Computer Center

Careful searching for valentine cards online

2010-02-08T18:33:00.000-08:00

Another tactic by cyber criminals to infect your computer.

Clicking on the above link sends you to the following Fake Anti-virus scanner. Warning you that your pc is infected.

Currently, Anti-Virus companies aren't doing very well against the install file. See below. Link here

Thanks to Malwarebytes Anti-Malware protection the threat is blocked. Having the paid subscription the threat is blocked from even giving you access to the scanner page.

Haiti Donation scammers

2010-01-25T17:30:00.000-08:00

Everyone!!!!!! Please be careful searching for donation sites on all search engines. Here is an example how malware writes are exploiting this tragedy.

Do not go to this site or you will risk being infected........

Click on the above search leads you to the following site.

Thanks to firefox extension No Script. The malicious script is blocked from running. Here is the actual fake rogue security site. As if i didn't have it blocked.

As you can it tries to trick you into thinking your computer is infected. My current Anti-Virus program didn't detect the file, so i recommend running a Anti-Malware program for added protection. Malwarebytes Anti-Malware (subscription version with protection module enabled) blocks everything, just another reason to have more than just Anti-Virus protection.

Hope this post has helped. Safe surfing.....

Great Tuturial on Rogue Security Products

2010-01-02T09:09:00.000-08:00

Its a must read because these criminals make millions every year. Don't become a victim.

Metallica's Malware Removal Guide at Malwarebytes Forum

Create a New Restore Point in Windows 7

2010-01-02T08:40:00.000-08:00

Go to Start ---> Control Panel

Click on System Security

Click on System

Click on System Protection

Under System Protection Tab, click on your system drive (usually Local Disk C: and click on Create

Type a description of the restore point and press Create

Windows 7 desktop enhancements.

2009-10-25T17:49:00.000-07:00

A little demo i created on how easy Windows 7 desktop is.

http://www.youtube.com/watch?v=2RIXvwKRpkk

Why Windows 7 is more secure than Vista an XP

2009-10-23T08:49:00.000-07:00

Why is Windows 7 more secure than Vista and XP?

Standard Mode is a new User Profile in Windows 7. Standard mode allows users to still customize there own profile, but will protect against any security modifications. Any changes to system security (UAC settings), Protection programs modification (anti-virus/security programs) the user will prompted for administrator approval.

The only problem with standard mode will be convincing users to actually implement it. Here is an article in Technet magazine by Mark Russinovich that explains it further.

July 2009

Updating Java SE Runtime

2009-10-18T20:51:00.000-07:00

Java exploits are widespread and spread a lot of malware.

Its very important that Java is checked weekly for any updates.

To update Java:
Open Control Panel
Double-Click on Java Icon

Here is a demo

Keeping Adobe Acrobat Reader up to date

2009-10-18T20:32:00.000-07:00

How important is keeping Adobe applications up to date? Its extremely important because exploits distribute a lot of malware. Keeping Adobe updated can prevent so many infections!!!!!

Here is a video on how easy it is to keep adobe up to date.

New Rogue Anti-Spyware program "WinSpywareProtect"

2008-05-21T19:40:00.000-07:00

You may receive popup ad's trying to lure you into purchasing this program. DO NOT INSTALL!!! Its not a legit Anti-Spyware program. Here is there very deceptive website.

Here are some additional screenshots.

For those who get infected with WinSpywareProtect, MalwareBytes Anti-Malware has been updated to remove WinSpywareProtect. You can download Malwarebytes Anti-Malware from here.

Google Groups spawning Malware

2008-04-28T18:56:00.000-07:00

Recently Google Groups has been a growing place for malware and Google needs to clean this up soon. Please do not download anything from a Google Groups link.
Here is an example of a Hacked Google Groups link to download Ring tones

When you click on the link you are prompted to download a file named msetup.exe.

New Rogue Anti-Spyware Program

2008-03-16T20:55:00.000-07:00

SpywareIsolator

Below is the pop up, you may receive in Internet Explorer. When you have a Trojan called FakeAlert you may receive this pop up too.

This pop up tries to lure you into thinking you are infected with dangerous spyware, however you aren't infected. Please do not install this program!!!!

For those unfortunate to get infected with Spywareisolator, Malwarebytes Anti-Malware will completely remove the infection. You can download Malwarebytes Anti-Malware from Here for free.

Rogue Anti-Spyware product

2008-03-13T21:30:00.001-07:00

Please don't install this program, its not legit.

new codec malware

2008-03-01T20:23:00.000-08:00

Please beware of this site
http://porntubecodec2008.com/
it installs the following fake codec MediaTubeCodec.exe. Please stay away from this as it will install rogue security applications and other malware.

Amazon's MP3 downloader

2008-03-01T18:39:00.000-08:00

Just a few months ago, Amazon has released its MP3 downloader for linux. I installed in Ubuntu Gusty Gibbon, i have to say it was very easy. Amazon provides a pretty basic instructions on installing it on Fedora, OpenSuse, Debian and Ubuntu. I really think this is a milestone for linux, we all finally have a way to purchase legal music. We all need to spread the word on DRM free music because that is the future. Go amazon!!!!

New fake security alert web page

2007-11-25T00:34:00.000-08:00

Another fake Security Site, it will scare you into downloading it. Also, it will install a Rogue Anti-Spyware application called Malware Destructor.

IP address is

85.255.120.99
http://www.malwaredestructor(dot)com/

Result: 15/32 (46.88%)

Antivirus Version Last Update Result
AhnLab-V3 2007.11.24.0 2007.11.23 Win-Trojan/Agent.23072.B
AntiVir 7.6.0.34 2007.11.23 -
Authentium 4.93.8 2007.11.24 -
Avast 4.7.1074.0 2007.11.23 -
AVG 7.5.0.503 2007.11.24 Downloader.Agent.TIV
BitDefender 7.2 2007.11.25 Trojan.Downloader.JJCE
CAT-QuickHeal 9.00 2007.11.24 TrojanDownloader.Agent.eyv
ClamAV 0.91.2 2007.11.25 Trojan.Downloader-15450
DrWeb 4.44.0.09170 2007.11.24 -
eSafe 7.0.15.0 2007.11.21 -
eTrust-Vet 31.3.5324 2007.11.24 -
Ewido 4.0 2007.11.24 Downloader.Agent.eyv
FileAdvisor 1 2007.11.25 -
Fortinet 3.14.0.0 2007.11.25 Misc/Renos
F-Prot 4.4.2.54 2007.11.23 -
F-Secure 6.70.13030.0 2007.11.24 Trojan-Downloader.Win32.Agent.eyv
Ikarus T3.1.1.12 2007.11.25 Trojan-Downloader.Win32.Agent.eyv
Kaspersky 7.0.0.125 2007.11.21 Trojan-Downloader.Win32.Agent.eyv
McAfee 5170 2007.11.23 -
Microsoft 1.3007 2007.11.25 -
NOD32v2 2684 2007.11.25 -
Norman 5.80.02 2007.11.23 -
Panda 9.0.0.4 2007.11.25 -
Prevx1 V2 2007.11.25 Heuristic: Suspicious Self Modifying File
Rising 20.19.60.00 2007.11.25 Trojan.DL.Win32.Agent.dps
Sophos 4.23.0 2007.11.25 -
Sunbelt 2.2.907.0 2007.11.24 -
Symantec 10 2007.11.25 ExpertAntiVirus
TheHacker 6.2.9.141 2007.11.24 -
VBA32 3.12.2.5 2007.11.23 Trojan-Downloader.Win32.Agent.dps
VirusBuster 4.3.26:9 2007.11.24 Trojan.DL.Agent.WVG
Webwasher-Gateway 6.0.1 2007.11.25 -

If you happen to get infected, please download this free tool. It will remove the rogue program and all its components.

RogueRemover FREE 1.22

New rogue Anti-Spyware program

2007-10-29T18:53:00.000-07:00

Please stay away from this program, its a scam. Uninstalling this program is not easy, you have to kill the following process AdwareRemover.exe .

Here is a VirusTotal results of the install file

File Install1216.exe received on 10.30.2007 02:34:50 (CET)
Current status: Loading ... queued waiting scanning finished NOT FOUND STOPPED
Result: 12/32 (37.5%)

Antivirus Version Last Update Result
AhnLab-V3 2007.10.30.0 2007.10.29 -
AntiVir 7.6.0.30 2007.10.29 TR/Renos.29776
Authentium 4.93.8 2007.10.29 -
Avast 4.7.1074.0 2007.10.29 -
AVG 7.5.0.503 2007.10.29 Potentially harmful program Downloader.IY
BitDefender 7.2 2007.10.30 -
CAT-QuickHeal 9.00 2007.10.29 -
ClamAV 0.91.2 2007.10.30 -
DrWeb 4.44.0.09170 2007.10.30 Trojan.Fakealert
eSafe 7.0.15.0 2007.10.28 -
eTrust-Vet 31.2.5252 2007.10.30 -
Ewido 4.0 2007.10.29 -
FileAdvisor 1 2007.10.30 -
Fortinet 3.11.0.0 2007.10.19 -
F-Prot 4.3.2.48 2007.10.29 -
F-Secure 6.70.13030.0 2007.10.30 not-virus:Hoax.Win32.Renos.mw
Ikarus T3.1.1.12 2007.10.30 not-a-virus:Hoax.Win32.Renos.mw
Kaspersky 7.0.0.125 2007.10.30 not-virus:Hoax.Win32.Renos.mw
McAfee 5151 2007.10.29 BraveSentry
Microsoft 1.2908 2007.10.30 TrojanDownloader:Win32/Renos.CF
NOD32v2 2625 2007.10.30 probably unknown NewHeur_PE virus
Norman 5.80.02 2007.10.29 -
Panda 9.0.0.4 2007.10.30 Suspicious file
Prevx1 V2 2007.10.30 Generic.Dropper.xCodec
Rising 19.47.02.00 2007.10.29 -
Sophos 4.23.0 2007.10.30 -
Sunbelt 2.2.907.0 2007.10.29 -
Symantec 10 2007.10.30 -
TheHacker 6.2.9.110 2007.10.27 -
VBA32 3.12.2.4 2007.10.28 -
VirusBuster 4.3.26:9 2007.10.29 -
Webwasher-Gateway 6.6.1 2007.10.29 Trojan.Renos.29776

Here are more screenshots of this rogue app.

Another fake codec site

2007-09-12T20:58:00.000-07:00

Please don't visit this site

hxxp://codec-scan.com/

Anti-Virus detection is minimal at best.

new codec malware

2007-09-09T20:58:00.000-07:00

Please stay away from site!!!!!!

hxxp://codec-fun.com/

Currently, virus detection is not good. My best recommendation is never download a video file that asks you to install a video codec. Its normally malware. Safe surfing.

Some more rogue Security programs!!!!

2007-08-10T14:01:00.000-07:00

These programs use tricks to get you to download and pay for there software. Here is an example:

Typically, you can get infected by going to malicious porn sites. They make you download a video codec to watch the video. When you download the codec, you get infected.

Here are some of the latest rogue app's.

Careful browsing

New Rogue Security Program

2007-08-09T15:09:00.000-07:00

Anti-SpyGolden v4.9 is a new rogue program. Please stay away!!!!!

I believe Sunbelt CounterSpy can detect and remove Anti-SpyGolden.

2007-07-28T13:42:00.000-07:00

Today, i received the following friend request on MySpace.

Looks like a legit request, but this is a red flag My Other Pics. When you click on that link, you are sent to Fling.com. Beware of the previous link, it contains adult content!!!!!!

This is similer to one i recieved in June, but i was sent to AdultFinder.com. This is a pretty bad why to market your website and buisness. For everyone, who frequents MySpace. Please be careful.

Update on Privacy Protector

2007-07-05T06:54:00.000-07:00

There are now tools available to remove Privacy Protector trojan installs. The following sites have experts that can work you through the disinfection.

Castlecops

BleepingComputer

TechSupport Guy

MalwareRemoval

PC Drive Tool

2007-06-30T20:32:00.000-07:00

Here is another rogue Anti-Spyware app and its linked to http://www.pcprivacytool.com/. When you click on Buy Now, you are directed there.

What a rip off. Here are some more screenshots. The installer is installer_en.exe and is not detected well at all. However, i am not getting the program via a trojan. So, the install file could be different.

Privacy Protector

2007-06-30T19:46:00.000-07:00

Here is a new Rogue Anti-Spyware program, please stay away!!!!

You will be directed to a site to remove porn form websites. It obliviously a scam. The program costs 39.95 to remove malware. However the stuff it detects is bogus!!!

When you click on Detect and Erase Porn Now you will prompted to download installprivacyprotectorfree.exe. This will install the rogue app. Here are some more screenshots of the install. Anti-Virus detect is limited at best.

As of right know nothing will remove it. When there is a removal, i will post it.

Mozilla Firefox Extension "NoScript"

2007-06-29T20:39:00.000-07:00

NoScript is another tool to keep malicious hackers from getting into your computer. You say how can this be?? Well, NoScript blocks all Javascript on websites. You have the option to Allow sites you deem secure, my recommendation is to bank sites only. However, some good sites may need Javascript enabled. Most of the time, you will get a little message "You have Javascript disabled." You can then allow it. Moreover, NoScript will disable all flash ads on untrusted sites. I know these ads can be annoying, so its nice to have that option. Furthermore, NoScript will block any Cross-Site scripting. What is Cross-Site Scripting?? Cross-site Scripting is a type of computer security vulnerability in web application that allow code injections by a malicious attacker. These attacks have been linked to powerful phishing attacks and browser exploits. Finally, NoScript can protect you from malicious Javascript vulnerabilities. There are many kinds of malware installed via malicious sites that inject the code via a Javascript vulnerability.

I don't want to bash Microsoft and IE7 because Microsoft has made great strides with IE 7. However, to prevent scripting in IE7 you have to Okay five or more prompts to allow scripts to run. This is not a very good option, how many of us will actually do this for every site. NoScript makes it easier because you select what to allow and forbid. Here are some screenshots.

Beware of malicious Myspace sites

2007-05-27T20:27:00.000-07:00

Please beware of the following program called Myspace Viewer. Most of the time you will get a unknown friend request, once you click on the link to the profile. You are sent to a malicious page wanting you to download a program called MyInstaller.exe . Do not install it!!!

The Virus is variant of the popular Trojan Zlob, but can be Trojan.DNS.Hijacker. Which Hijacks your searches. If you ever come across this please visit this site to get help Castlecops