanted to point out that these are not confirmed and should be considered as a rumor nothing more nothing less.  Don't put to much money on what will happen to much.  We do know that the Betas are probably going to come out due to Microsoft announcing these to be out by the first of year.   Only time will tell for what will happen in the coming year though.  I can't wait to find out what happens.

You too could win!!!

As of this morning, I've found out that I will have a shared hosting account from Geeknewscentral. I want some help coming up with ideas for the website. I decided I will use a survey. If you have been wanting to blog but don't have the experience and wanting to get your feet wet, Fill out this Survey!! You too could have you name on my blog as an author to a blog post!! If not still fill out this survey.



Click Here to take survey

I will choice 2 people Randomly from this survey. Enter to win contest!!

Survey Ends June 20, 2008 at 12:00 AM

Best of Tech-linkblog

So I've been thinking of what do next with the blog. It suddenly came to me, review what I've written and explore some my help posts and see if I can't get even a better blog post going!! I've been so busy with a bunch of areas here are some things to consider:

You Can do more with Steam and a Half!

This is one of my favorite post because it talks about hacking, err better not say that, using the command line for steam and make Half Life 2 more enjoyable. You see I've had problems with IGFX and Half Life 2. So I decided to tell people how to fix it, and People are constantly coming to my blog to read this article.

[ad]

Wolfenstein:Enemy Territories and Vista saying it Stops responding.

This little Article was those who were having problems with Vista and Enemy Territories. I created this article to also help people play Enemy territory multi-player game. People also come to mine to look at this one. Also it seems to be very popular with people wanting to know how to get some old games to work with Vista.

Some Important programs to prevent yourself from having viruses and Malware!!

So I was getting inspired on this one. People were having problems with this little skype text and some bot trying to trick people into thinking they had a virus. I decided I would write this page to better make people aware of other ways to find out if you had a virus. There are some good tips and suggestions on this one.

[ad]

Ways to improve Battery Life in Vista

As you can see I've done my research on this one. I've got a laptop with Vista Premium on it and have gotten my battery life to be to be extended to last around 2 1/2 hours. Not all the good but it is really good for those slightly long drives and other such things. I hope people find this as informative as I do.

Skype isn't always safe!!

This One was because of Alertscan on Skype trying to do what other scams do. They want you to install software and malware. So I did a post on this one as well.

I hope you enjoyed these post and soon there will be more. I've been doing some research on Vista SP1 and will have tips and tricks it also. Until Next time. (Same bat channel, same bat time!!)

[ad]