Security news and information

AntiVermins is renamed to AntiVerminser

Bleeping Malware — Sat, 06 Jan 2007 10:32:29 +0000

I think I caught my boys stomach virus so I will keep this short so I can hit the sack before I vomit again. AntiVermins, the latest widespread infection in the rogue anti-spyware products, has renamed itself to AntiVerminser. It’s amazing the names these people come up with.

As usual, they rename a few things but still leave the original name all over the app as you can see below.

With the rename came a brand new infector:

C:\Windows\System32\gwquvw.dll

We have updated our removal guide here:

How To Remove Antivermins Or Antiverminser (removal Instructions)

Tags: No Tags

SpyMarshal is more than it seems

Bleeping Malware — Thu, 04 Jan 2007 01:38:27 +0000

Last month Sunbelt broke the news about a new Rogue anti-spyware product called SpyMarshal. This program is just like all the rest. Comes bundled with malware, hijacks your DNS settings, displays fake alerts all as a scare tactic to have you purchase the commercial version of this software.

Analysis from some of the Bleeping Computer HJT Team has also shown that SpyMarshal has come bundled with a rootkit as shown in the Gmer image below.

Please be patient while we create a self-help guide for the removal of SpyMarshal. For now, though, if you are infected with this malware please post a HijackThis log in our forums. Instructions on how to do so can be found here:

Preparation Guide For Use Before Posting A Hijackthis Log

Tags: rootkit spymarshal

AntiVermins on the Loose

Bleeping Malware — Sun, 17 Dec 2006 17:08:13 +0000

Sorry for the lack of entries lately, but between vacation, my twins birthday and work, my time has not been my own. For those who follow new rogue anti-spyware applications and the trojans that push them, the latest push is for a program called AntiVermins. AntiVermins, like all the rest, uses misleading advertising, false positives, and fake scan reports as a scare tactic for you to purchase the commercial version of their application.

The three current infectors for AntiVermins are:

C:\Windows\System32\hjpprpu.dll
C:\Windows\System32\cvnzie.dll
C:\Windows\System32\kuhmk.dll

Currently the custom removal tools may not be targetting these variants, so you may want to follow the manual removal steps of our AntiVermins removal guide:

How To Remove Antivermins (removal Instructions)

Tags: No Tags

Protecting your login information with KeyScrambler

Bleeping Malware — Thu, 30 Nov 2006 19:18:01 +0000

One of the BC moderators, TG1911, recently referred me to a new FireFox extension and Internet Explorer plugin that he wanted to add into our popular Freeware Replacements for Common Commercial Applications thread. This program, called KeyScrambler Personal, is an anti-keylogger application that can be used to encrypt data that you input into a browser. It works by encrypting your keystrokes at the keyboard driver level and then decrypting them when they reach your browser. As keyloggers attempt to read from the keyboard driver, they will now only be able to see the encrypted keystrokes.

The program comes in two versions, a Personal and a Pro version. The Personal version is free and will encrypt all logon input when logging into a site. The Pro version, on the other hand, costs $24.99 but will encrypt all input that you enter while using a site.

While using the Personal version when I visited a site that contained a logon form the browser would show a small popup that stated that my input was being protected by Key Scramber as shown in the image below.

As I input data into the login form, that same popup will show the encrypted data that the keylogger will see.

In order to properly test this, I needed to install a keylogger and see if it worked. I fired up Vmware and then installed KeyScrambler. I then used the below test method using three different commercial keyloggers - Actual Spy, PC ACME Professional, and Keyboard Spectator Pro (KGB Spy) 3.30. For this review I will go over my experiences when using Actual Spy.

First, I fired up FireFox, disabled Keyscrambler, and went to Hotmail to sign in with a fake account. As you can see from the image below, Actual Spy did record the correct text I entered. So now I know the keylogger is capturing my keystrokes and I can continue with my experiment.

I now went into the FireFox KeyScrambler extension properties and enabled it so it would protect my login data. When visiting Hotmail again and entering the same fake login information, Actual Spy once again recorded the key strokes. This time, though, the keystrokes were encrypted!

I now performed the same procedure using Internet Explorer where it worked just as well. This entire procedure was tested again using the other two keyloggers. They all produced the same results; KeyScrambler is encrypting the keystrokes before it gets to them.

For those who are looking for a free way to protect their login information from a keylogger, this seems like the perfect tool to use. It’s easy to use, requires no work on your side other than the install, and works nicely. I know I am now using it.

Tags: keyscrambler, firefox, internet explorer, keylogger, security

From precious metals to body parts?

Bleeping Malware — Wed, 29 Nov 2006 13:53:05 +0000

The latest in a long line of fake codecs was discovered today by Miekiemoes. Instead of using names deriving from precious metals, as reported by Sunbelt, they now have moved on to body parts. Introducing BrainCodec; the latest site ready to infect you with VirusBursters.

This is so new in fact, that though the BrainCodec has its own domain and its own braincodec.107.exe, they forgot to change the web site itself. As you can see the web site is still showing the layout and image for Gold Codec.

What happened to Gold Codec then? They reverted it back to a parked domain at our favorite malware registrar, and hoster, ESTDomains.

Information on Brain Codec is:

braincodec(dot).com
85.255.117.198

Domain Name: BRAINCODEC.COM

Registrant:
na
Alex Plawsky (alex@braincodec.com)
ul. Chłodna 51
Warszawa
null,00867
PL
Tel. +48.22528102

I can’t wait for toecodec to be released.

Tags: No Tags

Vista may help to protect MS Office attacks

Bleeping Malware — Mon, 27 Nov 2006 22:38:22 +0000

Thomas Dullien, head of research for reverse-engineering tool maker Sabre Security, posted on his blog that a feature in Windows Vista will help to block the rash of client side exploits that have been targeting Microsoft Office. This new feature called address space layout randomization, or ASLR, spreads data randomly through a process’s memory space. Doing this makes it much harder for an attacker to pick the right memory address that it needs to target in order to exploit a known security risk.

Tags: No Tags

The Soul Of A New Microsoft

Bleeping Malware — Mon, 27 Nov 2006 07:24:10 +0000

Businessweek.com has a new cover story titled The Soul Of A New Microsoft which focuses on the new breed of leaders who are be paving the way for Microsoft to new branches of technology like the XBOX and Zune. The article predominantly focuses on the vice-president for design and development at its Entertainment & Devices unit, J Allard who was the team leader behind Zune.

lready, Allard and those like him are having an impact. They’re showing that strategies to move the company beyond Windows can emerge and be accepted by top brass as nonthreatening. A key moment came six years ago, when Allard insisted that the new Xbox video game console be developed without using Windows. In one meeting, Gates berated him for suggesting that the operating system wasn’t up to snuff. But Allard argued that it wasn’t specialized enough to handle video gaming. Gates eventually relented, in a decision that is widely seen today as a key to the console’s success.

The article is definitely an interesting read whether your into technology or business.

Tags: No Tags

Brief Overview of the Windows Vista Parental Controls

Bleeping Malware — Mon, 27 Nov 2006 07:21:05 +0000

Windows Vista comes with a new set of parental control features that allow you to set limits on an account’s web use, hours that they can use the computer, and games and programs they can run. Using these features a parent can control how a minor uses a computer.

The categories that can be enforced in parental control are:

Web Filters - This category allow you to specify what sites a user can or cannot go to, whether they can download files, or if they are allowed to go to a site that matches a particular content.
Time Limits - In this category you can specify the specific hours that a user can use a computer. If they attempt to logon during this time, they will be denied, and if they are currently logged on, will be logged off.
Games - Here you can specify the game rating system that will be used, the highest rating of a game they can play, and choose specific games that they can or cannot play.
Program Use - Specify the programs a user is allowed to run and is not allowed to run.

It is important to note that parental controls can only be assigned to Standard User accounts and not an administrator. You can see a video where we set the parental controls on a user and this video where we show these restrictions in place.

Tags: No Tags

Zune receives a scathing review from the Chicago Sun-Times

Bleeping Malware — Mon, 27 Nov 2006 07:17:45 +0000

The Microsoft Zune has received what could be the most critical and scathing review since its release. In Andy Ihnatko’s review titled Avoid the loony Zune, Andy relates his horrible experiences during his week of playing with it. The problems reported range from a horrible setup to lack of compatibility with Windows Media Player.

I personally do not own, or have tried, a Zune but if the reports from this article are true then it does not sound like the iPod killer that Microsoft hopes it will be. Some of the problems Andy ran into include:

Horrible setup
Lack of compatibility with Windows Media Player. To me that doesn’t event make sense as it is Window’s flagship media program.
Only the Zune software can sync with the Zune
No support for podcasts.
Having to purchase Zune points ($5 blocks) instead of just using real money to purchase a song for $0.99.

For more information please read the original article while I leave you with one of Andy’s comments:

“Avoid,” is my general message. The Zune is a square wheel, a product that’s so absurd and so obviously immune to success that it evokes something akin to a sense of pity.

Tags: No Tags

Advanced queries for Windows Desktop Search

Bleeping Malware — Mon, 27 Nov 2006 07:10:47 +0000

Are you a Windows Desktop Search user? If so then you may be interested in learning the advanced queries that you can use to search for information on your computer. This list contains all the various query terms and operators you can use in a search query.

The following tables describe the syntax to use with Windows Desktop Search, as well as the properties that can be queried for each category of file displayed in the Desktop Search results window.

You can restrict your query to specific locations, specific file types or properties within those types, or specific “file kinds.” File kinds refer to the categories displayed at the top of the Windows Desktop Search results window.

Tags: No Tags