Real-time spyware stats

We’ve been doing a fair amount of work on cleaning up our research center, and now there’s a nifty new thingie on the front page of our research center — live stats of spyware being removed from CounterSpy users’ systems. 

It’s a general and approximate representation of a sample of our users but it’s interesting to play with (we did have a version floating around in the past but it was not broadly known about — except for one writer who mentioned it in his newsletter).

Spywarescan000013

You can see the live stats here.

And here’s something curious — recently we saw a number of ancient pieces of adware on the top-10 list:

  • ABetterInternet – Adware (General)
  • Bridge/WinFavorites – Adware (General)
  • Xplugin – Trojan Downloader
  • Transponder TPS108 – Browser Plug-in
  • Transponder.Pynix – Adware (General)
  • DailyToolbar – Toolbar

I’ll quote from an internal email from Eric Howes, Sunbelt’s director of malware research:

The culprit is the new rogue anti-spyware app, TitanShield AntiSpyware. Incredibly enough, this app loads a bunch of bogus spyware/adware, which is then proceeds to detect.

The bogus spyware/adware conists of both garbage dummy files named and located like the originals of the above threats as well as Registry keys that actually match the above threats.

CounterSpy is detecting both the Reg keys and, in some cases, the files (based on file name/path match) and reporting that the PCs are infected with those ancient spyware/adware programs, when in fact what’s really going on is that TitanShield loaded a bunch of bogus apps.

It’s hard to call these false positives, and the junk really should be removed. It’s just that the users’ PCs aren’t infested with the above apps but rather TitanShield AntiSpyware.

Pretty incredible, eh?

Alex Eckelberry

 

E&Y gives award to freeze.com

Ever year, Ernst and Young holds “Entrepreneur of the Year” awards, regionally and nationally.  (I was nominated for the award last year in my region but lost out to a smart guy who provides internet access to hotels, while Dave Moll. over at WebRoot deservedly won last year in his region.) The process of winning an award is a bit of a mystery, but one assumes there’s a certain amount of due diligence in the whole process. 

Well, the E&Y team for the Minessota/Dakotas region decided that the folks who power Freeze.com deserved to become Entrepreneurs of the Year for their region.  They are Aaron Weber, Vice President, Robert Weber, President and Founder, and Ryan Weber, Executive Vice President and Founder.

Ok.  What is Freeze.com?  It’s a site which tries to load you up with adware and spams you, in return for free screensavers. 

A recent test install of a screen saver netted attempts to install products from New.Net, WhenU and the Yahoo toolbar.  It was a cornucopia of fruity, juicy ads blizzard happiness.  Use a product from Freeze.com and you will be awash in sea of happy advertising!  But you’ll have a cool screensaver, so that’s a relief.

Here’s a recent download of one nifty shark screensaver:

Freeze1

Start page

Freeze_yahoo

Yahoo toolbar

Freeze3

WhenU SaveNow adware

Freeze4

New.net adware

Freeze5

Weather Channel

(To their credit, I opted out of all of these offers, and they didn’t install on my machine.  But how many people just click “Next, Next, Next”?)

On my desktop, there was a cluster of beautiful new icons.

Freeze_icons

These point to Certified-Safe-Downloads, aka Registry Cleaner (rating) and 24/7 downloads (rating) — and a couple of other sites.  (Fwiw, Freeze.com EULA here.)

Anyway, Freeze’s formula has worked.  According to the company,. the company has grown over 400% in the last three years, has been profitable since inception and has 85 million registered users.

Well, what can I say.  This company isn’t a criminal enterprise by any stretch of the imagination.  They’re just a bunch of guys aggressively monetizing free screensavers through advertising.  I just wonder if that E&Yoffice should have given the award to their local guy who does internet access to hotels.

 

Alex Eckelberry
(Hat tip to SiteAdvisor)

Sunbelt TechTips for the week of June 12th

How to reinstall Windows without reactivating
Need to format your hard drive and reinstall XP, and don’t want to have to go through the product activation process again? You can save the activation status info and then restore it after you reinstall the operating system, as long as you haven’t made any changes to the hardware. Here’s how:

  1. Before reformatting, in My Computer, double click the drive letter on which you installed XP, and navigate to WINDOWSSystem32.
  2. Click “Show the contents of this folder” if necessary.
  3. Copy the following files to a floppy, USB drive, CD/DVD or network location: wpa.dbl and wpa.bak.
  4. After reformatting and reinstalling XP, select NO when asked if you want to activate Windows now.
  5. Restart in Safe Mode.
  6. In My Computer, open the WINDOWSSystem32 folder and rename the existing wpa.dbl and wpa.bak files (if you have them).
  7. Now copy your old wpa.dbl and wpa.bak files to the System32 folder.
  8. Restart and you should not be requested to activate again. This only works when you reinstall Windows on the same computer and the hardware remains the same.

Can’t play your WMA file?
If you get a message that says “A security upgrade is required to play this file” when you try to play a WMA file in Windows Media Player: This happens when you try to play copy protected content in Windows Media Player 10. If you click the “yes” button, you will probably get a message that says “This computer is not authorized to play this song. In order to play this song you must first purchase it. If you already own the song, sign in to listen to it.” At that point, you’re given two choices: buy the song for $.99 or click the “I already own this song button.” If you click the latter, you may be asked to install the MSN Music Assistant and the digital rights management components on your XP computer may be upgraded by creating a unique identifier and sending it to the MSN server. To download the Assistant, you’ll have to sign into MSN with a Passport or Windows Live ID.

If you get a message that you’re unable to upgrade the DRM components, it may be because your LAN settings in Internet Explorer are configured to automatically detect a proxy server. To fix that, click Tools | Internet Options, click the Connections tab and then click the LAN Settings button. In the dialog box, uncheck the box labeled Automatically Detect Settings.

Slow Performance of Favorites menu with SP2
If you find that your computer is slowing down to a crawl whenever you try to access the Favorites menu in IE or Windows Explorer after you installed Service Pack 2, it may be because you’re redirecting the My Documents folder to a non-local (network) location and have enabled the desktop.ini cache. There is a hotfix available for this problem, but Microsoft recommends you apply it only if severely affected. Read more in KB article 898612.

Memory leak in Tablet PC
If your portable computer is running the Tablet PC edition of Windows XP and you’re noticing a gradual decrease in available system memory that causes a performance hit, you may be suffering from a known memory leak caused by the tcserver.exe service. Restarting the computer fixes the problem temporarily, but now there is a hotfix you can get from Microsoft Product Support Services. To find out how, see KB article 895953.

You get an error message when you try to open User Accounts in Control Panel
If you try to open the User Accounts applet in the Windows XP Control Panel and instead of opening, it gives you a message that says “Microsoft HMTL Application host has encountered a problem and needs to close,” you can usually remedy the problem quickly by registering a DLL. For instructions on how to do so, see KB article 919751.

Deb Shinder

Vista goes public

Techies have been testing it for months, but as you know, until now, most had to wait.

There’s been plenty of hype about Microsoft’s new operating system, from both sides of the fence. On private newsgroups, beta testers have posted horror stories, glowing reports, and everything in between. Some industry pundits have ragged on Microsoft for omitting some features as Vista has rolled closer to completion and for pushing the final release date back. Meanwhile, members of the computer-using public have reacted in ways ranging from ho-hum apathy to eager anticipation. Now those who want to (and are brave enough) can try it out for themselves. Last week, Microsoft released the first public beta of Vista. You can download the “Customer Preview Edition” here.  

It comes in English, German and Japanese language versions and if you’re running cutting edge hardware, yes, you can get a 64 bit edition. Registering for the Customer Preview will also get you the release candidate (RC1) when it becomes available later this year.

As an MVP and MSDN member, I’ve had access to several previous builds of Vista betas and some of them have impressed me more than others. Since I’ve been under a Non-Disclosure Agreement, though, I couldn’t write much about it. Now the cat’s out of the bag! I decided to try to approach this public beta fresh, as if I were a consumer seeing it for the first time, and report on the download and installation experience here.

For a small fee, you can have Microsoft send you a DVD. I opted to instead download the ISO file. It’s about 3.5 GB for the 32 bit edition or 4.4 GB for the 64 bit, so a high speed connection is almost essential. You also need a DVD burner in order to convert the download into a bootable DVD. Of course, if you’re using virtualization software you can run the ISO as if it were a physical disc. Be sure to check the system requirements and run the system checker on the installation DVD before attempting to install.

I’ve installed the private betas of Vista in virtual machines (both Microsoft’s Virtual PC and VMWare). For this public beta, I decide to take the plunge and install it “for real” in a dual boot configuration with XP on one of my two primary computers. That took a leap of faith (if things go wrong in a VM, it doesn’t affect your host operating system; if things go wrong in a dual boot install, you might end up hosing XP). But I crossed my fingers, said a prayer and clicked “Install.”

First you’re asked whether you want to connect to the Internet during installation and automatically install updates. Since this was the default choice most consumers would make, I okayed it. Next you have to agree to the EULA, then choose whether to upgrade your current OS or do a custom installation. I was very pleased to see that the upgrade option is disabled (that’ll keep a lot of people from overwriting their XP and regretting it later). You must remove c:ProgramData in order to upgrade.

I chose Custom Install and picked an empty partition I’d created just for Vista. File copy took about five minutes, but expanding those files took almost three times that long. Then it flew through feature and update installation and we came to “Completing Installation” less than 20 minutes after beginning (of course, your mileage may vary depending on your computer’s resources and configuration. This is a fairly high end system). The computer rebooted a total of three times during the process.

The only scary part came at the end, when after about one minute of the Completing Installation screen, the monitor went black and a “no signal input” message appeared. This lasted for maybe two minutes (two long minutes), but it was obvious there was still activity going on from the DVD and hard disk noises. Finally the disc spun down and then the system restarted for the third and last time. The boot menu appeared, with two choices: “Microsoft Windows” (that’s Vista) and “Earlier version of Windows” (which I hoped would take me to my original XP installation). I booted into Vista first.

The cursor appeared and “Beta 2, Build 5384” in the lower right corner of the screen. After 30 seconds or so, the graphic setup program started. The dialog boxes went through the usual questions: country, region, keyboard layout, entering username and password, choosing a computer name and wallpaper, time/date settings. You’re also asked whether you want to automatically install updates, use recommended security settings, or decide later. When setup is complete, you click Start and a logon screen appears. Enter the password you set up for the account a moment before, and your desktop will appear in another half minute or so.

I was automatically connected to my home network and could access my domain resources. IE 7 worked on the first click (I still remember how many readers wrote in exasperation when XP’s IE 6 wouldn’t connect “out of the box”). Most exciting of all, I opened Outlook Express, entered the configuration settings for my Exchange server, and OE immediately connected and started downloading my folders. The OE interface has two folder hierarchies, one for the local inbox and one for the Exchange inbox. How cool. The only real glitch I encountered was that multiple monitors didn’t work. I have three monitors connected to two video cards on this computer, and all three work fine in XP. Vista only seemed to recognize the primary monitor (DVI connection). I’ll be spending some time figuring that one out.

Shutdown was fast, and then came the moment of truth: was XP still there? At the boot menu, I selected “Earlier version” and after only a brief moment of suspense, was back in my old operating system, which performed normally. I’d rate the installation of the Customer Preview edition a definite success – although I’ll be happier still when I can get all three monitors going.

Despite my own experience, remember that different systems may react differently and some will have compatibility issues. Installing in a VM is still the safest way to experiment with beta software. If you give Vista a try, please back everything up first. And let us know how it goes. Now that the NDA restrictions don’t apply, I’ll be writing more about Vista’s new features in the future.

Deb Shinder

Titan Shield – New rogue antispyware app

Titan Shield (aka TitanShield) offers loads of fun.  Available at antispywarebox(dot)com (a new rogue site) and titanshield(dot)com

Titan_000001

One curious thing this naughty program does is install fake adware files on your PC.

The latest version of CounterSpy will detect this new rogue application (download here).

Alex Eckelberry
(And gracious thanks to our friends at MAD for the tip)  

 

Car ad brings malware: Beware

Got this from Mat at Sana Security.  An innocent looking ad on Craigslist leads to a site with malware.

Hello,
Thank you for your interest in my car. I gladly inform you that it is still on sale so you are right on time.
Sorry for the delay, as I am staying in the hospital right now. As I have to cover all the costs myself, I am selling it and the deal is very good for you. The car is in an excellent good condition. Please, follow the link and download all the specific information about the car:
http://url_removed/myalbum.exe
As soon as you download it, you will have all the necessary data:
description, photos, and other
details. Please, make sure you are well acquainted with the info so that your decision would be reasonable. The car is in excellent condition, no accident. Thank you.
Please, reply ASAP and feel free
to ask any questions.
P.S. To watch the pictures you are to save the portfolio on your computer and launch it.

Mat’s link here.

Alex Eckelberry

If you want a spare towel, Microsoft just threw one in

While official support ends in mid-July, Microsoft looked at fixing MS06-015 and said screw it:

Specifically, after extensive investigation, we’ve found that it’s not feasible to make the extensive changes necessary to Windows Explorer on these older versions of Windows to eliminate the vulnerability.

This is because during the development of Windows 2000, we made significant enhancements to the underlying architecture of Windows Explorer. The Windows Explorer architecture on these older versions of Windows is much less robust than the more recent Windows architectures.

Due to these fundamental differences, these changes would require reengineering a significant amount of a critical core component of the operating system. After such a reengineering effort, there would be no assurance that applications designed to run on these platforms would continue to operate on the updated system.

We do strongly recommend that customers still using Microsoft Windows 98, Microsoft Windows 98 Second Edition (SE), and Microsoft Windows Millennium Edition (ME) protect those systems by placing them behind a perimeter firewall which filters traffic on TCP Port 139 which will block attacks attempting to exploit this vulnerability. This is discussed in the “Workarounds” section of the vulnerability.

Link here via /.

Well, this may elicit howls of protest from some, but I personally don’t blame them much.  Low-level Win 98 development is a horrible, ghastly endeavor, and given the challenges they were faced with (like making apps continue to be compatible), I think they made the most logical decision.

 

Alex Eckelberry

This is how we resolve problems in Florida

Now there’s jurisprudence in our local court.  Come to think of it, I rather like it.

This matter comes before the Court on Plaintiff’s Motion to designate location of a Rule 30(b)(6) deposition (Doc. 105). Upon consideration of the Motion – the latest in a series of Gordian knots that the parties have been unable to untangle without enlisting the assistance of the federal courts – it is

ORDERED that said Motion is DENIED. Instead, the Court will fashion a new form of alternative dispute resolution, to wit: at 4:00 P.M. on Friday, June 30, 2006, counsel shall convene at a neutral site agreeable to both parties. If counsel cannot agree on a neutral site, they shall meet on the front steps of the Sam M. Gibbons U.S. Courthouse, 801 North Florida Ave., Tampa, Florida 33602. Each lawyer shall be entitled to be accompanied by one paralegal who shall act as an attendant and witness. At that time and location, counsel shall engage in one (1) game of “rock, paper, scissors.” The winner of this engagement shall be entitled to select the location for the 30(b)(6) deposition to be held somewhere in Hillsborough County during the period July 11-12, 2006. If either party disputes the outcome of this engagement, an appeal may be filed and a hearing will be held at 8:30 A.M. on Friday, July 7, 2006 before the undersigned in Courtroom 3, George C. Young United States Courthouse and Federal Building, 80 North Hughey Avenue, Orlando, Florida 32801.

DONE and ORDERED in Chambers, Orlando, Florida on June 6, 2006.

Link here.

Alex Eckelberry

Even if a teller says it’s ok, it still may not be

Tedd Richardson has a good post about fraud:

Just because someone at the bank tells you a check is good, it might not be the case. Here is a story written by Caroline Mayer of the Washington Post, where someone selling a car on a auction site received a check for more than the amount of the purchase and was asked to wire the excess funds back. The seller was suspicious and asked a teller at his bank (twice) to verify the check and was told it was good. Here is what happened next as Caroline Mayer reports: “Four days later, as he reviewed his account online, he discovered the check was not good. Even worse, the bank was demanding that he repay the $5,000.”

Link here.

Alex Eckelberry

No, there s not a net-neutrality problem at Cox

Some Cox subscribers might be having a tough time getting to Craigslist

Instantly, rumors started that Cox was doing a net-neutrality thing — throttling bandwidth to the site to stifle competition against their own print classified business.

Well, it turns out the problem is a lot simpler (and considerably less nefarious): It’s related to the AV/firewall suite that Cox license from Authentium.  Since we do business with Authentium, I thought I would contact them to get an explanation.

Here’s what happened: Craigslist does the unusual step of sending a TCP packet with a zero-length window (typically used to indicate that that the server is experiencing congestion and can’t handle more data). 

Those subscribers running the suite will experience delays in getting to the site, since Authentium’s firewall responds to the zero-length window by sending data only one byte at a time, even after the server increases the TCP window size.

Authentium is on it and is fixing the problem.

The whole thing is explained here by Ray Dickenson of Authentium. 

Alex Eckelberry

CastleCops under heavy attack

A while back, Paul and Robin Laudanski and I started PIRT, and the results have been strong.  The PIRT volunteer staff is taking down lots of phishing sites.

I guess it’s been working and pissing off some phishers, because CastleCops has been under heavy DDoS attack.

Things are back to normal, and Paul will be writing something up a bit later as a forensic investigation is still in progress.  

Alex Eckelberry

PornMagPass — your pass to hell

There’s a new trojan on the loose, undetected by almost all AV engines:  Pornmagpass, from pornmagpass(dot)com.

Pornmagpass_0001

Install it as a “free” ticket to porn. After all, the FAQ says “It is 100% free. No catch.”

But… the EULA says:

SOFTWARE INSTALLATION: Components bundled with our software may report to Licensor and/or its affiliates the installation status of certain marketing offers, such as toolbars, and also generalized installation information, such as language preference and operating system version, to assist Licensor in its product development. No personal information will be communicated to PORNMAGPASS or its affiliates during this process. Licensor may change homepage on user’s computer and may offer additional components through our version of checking/update system. These components include: toolbar, popup ads manager, advertisements messenger, pc protection software, shortcuts manager.

Well, well.

Install it, and this trojan will install rogue security app SpywareQuake and adds a new IE Toolbar called “Safety Bar”

Pornmag_1023

To mangle a common phrase, the pass to hell is littered with porn. In this case, PornMagPass.

And as a final note, yet another malware site hosted by Intercage, the Best Friend Ever of all malware authors. 

 

Alex Eckelberry
(And thanks to Sunbelt’s Adam Thomas for his work on this)

The LAMP controversy

The idea of LAMP (which stands for Linux, Apache, MySQL and PHP) has its share of detractors. Cliff Wells is one of them, and writes an interesting rant on the subject.

PHP and MySQL are this generation’s BASIC, the language that was described thusly by the Free Online Dictionary of Computing

BASIC has become the leading cause of brain-damage in proto-hackers. This is another case (like Pascal) of the cascading lossage that happens when a language deliberately designed as an educational toy gets taken too seriously. A novice can write short BASIC programs (on the order of 10-20 lines) very easily; writing anything longer is (a) very painful, and (b) encourages bad habits that will make it harder to use more powerful languages well. This wouldn’t be so bad if historical accidents hadn’t made BASIC so common on low-end micros. As it is, it ruins thousands of potential wizards a year. [ed — possibly mis-attributed quote. ]

Link here via /. And the comment storm is epic on this one, so I know I’m stepping feet-first into the fire.

I’m not going to comment on code. We have coders here who love PHP and those who don’t. .

But focusing on the security perspective, LAMP can be a deadly combination. Let’s face it: People get sloppy with security policies for Apache, MySQL and PHP. I can’t believe the amount of crap I see out there that’s only in existence because of loose security and poor (or more likely, non-existent) patching practices.

We use PHP ourselves in our beta forums. But it gets tiring dealing with open source in a commercial environment. PHP is routinely exploited and we have to constantly stay on top of our code to keep it updated and secure.

I do understand the other side — so many people have gotten their start with some quick PHP scripts and MySQL. Look at Paul Laudanski at CastleCops and Suzie Turner at SpywareWarrior — both have created robust, highly secure PHP-based sites (and in the case of Paul, he’s admirably stretched MySQL to its absolute limits).

And, yes, any language can be mis-used and exploited.

So before the comment storm starts, I am not bashing Perl, Python or PHP. I’m not bashing Apache (well, not really…). And dear God, I’m not bashing Linux, or else I know that my website will be blown up by Microsoft-hating vigilantes.

It’s just like this: Like any tools (including, umm, chainsaws), one has to know how to use them and be responsible for their use.

I’ve seen way, way too many hacked Apache servers not to say something.

Alex Eckelberry