How computer viruses use word of mouth to infect systems!

Social Networks Hype Cycle (Photo credit: fredcavazza)

Social Network is Culprit!

I remember some very interesting Facebook, Twitter, and other social media sites used in the past to get people to click on an infected link.  This is one of the oldest techniques.   The virus post something on your twitter account or your Facebook account about something really interesting.   Even if you trust your friend, sometimes the friend or twitter account that you know aren't really in control of what they post.   This is the first line of trust that the virus makers use to spread their viruses until other computers and systems.   You should never click any link unless you know where it is going.  Although this is becoming less and less troublesome, I am sure it isn't going away but just biding it's time to come out and strike another day.

Some tips to remember when your using social media sites are to use url expanders such as:

• LongUrl - http://www.longurl.org/


• Where Does this URL Go - http://www.wheredoesthislinkgo.com/


• Clybs URL Expander - http://www.clybs.com/urlexpander


• URL X-ray Checker - http://urlxray.com/


• Link Peeler - http://linkpeelr.appspot.com/

These are some great little url expanders that if your have a question about what the URL is then by all means use these.   I also like to use Bit.ly extensions for Chrome but it won't expand all and is only available on Chrome.   I don't know if there are other apps for Firefox like this but at least you have a starting place!

Emails are Second!

It is just like Social Networks but in this case you are getting an email to you.  A few years ago, we had some really interesting emails with either warnings or saying you have a picture on the internet to click it.  There are a dozen or so ways someone could fool you into downloading malware or viruses but these are the most common because most users will click links and they feel safe because they have built up trust.   Lately though they haven't been doing this much but it could be a very good possibly, so you must be careful!

Some things to remember when using emails, if your not expecting a link don't click it!  If your thinking it was sent to you for that purpose, it might be high time to email your friend and ask them if the y knew they sent that to you.   Sometimes the person or account involved doesn't know that they sending links that might be infectious.

If you follow these steps and consider using Malwarebytes [Affiliate Link] you are less likely to get infected but that doesn't mean that you are a 100 percent immune to computer viruses.  No Operating system is immune even Linux but that is just my opinion others  have said that you can't possibly get infected on Mac OS or Linux!

Paul Sylvester

Try Malwarebytes, the Leader in Malware Removal

Related articles

• 20% of Facebook links lead to viruses (infographic) (zdnet.com)


• Where Are You Picking Up All Those PC Viruses? Facebook (businessinsider.com)


• What Is Ransomware and How to Protect Your Computer (techtools4us.wordpress.com)


• MyCuredComputer.com Combats the Ever-Changing Facebook Virus Koobface (prweb.com)

Microsoft Get Ready for Patch Tuesday. 6 Bulletins

According to Arstechnica there will be 6 Bulletins and each of them are very interesting:

• Bulletin 1: Critical (Remote Code Execution), Windows


• Bulletin 2: Critical (Remote Code Execution), Windows


• Bulletin 3: Critical (Remote Code Execution), Windows


• Bulletin 4: Important (Elevation of Privilege), Virtual PC, Virtual Server


• Bulletin 5: Important (Elevation of Privilege), ISA Server


• Bulletin 6: Important (Remote Code Execution), Office

[ad]It looks like there will be another Directx Patch for those who have Directx 7 through 9.0c.  It also seems they will be Patching the Virtual PC and Server and ISA Server.    Microsoft will also be patching 2007 Microsoft Office System Service Pack 1.  They will also Be Releasing 14 different patches for non Critical status.

The Directx Flaw that was reported in May is reportedly being patched and that is why we have these Directx updates that are comming down from Microsoft.

So Now is the time to get [intlink id="2883" type="post"]Autopatcher[/intlink] updated to the lastest updates and schedule a time next week for you to test and install these updates.   I would recommend updating your [intlink id="2205" type="page"]anti-virus and Firewall[/intlink] software if you have any, if not it is time to get them and install them.

Using Malwarebytes to get Rid of Malware

I have been using Malwarebytes for quite some time.  I have the Installer for Malwarebytes in place on a  USB drive so i can use anywhere I go. I have seen several computers with very old Viruses and this actually detected them.

[ad]How Malwarebytes useful

• Malwarebytes has a really good protection module to help prevent infections in the first place, but that requires you to buy it.  It should never be used without at least a [intlink id="2205" type="page"]firewall installed[/intlink] but it is a good defense against what I like to call a Drive by install.


• Automatically create logs of Malware that is found -- This is good to for people who want to be able to check out what might be infected.   Also good to help identify the virus or Trojan, and find out how to uninfected it.


• Cheaper than buying AVG -- Cost $24.95 which is half of the cost of buying AVG.

As you can see buying Malwarebytes can be cheaper than buying AVG or Norton and protects your almost as if you have a brand name.   I think if a customer can't afford $50 this would be the next best thing to suggest being that it will at least protect the system.   You can always install a [intlink id="2205" type="page"]Free Anti-virus[/intlink] along with Malwarebytes to better protect your system.   This is one way to not have to buy expensive antivirus and yet still protect your systems from Malware.

No matter if you Buy Malwarebytes or use the Free version you are better off then not having it.  With the Free Version you can't unlocks real-time protection, scheduled scanning, and scheduled updating.  These can be done manually without the having any Real time Protect.   You can scan manually and Schedule manually without buying the full version.  This is still a good buy, I recommend this to all my customers.

A few Zero Day Exploits in the wild -- Heads up

Several different Security Vendors are Reporting that there is an ActiveX and Directshow exploits out in the wild.

The Directshow file in question is : msvidctl.dll

[A work around to prevent this]

[ad]It involves an ActiveX control called the Microsoft Streaming Video control and there is no workaround that I know of just yet.   Microsoft is aware of these exploits but we don't know when they will release the patches.
These flaws mean that if you visit an Infected site you will most likely install software that you really don't need or want.   You should be cautious where you go especially on chinese servers because some of them are reporting that they have seen an overnight bloom of sites that have these exploits in place.

People should take care and [intlink id="2205" type="page"]install anti-virus and firewalls[/intlink] even the free ones are the best choices right now to defend againts these types of attacks.  You should also make sure you have the updated virus definitions and make sure you have the latest version of the AV program.

It is also suggest for users to not use Internet Explorer to prevent some of these exploits but take care and install a good browser, I would suggest Firefox to better protect your computer from some of these exploits.

Hulu Days Of Summer are here again

So we have it here right now, and it starts out really good.   You can watch Stargate SG1 Season 1 through 4 the whole summer.  The last of the Mohicans was the frst movie they brought out for this event.  I rember last years one where we had to guess the coming week.  Some of the ones that I did last year were:

• Hulu’s Summer Clues Aug 11th-15th, 2008


• Hulu’s Summer clues — Unleashed Edition 2!


• Clues of the ages unearthed! June 28 – Aug 1


• Hulu’s Summer Clues Aug 11th-15th, 2008


• The Clues of the Ages Unlocked!! Aug 4-8, 2008
  

Now I don't know all that will come this summer but I would of liked to have clues like we did last year. That would of been really fun.  Oh well, I will keep watch on this and see what comes from this.   I also have been using the Hulu Desktop more and more, it seems to work well with [intlink id="3059" type="post"]A600 Cricket modem[/intlink] really well.  For those who have it, I would suggest using the lowest quality of playback for using it.  It really isn't bad quality for watching shows and such on.   You really don't have to worry to much about buffering.  Although you should check your settings on the [intlink id="1009" type="post"]player and change them[/intlink].

On a side note this week and next I will be really busy so I don't know if I will update as much as I have in the past.  This is summer afterall so it might be off and on this summer until everything goes back to normal in the fall.  I will update the blog when I can this summer, so don't you fret to much!!

Harry Potter and the Half Blood Prince Movie Spreads Malware

It seems in anticipation of the release of Half Blood Prince the Malware authors are starting to send for the movie. For example:


As you can see they really try to fool you into think your are going to be able to watch it for free.    They even put it the movie poster to try to get you to click that link. It is on a blogspot page and has a few Google followers, which I am amazed at because what I have found it.   If you were to click that play link (usa-top-news.info) it will redirect your to (world-news-scandals.com) and then to the final destination (tubes-portal.com). Each site is surprisingly in the US and tries to look like it is a real site. It sends you a file called streamviewer.40018.exe, which I am surprised AVG hasn't picked this up so I went to see if this was a virus and Virustotal showed me this:

[ad]Very few actually detect this trojan downloader even [intlink id="2205" type="page"]AVG[/intlink] hasn't detected this as being malware.   So you best bet is not try to go watch it early because 9 times out of 10 it will be a virus.  You also should know that there are even some links in Digg.com and other popular websites that are promoting this. The top rated sites are what I call Google Juice to put the blog spot website onto the first page of Google. So you should install a good [intlink id="2205" type="page"]Anti-virus software and Firewall[/intlink]. I also believe this will be coming out on DVD in December according to my sources this movie has been ready for quite some time and they are anxious to have it ready for Christmas so you won't have to wait long to see it. Afterall they have had this movie ready since last Year.

This seems to be like the [intlink id="3448" type="post"]Fake Codecs[/intlink], I have talked about.   In order to see this you have to install this software to view this movie.   I don't even know if it is a true movie but I do expect in the coming weeks to days there will be even more Fake Sites like this trying to promote watching it for Free.  Thank goodness [intlink id="3385" type="post"]we don''t have to worry about Zango anymore[/intlink]. Nothing in life comes free, so be on your guard.  Only you can prevent virus infections on your system.

Link shortening and the new wave malware on Twitter

I've been reading what Sans Internet storm has to say about twitter and how that can bring malware to Twitter. Sans argues that there is no reliable way to determine the information someone says, and that is where I am wanting to talk about the way people are creating what I call Link baiting or Blind links. You ever click on a link in twitter to find it it wasn't what you thought it was?

[ad]I also thought of what Sopho's blog about today where someone hijacked 2.2 Million redirect Urls using Cli.gs services to shorten links. I was reading through the Cli.gs blog about the incident and it came from Canada but I don't think the user of the website who had all that traffic was involved in any way shape or form to the hacking of Cli.gs website. I personally think this was done to prove a point and it is a very good point.

That in the future there will be someone to redirect links to a malware site and it won't be pretty. Think about it any shorten url service like Tinyurl or others who could have their links all be directed to a website. that is a big number and it worries me. Let us go through the numbers a little bit and see. 98.2% of people go to Tinyurl.com and don't preview the url first. Half of the clicks in Bit.ly are coming from the US, which means we are more at risk of clicking on a link that could be a virus or malware.

Now I know people don't have time to check out all the links or forget to check before they click. So I have a few plugins that might help with this.   LongUrl Pluggin  Can use 72 different web services including Bit.ly, Tinyurl, Cli.gs, and a bunch more.  This is a good little plugin to help prevent yourself from clicking those links that you are unsure of.    I would also recommend getting a [intlink id="2205" type="page"]Free Anti-virus and Free Firewall[/intlink] to better protect yoru system.  I wouldn't use Internet Explorer it seems that is more easier to infect with malware than Firefox.  [intlink id="3668" type="post"]Firefox still has to worry[/intlink] but not as much.

Microsoft Drops a 9 Security updates on Patch Tuesday

So I get home and here is what they updated for those who would like to keep track:

• Vulnerabilities in Active Directory Could Allow Remote Code Execution (KB971055) -- This update is only for Microsoft Windows 2000 Server, Windows Server 2003, Windows XP Professional and Windows Server 2003.  This one is Rated critical due to Remote Code Execution, which means a program can install malware or viruses on your system and you wouldn't know it.


• Cumulative Security Update for Internet Explorer (KB969897) --This security update resolves seven privately reported vulnerabilities and one publicly disclosed vulnerability in Internet Explorer.


• Vulnerabilities in Internet Information Services (IIS) Could Allow Elevation of Privilege (KB970483) --This security update resolves one publicly disclosed vulnerability and one privately reported vulnerability in Microsoft Internet Information Services (IIS). The vulnerabilities could allow elevation of privilege if an attacker sent a specially crafted HTTP request to a Web site that requires authentication.


• Vulnerabilities in Microsoft Office Excel Could Allow Remote Code Execution (KB969462) -- This security update resolves several privately reported vulnerabilities that could allow remote code execution if a user opens a specially crafted Excel file that includes a malformed record object.


• Vulnerabilities in Windows Print Spooler Could Allow Remote Code Execution (KB961501) -- This security update resolves three privately reported vulnerabilities in Windows Print Spooler. The most severe vulnerability could allow remote code execution if an affected server received a specially crafted RPC request.


• Vulnerability in Windows Search Could Allow Information Disclosure (KB963093) -- This security update resolves a privately reported vulnerability in Windows Search. The vulnerability could allow information disclosure if a user performs a search that returns a specially crafted file as the first result or if the user previews a specially crafted file from the search results.


• Vulnerability in Microsoft Works Converters Could Allow Remote Code Execution (Kb957632) -- This security update resolves a privately reported vulnerability in the Microsoft Works converters. The vulnerability could allow remote code execution if a user opens a specially crafted Works file.


• Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (Kb968537) -- This security update resolves two publicly disclosed and two privately reported vulnerabilities in the Windows kernel that could allow elevation of privilege.

[ad]

• Vulnerability in RPC Could Allow Elevation of Privilege (Kb970238) -- This security update resolves a publicly disclosed vulnerability in the Windows remote procedure call (RPC) facility where the RPC Marshalling Engine does not update its internal state appropriately.


• Vulnerabilities in Microsoft Office Word Could Allow Remote Code Execution (Kb969514) -- This security update resolves two privately reported vulnerabilities that could allow remote code execution if a user opens a specially crafted Word file.

As you can see these are rated from being Critical to Moderate.   Each and every one of these should be updated and can be easily done using [intlink id="2883" type="post"]Autopatcher[/intlink].   Something you should consider before doing these updates is to make a Restore point before proceeding or a [intlink id="682" type="post"]Complete backup[/intlink], just in case.  Also it is suggested to install these at your earliest convenience due to the fact that the malware authors will start using and is called Exploit Wednesday. Also it wouldn't hurt to install some[intlink id="2205" type="page"] free Anti-virus and Free Firewalls[/intlink] instead of using Windows Firewall. This will help protect your in the future also.

Ms Patch Tuesday For June 2009

Photo by Andrew Magill

Microsoft has released the upcoming patch information for this Tuesday, and boy does it look like a big one. It looks like there will be 10 bulletins this time around:

• Bulletin 1: Critical (Remote Code Execution):   Windows


• Bulletin 2: Critical (Remote Code Execution):   Windows


• Bulletin 3: Critical (Remote Code Execution):   Windows, Internet Explorer


• Bulletin 4: Critical (Remote Code Execution):   Office


• Bulletin 5: Critical (Remote Code Execution):   Office


• Bulletin 6: Critical (Remote Code Execution):   Office


• Bulletin 7: Important (Elevation of Privilege):        Windows


• Bulletin 8: Important (Elevation of Privilege):        Windows


• Bulletin 9: Important (Elevation of Privilege):        Windows


• Bulletin 10: Moderate (Information Disclosure):    Windows

It will also include one or more updates on WSUS and Windows update, and Microsoft Windows Malicious Software Removal Tool.   This looks to be quite a big set of updates.   Each one is very serious and will probably be a big download.   If your in corporate IT you may want to get ready the [intlink id="2883" type="post"]Autopatcher program [/intlink]this will help update all the important files on each system without having to have a internet Connection.

[ad]We don't know what they will be until they have dropped from Microsoft, but we can guess that the Latest Directx vulnerability isn't going to be one of them.  I wouldn't be surprised if this was going to be pushed out of cycle but that is going to have to wait a see.

The Affected systems are Windows 2000 Through Windows Vista and Server 2008.   Which means if you have windows it most likely will need to be updated.   Although on a side not the Office suite from 2000 to 2008 also will be patched and that includes the Macintosh systems.

It also looks like 7 out of the 10 will require restarts, so the autopatcher will save you time.  I wouldn't expect this to notbe exploited on Wensday because most of them are Remote Code Execution which means it is easy for a hacker to take control of your system.   These should be installed ASAP and you also should have a [intlink id="2205" type="page"]Firewall and Antivirus installed[/intlink] to better protect your system.

Microsoft makes Firefox more insecure with the .NET 3.5 Framework (KB951847)!

Photo by Daniel F. Pigatto

In February, Microsoft quietly installed .NET Framework Assistant (ClickOnce) Firefox Extension. This extension is a bad idea because of what this could do.

This update adds to Firefox one of the most dangerous vulnerabilities present in all versions of Internet Explorer: the ability for websites to easily and quietly install software on your PC. Since this design flaw is one of the reasons you may've originally choosen to abandon IE in favor of a safer browser like Firefox, you may wish to remove this extension with all due haste.

[Via Annoyances.org]

As you see, this is a way to make Firefox less secure and almost like Internet Explorer.   We've seen the problems with all the [intlink id="2946" type="post"]Malware exploits[/intlink] that people have used in the past.   If you want to uninstall it, well you can't.   Microsoft as went out if its way to prevent users from uninstalling.    Here is what Brad Abrams talked about on his blog:

[ad]We added this support at the machine level in order to enable the feature for all users on the machine.Seems reasonable right? Well, turns out that enabling this functionality at the machine level, rather than at the user level means that the "Uninstall" button is grayed out in the Firefox Add-ons menu because standard users are not permitted to uninstall machine-level components.

If you went to your Addons Menu and then to your extensions tab you would see that the uninstall button is grey out. You can disable it but you can't uninstall it. It looks like Microsoft has sent out a patch to let regular users uninstall this addon(KB963707).

I am really surprised that Microsoft did this little stunt. I would of expected more from Microsoft, but to their credit they did this for a reason to allow users who don't use IE8 but Firefox , to be able to use the .net Framework but this plugin makes browsing just unsafe. Don't forgot about the [intlink id="1010" type="post"]MobileMe apple installed on Vista[/intlink] without your knowledge. Microsoft and Apple have both had problems but this is very disturbing.  This patch they are letting people download to fix the problem doesn't mean much because it hasn't been sent out to the Auto updates and requires people go download it manually.  So Microsoft believes if you don't know, it won't your.

Service Pack 2 For Vista is out -- Working good on the Cricket Broadband A600

Microsoft has sent out Service pack 2 for Vista, and so I installed it on my machine to see what happens with the [intlink id="3479" type="post"]Cricket Modem[/intlink].  The Files Microsoft are letting people download are:

[ad]

• Windows Server 2008 Service Pack 2 and Windows Vista Service Pack 2 - Five Language Standalone X86
  


• Windows Server 2008 Service Pack 2 and Windows Vista Service Pack 2 - Five Language Standalone for x64-based systems
  


• Windows Server 2008 Service Pack 2 - Five Language Standalone for ia64-based Systems
  

All of these are KB948465 and will be released on June 30, 2009 via Automatic updates.   I also tested it out and I have a 32 bit system.   I am unsure as to the other systems if the Cricket Broadband works or not on the [intlink id="1936" type="post"]UM100 Modem.[/intlink]  I have the [intlink id="3059" type="post"]A600 Cricket Broadband modem[/intlink] and it installed without a hitch.

According to Ars technica this Service Pack has over 800 hot fixes and have fixed several things that Microsoft did wrong with Service Pack 1.  If you have the Beta version you will have to unistall it before you install this service pack.  I would love to hear of any problems with Cricket Broadband from others in the forums.   If you have problems let me know and I'll  do my best to help you out.

If you want to find out some of the fixes Microsoft sent out in this service pack you can see some of the updates on the Ars Technica article about what they fixed or changed.   That list isn't a complete list but it highlights some of them.  If you haven't installed [intlink id="843" type="post"]Service Pack 1[/intlink], you will need to install that before you can install Service pack 2.

Spyware : Michelle Obama's Ta's Ta's Video

I love this one, I was reading the Sans Report about Michelle Obama Ta's Ta's on Video.  I wanted to investigate this a little further so I went searching around.  I found some comment spam links to a site I will not talk about the links directly.  The site however had a fake video on it :

It looks like if you hit Cancel or Details it keeps trying to tell you need to install an ActiveX Object.   It also makes the user think that there is only one option to use right now.   As you can tell  it makes you think you can't cancel or get details but I did.  I tried to cancel and it kept on popping up trying to get you to install this active X installer.   AVG detects it as:

[ad]This proves the fact that any Anti-virus software is better than nothing at all.   I also  have talked in the past about [intlink id="2991" type="post"]fake codecs and how they are used maliciously[/intlink] to spread malware to people who aren't up to the job.   I didn't take long to find Phrases such as "Michelle Obama Topless" or "Michelle Obama Topless Video" to find spam comments linking to sites that are hosting these types of malware.  It seemed that in order to get out of the cycle with the Malware site, I had to do a CLT-ALT-DELETE and End the process of Internet Explorer process from Task manager.  It was an infinite loop and could not be closed any other way.  upon trying to go the link again it seems to be a random redirection every time you visit that site the next time I went there, I had a scare message pop up telling me:

As you can tell this [intlink id="3397" type="post"]pops up with scareware[/intlink] instead of the video and tries to tell you have a virus and you should run a free scan from the site of their choice.   This is an old tactic and still being used but funny if you look at that message one you know it is from a "Webpage" and two there are at least one grammar error?  Can you see it?

You're best bet is not to go clicking on links that people have left in comments.   I am so glad I have moderation turned on and I have to approve each and every post someone comments on.   This is the only way I know how to prevent from being used in the spam campaign.  Remember it is time to update your [intlink id="2205" type="page"]Anti-virus and Firewall [/intlink]if you don't already have it.  Don't forget to visit the Forums and help discuss this problem in detail.

Free Anonymous Browsing with Opera-Tor

Photo by Philip Chapman-Bell

Anonymous browsing is something of huge interest to the Internet users, who are very particular about their online privacy and security. There may be many reasons and situations, when you might be interested in using internet anonymously; for instance, you may be working on a public place and do not want to leave the traces or you may not like your family members or office colleagues to know what you have been doing online. Whatever be the reason, but still, it is an area, where a lot research is to be done.

How Anonymous Browsers Operate?

At present there are two dominant techniques used by various anonymous browsing tools. One is the use of JAP Networks, which was used hugely used earlier but later it ran into controversies after a backdoor had to be put into the product to allow interception of child pornographers on insistence of German Police.

The second technique is the use of Tor (The Onion Ring), which only allows anonymous browsing but also facilitates other applications like anonymous P2P, email, IM, and IRC chat. This technique is dominantly used in present day anonymous browsing tools.

Operator – A useful anonymous browser

OperaTor is small and relatively fast anonymous web browser, which combines the browsing platform of Opera, with privacy provided by Tor engines and the speed of browsing provided by Polipo.

You can download this 7MB application in your USB drive and carry it whenever you need to use a public computer for anonymous surfing.

In my testing, I was pleasantly surprised with the speed of browsing, which I was getting with this little tool. I had earlier used XBBrowser for anonymous browsing, but it was too slow, as compared to Operator. In fact, there was hardly any noticeable difference in the browsing speed as compared to my normal Opera browser. This is because of Polipo, the small caching web proxy, that comes bundled with Opera-Tor.

Since Operator allows only http and https protocols in anonymous mode, you should avoid Javascripts and Opera's IRC functions running through it.

Some people complain that it has not yet released the source code of itself. But my view is that unless you are hard-core programmer and really need to tweak the source code, why should you worry about that. After all, trusted networks like CNet says OperaTor has been tested spyware free and Softpedia gave OperaTor its 100% Clean award. Major antivirus vendors, like GData, Kaspersky, McAfee and Microsoft, confirm that OperaTor contains no malicious software.

Overall, one of the best applications for anonymous browsing available today.

Download Operator.

[This is a guest post by Silki Garg. She advises on how to eliminate spyware, online threats and malware detection, on her Internet Security Blog. A visit to her Blog is highly recommended. You’re sure to find something of interest.]

JSRedir-R/Gumblar The underlying problem!!

Some people have made comments about there website being hosted to Malware injection into there site.  I've been seing a Lot of talk about JSRedir-R/Gumblar found to be the biggest malware threat on the Web.  They estimate that it is 42% of infected websites to be carrying this malware threat, last week.  I have heard some think it is weak login creditals.

[ad]See the Graph from Sophos about the percentage.  I also wanted to tell people how to identify if you have the infection or not.  This is very important to check because people are letting this Malware spread and all.  

I on the other hand think the way this is spreading is a Cross Site Scripting vulnerability for these websites but there are a few websites that do keep your login cache on your system.   I would recommend if your a web site owner to have your cache deleted everytime you exit your web browser.   This should in theory help prevent Cross Site scripting and Website owners should also either buy [intlink id="2205" type="page"]Anti-virus and Firewall software or install the Free version[/intlink] to better protect your website.

Just like the[intlink id="3308" type="post"]Twitter Cross Site Scripting tom foolery [/intlink]this is my theory on how websites are being injected with this malware.   It is however just a theory.  I was never logged into my account on twitter through my web browser when this happened and that is what kept me from spreading it to my Twitter users.   You should also consider always logging off your web site when your done doing what you do!   Just my thoughts on the matter,  Remember only you can prevent from getting a Virus.

Why Norton users do it wrong with Passwords

I just read this blog post Phishing attacks on Facebook users point to efforts to mine login data for profit. After reading one of the suggestions on how to create a good password and I'll quote:
< [ad]blockquote>1. Use complex passwords and unique ones for each site. My method? Pick one string of letters and numbers and then add the first letter from the website's name. For example: if my password "string" were "abc123$" then my Facebook password would be "Fabc123$".
Now I can see where this can be used to figure the password?  If people use this method they would still be able to figure it out over time.   Let's say you use the same sequence of numbers and letters after each site you go to.  This would make it much easier for a hacker to figure out the other passwords.

I will keep saying this time and time again, remembering passwords for me is the past.  I've been using [intlink id="2646" type="post"]Roboform[/intlink] for the past few months and haven't had any problems.  I've also have them backed up to Mozy to help protect my passwords.  As long as you back them up with Mozy and Keep save a copy of it off your hard drive you will be much safer than trying to remember a good password.

If you would like to find ways to help backup your passwords or your valuable information please [intlink id="3171" type="post"]check this out[/intlink].

Remember your Roboform passwords are stored at :

C:\Users\(your username)\Documents\My RoboForm Data\Default Profile (Windows Vista and Windows 7).

C:\documents and settings\(your username)\My Documents\My RoboForm Data\Default Profile (Windows XP).

Although Norton's suggestions does help keep your a little more safer this can be easily used to brute force attacks because they probably have tried letters from the website just because they do think about these things. You should always have a really good password and [intlink id="2646" type="post"]Roboform[/intlink] can do that for you and keep it safe.

Casino Spammers still user Yahoo for Spam : Could this be Malware?

It just shows you just how one Geocities was taken down by Yahoo who owns it, the spammers have to come up with more ways to get you to download there software.

[ad]In my previous post about [intlink id="3199" type="post"]Casino programs[/intlink],  They were using Geocities to host the page for the link to the download.

It seems to be linking to "http://bestwinscasino.com/SmartDownload.exe".  From [intlink id="3199" type="post"]previous post[/intlink] I talked about what that program did but I wanted to do another test with CWSandbox and see what has change. It looks like they must be having problems lately,  So If you want to do your own test and send me the link by all means.  I don't know what is going on but, it probably is like the other post about wanting to do some bad things.  Virustotal has some anti-virus programs flagging this so I am unsure of the Harmlessness of this file but I wouldn't install this software.  According to Avinti this program is a trojan dropper.  So Iwill let you decide on installing this software or not.

While the CWSndbox checks for malware, I went to Whois and looked up the domain.   Very interesting,  According to Whois this domain is located in China?  You don't say, we've heard a lot of stuff coming from China from Graham Cluely Blog.  So it only makes me wonder what they are attempting to do now.  I do know never download a file you haven't heard off

This is a good time to install some [intlink id="2205" type="page"]Free Anti-virus and Free Firewall [/intlink]software to better protect your system.

Microsoft Release MS09-017

Microsoft Today has released fix a Powerpoint Vulnerability:

[ad]Microsoft Office PowerPoint 2000 Service Pack 3 (KB957790), Microsoft Office PowerPoint 2002 Service Pack 3 (KB957781), Microsoft Office PowerPoint 2003 Service Pack 3(KB957784), Microsoft Office PowerPoint 2007 Service Pack 1 and 2* (KB957789).

It looks like this Powerpoint Vulnerability is in the wild so you should update your Microsoft Office. [intlink id="2883" type="post"]Autopatcher[/intlink] will download the latest the Microsoft Office patches and help you update your office computers without being on the internet.

Other Software affected by this update is:

PowerPoint Viewer 2003 (KB969615), PowerPoint Viewer 2007 Service Pack 1 and PowerPoint Viewer 2007 Service Pack 2 (KB970059), Microsoft Office Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats Service Pack 1 and 2 (KB969618)

All these should be installed as soon as you get a chance.  If you have several different version I would recommend [intlink id="2883" type="post"]Autopatcher[/intlink] to do it for you.   While you at it you should also update your [intlink id="2205" type="page"]Anti-virus and Firewall software[/intlink].  You should schedule a time this week to update these important Microsoft Office programs.   You don't want to clean a system that has a virus or trojan.   Hackers will want to jump on board and make your job even worse.  This update replaces MS08-051, so please update soon!

Microsoft to Release One Crictical update for Tuesday

Microsoft has release the information for May's Patch Tuesday and it looks like there is one major update for Power point:

The Affected software is MS Office 2000, MS office Xp, MS Office 2003, Ms Office 2007, Power point viewer, and MS compatibility pack for Word, Excel, and Power point 2007.

[ad]What will be coming out for Tuesday is as Followers for Non-security Releated:

• Windows PowerShell 1.0 for Windows Vista (KB928439)
  


• Microsoft .NET Framework 3.5 Service Pack 1 and .NET Framework 3.5 Family Update (KB951847)


• Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)


• Windows Malicious Software Removal Tool - May 2009 (KB890830)/Windows Malicious Software Removal Tool - May 2009 (KB890830) - Internet Explorer Version


• Update for Windows Mail Junk E-mail Filter [May 2009] (KB905866)

Although some of this is usual like the Malicious software removal tool, and Windows Junke e-mail filter, we won't know what else will be released until Tuesday.  Some of the updates will be minor like the Powershell, I am guessing tis will help get ready for SP2, and the SP1 for the .NET framwork also looks to be getting ready for SP2.  So I will keep you updated if i find out what else is released on Tuesday!

Deciding the need for a Full backup or backing up your important files

This weekend I talked about Backups on the [intlink id="3455" type="post"]Mike Tech Show listener Round table[/intlink], and I heard from one or two people saying you can't do a full backup with Allwaysync, and to a point that is true but I really don't need a full back and some have said the program is only good for Synchronization and not backup.

I could debate that last point because what is a backup?  Wikipedia defines it as "backup refers to making copies of data so that these additional copies may be used to restore the original after a data loss event".   So backing up and Synchronizing are essentially the same thing.  Some users will argue that it is getting every file on your hard drive but I don't think so.   I however will tell you that Most files on your hard drive don't need to be copied.   Due to the fact that if you get a complete backup of your windows directory you will most ly end up where you left off, Viruses or some file that corrupt.   I don't make copies of the windows for that one reason, I have all OEM systems and don't need to worry about the Windows because when I do a system restore, I get my system back to the Factory default.

With Vista you have some data that is never put in Windows system, like your email settings and other such important date.  This is usually put in the Application Data directory, which is usally "[DRIVE]\USERS\[USERNAME]\AppData" . To get to the directory in Vista just type "%APPDATA%" in the Vista search bar and hit enter.  So I tell Allwaysync to copy everything in that directory including subdirectories.  This is where my configuration files are put for each and every program I install or run!!

People will also argue that you need to compress the data or use a Proprietary software to backup your hard drive, although this can be useful.  The more complicated the process the more chance there is for failure.  My dad always told me to keep it simple.  The simplest is usually the best in my opinion.  If I were to need to backup data, I do not need any program to get to it.   This is how I like it, plus if the drive starts to go bad you have more time to move the data off the backup drive because of moving parts and the magnetic properties could change the compress file just one bit and you would not be able to access the programs inside of it.

I also have a 500 gig external backup drive for use with keeping my data backed up, which my two laptops only use 380 if I back up all of my hard drive space but in my case my data drive is usually just used a safegaurd if I did need to do a restore on the road.  I'd still have my important programs ready to re-install and restoring my configuration files.  I wouldn't be in the dark if I had to restore on the road.  This is how I keep my important safe.  I use:

• [intlink id="3059" type="post"]My A600 Broad Band Sd Card[/intlink] -- Passwords and such on it


• My External hard drive --  Important Software and important files


• Mozy Free 2 Gig - I use this also to put my Passwords and my configuration files here.  It's free but you can pay 4.95 a month for unlimited.  I like it and it works really well.


• My spouses computer - We keep our important passwords on each other computer just in case we are on the road with one laptop we can always have access to the passwords for each of our accounts.

This has worked for me for quite some time but this isn't for everyone, some require the compression on the hard drive and that is fine but I don't.  I hope this clears it up on what I said on the Mike Tech show.  I did however make a mistake.  This software is not bit by bit coping it is however a file by file copy.   That was my fault and no others.  I'm only human.  Hope you understand.

Vista Sp2 To Come out in Second Quarter of 2009 -- Not Compatiable with Cricket Broadband

Well that isn't really news we knew this was coming from my previous post about [intlink id="3402" type="post"]Sp1 being sent out to all users[/intlink].
[ad#cricket-right-ez]But what I did hear won't be a good feeling to all those who have Cricket broadband.   From a source that has contacted me and let me know, SP2 will break Cricket Broadband.   I on the other hand have to wait to see what all they put in the SP2 to figure out how to fix this small problem.   Until then I would suggest to all who like or want to continue to use Cricket broadband to install and use the Service Pack Blocker.

Download this and run as an Administrator in command line.  (START > SEARCH "cmd" > right click on CMD.EXE and run as admin.)  (You'll want to extract this program first but You'd want to do:

• The executable creates a registry key on the computer on which it is run that blocks or unblocks (depending on the command-line option used) the delivery of a Service Pack to that computer through Windows Update. The key used is HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate.When the '/B' command line option is used, the key value name 'DoNotAllowSP' is created and its value set to 1. This value blocks delivery of a Service Pack to the computer through Automatic Update or Windows Update.
  
  When the '/U' command line option is used, the previously created registry value that temporarily blocked the delivery of a Service Pack to the computer through Automatic Update or Windows Update is removed. If the value does not exist on the computer on which it is run, no action is taken.
  
  

This will help prevent it from downlading and installing the SP until Either Cricket or I have the chance to test out how to fix the problem.  Any questions can be posted on the Forums and I'll answer them as quickly as possible!!

*UPDATE 1/1/2010*

The Latest update from Cricket is that Both the [intlink id="3059" type="post" target="_blank"]A600[/intlink] and [intlink id="4641" type="post" target="_blank"]The UM185C[/intlink] works with Vista Sp2 and Windows 7 32 and 64 bit systems.  So you no longer have to worry about it not working!!!