Virus Alert

Optimus Media News » FBI Warns of Storm Worm Virus

July 31, 2008 by Ron Shank Leave a Comment

The Federal Bureau of Investigation and its partner, the Internet Crime Complaint Center (IC3), have received reports of recent spam e-mails spreading the Storm Worm malicious software, known as malware. These e-mails, which contain the phrase “F.B.I. vs. facebook,” direct e-mail recipients to click on a link to view an article about the FBI and Facebook, a popular social networking website. The Storm Worm virus has also been spread in the past in e-mails advertising a holiday e-card link. Clicking on the link downloads malware onto the Internet connected device, causing it to become infected with the virus and part of the Storm Worm botnet.

“The spammers spreading this virus are preying on Internet users and making their computers an unwitting part of criminal botnet activity. We urge citizens to help prevent the spread of botnets by becoming web-savvy. Following some simple computer security practices will reduce the risk that their computers will be compromised,” said Special Agent Richard Kolko, Chief, FBI National Press Office.

Everyone should consider the following:

* Do not respond to unsolicited (spam) e-mail.

* Be skeptical of individuals representing themselves as officials soliciting personal information via e-mail.

* Do not click on links contained within an unsolicited e-mail.

* Be cautious of e-mail claiming to contain pictures in attached files, as the files may contain viruses. Only open attachments from known senders.

* Validate the legitimacy of the organization by directly accessing the organization’s website rather than following an alleged link to the site.

* Do not provide personal or financial information to anyone who solicits information.

More here: Optimus Media News » FBI Warns of Storm Worm Virus.

Firefox Security Flaw Affecting Gmails Users – The Firefox JAR vulnerability still there – Softpedia

November 13, 2007 by Ron Shank Leave a Comment

This is big folks. I recommend getting firefox’s “no script” add-on right away.

Firefox Security Flaw Affecting Gmails Users – The Firefox JAR vulnerability still there!
Last week, security companies around the world spotted a new vulnerability in Mozilla Firefox which could allow the attackers to use a malicious JAR file to harm users computers. The security flaw is still there and moreover, it seems it affects most websites on the Internet including the super search giant Google.
GnuCitizien wrote that Michal Zalewski from Google you know, that famous hacker who joined Googleplex required additional information about a potential exploitation over the companys technologies. In addition, beford.org discovered a way to steal the Gmail contact list using a malicious JAR file especially created to take advantage of the Firefox vulnerability.

Im not going to offer you more details about it but Ill give you a tip on how to remain protected against attacks. You can always install the NoScript extension which was already updated to provide protection for this exploit. In case you never tried it, NoScript is an add-on designed to work with Mozilla Firefox which is supposed to disable the webscripts included on the websites you choose.

More at Softpedia

Storm worm exploits YouTube

October 10, 2007 by Ron Shank Leave a Comment

‘Storm worm’ exploits YouTube | Tech News on ZDNet

Spammers are exploiting YouTube’s “invite your friends” function to send spam containing a variant of the “Storm worm.”Bradley Anstis, director of product management at security firm Marshal, said that spammers are taking advantage of the YouTube function that lets people invite friends to view videos that they have viewed or posted. The function allows someone to e-mail any address from an account.

The scam on Google’s video-sharing site is targeting Xbox owners, urging recipients to collect a prize version of the popular game Halo 3. Anstis said clicking on the link to “winhalo3” leads to a file containing a Storm trojan.

To date, Marshal has tracked around 150,000 of the spam e-mail messages thought to have originated from YouTube accounts.

Trojan Horse SHeur.AFJ (false positive within Quickbooks/Quickin)

July 14, 2007 by Ron Shank 40 Comments

There are a growing number of reports that this is a false positive within AGV.

I’ll update you with more soon, but for now check out this excellent post on the topic (translated to English here). Complete with screen shots and search engine analysis.

Please leave a comment if you have any information to share. Unlike the AVG Forum, stupid questions will not be deleted nor the questioners abused. We were all stupid at some point so, chill-out folks.

Update: I have found AVG to do find this with multiple PCs in separate locations. It’s definitely a false positive (misreading from the AVG software). (A note to AVG users, don’t let this bother you, I’ve been using AVG for years and I think this is only the 2nd time Its found a false positive.)

Another Update: AVG will not quarantine Quickbooks files, but it will quarantine Quicken files automatically (in many cases). If you get a message that says the files were deleted you can get them out of AVG’s Virus Vault.

Update #3: I see that the folks at Quickbooks are aware of the issue and are working with AVG to repair it.

IM-Names Trojan/Virus/Spyware

April 11, 2006 by Ron Shank 7 Comments

MSN messenger users are seeing this message sent to people on thier contact list:

Hey, I get my MSN Names from http://www.IM-Names.com

Remove the malware with your favorite spyware killer (like Ad-aware)

If you have questions or comments you are welcome to leave them in the comments section.

Ron’s Note: Good fix from Dave below:

Dave Says:
May 22nd, 2006 at 8:08 am eThis worked for me!

first open WINDOWS TASK MANAGER (ctrl+alt+del) then click on PROCESSES. now look for something called ‘IM-svr.exe‘ click on it then then END PROCESS.

now goto ur program files folder and delete IM-names folder

Virus Alert – Just calm down

February 2, 2006 by Ron Shank Leave a Comment

Experts at SophosLabsÃ¢â€žÂ¢, Sophos’s global network of virus, spyware and spam analysis centers, have warned users not to panic over the threat posed by the Nyxem-D worm (also known as Blackworm, Email-Worm.Win32.VB.bi, Win32/Mywife.e or W32.Blackmal.E@mm), which is programmed to wipe data on infected computers on Friday 3 February, but to take calm action.

“When you panic, you make mistakes,” said Graham Cluley, senior technology consultant for Sophos. “Sit down, have a cup of tea, and work out if you have done everything you should have done to ensure your computer isn’t at risk from the Nyxem worm, and indeed any of the other 120,000 pieces of malware in existence.”

The W32/Nyxem-D worm, which can pose as pictures of the Kama Sutra, has a destructive payload, which triggers half an hour after a computer is booted on the third day of any month, destroying DOC, XLS, MDB, MDE, PPT, PPS, ZIP, RAR, PDF, PSD and DMP files by replacing their contents with the phrase:

DATA Error [47 0F 94 93 F4 K5]

The Nyxem worm overwrites files with a bogus error message

Sophos automatically updated customers with protection against the W32/Nyxem-D Windows worm, which does not infect Macintosh computers, at 16:03 GMT on 16 January 2006. Experts believe that home users may be at more risk than businesses because typically they take security issues less seriously.

Need Antivirus?
I recommend Bsafe Online’s Security Suite. A 10-day FREE trial is available here.