Win 2 10$ Amazon Gift Cards!

Another chance to win!

Last month, I gave away two Pairs of eyeglasses. If you weren't one of the lucky two winners, you can still enter this contest. So it is time to give away something else for this month. I've decided to give out two 10 dollars gift cards. This will be an easy to enter and you will also help me in the same process. Like last time, I will be using Random.org to find those two lucky people. So here are the rules!

Rules for entry!

First way to earn 10$ is a simple one. Just sign up for my Mailing List, nothing else is required. If your already signed up, your automatically entered into the running of the first 10$ gift card. Just sit back and wait!

The Second way, Is to tweet:

How to Win a 10$ gift card go to: http://bit.ly/iXi2iA #paulstechtalk #giftcard #free

You may only tweet this once per day, I will be watching the tweets if you start to spam people on twitter, I will know. So don't do it to many times, or your will be disqualified for the 10$ gift card. The more you tweet the better your chances are at getting the prize, so tweet 30 times and you could be the winner, that is tweet from 06/14/2011 12:01am EST to 07/13/2011 11:59pm EST and I will be watching. Good luck to all the people who enter and We will see who winds next Month!

If you like me to give out even more from Amazon, please bookmark the Amazon link and use that anytime you shop at Amazon and that way I will be able to give away even more cards down the road.  For your convience, you can use this bit.ly url to buy from Amazon:

http://amzn.to/jCdF1y or http://www.amazon.com/?tag=paulstechtalk-20

Anytime you use that link, I will make a small amount off the sale of anything you buy that day.   So the more you use it the more I will make and in turn be able to give away even more stuff from Amazon!

 

Good Luck to All That enter

Paul Sylvester

Twitter Spam attempt: "See the NSFW pics twitter deleted from my profile here"

Looks like this might have been a improper adult content or maybe a Malware attack:


[ad#cricket-right-ez]If people are wonder what NSFW means:

Not suitable/safe for work (NSFW), not work-suitable/safe (NWS), or not school-suitable (NSS) is Internet slang or shorthand. Typically, the NSFW tag is used in E-mail, movies (such as on Youtube) and on interactive discussion areas (such as internet forums, blogs and community websites) to mark URLs or hyperlinks which may be sexually explicit or include audio containing profanity, helping the reader avoid potentially objectionable content.
[via Wikipedia]

It looks like this was done with using Tinyurl and has been flagged for either Spam, Fraud, Malware, or Any other use that is illegal. I am glad Tinyurl did catch this and stop it. If you see something that say NSFW in your twitter account your best bet is to delete it and go on with your life. I am sure it is something your should not go to probably because it was a malicious way to get your to go to the link. If you want to preview the urls that are used by Tinyurl, just visit the preview feature. If anyone else hears of some kind of Twitter attempt let me know and I'll blog about it. This would be the best time to install [intlink id="2205" type="page"]Free Anti-virus and Free Firewalls[/intlink] to help prevent from getting Viruses or Malware.

Is Google the ultimate news source?

As you know We had a big problem Monday Night and All day Tuesday. If you are a regular reader of this blog, you would of noticed either a 503 or lag. It was due to an article that I released late Monday night about the PIFTS.EXE and the so call conspiracy.

At the time, I was wondering and quite disturbed about what Norton Symantec was doing to the forums. So I blogged about this and wouldn't you know my site was Held Hostage by Google. I kid you not, I had so many people come to my site in under an hour it wasn't even funny.

[ad#cricket-right-ez]So I sit here, asking a really good question is Google the News? I don't know exactly when but according to Wikipedia Google was formed in 1998. The Google Motto is Don't Be Evil, and I guess it makes them look like a news source. When did they get past the news site? I would hazard a guess that it was in late 2004 they started when they when Google gave people the first chance to own the stock on August 19, 2004, when Google became a publicly held company.

I got hit hard by Slashdot, Reddit.com, and Google.  In truthfulness, It was more of searches and people coming from Google than anywhere else. I would say Google was the 90% and and Slashdot and Redidit was 8% and the rest was from other websites for this one article. Now don't get me wrong the 2% of people was my normal amount of people for the day. So you can imagine how many people actually came to my site over this fiasco.

I call this a fiasco because basically it was one that really made me worry about the server going down. People seemed to try to find out about this program and some of them didn't even do any more research than to come to my site? Although I do know a little, I have always considered myself to be a BLUE COLLAR Tech Blogger. So you can just call me "The Blue Collar Tech Blogger" when it comes to things like this. I will never proclaim I know everything and I am still learning every day I blog I learn something new.

So this leaves me with a question on how did Blogs become the news also?  Did we step into the roll of news?  I know there are many blogs out there that are telling the news and are almost as if they are the news.  Is that where this has become Web 2.0?  I throw these questions out to see what type of comment.  I just thought this was a good topic for today to talk about.

Thinking back to PIFTS.EXE.

Thinking to this very incident looks to something out of the movie "Lemony Snicket's A Series of Unfortunate Events".  I won't go into much detail but here is what I want answers to about the PIFTS.EXE.  You see after I have read a great article talking in detail about this, I have also come to the conclusion something isn't right.

[ad#cricket-right-ez]The blog owner known as Anshar in the forums on the Symantec points out some key events. He wanted to point out that the users who were posting were not violating the TOS and was posting questions that look to asking about this file. See screen capture of what I took. This one picture doesn't prove his theory in whole, but does bring up some suspicions. This actually might be them trying to find a 'scapegoat' so to speak. He also talks about what others are asking? What is PIFTS.EXE? People seem to still have not be answered that question.

Although, in Norton's defense there seems to be a lot of information that they have to sort through. I'll admit this information people are asking should be really simple to find in the Symantec Databases somewhere. I will not say they are hiding anything major but I do think something is going on that we are not aware of. Here's some other thoughts to considers? If Norton needed to find out who was using Windows 7, couldn't they of asked or even made a simple site redirect to find that information, after all anytime you visit a site you have that information sent to the stats. I could in theory find out how many visitors are visiting from Macs and how many are on older systems. That would be very easy to do with Google Analytics.

Now with that said let's talk about Why it took almost a whole day for them to release a public statement about what happened.  I might be wrong but if I was a stockholder, I'd of demanded them to send that out ASAP instead of waiting 20 to 24 hours.  Although I'm not trying to make any more conspiracy theories, I do think the Streisand effect came into effect and people are feeling like Norton did something they shouldn't have.  In which case, Norton probably made "A fail whale" attempt of making it better when they started to delete the post.

I've been watching the Norton forums trying to make sense of all this, and I do know that Norton have lost people's faith in them and people are removing their product off there systems if Norton doesn't start answering questions that need to be answered.

Norton has released the information of PIFTS.EXE and what it does. Although I am sure people are going to argue about what it does or doesn't. I wanted to post this for people to check out and consider for yourself.

Fake Scareware Sites Popup after the Pifts.EXE Conspiracy

There Seems to Be a Fake site that are popping up today right after what happened with PIFTS.EXE. I just happen to Google it to see what people are talking about and this appears on the front page.



As you can see this leads to a server in Poland and once you go to it you see:

I will be reporting this to Phishtank. This is scareware which means  there is no real VIRUS because and you
Should never believe the screens when you see something like this. According to Wikipedia:

[ad#ad2-right]Some websites display pop-up advertisement windows or banners with text such as: "Your computer may be infected with harmful spyware programs. Immediate removal may be required. To scan, click 'Yes' below." These websites go as far as saying that a user's job, career, or marriage would be at risk. Products using advertisements such as these are often considered scareware. serious scareware applications qualify as Rogue software.
[Via Wikipedia]

So if you are worried you have a virus or think you have a virus I would advise you to download one of the free Many anti-virus software and firewall. This is nothing new with the companies who are doing this but don't buy anything because people are trying to scare you into thinking you have a virus. That rarely is a valid software and you should use the ones that you trust. If you find a site like that please report them to Phishtank and other sites that way we can protect everyone who goes there.

Getting to the A600 Program Files

So you want to see this screen when you plug in the A600 Broadband Card:


[ad]But doesn't pop up! I found out why. If you installed it one time or another and had a problem with the installation and it won't pop up with that screen. You'll need to take this first step:

Uninstall THE USB DRIVERS for A600
C:\Program Files\Cricket\USB DRIVERS\Uninstall.EXE

Once you do that you will see need to reboot and then try to insert the A600 Modem into the USB slot. It should pop up with t hat screen or you should see the drive become available.

I've also took the drive and copied the program files into a sub Directory of the 4 Gig drive installed in the A600 and I decided to help everyone else out by uploading the self-extracting program to rapid share:

Cricket-A600-Program.exe Bit torrent file

This is the file I created on Memory card for when I need it.  If you are uncomfortable downloading this because your worried about virus, then follow the directions on how to uninstall the software to get to your Cricket software for the A600.  I did this to make it easier later on to re-install the software without having to uninstall software.  Let me know if this helps. You should consider downloading Free Anti-virus Software and free Firewalls to protect your system if you haven't already!!

Microsoft Releases the Patch Information for March

Microsoft Has Released the Patch information For march and This is what is expected to be patch on March 11, 2009:

• Vulnerabilities in Microsoft Excel Could Allow Remote Code Execution (Kb949029) -- This security update resolves several privately reported and publicly reported vulnerabilities in Microsoft Office Excel that could allow remote code execution if a user opens a specially crafted Excel file. An attacker who successfully exploited these vulnerabilities could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.  (affected System : Microsoft Office)

[ad#ad2-right]
• Vulnerability in Microsoft Outlook Could Allow Remote Code Execution (Kb949031) -- This security update resolves a privately reported vulnerability in Microsoft Office Outlook. The vulnerability could allow remote code execution if Outlook is passed a specially crafted mailto URI. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. This vulnerability is not exploitable by simply viewing an e-mail through the Outlook preview pane. (affected System : Microsoft Office)


• Vulnerabilities in Microsoft Office Could Allow Remote Code Execution (Kb949030) -- This security update resolves two privately reported vulnerabilities in Microsoft Office that could allow remote code execution if a user opens a malformed Office file. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights. (affected System : Microsoft Office)


• Vulnerabilities in Microsoft Office Web Components Could Allow Remote Code Execution (Kb933103) -- This critical update resolves two privately reported vulnerabilities in Microsoft Office Web Components. These vulnerabilities could allow remote code execution if a user viewed a specially crafted Web page. An attacker who successfully exploited this vulnerability could take complete control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.  (affected System : Microsoft Office)

These Four are all Critical and should be applied the week of March 11, 2009.  Their are Seven Patches coming out, but these are the main focus.   According to Microsoft they have released MS08-014, MS08-015, MS08-016 and MS08-017 to better help you find out which ones are affected.

Now is the time to get AutoPatcher ready and make sure it is up to date on any patches that might of came out this month that you didn't know about.  Also consider downloading the new version of Anti-virus and Firewall software while you are it.  In case you come accross a rogue virus and need to disinfect it!!  Some of these patches for this month is due to the EXCEL vulnerability that is out right now and is in the wild, so that should be your top priority once Tuesday come around.  Remember hackers will start exploiting these patches on Wensday and you will be racing against the clock.   One last bit of information for the Mac Users you should also apply these patches they are vulnerable to according to Microsoft.  I'll update as more information becomes available!!

Cracking and Warez sites are Host of Trouble!!

It is nothing to laugh at and should be understood that gamers have no freedom right now.   That said this new Variant to Virux Trojan is in regards to Win32/Vitro Trojan.  It seems tobe infecting .exe and .Scr files just like this.

According to Trend Micro:
[ad#ad2-right]

The downloaded malware include variants under the FAKEAV, TDSS, and VUNDO families. Infection chains, however, are notable for the presence of VIRUT and VIRUX malware. VIRUX and VIRUT attacks were initially about the volume of infected PCs. The numbers are massive enough to worry Web users and security researchers: around 20,000 PCs are infected per day
Read more: "Crack Sites Distribute VIRUX and FakeAV"

Now it seems to be more and more sites with getting computer infected. It also seems the Malware writers are using these servers for helping infect essentially gamers computers. So for the time being, if you have a favorite game and you want to:

• No-CD Crack (This is good for those who want to play the game without the CD)


• Key Gen Cracks (This is used for pirated version of a game)


• Update Cracks (This is used to prevent CD checking or Also prevent Version Checking)


• Game Cheats (This is usually a small program like a bot or some other way for the gamer to cheat)

And should not be Downloaded or USED!! I don't say that lightly, because Gamers feel they should be able to play any game they want. Although this post will probably make the Gamer developers happy, I do this to tell people that these virus writers are using the gamers to distribute the Virus.   I encourage all the gamers out there, that don't want to loose their games to not download any more of these types of cracks.  It seems the virus writers are wanting to infect systems and slow you down.  You don't want to slowed down do you?  Please consider getting a Firewall and a Free Anti-virus software to better protect your system.

Facebook Goes Phishing again

In one of my Previous articles about the Koobface Worm, I talked about the way they were infecting the systems and what you need not do.

It seems that Trend Micro has seen an even more rise in people downloading the WORM_KOOBFACE.AZ and Seems to be on the RISE. This is all done with a Social engineering and Has had some attempts before with this little worm on Facebook.

[ad#ad2-right]After your Infected with this new Variant, it searches for cookies and Sends out a message to people from:
* facebook.com
* hi5.com
* friendster.com
* myyearbook.com
* myspace.com
* bebo.com
* tagged.com
* netlog.com
* fubar.com
* livejournal.com

This seems to be a social engineering Nightmare for these websites and as yet are unsure what else it does but it says the same thing it did before by saying "This is a Video of You on the Street." Which is bogus but none the less people click and think they have to download a codec or update their Flash. Social Engineering is on the rise and will be taken seriously. You should read the full report from Trend on what it does but you also should have an anti-virus and Firewall installed to prevent this from happening in the first place. The only true way of preventing this is not to be fooled, you should NEVER Download from a site you don't know or trust. See all the Facebook articles for more information.

Internet Security Companies Warn about Patch Tuesday and Valentines Day.

With Tomorrow being released some very highly rated Remote Code Execution to become Zero day in very short time. Some researchers are speculating about more viruses will be released in conjunction to Valentines day. According to this one post it will be likely to be E-cards being sent to try to lure you into downloading Malware.
[ad#ad2-right]

Various security vendors, including CA Inc, MX Logic Inc., Trend Micro Inc., and Panda Security, have issued alerts about new Valentine’s Day-themed spam campaigns that try to dupe users into installing the Waledec bot.

Researchers note that many websites which are affiliated to Waledac e-card scam have been recently updated with content based on the Valentine's Day theme.

Web sites distribute Trojan files which are commonly named love.exe; onlyyou.exe; you.exe; youandme.exe; and meandyou.exe and the list is not exhaustive.
[Via Express Buzz]

So which ones will likely be the exploits they will use? I have a few theories on that and One of them is the INTERNET EXPLORER vulnerability that will be patched and will try to get you to launch the link and will most likely try to launch it in Internet explorer, That would be my guess.    It seems to be Internet Explorer 7 and Below which will be patched so if you want to try out the IE 8 Beta,  You should be safe on that.  Although the best bet is to prevent users from clicking links in emails and also warning them not to open any attachments they are not expecting.    I'd also have the AutoPatcher ready to install the lastest patches for this Tuesday and schedule a time this week to update all the possible systems involved with the Databases.  Although this isn't one that tries to steal your data it is however a chance the writers to look at what you have and you know how that can be call a data breach.   So if your the IT for the department I'd suggest sending out warnings so they can keep from being caught with their pants down.   I'd also suggest having Anti-Virus and free Firewall installed on all the major systems and it wouldn't hurt to have the installed on minor systems if at all possible.

Offline Update 5.0, Clone of Autopatcher to Some!!

Offline updater 5.0 has been released a couple months ago and I just realized it now.  This is an excellent tool for IT professionals who want to keep all your Systems up-to-date with the last patches from Microsoft.  The systems it supports are Windows 2000, Windows XP, Windows Server 2003, Windows Server 2003 x64, And Windows Vista / Server 2008.(32 bit and 64 Bit updates).



[ad#ad2-right]I find this a very useful program for people who have a multitude of problems, from not being able to get on the net to computer virus infections.  This is really good for big businesses that want to update a lot of systems in easy way without having to wait for downloads of updates to install.   You can take a DVD and update on the fly within Mins.   DVD being Cheap or buying them in bulk helps saves time and money for the company.   Less time spent downloading the updates and more time actually getting work done.  As with the Conflicker, Downadup, and to some the Conflickr Trojan, if you got infected with that little worm.  This would help install the updates that it prevented you from doing in the first place.  I also found that once you download do the update the files are kept on the hard drive so you no longer have to redownload them again.  You just update the updates every second Tuesday of the month and it downloads the newest patches and creates a whole new ISO for you to burn.

Q: How can I create the offline update CD images automate, for example via a "scheduled job"?
A: Create a new batch file in the "cmd", eg "DownloadUpdatesAndCreateISOImage.cmd". Add the desired calls of

"DownloadUpdates.cmd" and "CreateISOImage.cmd" with the necessary parameters in this new file. The file might for

example have the following contents:

@ echo off
call WXP download updates eng
call CreateISOImage WXP eng

Then set a "time-controlled contract" for the new script "DownloadUpdatesAndCreateISOImage.cmd" to your desired

time. For example, after each Microsoft Patchday create new images, select every second Wednesday of the month.

[Via The FAQ's Documentation (Translated Via Google)]

As you can see you can have it do a script and be ready for you in the morning.  You then just take it out of the drive and install where you need to install the day after the updates are issued. On another Note if you have clients who use Windows office Xp, 2000, 2003, 2007 then this will also help:



This is nice if you have clients who use the Microsoft Office Suites also.  Some Malware will often try to infect people's systems through a office script or some other vector.   So this will also prevent infections or hackers from getting onto the system by updating this also.  You can have this added to each and every DVD ISO you make to include these as you update the patches also.

Download:

• Offline update 5.0 Download site


• Official Site for Offline Update (Translated into English)

People coming from Sites that don't exist

So I woke up today checking out my sites, and looking outside.   So As I was checking my Stats for my blog.  I cam across a referring site that brought Supposedly Two people to my site.  I looked at the URL for the site:

• http://trojan.fiftystatesclassifiedads.com/index.php

[ad#ad2-right]So after seeing the "trojan" Prefix and I am wondering if this was an attempt by Malware to infect my domain.   So I go check this domain out.   I got to it and I get a 404.  I then do a Cache Check with OPENDNS.  I also Then decided to see if it was even Registered domain by the doing a Whois.  So I am opening this up to people who might know.   I did do some research and here's wha I've found out so far.

According to How2hack, they talk about how people want privacy and that it might be someone who does not want to be found.  I tend to agree with them, Privacy for Privacy sake is good but if you want to be private you would you even be checking out websites knowing people will want to find out who really is coming to your site.  The How2Hack site also talks about how this might happen and I see where they are coming from.

This was the only site I could find that even looked like it was relevant to what I was searching for.  I don't see how someone can come to my site saying they were referred by another site and that site does not exist?  Anyone want to try to answer this question and give insight as to why this would happen?

Microsoft Keynote CES 2009

[ad#ad2-right]

Some Key topics talk about in this Keynotes are:

Windows 7 -- Lighter, Faster, and Reliability. Windows 7 Should boot quicker and faster, and enables cool new interface touch.

Windows 7 -- Beta will be available Worldwide on January 9, 2009 and will be available for download on MSDN and Technet.  Also it will be available at : http://www.microsoft.com/windows/windows-7 For those who want to download it from Microsoft directly.

Windows Live Essentials -- Windows live Messenger, Mail, and Photo Gallery works with Windows XP, VISTA, and Windows 7. It is available for download worldwide. Dell will also be putting this on their consumer and small business computers.

Windows Mobile -- 11 Different Mobile phones.

Verizon Mobile --  Windows Live Search will be available through Verizon and it's a partnership with Microsoft.

Demo of Windows 7, Live, and Mobile:

Windows 7 will have Windows touch and be able to use net books with Windows 7.

Windows 7 has been designed with the Touch DNA in mind.

Windows Mobile demo with an Panoramic display.

Windows Live Demo --  Various things they discuss here including Photo's and Silver light.

Windows XBOX:

[ad#ad2-left]Halo Wars -- Strategy game and will Available February 28, 2009. The Bungie Will have a demo version February 5, 2009 and will be available for download.

Halo 3 ODST -- Will be available in the Fall of 2009. New Characters, new events and will be like Halo 3.

Various stuff about Xbox Live 360

These were just the main things that I thought was important to let people know what was mainly the important highlights of this keynote. I will recommend everyone to go and watch it for yourself, I am sure I've missed something that someone would consider very important and understand that. This however is a personal and will be different in everyone. I watched this and am excited and can't wait for windows 7 to be released so I can get my hands on this and see how it fairs with a Vista CPU and GPU. So only time will tell. I hope you enjoyed this little run down. Please feel free to leave a comment and talk about this or anything else in the Disqus community.

Disaster preparation 101 -- Data backup

In this one I will talk about Disaster, it happens to all of us from time to time. A fire, a earthquake, a stolen laptop or any number of ways. So what happens to your data, is it stored on the laptop? Is it important very sensitive data? Could you get fired if you lost that data?

[ad#ad2-right]These are all questions you must ask yourself when you have laptop. How do you backup your data or even do you have a backup? Having seen this with my own clients, I must wonder if there are people out there who just don't care. I had a client the other day who gotten a virus and this was a really mean virus. Deleted some very important files when you tried to clean the virus out. She called me in a panic because she couldn't load up windows? I asked if she had any backups, she said "what's a backup" . So I sat there discussing this with the client for over 20 minutes. Finally she started to understand, she said she had the OEM Backup DVD but nothing else. She also said she needed help with getting data off the computer. I told her that I would be able to come the next day and I was lucky the virus didn't do anything else to her data. We were able to retrieve the data from her system. That is where I start my rant , Why would anyone not have backup of there most important data?

So How do you backup your data? This is controversial and somewhat depends on how much people want to spend to keep there data safe and not loose pictures or music. There are several ways to do it, each way has it's pitfalls or short comings and requires a little more effort:

Kinds of Backup

Hard Medium - DVD, CD, External Hard drive

• Wikipedia's List of DVD backup Software -- This is good for beginners who want to explore how to backup options.


• Free Hard Disk Backups and Restore Software -- Gives you a list of great free backups and restore software to help you backup your system.


• GoodSync Backup --  This isn't free but helps you backup your software to an external drive and makes sure you have the most current files on your system.


• Some other Backup Software -- This is a variety of good backup software from Amazon.

Although,  The hard medium is usually used that doesn't mean you can have a backup other than hard.   Here are some ways to back up on the internet.

Internet Medium:

• Jungle Disk -- Provides online storage through the Amazon s3 service.   Only pay for what you use.   It works well with most Operating system.  I've used it on Vista so it is really nice.


• Carbonite Online backup --Another good Online storage.


• Some Other Online backup -- Here a list from Amazon to better help you find the type of software that you might need.

These are just a few options, if you want to look for other you can.  The important thing to do is BACKUP because if you need some data that gets wiped or destroyed.  You will be kicking yourself for not backing up.

Removing Win32/Bagle.HE worm

Here is another virus that seems to be spreading lately.   From the looks of it, it sees to be another email worm.  Here is what eset says:

Aliases

Email-Worm.Win32.Bagle.gt (Kaspersky), W32/Bagle.gen (McAfee), Trojan.Tooso!gen (Symantec)

[ad#ad2-right]Win32/Bagle.HE is a worm that spreads via e-mail. The size of its executable is 40565 B .

When executed the worm copies itself in the following locations:

• Documents and Settings\All Users\Application Data\hidn\
  hldrrr.exe


• Documents and Settings\All Users\Application Data\hidn\
  hidn2.exe

In order to be executed on every system start, the worm sets the following Registry entry:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\drv_st_key

[ad#ad2-left]It seems to have a manual removal process, Unless you pay for the other software but according to the 411 on PC Security:

Win32/Bagle.HE worm is a “threat” that appears in security scans by fake antispyware WinDefender 2008.

The danger of Win32/Bagle.HE worm is supposed to scare you into wasting $49.95 on WinDefender 2008.

Unless you like getting ripped off, don’t download the software the Win32/Bagle.HE worm popup links to. You’re not really infected with Win32/Bagle.HE worm — you’re infected with scamware that you need to remove.

I’ll show you how to get rid of Win32/Bagle.HE worm and WinDefender 2008, for free.

[via 411 on PC Security]

According to this site you can remove it by doing some steps.  I think Kaspersky has an easier way to remove it and it looks like most anti-virus software will remove this.   You need to remember that only you can prevent this from the future.   You should also update your windows update and make sure your system is up to date.

Figuring out the Email-Worm Win32.Zafi.b

This is another just I just saw on the web and wanted to talk about what this little Worm does and what it's known Aliases:

Email-Worm.Win32.Zafi.b (Kaspersky Lab) is also known as: I-Worm.Zafi.b (Kaspersky Lab), W32/Zafi.b@MM (McAfee), W32.Erkez.B@mm (Symantec), Win32.Hazafi.30720 (Doctor Web), W32/Zafi-B (Sophos), Win32/Zafi.B@mm (RAV), PE_ZAFI.B (Trend Micro), Worm/Zafi.B (H+BEDV), W32/Zafi.B@mm (FRISK), Win32:Zafi-B (ALWIL), I-Worm/Zafi.B (Grisoft), Win32.Zafi.B@mm (SOFTWIN), Worm.Zafi.B (ClamAV), W32/Zafi.B.worm (Panda), Win32/Zafi.B (Eset)

[ad#ad2-left]This worm spreads via the Internet as an attachment to infected messages, and also via local and file-sharing networks.
It is written in Assembler, and packed using FSG. It is 12800 bytes in packed form, and 33292 in unpacked form.


This Worm seems to be running through email and file sharing sites, One thing it tries to do is stop the process and deletes:
fvprotect.exe
winlogon.exe
jammer2nd.exe
services.exe

It attempts to detect antivirus program files on the computer and overwrite them with a copy of itself.

[ad#ad2-right]It also attempts to conduct DoS attacks on the following sites:

www.2f.hu
www.parlament.hu
www.virusbuster.hu
www.virushirado.hu

This seems to be a very big virus and can be removed with the use of Kapersky Virus removal tool for free for this type of virus. In order to prevent this virus in the future the user has to remember about not getting opening unknown documents or emails and not running any unkown program from an unknown file sharing.   Also remember you need to have an anti-virus  and also a firewall to protect yourself in the future.

Inside understanding of win32.netsky.q

Netsky.Q is a worm that spreads through e-mail. It is distributed as a 28,008 byte Win32 executable, compressed with PEtite, which drops a 23,040 byte DLL file. It also distributes itself inside ZIP archives.

I saw this on on the net and through we should talk about and let people know how you could get that the worm off your computer. It seems to be a self-replicating worm, it will continue to send out fake messages to people with the subject lines Like:
[ad#ad2-left]

• Delivery Error


• Delivery Failure


• Delivery


• Mail Delivery failure


• Mail Delivery System


• Mail System


• Delivery


• Delivered Message


• Error


• Status


• Failure


• Failed


• Unknown Exception


• Delivery Failed


• Deliver Mail


• Server Error


• Delivery Bot

And with each message there is the reciepts email address at the end.  This worm seems to be spreading like wildfire today.   It is because people have not install

Microsoft Security Bulletin (MS01-020)

[ad#ad2-right]Now how do you get rid of it.  It seems that most of Anti-Virus software would get it done.  All you would need to do is scan for this virus with the latest updated virus databases and will go away.   According E-Trust Anti-Virus they say they can remove it.   This is a really old virus, according to my sources this was first seen in 2004.   In order to prevent this in the future I'd suggest installing a free anti-virus and using it.    This is one smart little worm according to CA IT.


If you have quite a few Desktops in your Office and want to update all of them to the newest patch all in one swoop, I'd suggest downloading Clone of Autopatcher and making an ISO image so you can go around to each computer and install the patches quickly and easily.  Prevent yourself from getting that virus and some others in the future.   This is a friendly tip for all those hard working IT workers.

Fix Shutdown Problems in Vista!

[ad]
In the Patch Tuesday update, Microsoft quietly released the patch to fix Windows Vista machine shut problems. This patch should of came sooner.

KB957388

Update for Windows Server 2008 and Windows Vista

Install this update to resolve a set of known application compatibility issues with Windows Server 2008. After you install this item, you may have to restart your computer.

This was not a critical update and it seems to resolve so many issues with compatibility.  One thing it seemed to fix on my system has been the shutdown time.  It is now quite fast, it would normally take me 2 to 3 mins to shutdown, now it does it in less than a Minute.   So if you've not installed this update please install it soon.   I would like to know if people are seeing the same thing I am.   I've found a great resource on fixing it if you are still having problem, it talks about how to check your system performance. Although this is been doing it lately with these programs not loaded or even running, they still seem to cause problems so now I get the feeling it has to do with legacy programs.  This should fix most of the problem with older programs.

Rumor is that Itunes will Remove DRM!

[ad#ad2-right]A report from last week brought to AppleInsider's attention by French technology site ElectronLibre asserts that it's now "clear" Apple will spark new interest in its music store by removing DRM from tracks published by Sony, Universal and Warner on December 9th.

[Via Apple Insider]

Although, this is somewhat unlikely I've got my own theories on this.  You see If Apple did this tomorrow that would be a BIG deal, due to the fact that Microsoft will be releasing there patches on the same day.  I find it would be a momentous occasion.

[ad#ad2-left]I can only guess why and the guess is just a guess.  If Itune's did remove there DRM the same time as Microsoft Patch Tuesday, I'd have to guess they will co-inside because of the difficulty of using the DRM, Digital Rights Management, on other products.  For example, Windows Media Player .  If Apple decided to approach Microsoft and come up with a way to make sure all DRM is stripped this would be the ideal situation.   Although this is highly unlikely, I'd have to think Apple wouldn't wait till tomorrow to strip the DRM.  They know Microsoft schedule.  We will have to find out in the coming days.

Upcoming Patch Tuesday

[ad#ad2-right]I wanted to get prepared for the updates for this Tuesday and I thought I'd go through them and list what Microsoft said about each.   These are what's been said on Technet and I am sure there will be more.   Each one of these don't look to serious but I will post Tuesday if there is anything I've missed on this post.   As you might know this is not set in stone but just the direction of Microsoft for this Months Release.


KB955839

Update for Windows Server 2008, Windows Vista, Windows Server 2003, and Windows XP

Install this update to resolve an issue that is caused by revised daylight saving time laws in many countries. This update enables your computer to automatically adjust the computer clock on the correct date in 2008. After you install this item, you may have to restart your computer. This update is provided to you and licensed under the Windows Server 2008 License Terms.

[ad#ad2-left]KB957388

Update for Windows Server 2008 and Windows Vista

Install this update to resolve a set of known application compatibility issues with Windows Server 2008. After you install this item, you may have to restart your computer.

KB890830

Windows Malicious Software Removal Tool

Microsoft released the Microsoft Windows Malicious Software Removal Tool to help remove specific prevalent malicious software from computers that are running Windows Vista, Windows Server 2003, Windows XP, or Windows 2000. After you download the Microsoft Malicious Software Removal Tool, it runs one time to check your computer for inflection by specific prevalent malicious software (including Blaster, Sasser, and Mydoom) and helps remove any infection it finds. Microsoft releases a new version of the tool every month.

[ad#ad2-right]KB905866

Update for Windows Mail Junk E-mail Filter [November 2008] (KB905866)

Install this update for Windows Mail to revise the definition files that are used to detect e-mail messages that should be considered junk e-mail or that may contain phishing content. After you install this item, you may have to restart your computer. This update is provided to you and licensed under the Windows Vista License Terms.

I am sure there are going to be others but right now this looks like the normal things Microsoft sends out.  I am sure they are keeping a tight lid on the really serious stuff until last second so I'll have to report the really important stuff Tuesday.