Category: worm

Are You and Your Friends Fine — Virus Spam

Paul

Logged into my Google Email and was checking my spam to see what I see and this one draws my attention:

virusspam

I think I know where this is leading me but I click the link and this website with the Reuters logo pops up:

fakesvideo

Now as you can tell this looks authentic but when I did go to this site, AVG detected some trojan.  It blocked it, but  the file that it is downloaded called “save.exe” and I have talked about [intlink id=”2991″ type=”post” target=”_blank”]flash player fake updates[/intlink].  I have seen other blogs talking about dirty bomb news report leads to malware.  I don’t know about you but if I wanted to update my flash player, I go to the source and not use any links.  It is wise not to download any programs or files and run them without properly checking them out for viruses and Trojans.  You should have a fiewall and anti-virus running at all times and that will help but it is your actions that help your prevent from getting viruses or Trojans.

Microsoft Updates the Autorun Patch KB967715

Paul

The updates offered in this article correctly disable the Autorun features. These features were not correctly disabled if you followed previously published guidance. The updates that are offered in this article have been distributed to the following systems through the Windows Update and Automatic update distribution channels:

* Microsoft Windows 2000
* Windows XP Service Pack 2
* Windows XP Service Pack 3
* Windows Server 2003 Service Pack 1
* Windows Server 2003 Service Pack 2

[ad#ad2-right]This will help with the Conflicker Worm, also known the new variant Conflicker B++. Microsoft released this patch to better help the Administrators deal with the problem at hand. That the Conflicker worm exploits the autorun feature in most system. The Administrators need to disable the Autorun feature the right way, or it will not prevent infections.

Microsoft releases the necessary registry keys to edit and how want updates are needed to make this work. This will make it much harder for any program to exploit the Autorun feature in Windows.

This information is provided to help the Admins prevent from getting infected and should not be done by anyone who isn’t comfortable with editing the registry. If you’re not sure how to do it, please take it to someone who can do it. You could potentially make the system unstable messing with registry.

Polymorphic w32/Scribble and what that is:

Paul

Having read the Graham Cluley’s Blog about “Court halted by fast-spreading virus“. I wanted to talk about this one because of the need to let people know about this little Virus and what you see when you are infected.

This virus modifies the Windows Host file so it redirects the host to a loopback address. It also uses the I-frame Injection into HTM, PHP or ASP file extensions. W32/Scribble-a, also known as Virus.Win32.Virut.ce, PE_VIRUX.A, or Virus:Win32/Virut.BM allows a users to control the machine through IRC.
[ad#ad2-right]

Although originally misidentified at the time of the initial infection on 4th February as the Conficker worm, the infection was ultimately declared by officials to be “W32/Virut.n” (which Sophos has detected as the W32/Scribble-A virus since 3rd February).

[Via Graham Cluley’s Blog]

Sopho’s Has a removal tool for this to help disinfect a system that is infected. I also want to remind people about the need for backups and the need for Anti-virus Software, including a free firewall, will not protect you 100% of the time but will help you identify and possibliy remove a virus, Trojan, and worm from you system. Just like the seriousness of the Conflicker Worm, this too should be taken seriously due to how it is easily spreading. And with Valentines Day just a few days and some Other Holidays that will be coming up, you can bet this virus will start infecting even more systems. You should also backup your data weekly if not monthly. I’d suggest doing a backup on a Early Sunday Morning before 4am so the system won’t be used.  I’ll update you if there is anything else about this virus on my blog later.  Just wanted to let people know to be watching for this little virus on and offline!!

Offline Update 5.0, Clone of Autopatcher to Some!!

Paul

Offline updater 5.0 has been released a couple months ago and I just realized it now.  This is an excellent tool for IT professionals who want to keep all your Systems up-to-date with the last patches from Microsoft.  The systems it supports are Windows 2000, Windows XP, Windows Server 2003, Windows Server 2003 x64, And Windows Vista / Server 2008.(32 bit and 64 Bit updates).

ct-offline-update50

[ad#ad2-right]I find this a very useful program for people who have a multitude of problems, from not being able to get on the net to computer virus infections.  This is really good for big businesses that want to update a lot of systems in easy way without having to wait for downloads of updates to install.   You can take a DVD and update on the fly within Mins.   DVD being Cheap or buying them in bulk helps saves time and money for the company.   Less time spent downloading the updates and more time actually getting work done.  As with the Conflicker, Downadup, and to some the Conflickr Trojan, if you got infected with that little worm.  This would help install the updates that it prevented you from doing in the first place.  I also found that once you download do the update the files are kept on the hard drive so you no longer have to redownload them again.  You just update the updates every second Tuesday of the month and it downloads the newest patches and creates a whole new ISO for you to burn.

Q: How can I create the offline update CD images automate, for example via a “scheduled job”?
A: Create a new batch file in the “cmd”, eg “DownloadUpdatesAndCreateISOImage.cmd”. Add the desired calls of

“DownloadUpdates.cmd” and “CreateISOImage.cmd” with the necessary parameters in this new file. The file might for

example have the following contents:

@ echo off
call WXP download updates eng
call CreateISOImage WXP eng

Then set a “time-controlled contract” for the new script “DownloadUpdatesAndCreateISOImage.cmd” to your desired

time. For example, after each Microsoft Patchday create new images, select every second Wednesday of the month.

[Via The FAQ’s Documentation (Translated Via Google)]

As you can see you can have it do a script and be ready for you in the morning.  You then just take it out of the drive and install where you need to install the day after the updates are issued. On another Note if you have clients who use Windows office Xp, 2000, 2003, 2007 then this will also help:

ct-offline-update50-1

This is nice if you have clients who use the Microsoft Office Suites also.  Some Malware will often try to infect people’s systems through a office script or some other vector.   So this will also prevent infections or hackers from getting onto the system by updating this also.  You can have this added to each and every DVD ISO you make to include these as you update the patches also.

Download:

Do you have the Obama Worm?

Paul

So I sit here reading about the Obama Worm from PcWorld. Asking myself what type of worm this is? Here’s what I do know, it isn’t a malicious intent but it does look like it is something someone thought of this to test out their skills and to make people laugh. This however isn’t a well made worm, it seems to slow down systems after awhile and prevents loading up of programs. The Odds of you getting this worm is like Dieing in an Airplane or Very slim according to some researchers.

[ad#ad2-left]It seems to be spreading through USB and therefore should prevent this by disabling Autorun features in your machine, also you should limit the use of external storage devices whenever possible to help prevent infection.  Although currently it seems that the worm isn’t detected by any anti-virus software t right now.  There is a screen capture of the Obama Worm in case anyone wanted to see what it looks like.

The Back story is this started at school, and It looks to be only visible on Monday’s.  So if you find yourself seeing the face of Obama on the right hand corner of your screen. That is the only way to find out if you have the Obama Worm.   If you want to find out,if you have the worm, the easiest and quickest way is to change the time on your Windows systems to the following Monday and reboot.  IF after you reboot, and you see the head then you will know you are infected or at least that is my theory on discovering it, haven’t had a system with the Obama Worm yet but expect it to be really simple to find out.

Right now, Most of the Anti-virus companies are trying to figure out how to detect it and remove it so it will of course be a little while.  The best advice I can give you is to make sure you systems are fully patched to help protect the systems from Malware infestations.