Cyber Monday: Beware The Malware

It's the Monday after Thanksgiving and you're sitting at your work computer suffering from food coma. Too bloated to get any real work done, you decide to do something that doesn't occupy too much of the brain--online Christmas shopping.

There's more at stake here than the cost of shipping and handling, though. First off, your boss probably doesn't want you to be surfing Amazon when you have spreadsheets to complete. Secondly, you could be opening up the corporate network to malicious hackers during what is known to be a particularly risky period.

Scammers are ready for unsuspecting online shoppers to be hunting for holiday bargains that hit on what has become known as Cyber Monday (given that more than 40 percent of you will be buying holiday gifts online, according to this survey). There will no doubt be malware hiding on retail sites, fake sites created just for distributing viruses and Trojans, and e-mails with malware-laden attachments and links leading to nastiness.

Once inside the corporate network, the malware can easily spread to other computers in the company and leave back doors that can be used later for nefarious purposes, putting corporate data at risk.

Unless a company forbids Web surfing on company time and uses software to monitor and enforce the policy, there is little recourse once workers start browsing. IT departments should do what they can to protect the networks before then, by using the most up-to-date spam filters and anti-malware software and adjusting the enterprise Internet settings to alert users when a program attempts to download something.

Communication is key, too. Corporate IT personnel should consider sending an alert to remind employees of the dangers and to report suspected malware downloads, advises Adam Chernichaw, a privacy expert and partner at the law firm White & Case. Also, they should tell employees to not click "Agree" or "OK" to close a window, but to click the red "X" in the upper corner or press "ALT + F4" instead.

Employees should practice safe browsing. CNET contributor Lance Whitney wrote about some general tips for Web surfers from Webroot, including typing URLs in directly instead of following links and keeping a close eye on PayPal and other payment accounts.

Be careful of electronic greeting cards, because they are an easy way to trick people into downloading malware. Verify that the merchant or site a greeting card is sent from is legitimate, warns the United States Computer Emergency Readiness Team, an arm of the Department of Homeland Security. If you get an e-card from someone you don't know, be suspicious. You can always ask friends in an e-mail to confirm that he or she sent you something.

If you are buying gift cards online, only shop at reputable retailers and not through online auction sites, says the National Retail Federation. Gift cards sold through online auction sites may be counterfeit or stolen and once you buy it it's yours. The group has more online shopping tips on its Web site.

And for people wanting to donate to charity, the U.S. Federal Trade Commission has a charity checklist with tips such as asking groups seeking donations for more information about who is behind the operation, being wary of charities that spring up overnight in response to disasters, and not sending cash or donations.

Web searches can be dangerous any time of year as scammers use search engine optimization tactics to lure people to their sites. But holiday shopping online presents an attractive pool of potential victims. Be extra cautious when doing searches related to "holiday sale" and "Christmas specials" during this time of year.

F-Secure has compiled a Holiday 2010 Cyber-Watch List of popular search terms that are expected to be used by scammers to poison search results, which features "Kinect for Xbox" and "Call of Duty: Black Ops" at the top.

And make sure you don't do too much shopping at work or you'll instead be online checking out the job wanted ads.


Read more: http://news.cnet.com/8301-27080_3-20023728-245.html#ixzz16iEVo8Aj

Guide For Teen-Proofing Facebook Released

If you are a parent and you want your teen to be able to use Facebook without either of you having to worry that your child is sharing too much personal information, there's a new resource that can help.

A "Parents' Guide to Facebook," being unveiled today, offers hands-on, step-by-step instructions and illustrations, as well as information on safety, privacy, and reputation protection; and it covers the use of Facebook on computers and cell phones. It also offers specific recommendations for configuring privacy settings, noting that the default Facebook settings are not as privacy protective as they should be, even for adults.

The guide is being debuted at the fourth annual Family Online Safety Institute conference by the iKeepSafe Coalition and Connect Safely, a project of the nonprofit Tech Parenting Group. (CBS.com contributor Larry Magid of SafeKids.com is a co-director of that group.)

Facebook also has its own Safety Center, launched earlier this year, that provides information geared toward parents and teens.

The guidance will no doubt be a welcome resource for parents who have trouble keeping up with their teens' activities, both online and offline. A recent survey found social networks are not doing enough to protect teens' privacy. The guide may even help teens avoid the mistake one girl made recently when she accidentally invited thousands of strangers to her private house party.


Read more: http://news.cnet.com/8301-27080_3-20021992-245.html?tag=mncol;title#ixzz14jahVRh9

Adobe: Flash, Reader Hole Used In PDF Attacks

A new critical vulnerability in Flash and Adobe Reader and Acrobat 9.x is being exploited to attack computers running the popular PDF viewer software, Adobe warned today.

Adobe is not currently aware of attacks targeting Flash Player, the company said in a blog post.

The bug is in Flash Player 10.1.85.3 and earlier versions for Windows, Mac, Linux, and Solaris, and Flash Player 10.1.95.2 and earlier for Android. It also is in the authplay.dll component in Reader 9.4 and earlier 9.x versions for Windows, Mac, and Unix, and Acrobat 9.4 and earlier 9.x versions for Windows and Mac. The component renders Flash content in the PDF viewer.

Adobe Reader and Acrobat 8.x and Reader for Android are not impacted by the flaw, the company said.

The hole could be used by an attacker to take control of the system. In the existing attacks, a Trojan is being dropped onto victims' computers that steals sensitive data and loads other malware, according to ThreatExpert.

Adobe is working on a fix and expects to provide it in an update for Flash Player by November 9 and an update for Reader and Acrobat 9.x during the week of November 15.
Workarounds are included in this security advisory.

This afternoon, Adobe issued a fix for a hole in Shockwave Player that was disclosed last week. Earlier this month, the company plugged 23 holes in Reader and Acrobat, including two being used in attacks.

The company is adding sandbox technology designed to add more layers of protection to the next version of Adobe Reader, Reader X, which is due out by mid-November.

Updated 12:50 p.m. PDT with Adobe releasing fix for Shockwave Player hole.


Read more: http://news.cnet.com/8301-27080_3-20021055-245.html?tag=mncol;title#ixzz144Imxx00

Report: United States Is World's Top Spammer

The United States is now the top source of spam, accounting for almost 19 percent of all junk e-mail sent throughout the world, according to a new report out today from Sophos.

The security firm's "Dirty Dozen" report highlighted the top 12 countries responsible for the world's supply of spam during the third quarter. With the United States generating almost 2.5 times more spam than second-place India, the country now accounts for almost one in five junk messages. The United States' 18.6 percent share of all global spam also showed a significant jump from its 15.2 percent share in the second quarter.

Among the other top sources of spam, according to Sophos, are India with 7.6 percent of all global junk mail, Brazil with 5.7 percent, France with 5.4 percent, and the U.K. with 5 percent.

The report also highlighted the growth in spam from social-networking sites over the third quarter. Last month, Twitter users were hit by a "MouseOver" exploit that redirected them to third-party spam sites if they simply hovered over a link in a tweet. And over the summer, Facebook users faced their own scams, ones that attempted to trick them into filling out bogus surveys, with the information then used to spam their friends.

Much of the spam now being generated around the world isn't coming from the spammers themselves but from botnets, networks of infected computers directed to send junk mail to other unsuspecting users.

"You should never even be tempted to open a spam message out of curiosity, as it can only take a second to effectively hand over control of your computer to the spammers," Graham Cluley, senior technology consultant at Sophos, explained in a statement. "If your computer does become part of a botnet, you're also inviting further malware infections, which may compromise your personal or banking information."

To protect their PCs from infection by bots and other malware, Cluley advises users to run antispam and anti-malware tools, behave sensibly when online, and stay updated with the latest security patches.


Read more: http://news.cnet.com/8301-1009_3-20019611-83.html?tag=mncol;title#ixzz12qFP4bjw

Microsoft To Fix 49 Holes In Windows, IE, Office, And .NET

Microsoft will fix a record 49 vulnerabilities in its Patch Tuesday release next week that will involve 16 security bulletins affecting Windows, Internet Explorer, Office, and the .NET framework.

Four of the bulletins carry a "critical" rating, 10 are rated "important," and two are "moderate," according to the advisory.

They affect specifically Windows XP, Vista, Windows 7, Windows Server 2003 and 2008, Microsoft Office XP Service Pack 3, Office 2003 Service Pack 3, Office 2007 Service Pack 2, Office 2010, Office 2004 for Mac and 2008 for Mac, Windows SharePoint Services 3.0, SharePoint Server 2007, Groove Server 2010, and Office Web Apps.

Microsoft did not indicate whether two unpatched Windows holes that are being exploited by the Stuxnet worm will be fixed next week. Microsoft previously patched two other zero-day vulnerabilities in Windows the worm was using and said during last month's Patch Tuesday release that two more holes being used by Stuxnet needed to be plugged. Stuxnet spreads through the Windows vulnerabilities but was designed to target industrial control and critical infrastructure systems running Siemens software.

This is the highest number of vulnerabilities fixed in one Patch Tuesday release; the previous record was 34 holes fixed in August.

Meanwhile, in a tacit acknowledgment that after-the-fact patching isn't enough, Microsoft is proposing new ways to address security issues online. Earlier in the week, Microsoft released a paper (PDF) written by Scott Charney, corporate vice president for Microsoft's Trustworthy Computing, in which he proposes applying public health models to the Internet.

He suggests that computers could be given "health certificates" indicating whether they have the latest software patches, their firewalls are installed and correctly configured, antivirus programs are up-to-date, and that they are free of malware. If the health certificate indicates that something is amiss, an ISP could notify the computer user about the problem, and if the computer is being used in an attack, the bandwidth could be throttled to curb that activity, he said.

Comcast is already taking action to alert its Internet-using customers to possible malware on their computers as part of its anti-botnet service. And Brian Krebs reports that the FCC may do more to encourage ISPs to be more proactive in protecting consumer PCs.


Read more: http://news.cnet.com/8301-27080_3-20018933-245.html?tag=mncol;title#ixzz1253q6VPW

Dozens Charged In Use Of Zeus Trojan To Steal $3 Million

The FBI and the U.S. Attorney's office in southern New York announced charges today against 37 people accused of being part of an international crime ring that stole $3 million from bank accounts by infecting computers with the Zeus Trojan and other malware.

Between federal and state charges, more than 60 people total are being charged in the operation, officials said.

Ten people were arrested today by federal and New York law enforcement officers and another 10 were previously arrested in the U.S. as part of a coordinated takedown, authorities said. Seventeen people are still being sought in the U.S. and abroad, officials said. The defendants named in the documents, unsealed by the court today, were all listed as being from Eastern Europe and face federal charges.

Separately, 10 people were charged earlier today in England for similar Zeus-related crimes.

The Zeus Trojan was identified earlier this year as a key factor in the construction of a botnet that infected tens of thousands of computers around the world.

The defendants charged in Manhattan federal court today include alleged managers of the operation as well as alleged money mules recruited to open bank accounts for laundering money and a person accused of obtaining false foreign passports for mules.

The group allegedly recruited mules by placing ads on Russian language Web sites seeking students with J-1 visas, who could open bank accounts in the U.S.

One of the purported victims was identified as a municipal entity in Massachusetts.

Some of the alleged mules are accused of retrieving money from breached brokerage accounts at eTrade and TD Ameritrade. Other defendants allegedly received stolen money from wire transfers to bank accounts in Asia or by withdrawing money from ATMs in New York, the documents indicate.

The investigation appears to have been triggered when New York police detectives went to a Bronx bank in February to investigate a suspicious $44,000 withdrawal, according to a news release issued by the FBI, the U.S. Attorney's office, the New York Police Department, and other agencies.

The charges range from bank fraud and false use of passport to money laundering and conspiracy to commit wire fraud. Maximum prison sentences range from 10 years to 30 years and fines from $250,000 to $1 million per count.


Read more: http://news.cnet.com/8301-27080_3-20018177-245.html?tag=mncol;title#ixzz112wQTfox

Stuxnet Worm Hits Iranian Nuclear Plant

Iran's official news agency said today that a sophisticated computer worm purportedly designed to disrupt power grids and other such industrial facilities had infected computers at the country's first nuclear-power plant but had not caused any serious damage.

The Stuxnet worm, which some see as heralding a new era of cyberwarfare, appeared in July and was already known to be widespread in Iran. In fact, its high concentration there, along with a delay in the opening of the Bushehr plant, led one security researcher to hypothesize that Stuxnet was created to sabotage Iran's nuclear industry.

In addition to emphasizing the threat posed by the worm, which could be used to remotely seize control of industrial systems, today's news could well add to speculation about Stuxnet, the sophistication of which has caused some to suspect that a nation state, such as Israel or the U.S., might be behind its creation.

The worm exploits three holes in Windows, one of which has been patched, and targets computers running Siemens software used in industrial control systems.

Mahmoud Jafari, the project manager at the Bushehr plant, said the worm "has not caused any damage to major systems of the plant" and that a team was working to remove it from several computers, according to Iran's IRNA news agency, which was cited in a report by the Associated Press.

Jafari said the infection involved the personal computers of several staff members working at Bushehr and would not affect plans to open the nuclear plant in October, the AP reported.


Read more: http://news.cnet.com/8301-1009_3-20017651-83.html?tag=mncol;title#ixzz10lUCBP1g

Report: Half Of Apps Have Security Problems

This chart shows the source of application and the failure rate for security acceptance based on how critical the app is to the business.
(Credit: Veracode)


More than half of software used in enterprises has security problems, according to a new report to be released today from Veracode, an application security company.

Veracode looked at more than 2,900 applications over an 18-month period that were used by its cloud-based customers and found that 57 percent of all the apps were found to have unacceptable application security quality.

Eight out of 10 Web apps failed to meet the OWASP (Open Web Application Security Project ) Top 10 requirement that is necessary to achieve PCI (payment card industry) compliance for use in financial and e-commerce sites, Veracode said.

The report finds that third-party code, which is growing in use in enterprises, is often insecure. Third-party suppliers failed to achieve acceptable security standards 81 percent of the time, the report said.

Meanwhile, cross-site scripting remains the most common of all application vulnerabilities, and .NET applications showed "abnormally high" numbers of flaws, Veracode said.

"A lot of work still needs to be done around the work of software security," Sam King, vice president of product marketing at Veracode, told CNET.

Also on Wednesday, WhiteHat Security released a report that found that the average Web site had nearly 13 serious vulnerabilities.

Security Fixes Land In Chrome 6

Google updated the stable and beta builds of its Chrome browser on Tuesday evening, making a fix marked as critical to the Mac version and numerous repairs marked as high-priority across all platforms. Chrome 6.0.472.59 for Windows, Mac, and Linux also repaired a Linux-specific memory corruption bug.

At the time of writing, the critical Mac bug was still blocked from public view. This is not uncommon with bugs that can represent serious security risks. Judging by its public security logs, Google appears to be releasing details on fixed bugs no earlier than a week after the bug has been repaired.

Other security issues that were addressed include multiple high-level bugs involving use-after-free in document APIs, SVG styles, and nested SVG elements. Two high-level memory corruption bugs were also fixed, one in the HTML5 Geolocation feature, and another in language handling for Khmer. Finally, a small number of users who experienced browser crashes when blocking pop ups should now see that fixed. The Chrome 6.0.472.59 changelog can be read at Google's Chrome updates blog.

Adobe Warns Of Zero-Day Hole In Reader, Acrobat

Adobe on Wednesday warned of a zero-day hole in Reader and Acrobat that is reportedly being exploited in the wild.

The critical vulnerability is in Adobe Reader 9.3.4 and earlier versions for Windows, Macintosh, and UNIX, and Adobe Acrobat 9.3.4 and earlier versions for Windows and Macintosh, according to the security advisory. The hole could allow an attacker to take control of an affected computer and potentially affects millions of computers using the Adobe software, which is the most popular PDF (portable document format) viewer.

The company said it is evaluating the schedule for releasing a security update to resolve the issue.

"Unfortunately, there are no mitigations we can offer," the advisory said. "However, Adobe is actively sharing information about this vulnerability (and vulnerabilities in general) with partners in the security community to enable them to quickly develop detection and quarantine methods to protect users until a patch is available."
Adobe learned of the issue on Tuesday, according to a company statement.

'LOL Is This You?' Spam Spreading Via Facebook Chat

Facebook on Friday afternoon was investigating what appeared to be a new spam scheme that results in users getting messages from friends over Facebook chat that have malicious links.

The messages say "LOL is this you?" and are accompanied by a link that looks like it leads to a video on Facebook, one victim told CNET. In his case, clicking the link directed to a Web page with a "404-Page Not Found" error message and his account sent the spam out to at least one of his friends, he said.

The spam was also reported on Twitter, but at this point the outbreak seems to be minor..

A Facebook spokesman said the company is looking into the matter.

The spam message is similar to ones used in several phishing attacks on Twitter in February.

Update 10:07 a.m. PDT August 30: A Facebook spokesman provided this comment over the weekend:

"The Chat messages were being sent from compromised accounts and included a link to an application on Facebook that has now been disabled. We disable spam applications as soon as they're reported to us or surfaced by our automated systems and before the scammers can get very far. We also quickly delete malicious links across the Facebook site, and when we detect that an account may be compromised, we block access to it and put the owner through a series of remediation steps."


Read more: http://news.cnet.com/8301-27080_3-20014977-245.html?tag=mncol;title#ixzz0yDnPv6yt

Rustock Botnet Responsible For 39 Percent Of All Spam

Botnets are now responsible for sending 95 percent of all spam, up from 84 percent in April, and almost half of that spam comes from a single botnet, Rustock.

Rustock sent 41 percent of the world's botnet spam in August, up from 32 percent in April. This is despite the network actually shrinking in size from 2.5 million to 1.3 million bots over the same period, security company Symantec said on Tuesday. This means Rustock is currently responsible for 39 percent of all the world's spam e-mails.

"Overall, the total amount of spam in circulation is down slightly from the previous quarters as most botnets have reduced their number of bots, [but] one exception is Rustock, which has decreased its number of bots, but increased its [spam] volume," according to Paul Wood, a MessageLabs Intelligence senior analyst for Symantec Hosted Services. Rustock has been responsible for a 6-percent increase in spam e-mails per day, he said in a statement.

Sophos Flags Facebook 'Dislike Button' Scam

Security firm Sophos has highlighted yet another scam that's zipping around Facebook in the form of a third-party application, this one spreading in the form of links claiming to be from friends that encourage members to install a Facebook "dislike button."

Sophos wrote about the scam in a blog post Monday, pointing out that a link to it tends to appear in wall posts that appear to be from the user's friends ("I just got the Dislike button, so now I can dislike all of your dumb posts lol!!") but which are actually automated messages from friends who have already been duped. The scam's purpose is to force users to complete a survey contained in the application, a bit of trickery that has already been known to be perpetuated through scam links like "Justin Bieber trying to flirt" and "Anaconda coughs up a hippo," the two of which presumably would be enticing to rather different demographics of Facebook users.

As Facebook's surging membership numbers have blazed past 500 million around the world, its channels of fast social connection and messaging have become a prime target for scammers and viruses. This one's particularly nasty because a "dislike button," offering some kind of counterpoint to Facebook's own "like" button, is something that many members have been clamoring for.

Beyond tricking a user into completing a survey, and hence gaining access to your profile and the ability to spam your friends, there doesn't appear to be much about the scam that's dangerous. Eventually, after the user completes the survey, it does redirect to FaceMod, the maker of a Facebook-based "dislike" button that takes the form of a Firefox browser plug-in. Sophos points out that the scam does not appear to have any direct connection to FaceMod.

"If you really want to try out FaceMod's add-on (and note - we're not endorsing it, and haven't verified if it works or not), get it direct from the Firefox Add-ons Web page, not by giving a rogue application permission to access your Facebook profile," the Sophos post by analyst Graham Cluley read.

iPhone Jailbreak Could Double As Security Hole

The jailbreak for the iPhone released over the weekend may have exposed a flaw in the iPhone's mobile Safari browser.

Unlike previous jailbreaks, which required the iPhone to be connected to a computer to run the software update, the latest jailbreak, posted by the iPhone Dev Team at Jailbreakme.com, is accomplished via the Safari browser loaded on the device.

But the fact that it can be performed just through Safari, and the way it's done, points to a larger problem, as several CNET readers and listeners wrote to us to point out Tuesday. It means potentially anyone could control your iPhone (or iPod Touch or iPad) just by visiting a certain Web page. A site can present the exploit as a simple PDF link, which requires no explicit user action short of clicking a link. It can then launch an exploit that takes advantage of the way the PDF viewer loads fonts.

The end result is that the program can then have unrestricted access to your iPhone or iPad or iPod Touch on virtually all versions of iPhone firmware, short of the iOS 4.1 beta, currently in the hands of developers for testing.

When reached for comment, an Apple representative said Apple is "aware of the reports and is investigating." We'll update if we hear more.

"It's really serious," said Charlie Miller, a principal analyst at Independent Security Evaluators, who was the first person with a public remote exploit for the iPhone.

There are two distinct vulnerabilities and two distinct exploits, he told CNET. One flaw is in the way the browser parses PDF files, enabling the code to get inside a protective sandbox, and the other hole allows code to break out of the sandbox and get root, or control, privileges on the device, he said.

"Basically, the way the iPhone is made to be secure is through several layers of defense, so even if someone were to compromise your Web browser, it limits what they can do," Miller said.

"There are a lot of people known for doing iPhone research, but I've never heard of this guy," Miller said, referring to whoever created the iPhone 4 jailbreak. "It goes to show you that for every researcher who is known, there are a bunch of others who know the same stuff and probably more"--and whose intentions might not be honorable, he said.

While this exploit is not malicious, other hackers could take the software, reverse-engineer it, and then release an exploit that takes control of the device for nefarious purposes.

"Vulnerabilities with reliable exploit code tend to get reused and repurposed for other attacks/malware/uses," David Marcus, security research and communications manager at McAfee, wrote in a blog post.

"This should serve as a wake-up call for anyone with a mobile device: remote exploitation is real and here to stay," he wrote. "For now, these vulnerabilities are being used only (as far as we know) to jailbreak iPhones, but they could be used to do many other things to iPhones and their owners around the world."

Microsoft Plugs Windows Shortcut Hole

As planned, Microsoft released a fix on Monday for a critical Windows vulnerability that was being exploited by a fast-spreading virus and other malware.

The software patch fixes the way Windows Shell handles shortcut files, which are links to a file represented by an icon and implemented with the .lnk extension. Attackers exploiting the hole could take complete control of the computer, the security advisory said.

An attacker could disseminate a USB or other removable drive with a malicious shortcut file on it and when the target victim opens the drive in Windows Explorer or any other application that parses the icon of the shortcut, the malicious code would execute on the victim's computer. An attacker could also embed malware in a malicious Web site, a remote network share, or in a Microsoft Word document, Microsoft said.

Originally, the Windows flaw was used to spread the Stuxnet worm via USB drives and it was stealing information from systems running Siemens software used in critical infrastructure companies. Late last week, Microsoft issued a blog post that said there were copycat attacks exploiting the hole, including one involving the Sality.AT virus, which was spreading fast.

The situation was serious enough to prompt Microsoft to release an "out of band" patch instead of wait a week to fix the hole with its next scheduled Patch Tuesday security update, on August 10.

"Symantec is aware of multiple threats leveraging the vulnerability, and attempted exploitations have steadily increased since the security hole first came to light," said Ben Greenbaum, senior research manager for Symantec Security Response. "One such threat is a new variant of Changeup," a highly destructive threat.

The hole affects all versions of Windows including Windows 2000 and Windows XP service pack 2, which are not supported by Microsoft anymore. Customers using those versions need to upgrade to be protected from the attacks.

"So far, most of the exploits using this vulnerability have been targeting SCADA (supervisory control and data acquisition) systems, and these systems typically run on older operating system versions. These older systems are not being patched today," said Andrew Storms, director of security operations for nCircle. "Utility companies that know they cannot upgrade are fully aware their systems contain a public vulnerability that is being exploited. Utility companies and SCADA vendors are probably scrambling to find a resolution to this problem as quickly as possible."

Microsoft: IE8 Barred 1 Billion Malware Downloads

Internet Explorer 8, with the help of its SmartScreen Filter, has "blocked 1 billion attempts to download malware," Microsoft product manager James Pratt said in a blog post Friday.

The SmartScreen Filter evaluates URLs and their associated servers. If the software recognizes a server as containing malicious content, it displays a warning, saying it's unsafe to browse to a respective site that could cause harm on the user's computer. The user is then given the option to continue to the page or go back to their home page without downloading any content.

According to Microsoft, the SmartScreen filter continues to improve. In August 2009, it blocked 70 million malware download attempts. At the time, just 15 percent of Web users were surfing with Internet Explorer 8. Today, Microsoft reported, nearly 26 percent of the Web population is using IE8, and the company's SmartScreen filter is blocking "five times more malware month on month" compared to August 2009.

Of course, whether Microsoft's ability to block a billion malware download attempts is really something to gloat about is up for debate. On one hand, the company seems to be doing a better job of keeping users safe. On the other, the fact that that many attempts have been made might speak to security issues that still plague the Windows ecosystem. Regardless, it seems that Microsoft is turning its blocking abilities into a positive thing. And to some extent, it's commendable.

But that won't stop me from choosing Google Chrome or Mozilla Firefox over Internet Explorer.

Spy Rootkit Goes After Indian, Iranian Systems

Sophisticated malicious software that infects critical infrastructure systems is spreading in the wild, according to security companies.

Finnish security company F-Secure, which is in the process of analyzing the malware, told ZDNet UK that critical infrastructure in India and Iran had been affected.

The malware takes advantage of a zero-day vulnerability in Microsoft .lnk shortcut files, and infects Siemens WinCC Scada software running on Windows 7 Enterprise Edition x86 systems. It spreads via USB drives and runs automatically when a shortcut icon is displayed on a user's screen.

Read more of "Spy rootkit goes after key Indian, Iranian systems" at ZDNet UK.

Report: NSA initiating program to detect cyberattacks

The National Security Agency is reportedly launching a program to monitor for cyberattacks against government agencies and private companies responsible for key services such as electricity, nuclear power, and transportation, according to a story in Thursday's Wall Street Journal.

The program, known as "Perfect Citizen," is already triggering mixed reactions, says the Journal. Some in industry and government see it as an attempt by the NSA to intrude into domestic matters, while others believe it's a much-needed step in fighting the threat of cyberattacks.

Perfect Citizen would establish a series of sensors across various computer networks that would sound an alarm in the event of a possible cyberattack. The sensors would be deployed at agencies and private companies that handle the nation's most critical infrastructure, including the electrical grid, nuclear power plants, subway systems, and air-traffic control networks.

The program would reportedly focus on older computer systems and networks that were initially designed without Internet access or any real security in place but have since been linked to the Internet, leaving them open and vulnerable. Since it can't force private companies to accept Perfect Citizen, the government would dangle various incentives to get them to tie into the new system, according to the Journal.
In spite of privacy concerns, many businesses might find the extra protection valuable, as in the case of Google, which enlisted the aid of the NSA last year to help investigate the cyberattacks launched from China. Reportedly, Google and the NSA chatted earlier this year about a more formal partnership to thwart future cyberattacks.

Officials in Washington and executives in the private sector have increasingly expressed fears that major cyberattacks launched against the country's critical infrastructure could seriously harm the government and economy. U.S. intelligence experts have already been monitoring attempts to hack into the electric grid and other key services, which they believe stem from China and Russia, the Journal reported.

The new program is getting funding from the Comprehensive National Cybersecurity Initiative. This multibillion initiative hinted at the Perfect Citizen project with plans by the NSA to expand its surveillance into the private sector through a network monitoring system named Einstein. Defense company Raytheon has already scored a contract worth up to $100 million for the initial stage of the project, the Journal said, citing a person familiar with the project.

Since Perfect Citizen is still in its infancy, key questions will need to be addressed, including which network systems will be monitored and how information will be gathered. The NSA would probably kick off the project with the most critical services, such as electricity, nuclear power, and air traffic control systems, said the Journal.

Ad-Aware Free Gains Antivirus Abilities

The paid upgrade versions of the popular malware remover Ad-Aware have offered antivirus support for more than a year, but now that feature, plus a long-awaited scheduler, have been added to the free version.
On Tuesday, Ad-Aware Free Internet Security 8.3 offered users of its free product those two new features in a minor update.



Ad-Aware Free Internet Security 8.3 finally offers its users a scheduler.
(Credit: Screenshot by Seth Rosenblatt/CNET)

Although the update sounds small, the addition of a scheduler comes after years of the publisher LavaSoft restricting the feature to its paid upgrades as bait to get users to buy a license. Many software publishers have similar business models, though there is an ongoing debate among users as to what is acceptable to restrict and what cripples a program's core functionality. While the scheduler doesn't affect the program's ability to function, many users felt that by forcing them to rely on themselves to run scans, the company was, in effect, making their computers less secure.

The antivirus feature is new to Ad-Aware, having only been introduced in 2008. Originally, the program used Avira's virus detection engine, but since 2009, the detection engine has been provided by Sunbelt Software. These changes to the free version of Ad-Aware put it on more competitive footing with other well-known free security programs, such as AVG, Avast, and Avira.

Latest Virus Threats Announced Online By Free Trial Spyware

Jay Stamford of Spyware Free Trial has announced that Win32/Oficla.GN trojan is one of a number of recent virus threats. When the infected e-mail attachment is executed, it copies to a Windows system folder and modifies the registry to load automatically on next startup.

It also downloads and installs several malicious files in the infected system. This is low to medium security threat. "Spywares and adwares are not only annoying but more often than not tend to damage your computer software and sometimes can even cause some damage to your hardware too. These annoying bugs have become a bane for internet browsers worldwide.

They have become a normal occurrence that we sometimes tend to ignore but God forbid we should never accept." Said Jay Stamford, site manager of Spyware Free Trial Spyware is computer software that spies on your internet usage. It collects highly personal and confidential information like credit card numbers, IPs and even addresses. The spyware program gets the credit card entries as the user logs them on a web form or an online application. Some spyware are even programmed to record your usage of the internet, what sites you visit, what files you download and how long you stay online.

Smart phone under threat of attacks - Friendly Computers

Smartphones are at risk of becoming the next major target for computer hackers. Researchers at Rutgers University presented their findings on cell phone vulnerabilities at a mobile computing workshop in Maryland, informing both users and phone manufacturers of the potential security threat. - Friendly Computers

Read more below…

“Smartphones are essentially becoming regular computers … they run the same class of operating systems as desktop and laptop computers, so they are just as vulnerable to attack by malicious,” said Vinod Ganapathy, assistant professor of computer science in the Rutgers School of Arts and Sciences, in a Rutgers press release.

Since 2006, attacks on cell phones have become more common. The first attacks on cell phones came in the form of multimedia messages. After the user’s phone received the message, the cell phone would continually process the information and drain the battery 20 times faster than regular use. While cell phones have become more advanced, the types of attacks have also become more sophisticated.

Ganapathy and his team worked on a specific type of nefarious malware dubbed “rootkits.” Unlike computer viruses, rootkits attack the heart of a computer’s software, the operating system.

Rootkits can only be detected through a program known as a “virtual machine monitor,” which examines every operating system operation and data structure. An anti-virus scan would be unable to detect this specific type of malware.

Combating rootkits on smartphones is impossible since smartphones lack a virtual machine monitor program due to processing constraints. The program simply demands too much processing resources and energy that a portable phone could currently support.

Rootkits can be dangerous for the user. Not only could the assailant eavesdrop on conversations and extract personal information from phone directories, they could even keep track of a user’s whereabouts by querying the phones’ Global Positioning System receiver.

In Europe and Asia, rootkits could even gain access to a user’s finances. With mobile phones that can make payments like a credit card, a rootkit could potentially make the phone issue “reverse SMS” orders, which would direct payments to the assailant.

Currently, rootkits can be spread through an online website or Bluetooth. A benign Bluetooth worm has already been discovered in Singapore. Security specialists speculate that it was simply a test of the efficiency and effectiveness of the infection mechanism and that a major virus might be in the works.

While there isn’t much that users can do currently to protect themselves from attacks, it is advisable to visit only credible websites and delete text messages from unknown senders.

Source: http://www.theticker.org/about/2.8220/smart-phone-under-threat-of-attacks-1.2174454

Killer Whale Video Spreading Viruses - Friendly Computers

DENVER -- The IT and security firm Sophos is warning computer uses to be ware of messages and Web sites that claim to show video or pictures of the death of killer whale trainer Dawn Brancheau. - Friendly Computers

Read more below…

Hackers have created Web pages stuffed with content that appears to be video footage of the trainer's death, but the sites are actually designed to infect computers.

Brancheau was killed when the 12,000-pound killer whale named Tilikum dragged her into its pool and thrashed the woman to death as audience members watched in horror.


"It's hard to believe that anyone would want to watch video footage of this horrible death, but it's currently one of the very hottest search terms on the Internet," said Sophos Senior Technology Consultant Graham Cluley in a news release.

"These poisoned pages can appear on the very first page of your search engine's results, and if you visit the links you may see pop-up warnings telling you about security issues with your computer. These warnings are fake and designed to trick you into downloading dangerous software or handing over your credit card details," Cluley said.

Scareware and fake anti-virus attacks like this have become an increasingly common weapon. They have been seen following the deaths of several high-profile individuals including Patrick Swayze and Natasha Richardson.

"You could argue that anyone hunting for footage of this horrific accident deserves everything that's coming to them, but the real sick ones here are the hackers who are trying to profit from the death of an innocent woman in a tragic accident," Cluley said.

INTERNET PROTECTION TIPS:
•Security: Microsoft security
•E-mail: Cyber Alerts
•Download: Virus Definitions
•Download: Other Tools
•Download: Securities Update Vault

REMEMBER: Don't open e-mail attachments that end in .vbs, .pif or other unfamiliar extensions. Even if the e-mail appears to come from a trusted source, it could be someone "spoofing" an address. Confirm it's from who you think it's from before you open.
Sophos suggests you make sure your anti-virus software is up to date and be cautious about the links you click on.

"The general public would find it much safer to get their news from established news outlets rather than any Tom, Dick or Harry website on the internet. There are simply too many cybercriminals out there waiting to trip up the unwary," Cluley said.

Sophos makes anti-virus software and provides analysts on Internet security. Their Web site says they have 100 million users in 150 countries.

Source: http://www.thedenverchannel.com/technology/22682717/detail.html

UTA Prof.: Kneber botnet a new sort of stealth computer virus - Friendly Computers

Businesses and government agencies have a new weapon to fear -- one that is stealthy, secretive and can steal secrets without easy detection, said Matthew Wright, assistant professor in the Department of Computer Science and Engineering at the University of Texas at Arlington. - Friendly Computers

Read more below…

A new generation of computer viruses have been born, according to Wright. This threat was furthered this week when news broke that Herndon-based NetWitness identified a virus, dubbed the Kneber botnet, that was able to affect up to 75,000 systems in 2,500 organizations worldwide.

“I think it’s very likely there are additional businesses that are affected, and they don’t know about it,” said Wright.

Based on NetWitness’ research, the new virus is able to gather log-in credentials for financial systems, social networking sites and e-mail systems from infected computers.

The source is hard to detect, Wright said.

He added that the creators of the new virus have essentially tied two types of malware, or negative software, together and created a system that allows all of the affected computers to talk to each other.

Wright said businesses should consider meeting with their security vendors or IT security groups to discuss handling or preventing these types of attacks. But don’t expect an ominous sign when your system has been hit.

“This is not going to take down your computers or cause trouble in any way,” he said. “It is going to stay low and quiet. The original goal is to steal online banking credentials.”

Wright said this new threat is real and even has the American government concerned.

“We’ve been seeing this trend over the past decade,” he said. “Hacking and virus-writing has gone from kids messing around with computers to pure criminalization. This is becoming a true criminal enterprise,” he said.

And what does the new generation of hackers want from companies?

“I don’t want to speculate too much," Wright said, “but any corporate secrets, technology that is going to be developed … anything about company projects.”

He added that the incentive for this information would be a criminal’s impetus to sell that information to competitors.

Source: http://www.bizjournals.com/dallas/stories/2010/02/15/daily37.html

Norton 360 checks the Web's rep to keep you safe from viruses - Friendly Computers

Today Norton has announced a new version of its Internet protection suite, Norton 360 v4, which includes antivirus protection, smart startup, online backup and uses reputation to keep you safe from malicious websites and enjoying your computer. - Friendly Computers

Read more below…

As we discussed in our look at SafeCentral, protecting against viruses is difficult because new threats come up every day. While Norton hasn't gotten to the point that it has an emergency response team breaking down the doors of hackers, it is building a rep of keeping your computer safe by letting Norton 360 users rate the reputation of websites and threats. Since it has added reputation, the new tool has blocked a previously hidden threat for one out of two users and has had more than 177 billion reputation rankings since September.

Reputation helps users by preventing them from visiting one of the 27% of websites deemed poisonous by Norton. A great example of it in use is that if you search Google for "amy wynalda" 8 out of the first 10 search results are malicious; which, thanks to reputation,Norton 360 can protect you against.

One of the biggest things that Norton has worked on addressing in the recent releases of Norton 360 is providing users with potent protection without slowing down their computer. According to a new report from the Passmark Software benchmarking company, Norton has done a good job, as Norton 360 v4 was awarded best overall performance in January 2010.

As far as slowdowns go, a slow computer was recently noted as one of the top 10 workplace frustrations and slow to start up computers are the frustration of many home users, like my father, who simply want to get one thing done and get on their way.

One of the most common reasons that your computer is slow to start up, and even slow to run, are the numerous programs that launch every time you turn your computer on. Windows has a built in tool to edit the start up of programs and you can open up each program and turn off auto-start one by one. but the first option can be confusing for many users and one-by one removal can take a while if you don't know what you're looking for.

Norton 360 v4 has added a new tool called Start up Manager, which on average can cut 30 seconds off the time it takes your computer to turn on. Start up Manager makes uses of the reputation management that is a large part of Norton 360 and helps you decide what programs to remove from start up based on what other users have done. You can also set items to start up 5 minutes after your computer turns on so you can get to work faster.

In addition to the 2GB of online backup that has been included, Norton 360 v4 has added the ability to access this important data anywhere, including on your mobile devices. Shortly you will be able to access these files on Android devices, the iPhone and even the iPad. Another part of this feature is the ability to email large files securely so you can easily share with business associates and family members.

It is great to see that antivirus companies are focusing on the performance of their products which had driven many users away and led to headaches for those of us who provide IT support to friends and family. Tech savvy users will be able to achieve the performance boost of cleaning out their start up and using an online backup tool like Dropbox; but the addition of reputation ranking and performance boosts make Norton 360 v4 a complete package for people, like my parents, who want a central system for protection. Upgrade pricing starts at $59.99 and new one year subscriptions are available for $79.99.

source: http://www.walletpop.com/blog/2010/02/17/norton-360-checks-the-webs-rep-to-keep-you-safe-from-viruses/

Valentine's Day E-Cards May Contain Virus - Friendly Computers

BOSTON -- E-cards may be a sweet gesture from your sweetie this Valentine's Day, but beware of e-mail scams sent by less than loving cyber-criminals. These criminals are taking advantage of the holiday to infect computers with nasty viruses, according to Internet security companies McAfee and AVG technologies. - Friendly Computers

Read more below…

"Beware that surprise e-card," wrote JR Smith, CEO of AVG in a blog post. "It could contain a whole load of heartache in the form of a hard drive hack designed to steal your identity."

Cyberscammers are sending e-cards with cute Shih tzu puppies, love notes reading "Deeply in love with you" and little red hearts to lure users to download a computer virus if they click on the links in the message.

To protect your computer, AVG and McAfee suggest that you do not open e-cards sent to you from people you don't know, or even e-mail the sender asking if they sent you an e-card. Do not open an e-mail with generic things in the subject line and make sure your security software is updated.

It is safer to copy and paste a URL from an e-mail into the browser than to click a link directly. E-card companies do not send cards as attachments. If you receive a card attachment, AVG suggests you delete the e-mail immediately.

Viruses from these e-mails, if clicked, may be installed without the user's knowledge.

If you suspect e-card an e-card contains a virus, you can file a complaint with the Internet Crime Complaint Center.

Source: http://www.thebostonchannel.com/news/22543278/detail.html

Computer virus attacks increasingly malicious - Friendly Computers

Though the Gumblar computer virus and its variants initially targeted private firms, these viruses are now increasingly affecting Web sites of local governments, universities and independent administrative institutions. - Friendly Computers

Read more below…

Attacks by new types of computer viruses similar to Gumblar have recently come to light, with about 400 private firms' Web sites altered since late December, according to a survey conducted by a computer security firm.

In the attacks by Gumblar and its variants, people who visit infected Web sites are redirected to other sites that then install malware onto their computers, resulting in private information such as passwords and IDs being stolen.

While the purpose behind such attacks has been unclear, attackers using the new Gumblar-type viruses have a clearer criminal intent, as such viruses are capable of stealing credit card numbers - something that older versions of the Gumblar variants could not do.

The Web sites of Tokyo's Mizuhomachi town government and Hokkaido prefectural government have been affected by Gumblar or its variants. The Mizuhomachi town government Web site was altered on different occasions between Oct. 12 and 30, and the personal computers of about 8,000 people who visited the site could potentially have been infected with the virus.

For the Hokkaido prefectural government, eight government-related Web sites, such as that of the Hokkaido Lifelong Learning Promotion Center, were altered on different occasions between Dec. 11 and Jan. 5. During this period, a total of about 1,800 people reportedly visited these infected Web sites.

Due to fears that the personal information of residents and other people could be stolen via infected Web sites, the Internal Affairs and Communications Ministry is calling for local governments across the nation to introduce a Gumblar-detection system developed by the Local Authorities Systems Development Center, which is under the ministry's control.

Meanwhile, it also has been learned that other Web sites might have been infected with Gumblar or its variants, including those belonging to Tokyo University's Graduate School of Education and Faculty of Education; the Organization for Small and Medium Enterprises and Regional Innovation, Japan; Sapporo's parks and greenery association; and the Sendai International Relations Association.

"In addition to private firms' Web sites, Gumblar and its variants are now affecting other sites," an official at G Data Software K.K. said. "Attackers apparently target Web sites by using autopilot and other software."

Gumblar and its variants started circulating around the globe last spring. Though the attacks seem to have gone into respite, they flared up again around October. At that time, visitors to infected Web sites were redirected to other sites, where their personal information such as IDs and passwords could be stolen.

However, no actual damage was reported at that time, and the attacks tailed off again in mid-December.

Around that time, however, a third wave of attacks started. In these latest attacks, visitors to infected Web sites are redirected to illicit Web sites where the users inadvertently install bogus antivirus software that is capable of stealing credit card numbers. These Web sites also can make visitors' computers send spam e-mails.

According to a survey by Kaspersky Labs Japan, a Tokyo branch of a Moscow-based computer security firm, similar kinds of attacks have occurred on more than 380 Web sites in the country since Dec. 24.

"In the previous attacks, the intention of attackers was unclear. But in the latest attacks, there's clearly a financial motive," Suguru Ishimaru, an analyst at the company said.

"An increasing number of computers may have been remotely operated by third parties without the computer owners even noticing. Individual users should take protective measures, such as updating their (antivirus) software," Ishimaru added.

Source: http://www.philly.com/philly/business/technology/020810_malicious_virus_attacks_rise.html

Antivirus programs fail to stop new malware - Friendly Computers

Nearly a third of PCs protected by up-to-date antivirus software show signs of malware infection, a new analysis based on real-world scans has found.

Dutch cloud security startup, SurfRight, studied scans from 107,435 PCs that had downloaded its cloud-based behavioural scanning system, and found malware on 35 percent of the machines, about what one might expect of the general population of PCs. More surprising, however, was that 32 percent of machines using a fully-updated antivirus programs also had such files present.

Although the much older Windows XP was more likely to have these files than other versions of Windows, all versions including Windows 7 had significant problems. Later service packs lowered infection levels, but not by enough to undermine the observation that malware is managing to get around installed protection often enough for it to be a concern.

The main reason that SurfRight is able to spot infections, it will claim, is its cloud model, which relies on uploading files to a host where they are run through a range of different engines (PCs run only one at a time) by the company's Hitman Pro 3 system. Systems are then analysed at a lower level, for instance by looking closely at the registry for inconsistencies.

"Our research shows that traditional antivirus software cannot keep up with cyber criminals," said SurfRight CEO, Mark Loman. "Despite all their efforts, it is often days or even weeks before some suppliers of antivirus programmes release a solution to a new threat."

So what is going wrong? In some cases, the fault might lie with the user and not the security product. The second most common type of malware found on 13,000 systems related to bogus anti-virus and spyware programs, which typically ask for user consent before installation proceeds. At that point the only line of defence would be the Windows User Account Control (UAC) which users are routinely said to ignore.

That aside, by far the largest group of infections was for 'generic' malware, which is to say files that are believed to be malevolent due to their design and behaviour but which simply have not been identified yet. These are the most dangerous type of malware because any single AV product will probably not be able to see many of them.
Nearly a third of PCs protected by up-to-date antivirus software show signs of malware infection, a new analysis based on real-world scans has found. - Friendly Computers

Read more below…

"We also found that not all programmes detect the same threats, so the only way for users to be really sure would be to combine multiple anti-malware programmes on their PCs." said Loman.

The company reckons that for as long as Windows can only cope with a single antivirus product on each PC, the answer is to give users a 'second opinion' using cloud technologies. It's a model that has been around for some years in a number of smaller vendors such as UK-based Prevx, and whose time might yet have come after investment in the idea by larger companies such as Symantec and Pandalabs.

The company's scanner can be downloaded from the SurfRight website and claims to check each PC in minutes without conflicting with installed software. The software is free to use for scanning but activates a one-month free trial for removal if it encounters malware after which an annual malware removal subscription costs 17.95 euros ($24).

Source: http://news.idg.no/cw/art.cfm?id=B8791702-1A64-6A71-CE9B978133633493

More people falling for fake anti-virus scam - Friendly Computers

If you're on your computer when a pop-up says your computer may be infected and recommends you click "OK" for a free scan, don't do it! - Friendly Computers

Read more below…

You could load a rogue anti-virus program on your computer.

"The bad guys will actually write a program that looks like it's going to help you with viruses," says Bob Sullivan, author of the book Stop Getting Ripped Off. "You download it and install it and you've just volunteered to be a criminal on behalf of the hacker because now they have control of your computer."

Sullivan says once that rogue software is in your computer, the cyber thieves may try to extort money.

"They'll try to charge you $10, $20, $30 to remove the software that they just put on your computer. The scam is widespread, it's growing quickly, it's harder and harder for the average consumer to tell what's real antivirus software and what's rogue antivirus software."

Play it safe and skip the free scans. Most are scams.

Buy your anti-virus software from a reputable retailer, in a shrink wrapped box or downloaded from a trusted site.

There are some good free anti-virus programs. Don't search for them -- go to download.com or pcworld.com so you get the real deal. If you have a PC, you can get Microsoft Security Essentials from Microsoft. It's free and does a good job.

Source: http://www.kpic.com/news/consumertips/82704457.html

ESET NOD32 An Effective Antivirus Solution - Friendly Computers

(OPENPRESS) January 25, 2010 -- Antivirus security has become essential to safeguard computers from any unwanted viruses, worms, Trojans, spyware, adware, rootkits, phishing and such. - Friendly Computers

Read more below…

If your computer is only used for writing and printing purposes, excluding the use of internet, the chances of your computer getting affected by the outside Trojans is minimal. Still, some undesired malware may attack your computer, through the use of pendrives, CD, or other transferrable media. So it is wise to install antivirus security like ESET NOD32, to be on the safe side.

When you search for a security program for your computer, you may come across various packages that are offered free of cost. But compared to paid solutions, the efficiency of the free security pack is very low. Alternatively, you can get ESET NOD32 antivirus pack, which is alive constantly on guard, to sense and eliminate any kind of virus, at a very affordable cost. Further, there are multiple packages, which help you to choose according to your need and budget. If you want security just for Windows or Apple Mac or for both, there are program options to suit you.

Personal as well as business computers have some files stored in a corner of the computer, but when a virus invades the computer, it may damage your hard drive and stop the entire working condition of your computer to the point that your machine is incapacitated, requiring a trip to the local computer store, which is an unnecessary extra expense. Further, some of your secrets involved in the business may be stolen via virus and have the risk of tampering the exclusive nature of your product or service. Just paying a nominal amount for antivirus protection like ESET NOD32, can bring you peace of mind, as it is awarded, in the two subsequent years from 2006, as BEST antivirus Solution, by AV-Comparatives.

Apart from the awards, many users of ESET NOD32 have provided testimonials that explain all the efficiencies in protection of a computer. The company has included ThreatSense Technology in the packages, so that the efficacy of detection is much more advanced than other antivirus solution available on the market. Both obvious and mysterious threats to your computer are detected and eliminated with this powerful technology. You can easily download ESET NOD32 to your computer and use it without disturbing other tasks, as it does not require huge memory or other resources.

Virus creation is a business for the virus creators and they take effort and time to design them in such a way that the new ones can override the old defense solutions. Further, the modifications in the making of computers and software installed is constantly changing. Hence, it is crucial to look for the updated versions of antivirus solution. ESET NOD32 can offer you the security with the option of renewing each year, so that every year you get the latest program, according to your computer and to your budget. The updated technology fetches you the facility of automatic early detection and elimination of threats. ESET NOD32 is a great solution for any occasion.

Source: http://www.theopenpress.com/index.php?a=press&id=65848

Koobface virus plagues students - Friendly Computers

To many people, "Koobface" may sound like a half-witted insult, but to the faculty, staff and students of Capital University, it means something much more. - Friendly Computers

Read more below…

Koobface is a new computer virus that surfaced sometime during Christmas break.

Information Technology does not know for sure when the virus started, but it was first noticed as the faculty and staff returned from break, Andrew Daugherty, student technical assistant in the tech department of IT, said.

"It's a pretty serious virus, and it is definitely one of the most widespread we've seen on campus," Daugherty said.

Koobface is spread mostly through social networking sites such as Facebook, MySpace and possibly even Twitter. Supposedly, the virus attacks through external links posted on a person's wall or page, often connecting to a video or photo.

Sometimes the external links or videos will ask a person to update the flash player or download some kind of program that looks legitimate, Rob Ahern, desktop administrator in IT, said.

"I would be wary if you are prompted to download a program while you are on a social networking site," Ahern said. "Even if the link is from someone you know, use your instincts."

"If you're going to download flash go to the actual website, don't trust a link or a pop-up," Daugherty added.

Once a computer is infected with the Koobface virus, it weakens the system and allows for other viruses to infect the computer as well. Once a computer has Koobface, it only gets progressively worse.

The virus is known to have a few common signs, although Ahern says if you're seeing these signs, it is probably already too late.

"The first characteristic of the virus is browser hijacking. At anytime you can be redirected to a page with malicious intent, and it can actually force you to download the virus," Daugherty said. Even safe downloads like Yahoo messenger, for example, can be unknowingly redirected and begin loading Koobface onto your computer.

Daughtery said a second trait of the virus is having multiple Internet Explorers or My Documents windows opening at the same time.

"They can open upwards of 250 windows at once," Daugherty said.

"If Internet Explorer, or the 'blue e' as many people call it, begins to act funny or flaky, get it checked out quickly. If it crashes a lot or even simple Google searches get messed up, it needs to be addressed," Ahern said.

The final known characteristic of the virus is that it can taunt you by name.

"It's really creepy," Daugherty said. "It can actually say something like 'Haha, Andrew, you can't get rid of me!'"

The damages associated with Koobface are similar to other types of viruses. If taken care of quickly there may be no serious damage done to the computer, however if the computer is exposed long enough, it can completely ruin the system and crash the hard drive or other components.

"You might have to re-install windows or even get a new computer completely," Daugherty said. "But hopefully you can catch it in time and simply delete it and have your computer back to normal. The virus is only affecting Windows, it is of no danger to Macs."

The common treatment of Koobface includes running a special virus scan that can take anywhere from ten minutes to over an hour. There is no guarantee that a computer can be fixed or that the data saved on it can be restored to its original form.

Ahern calculated about 15 to 20 faculty cases so far, but is unsure of the number of student cases. Most of the computers IT has fixed have taken 15 to 20 minutes and have been restored to working condition.

Steve Kall, sophomore, is a student affected by the virus. A friend posted a link to his wall telling him to watch himself in a funny video. When Kall clicked on the link, he was prompted to update his flash player and did so. From there, he could not get the windows to close or any other programs to open.

"Internet Explorer kept opening and asking me to run and download programs that weren't even on my computer," Kall said. "I took my computer to IT and they were able to fix it for me. I've had no problems since then."

Daugherty's best advice for avoiding the devastating effects is to back up data onto an external hard drive, even if you have a Mac.

"Most hard drives come with programs to back up data with. Or you can ask IT for help or do a Google search on your own. If you do a web search, be careful of what you download, though, because it might just be a scam to download a virus," Daugherty said.

Source: http://media.www.capitalchimes.com/media/storage/paper1195/news/2010/01/21/News/Koobface.Virus.Plagues.Students-3855430.shtml

Free antivirus drives AVG to 110M users - Friendly Computers

Free is a good price. Just ask AVG Technologies, which announced today that active users for its antivirus software have now surpassed 110 million. - Friendly Computers

Read more below…

The Amsterdam-based company gives away its antivirus software for free. Most people use the software for free, but they can also pay to upgrade it to a full-featured security software suite. Back in October, the company said it had 85 million users, so the growth rate is impressive.

The company announced today that it will keep J.R. Smith as the chief executive as the company prepares for an initial public offering at an unspecified point in the future.

In each of the last three years, the company has posted a 75 percent increase in revenues. Dale Fuller, chairman of AVG, said that the board was initially looking for a CEO who had experience taking companies through public offerings — an experience that Smith does not have. But after another successful year, Fuller said that Smith’s ability to execute and his vision are far more valuable to the company.

AVG offered its first suite of free software in 2005 and launched its ninth version in October. In 2009, it averaged more than 1.5 million downloads per week, and total downloads in the year surpassed 251 million. Of the 110 million users, it’s not clear exactly how many are paying for premium software.

Microsoft announced last October that it was going to launch its own free antivirus software, Microsoft Security Essentials. While Microsoft is offering bare bones protection for free, AVG has added a lot of protection over the years through the acquisition of startups.

The company makes money by selling a paid version of its software starting at $34.99. With that, you get customer support, protection from infections via instant messenger chat, and a “root kit” that can protect against hidden threats. Future expansion areas include protection for cell phones and Mac computers. AVG was founded more than 18 years ago. In 2006, the company received $52 million in private equity investments from Intel and Enterprise Investors. Benson Oak Capital also owns about 35 percent of the company. Smith joined in 2007 and the company has since managed to fend off challengers and keep growing.

Source: http://venturebeat.com/2010/01/19/free-antivirus-drives-avg-to-110m-users/

New Version Of Avast Antivirus Software Introduced - Friendly Computers

A new version of what many people regard as the best free security product available has been released. Avast Free Antivirus Version 5.0 is available, and it comes with more than just a simple upgrade or tweak compared to the previous offering. - Friendly Computers

Read more below…

New Version Of Avast Antivirus Software Introduced


The most noticeable change relates to the interface. Say "goodbye" to the dated design that, for no apparent reason, looked like a music player. The new one has navigation tabs and more text, making it appear much more like the useful computer program it is.

At the same time, Avast worked to make its software less intrusive. The free registration process has been reduced to a single click, saving people from filling out forms and providing their email addresses. A gaming mode's been introduced, too, so that not-critical reminders don't interrupt users' virtual firefights.

And of course, Avast tried to make sure its software keeps folks safe. Vincent Steckler, the CEO of ALWIL Software (which is Avast's developer), wrote on a corporate blog, "[I]n addition to the signature-based AV protection that you would expect, you also get all the modern detection techniques. Central to this is protection against web threats. These are 85% of the threats our users see . . . . There are also heuristic detections, behavioral detections, and just about any type of protection you can think of."

Not a bad deal, considering it's all available at no charge. Avast may well gain additional market share with this new version.

Source: http://www.securitypronews.com/insiderreports/insider/spn-49-20100119NewVersionOfAvastAntivirusSoftwareIntroduced.html

Internet security comes into sharp focus after Google attack - Friendly Computers

Following news that Google's (NASDAQ: GOOG) Gmail service was the target of an attack from Chinese hackers, websites - Google included - are beefing up their security procedures. - Friendly Computers

Read more below…

Google said it would make an encrypted connection the default for Gmail users in a bid to ensure user safety.

Facebook announced this week that it would partner with security software provider McAfee to better protect the popular social networking site. Users with compromised accounts will be able to scan their computers for viruses or malware at no charge.

The goal, said Facebook global communications vice president Elliot Schrage, is "reducing the possibility of threats being brought onto our service by unsuspecting users."

Antimalware software developer BitDefender suggests that social networking sites like Facebook will increasingly become the target of malware developers. The sites' overwhelming popularity - Facebook has an estimated 350 million users - makes them low-hanging fruit for hackers.

Another software company, Kaspersky, predicts that attacks on iPhone and Android mobile platforms will become more prevalent this year. Research firm ABI Research released this week a report on mobile security trends, saying that the market for mobile device security software will grow by a factor of five in the next half-decade.

Source: http://www.nasdaq.com/newscontent/20100115/internet-security-comes-into-sharp-focus-after-google-attack.aspx?storyid=19558991

Intego Releases VirusBarrier X6 - Much More than Just an Antivirus - Friendly Computers

Austin, TX - Intego, the Mac security specialist, today announced the release of VirusBarrier X6, the latest version of its acclaimed antivirus and anti-malware software that has garnered excellent reviews from the Mac press. VirusBarrier X6 now provides comprehensive protection from both malware and network threats. - Friendly Computers

Read more below…

VirusBarrier X6 is the only antivirus program for Mac that includes full antivirus and anti-malware protection together with a two-way firewall, network protection, anti-phishing, anti-spyware features and more.

As malware changes, protection needs to be reinforced

While viruses, Trojan horses, worms and other forms of malware are a constant threat to computers of all kinds, cyber-criminals are turning to new techniques to infect and control Macs. These new threats come silently, with little warning, over the Internet: in many cases, simply visiting a booby-trapped web page can compromise a Mac. Focusing on malware or network attacks alone is no longer sufficient to protect Macs from the dangers of the Internet.

Comprehensive protection with VirusBarrier X6

VirusBarrier X6, the latest version of Intego's network and malware security program, includes threat-detection techniques, improved methods of detection, combined detection protocols, proactive behavioral analysis, and a full range of defensive functions. VirusBarrier X6 protects Macs from all known network-based threats, as well as all known malware.

Customers spoke, we listened

Intego's customers have told us what they wanted, and we listened. VirusBarrier X6 includes many major changes compared to the X5 version. Here's some of what we've done to make VirusBarrier X6 the best Mac security program:

* New low price: customers told us they wanted lower prices; we made VirusBarrier X6 much less expensive than the X5 version.
* Standard license protects two Macs: many of our customers have both desktop and laptop Macs, and want to be able to use VirusBarrier on both computers. Our standard license now protects up to two Macs.
* Family savings: families with multiple Macs can now buy 5-Mac family packs for just a bit more than standard license to protect their entire family, offering the lowest cost per Mac for multi-Mac users.
* Integrated two-way firewall: an antivirus is no longer enough to protect Macs from the dangers of the Internet. We've added a powerful 2-way firewall to VirusBarrier X6, making it the only antivirus for Mac with comprehensive protection.
* Phishing protection: phishing is one of today's most serious threats, where scammers attempt to fool users into giving up personal information on bogus web sites, and VirusBarrier X6 provides robust protection against this menace.
* Protection against all types of malware: with new threats, Mac users need new protection. VirusBarrier X6 protects against all types of viruses and malware, as well as network threats, phishing, spyware and much more.

More than 100 new features

In addition to being the best defense against viruses and malware for Macs, VirusBarrier X6 adds more than 100 new features that provide hardened security and help protect against the latest threats. Here are some of them:

* Two-way firewall: VirusBarrier X6 now includes a powerful two-way firewall, extending the program's protection beyond detecting and eradicating malware. This firewall offers preset configurations, for most users, and customizable, rule-based settings for advanced users, to protect Macs from dangerous network traffic.
* Antivandal and web threat protection: VirusBarrier X6 protects users from intrusions, attacks and booby-trapped web pages. A full range of features is included to protect against the many new types of threats facing Internet users.
* Dynamic Code Monitoring: Intego's new technology detects suspicious actions carried out by applications that may be malicious, and detects malware by examining its code as it acts in real time.
* Phishing protection: Mac users are protected from phishing web sites that try to trick them into entering personal information, such as a credit card number or a password, on a site that looks exactly like a valid web site.
* New types of malware detected: VirusBarrier X6 detects a wide range of new types of malware, such as scareware (software that tries to trick users into thinking their Mac is infected, in order to get them to pay for software), spyware (including commercial software used as keyloggers or monitoring tools), hacking tools, dialers (software that initiates phone calls to premium-rate phone numbers), proof-of-concept malware (software designed to show how to exploit a vulnerability, which is not circulating "in the wild"), and more.
* Fine-tuned scanning and security policies: choose from a number of detailed options to determine exactly what is scanned and when, and the type of threats that VirusBarrier X6 scans for. There are also basic settings for users who don't need such detailed options.
* Performance control: users can choose a level of CPU time to be allocated to background scans, in order to optimize CPU and disk priorities for malware scans.
* 64-bit software: all of Intego's software is now provided with 64-bit code, fully compatible with Snow Leopard, and ready for the future.

System Requirements:
* Mac OS X 10.5 or 10.6 (Leopard or Snow Leopard)
* Runs on Macs with Intel or PowerPC processors

Pricing and Availability:
VirusBarrier X6 is available now. Standard licenses protect up to 2 Macs. Also available: 5-Mac family packs and multi-seat licenses. For pricing and upgrade information, see Intego online. Also available is Internet Security Barrier X6, which includes VirusBarrier X6 and four other Intego programs, ContentBarrier, Personal Backup, Personal Antispam and FileGuard, providing parental control, backup, antispam, confidential document protection features and much more.

Intego
VirusBarrier X6

Intego develops and sells desktop Internet security and privacy software for Macs. Intego provides the widest range of software to protect users and their Macs from the dangers of the Internet. Intego's multilingual software and support repeatedly receives awards from Mac magazines, and protects more than one million users in over 60 countries. Intego has headquarters in the USA, France and Japan. For further information, please visit them online.

Source: http://prmac.com/release-id-10021.htm

Good boot: If computer is slow, it's most likely something you've done - Friendly Computers

For those who may be wondering who or what contributed most to robbing their computer of its speed, I suggest it's more than likely a who, who did it and the who is you. - Friendly Computers

Read more below…

Perhaps a kinder and gentler way to put it is that although your computing regimen has always been marked by good intentions, because you became less vigilant about safeguarding and cleaning your system, you robbed it of its vitality and transformed it from a sprinter into a dawdler.
And here's how you did it.
You failed to control your addiction to installing junk software that bloated your registry with conflicting information, installed poorly written applications that cluttered your system with unnecessary DLL files and added unnecessary, always-running-in-the-background services.
Obviously listing all the applications I've discovered over the years to be "junk" is not possible, but I can suggest three categories of applications to avoid.
1.Utilities claiming they'll "Optimize Your RAM" or "Speed Up Your Computer". More than likely they'll either slow it down or do nothing at all.
2.Poorly written Explorer plug-in applications. Because they hook directly into Explorer's shell may slow down and in a worst case scenario crash your computer.
3.Registry Cleaners. Unless you're at least a bit beyond novice do not install a Registry cleaner. Novices will often discover that cleaning their Registry is a lot like playing Russian Roulette. And even if you consider yourself a bit beyond novice, do not allow your Registry cleaner to run in the background. Most versions will significantly hog your Windows resources.
Also do not install multiple anti virus applications. Multiple anti virus programs are counter productive and can create serious Registry problems.
And do not select an anti virus program by the number of features its vendor advertises. Bloated anti virus programs like Registry cleaners will make extraordinary demands on your system's resources.
In fact, I suggest you investigate AVG (the free version) and Microsoft's Security Essentials (now offered as a free download).
Beware becoming a junkie of junk applications, but if you've been seduced and your computer has gone from sprinter to a dawdler, I suggest you:
Identify your junk applications and use Revo Uninstaller (revouninstaller.com) to uninstall them and clean your computer of application leftovers.
Better yet, why not start the New Year right by inviting a qualified technician to your home and, with all your peripherals attached, thoroughly purge the junk from your computer.
Here's wishing you a Good Boot

Source: http://www.news-press.com/article/20100111/COLUMNISTS18/1110313/1014/business/Good-boot--If-computer-is-slow--it-s-most-likely-something-you-ve-done

BitDefender 2010 Security Editions Launched - Friendly Computers

BitDefender has introduced latest customized editions of its Internet Security
and Antivirus solutions for its consumers through Unistal. - Friendly Computers
Read more below…

BitDefender Internet Security 2010 locks out viruses, hackers and spam, while providing parental control and firewall protection. BitDefender 2010 features Active Virus Control security system, which constantly monitors all the processes on your PC, blocking any malicious behaviour before it can cause any damage. BitDefender's optimized scanning avoids scanning of files that are known to be safe. As a result, BitDefender 2010 scans your PC in half the time needed by previous versions, while using fewer resources.

BitDefender 2010 also features three dashboard views - Novice, Intermediate, and Expert - to better accommodate users with different levels of PC knowledge.

Even the parental control is better than earlier versions. The Parental Control module features a newly added reporting system allowing parents to view what websites their children visit. Moreover, parents can set specific time intervals in which their children are allowed to access the Internet or use certain applications. BitDefender detects and blocks attempts to change critical system files or registry entries on your PC and warns you about attacks performed by code injection (DLL injection).

BitDefender Antivirus 2010 provides advanced proactive protection against viruses, spyware, phishing attacks and identity theft, without slowing down your PC.

Other features of importance that BitDefender Internet Security 2010 and BitDefender Antivirus 2010 have include the following:


• Blocks spyware programs that track your online activities
•Blocks web pages that attempt to steal your credit card data
•Prevents personal information from leaking via e-mail, Web or instant messaging
•Instant Messaging Encryption keeps your conversations private on Yahoo! and MSN Messenger
•Reduces the system load and avoids requesting user interaction during game play
•Laptop Mode prolongs battery life

Bit Defender Internet Security 2010 - 3 Users - is available for Rs. 1,750 (MRP), while you can get BitDefender Anti Virus 2010 - 1 User - for Rs. 750 (MRP).

For further details on BitDefender 2010, visit www.bitdefender.com/world
You can download the demo from www.unistal.com/bitdefender.html

Source: http://www.techtree.com/India/News/BitDefender_2010_Security_Editions_Launched/551-108545-582.html

Virus can put child porn on your computer - Friendly Computers

St. Petersburg, Florida - Experts are warning about a new virus that can be used by pedophiles to store child porn on your computer. The worst part is, the victims are not aware that the child porn is being stored on their computers. - Friendly Computers

Read more below…

"It's the worst possible scenario that you could have," said Robert Dobbs with the Geek Squad.

Dobbs tells 10 Connects they have not had any local cases, but says there have been several cases nationally.

The Associated Press recently finished an investigation and found cases in which innocent people were branded as pedophiles because the virus attacked their computer. In the case of Michael Fiola, the AP says he was arrested and charged before he was finally exonerated. Fiola says he spent $250,000 to clear his name.

To best avoid getting the virus, Dobbs says follow these tips:

•Have an antivirus program that automatically scans your harddrive.
•Make sure you empty out your temporary internet files.
•Avoid file sharing websites.

Source: http://www.wtsp.com/news/local/story.aspx?storyid=121424&catid=8

Computer questions answered - Friendly Computers

READERS have raised queries about the need for virus protection while another is off around Australia and wants to keep in touch on the cheap. - Friendly Computers

Read more below…

Q I am running Spybot, Avast and PC Firewall. Do I need any additional protection for my laptop?

A It depends on what you do with the laptop. These free programs are all fine but they are not integrated so viruses and spyware can slip between the cracks. My tip for 2010 is to buy a fully integrated internet security suite like AVG 9.0 or Norton Internet Security. In my opinion the risks are now too great to rely on freeware security programs if you plan to do internet banking or pay your bills online.

Q I have been using AVG 8, Spybot, CleanUp and, occasionally, CCleaner without problems. I took my PC tower for a clean and service and the company removed AVG 8 and installed an Avast anti-virus program. They also reinstalled Spybot, deleting Tea Timer. Their reasoning for the AVG 8 change was that "it hasn't been any good since December and doesn't remove all the viruses". Is there any truth to this?

A There are so many myths out there and most are based on personal preference or bias, not experience. Please refer to the previous question on freeware virus and spyware. I think AVG 9 is one of the best and the free version is certainly more fully featured than most other free programs but it's not enough to cover all contingencies.

Q My wife and I are about to embark on a caravan trip around Australia and would like your advice on the cheapest and most efficient means of keeping in touch via email. Public libraries are useful but are often booked out.

A The best answer, though not the cheapest, is to get a Telstra NextG smartphone that allows tethering (connecting to a PC or laptop via USB) and buy a data pack from Telstra. You can get 150Mb per month for $10 and it will work in most places and should cover monthly email access unless you are sending lots of photos. You don't need to buy a top-end smartphone to get tethering. If you have WiFi in your notebook you can also use it at net cafes but be sure to have a full internet security suite like AVG 9.

Source: http://www.news.com.au/couriermail/story/0,23739,26556584-8362,00.html

Expect new, evolving computer viruses in 2010 - Friendly Computers

McAfee is becoming the Nostradamus of the antivirus software world. - Friendly Computers
Read more below…

This week, the Santa Clara, Calif., firm came out with its 2010 threat predictions report. Among the dire predictions — cybercriminals will target social networking sites and third-party applications and use more complex Trojans and botnets to build and execute attacks, according to McAfee Labs.

Still, McAfee Labs also predicts 2010 will be a good year for law enforcement’s fight against cybercrime.

"Over the past decade, we’ve seen a tremendous improvement in the ability to successfully monitor, uncover and stop cybercrime" said Jeff Green, senior vice president of McAfee Labs. "We’re now facing emerging threats from the explosive growth of social networking sites, the exploitation of popular applications and more advanced techniques used by cybercriminals, but we’re confident that 2010 will be a successful year for the cybersecurity community."

Here are some online threats to watch out for:

Social networks will be the vehicle for emerging threats. Facebook, Twitter and third-party applications on those sites will make computers more vulnerable to attacks. Cybercriminals will take advantage of friends trusting friends to get users to click on malicious links. The use of abbreviated URLs on sites like Twitter makes it easier for criminals to lure people onto a bad site.

Malware. Internet surfers will continue to shift their activities away from their desktop to online applications, allowing malware writers to prey on them.

Trojans. Trojans, which can spread bad software to computers, will become more sophisticated in 2010 and easily get around current protections used by banks. New techniques include a Trojan’s ability to silently interrupt a legitimate transaction to make an unauthorized withdrawal and simultaneously check the user’s transaction limits to avoid alerting the bank.

Cybercriminals. They will target popular programs such as Adobe Reader and Flash.

In 2009, McAfee Labs saw an increase in attacks targeting client software. Cybercriminals will target Adobe products, primarily Acrobat Reader and Flash, two of the most widely deployed applications in the world. McAfee Labs expects Adobe product exploitation will likely surpass that of Microsoft Office applications in 2010.

Botnets. The versatile software will spread stolen computing power and bandwidth around the globe.

Source: http://www.nj.com/business/index.ssf/2009/12/expect_new_evolving_computer_v.html