Be Cautious of Windows Security Alerts

I've shared a lot of information in the past about the dreaded Windows Antivirus program.  It's a malware program that has been infecting many of my client's computers over the last couple of years.  While the characteristics are the same, the rogue program keeps changing names and getting better at evading removal.

We know that it get's on people's computer while they're surfing the internet. All they have to do is click a link to an infected page and suddenly they find themselves confronted with several pop-up windows telling them their computer is infected. 

The problem is that it's impossible to narrow down the web site that is infected, because .... well, countless web pages are infected.  Today, I was doing research for my genealogy web site and was searching for genealogical societies in Pennsylvania when I stumbled across an infected site.  I thought I would share exactly what happens next so that you can take proper steps to remove the rogue program before it infects the rest of the computer.

So as I mentioned earlier, I was searching Google for "genealogical societies in Pennsylvania" when I stumbled across the search result below.

Now if I had been paying better attention, I never would have clicked on the link because several things stood out as red flags just looking at it. But I was in my 4th hour of research by that point, hungry, and blurry eyed, so I just clicked away!  Big mistake!

Looking at the image above, two things stand out (circled in red) that I should have paid closer attention to before clicking the link.  The first one is the yellow exclamation point (top right).  This was Norton warning me that this site is not safe.   The second red flag is the actual link of the site (also circled).  I'm searching genealogical societies and the link starts out: italiaclubprive.com.  That should have been a huge flag if I had been paying better attention.

None the less, I missed the red flags and clicked the link.  Next I was confronted with the following warning message.

Having seen the Windows Antivirus more times than I can count, I recognized this warning message immediately and tried to Cancel it.  As expected, that caused several more pop-up messages warning me my computer was infected and that I should click OK to fix the problem.  Every time I canceled the prompts, I was hit with more and stuck in an endless loop of warning messages.

 

After several cancellations, I eventually got to the Windows Security Alert window shown below (confirming my hunch that this was indeed the dreaded Windows Antivirus).

At this point, there was only one way to get out of the endless loop of warning messages.  I had to close my internet browser.  But of course, the only way to do this now, was to open the Windows Task Manager, find my browser in the list of processes, highlight it and click END PROCESS.

If you're not familiar with the Windows Task Manager., hit CNTRL - ALT - DEL on your keyboard (holding all 3 keys down together) to call it up.  Then click the PROCESSES tab and find your browser in the list (Firefox, Internet Explorer, etc.).  Single left-click it to highlight it, then click the END PROCESS button.  If done correctly, your internet browser should close. 

After my browser was closed, I wanted to make sure the rogue program was off my computer.  So I opened my favorite malware program (Malwarebytes Antimalware), updated it and then ran the quick scan.  Sure enough it found 3 infections listed as "Rogue.Security Toolbar".  I click the appropriate prompts to let Malwarebytes remove the program and then rebooted the computer when prompted.  Then I ran Malwarebytes again just to verify the rouge program was gone from my computer (and it was). 

You might be wondering why Norton didn't remove it.  Well, the quick answer is that I didn't ask Norton to.  I let Malwarebytes remove it instead since I knew it could handle it from previous experience.  If you recall, Norton did try and warn me when I was looking at the search listing in Google and I ignored it.  

This particular rogue program isn't a true virus in the way other viruses work.  This program is very malicious and tries to extort money from you by scaring you into believing your computer is so infected with Trojan viruses that you must let this rogue program remove them now (for a fee of course).

Malwarebytes Antimalware specializes in these types of programs so I trust and use it to remove them.  None the less, the problem is solved and hopefully you'll be better equipped to handle the attack yourself if ever you're ever confronted with it.

Yahoo IM hosting a new worm, Be cautious!

Be cautious! An unexpected photo viewing invite on Yahoo Instant Messenger is the way of spreading worm. Since last two days people are receiving a downloadable link which seems as if their friends has sent message for sharing the images or photos but in reality it is a malware. This malware helps in installing a backdoor on Windows systems and spreads to a victim’s IM contacts.

If you at all receive a message with tags like ‘photo or ‘photos’ along with a smiley face icon, please avoid clicking on it. The malicious link seems quite similar to a photo viewing request from Facebook or MySpace.

By clicking on the link the yahoo users will get a downloadable file. Afterwards no action will take place but as the executable will downloaded already once user runs the file on windows system your PC will get infected and the malicious message will be distributed to all of the IM contacts.


Source: ub-news.com

IE8 Blocked over 1 Billion Malware Attacks

With the help of the SmartScreen filter, IE 8, Microsoft’s standard Internet browser prevented 1 billion malware attacks or downloads. In a Microsoft Windows Blog on Friday, Microsoft noted that the growing number of socially engineering attacks like malware are posing a greater threat on the Internet. They are one of the most common risks to people’s online safety. Having introduced malware protection in Internet Explorer 8 as part of the SmartScreen Filter it has been a very successful ad on to a commonly used product.

How it Works

First the SmartScreen Filter looks and evaluates the URLs coming into the website, it follows up with an inspection of the associated servers of origin. When the software spots a server as containing malicious content, SmartScreen displays a warning, saying that it is unsafe to browse to that respective site. The user is then given the opportunity to continue forward to the page or return back to their home page without downloading any content.

Here are some quick facts of interest about the Internet Explorer and malware as IE 8 hit this 1 billion blocks milestone:

* In August 2009 and March 10, the NSS Labs have recognized the Internet Explorer 8 SmartScreen Filter was a leader in protection against Socially Engineered Malware. The reports also compared Internet Explorer 8 to Firefox and Chrome, and others browsers.

* The SmartScreen malware filter blocking rates continue to improve because there is a continued effort to improve the SmartScreen service program at the back-end. In comparison, an August 2009 report showed that the filter blocked about 70 million attempts to download malware. This was about 18 million blocks per month. But at the time,Net Applications reported that only 15% of the Internet population used IE 8. Now speed forward. In the last two months, IE8 blocked about 100 million attempts to download malware. Furthermore, last month, according to Net Applications, the number of users of IE 8 was almost 26% of the Internet population. this translates to about more than 1.7 times more users working with Internet Explorer 8 than last August 2009; however, the blocking rare is 5 times more malware month on month.

Source:http://www.windows7news.com/

Traditional Antivirus is Wasteful

A response to this LifeHacker post:

Traditional real-time antivirus scanning is wasteful, IMO. Viruses can come through in what you download, or if your networking settings are weirdly insecure-- but it's not like you can just "catch" a virus. To warn people that their computers might be unknowingly infected is unnecessarily alarmist; a virus or trojan would have to come from a downloaded or copied file. I scan every file I download by having Free Download Manager call ClamWin (and A-Squared Command Line), which I update hourly (I even made an AutoHotkey script so that the scan happens in the background). This precaution makes more sense than scanning every file whenever it is read or written, and it is hugely better for your I/O performance.

All in all, though, blacklist-paradigm antivirus does not make a lot of sense nowadays for on-access scanning, because viruses (and more relevantly, other kinds of malware) spread before virus definitions are created. Furthermore, on-access scanning of files involves a huge performance cost. If you scan all incoming files, extra file scanning doesn't make any sense unless the virus definitions have been updated in the interim. I'm perplexed, for instance, by Avast!, which can scan all files + emails + IMs... if all files are being scanned, why the extra scanning repetition due to its route of entry?

However, blacklist-oriented antivirus seems wise for periodic on-demand scanning. For this, Norton Security Scan available free through Google Pack is a nice choice.

A better choice for so-called real-time antivirus, though, is behavior-based scanning such as Threatfire, but I prefer Mamutu ($30 for 1 year). Threatfire would interfere with several programs (especially the kind that export files to other formats: PDF Creator, AutoHotkey EXE compiler) even when "suspended," so I can't recommend it unless you're allergic to spending money on security software (as I tend to be). Comodo Firewall is another free alternative in this vein, but it is quite confusing.

Additionally, you can take some preventive measures by using SpywareBlaster. I paid for the privilege of auto-updating and to support its development, but you don't have to.

The one thing that irritates me most about many anti-malware products: the false positives. Since trying out Comodo BOClean and having it shut down a program I wrote myself as a trojan, I've been very suspicious of claims that BOClean has caught malware other antivirus missed. When I see claims like that, I wonder about the likelihood that it is a false positive. (To be clear, I do NOT recommend Comodo BOClean.)

A final note is that I think infrequently-updated real-time antivirus like AVG, which allows only daily updates in its free version, is the worst (if used by itself), because you're exposed to the newest threats while suffering an I/O performance hit.

An Easy Way to Improve Security in IE

The Hazards of MIME Sniffing

Bottom line:

As a user you can go into security settings for the Internet Zone and switch off the “Open files based on content, not extension” option.

New Antivirus Recommendations

• Avast! Home: Web Shield, Network Shield, Email/Outlook (Attachments Only), Standard Shield (Check only on copying/modifying files and not on application launch) -- Very fast and Web Shield does not slow down browsing.
  
• SpywareBlaster
  

Please see previous security/malware posts for more information, especially why I prefer a "light" antivirus strategy.

Antivirus Strategy Update: Recommended Download Manager

As I've written earlier, I believe real-time antivirus carries too high a performance cost for the protection it provides. Windows has a deserved reputation for security holes, but antivirus is not the most relevant part of a wise security setup for a PC. In fact, traditional antivirus has some troubling disadvantages:

1. Slow read/write disk access up to 15-fold
2. Definitions may not be available until after a virus has reached your computer
3. Deleting or quarantining false positives can be hazardous
4. Background scanning can interfere with software installation and updating, leading to malfunction that is difficult to correct
   
5. Popular free software like AVG updates only daily, so even if proper definitions are available, your software might not have them
6. Marketing preys on fears of the Internet that aren't proportional to the actual risk involved
7. The same files may be scanned many times even though they hadn't changed at all since the last scan
   
8. Hazardous files may still go undetected by scanner incompetence or bad virus definitions

I still use antivirus, but only for downloads and for periodic on-demand scans. To assist with this, I use a download manager that scans downloaded files. I've recently tried many options: Free Download Manager 2.5/2.6, Fresh Download 8.06, Download Accelerator Manager, Download Statusbar, BitComet, LeechGet 2007, Orbit Downloader, and FlashGet. Of these, my current favorite choice is Orbit Downloader, which needs the FlashGot extension for Firefox 3 to work properly with that browser. For scanning, I use ClamWin but with a compiled AutoHotkey script so that it scans downloaded files in a minimized window unobtrusively. You're welcome to download the small .EXE I use for this purpose for yourself (specify that .EXE as your virus scanner in the options of the download manager).

Beyond this, it's wise to use an active firewall such as the one the comes with Windows XP SP2 or Vista, preventative steps such as subscriptions against malware sites as is provided with SpywareBlaster and AdBlock Plus, and to keep unnecessary networking functions disabled.

UPDATE: Avast is free, has frequent updates, and can be set to only scan when files are being copied/modified. I now prefer this approach over Orbit Downloader + ClamWin.

Norton AntiVirus 2009 is Surprisingly Good

I've been down on Norton/Symantec products in the past, but Norton AntiVirus is the best antimalware application I've ever used. It's fast, efficient, and protects Firefox. I got my copy for $20 after rebate at Staples, and there might be other good deals elsewhere.

Update: I now more fond of Microsoft Security Essentials, which is free.

How Run Malwarebytes Anti-Malware

Most of my clients know that one of my favorite software programs is Malwarebytes Anti-Malware!  This program has helped me remove some of the top Malware and virus threats on their computers. As a result, I help all my clients download and install this program on their computers.  I've written much about about Malwarebytes Anti-Malware in previous posts, but I wanted to focus this post on showing folks how to update it and run the scans.

First, after you download and install Malwarebytes Anti-Malware, you'll see a red icon with a white "M" on your desktop (like that shown on the right.  You may or may not see the shield on top it.  To run the program, just double left-click the icon (Windows Vista and 7 may ask you to confirm that you want to open/run that program).  After the program opens, you'll see the screen below.

Don't be fooled by all the tabs you see.  The only two that you really need to pay attention to are the "Scanner" tab and the "Update" tab (circled in red). 

If you're using the free version of Malwarebytes Anti-Malware, you'll have to manually update the software and run the scan.  

So first thing you want to do after opening Malwarebytes,  is click  the UPDATE tab so you can update the software. 

Once on the update page, there are two pieces of information you'll want to pay attention to.  The first is the date of the last update.  Malwarebytes provides updates daily. And every time you update it, this date will change.  Knowing when you last updated the software and ran the scan is helpful.  

The next step is to click the "CHECK FOR UPDATES" button (you must be connected to the internet for this step).  Depending on when you last updated the software, it could take a few minutes to complete, and you may (or may not) need to reboot the computer to finish the update.  Sometimes Malwarebytes will need to close the application and then you'll have to reopen it.

Just be sure to always update the software before running the scan.  

After Malwarebytes has been updated, click the SCANNER tab to run the scan.

There are two types of scans you can run - Quick Scan or Full Scan.  Most of the time, the Quick Scan will suffice (especially if you're running scans regularly).  The only time I run the Full Scan is when I want to perform a deep thorough scan for maintenance purposes or when I suspect a problem.   

The Quick scan takes 15-30 minutes are on average and the full scan can take anywhere from 1-6 hours (depending on the size of your hard drive and how much data you have on it).  The good news is that you can do other things on the computer while the scan is running - although it may slow you down a bit.

After selecting the type of scan you want to run (Quick or Full), click the SCAN button to start the scan. 

While the scan is running, you'll notice that it shows "Objects Infected" followed by a number (which is zero at the start) on the screen.  If Malwarebytes finds any problems, "Objects Infected" will turn red and show a number.  You'll have to wait for the scan to complete before you can see what it found.  If Malwarebytes doesn't find anything, this number will remain "0".

If you look at the bottom of the window while the scan is running, you'll see two buttons:  "Purchase" (if you're running the free version) and "Exit".  If  Malwarebytes finds infections, these buttons will disappear after the scan completes and you'll see a new button labeled, "SHOW RESULTS" (you'll only see this button if infections are found).

If you see the "SHOW RESULTS" button after the scan completes, you'll want to click it. The next screen shows you in detail what infections were found and by default, all are checked.  To remove those infections, you'll want to click the REMOVE ALL button.  In most cases, you'll be told to reboot computer to complete the removal process. 

After you reboot computer, I would recommend running the scan again to make sure it comes out clean.  I have seen cases where a scan needed to be ran 2 or 3 times before all infections were removed.

I recommend updating and running Malwarebytes Anti-Malware at least weekly to help keep your computer clean of malware. 

How to Protect Your Computer From Malware

In addition to virus protection, it's important to protect your computer from Spyware, Adware, and Malware.  Some "internet security" and Antivirus software will protect you against some of the additional threats, but they may not catch them all.

For years I ran Stopzilla and  Lavasoft's Ad-aware on my personal computer from spyware and adware.  But since discovering, Malwarebytes Anti-malware, I now favor this program. I've written several posts about the biggest Malware threat (Windows Antivirus) nfecting many of my client's computers, and Malwarebytes Anti-malware is the ONLY program out there that's been able to completely remove it in most cases.  For that reason alone, I've become a HUGE fan of Malwarebytes.

Malwarebytes makes a free and paid version of their Anti-malware program.  I've been using the free version, which is fine for me, but it's takes some discipline on my part.  The biggest difference between the paid and free version is automation.  With the free version of Antimalware, I have to remember to update the software and run the scans myself.  The paid version will automate updates and scanning for you.  If you're one of those people who doesn't want to be bothered with managing the software yourself, then I'd highly recommend getting the paid version.

Regardless of which version you use of Malwarebytes Antimalware (paid or free), I highly recommend downloading and installing it on your computer.  And of course, don't forget to use it!  This is one program you really want to have on your computer BEFORE some of these problems find their way onto your computer because some malware programs will prevent you from installing it after they infect your computer.

Between Norton Internet Security and Malwarebytes Antimalware, my computer stays really clean of viruses, malware, spyware and adware.

To download and install Malwarebytes Antimalware, click here.