Fake codecs getting creative

The fake codecs are really trying to look legitimate. 

Iaxobject.com1282006

Mediaactivex.com1282006

IP: 85.255.117.196 
iaxobject(dot)com   

IP: 69.50.188.103   
activexsoftwares(dot)com    

Potential future scam sites:

IP: 85.255.118.213 
anetgate(dot)com   

IP: 85.255.117.186 
interestslinks(dot)com         

The fake codecs are typical Zlob variants. For those endless people who find out about fake codecs by googling my site, it goes without saying that you should not install these fake codecs.  All sorts of very bad things will happen, like rootkits, trojans and the like. 

Patrick Jordan, Alex Eckelberry

CommScore admits relationship with DollarRevenue, denies it went far

Sunbelt’s Eric Howes and Ben Edelman have been doing some research on ComScore’s tracking software (ComScore tracks user behavior for market research)  and discovered it installed along with a DollarRevenue adware infestation. Forbes has written about it:

ComScore admits that the company engaged in partnership negotiations with DollarRevenue, even going as far as giving the company test software, says privacy officer Chris Lin. But the discussions stopped there, and the companies never signed a contract. Then, several months ago, comScore software installed by DollarRevenue started reporting back to company servers, says Lin.

DollarRevenue is slime.  A simple Google search would reveal this to any casual surfer.  Maybe it was in their sales department and didn’t go anywhere after that.  Ok, I can buy that, and that is understandable.  But why did ComScore software end up in DollarRevenue adware installs after the negotiations broke down?    The fundamental problem?  ComScore may try hard to police their channels, but they will always lose some aspect of control by using third-party affiliate channels to distribute their software.

Alex Eckelberry

Word vulnerability

Juha-Matti has written a very good overview of the Word zero-day vulnerability.

Q: What is the recent Microsoft Word 0-day vulnerability disclosed in December?
A: This vulnerability is caused by an unknown error when processing malformed Word documents. The issue was disclosed by the vendor. Late on 5th December Microsoft reported about zero-day type attacks using undocumented, previously unknown vulnerability in Microsoft Word products. Microsoft released Security Advisory to provide a notification of a “publicly disclosed vulnerability”.

Link here

Alex Eckelberry

 

 

Electronic lottery notifications are always fake. Period.

I got this question today from a reader, which I will print verbatim here:

how do i know if ‘the electronic mail lottery award notification i have received on email is valid and not fake

This person most certainly found my blog through a Google search.

So, for the benefit of other searchers, let me make a few facts of life clear:

1. Electronic lottery notifications are always fakes

2. Offers to pay you lots of money for working at home are worthy of trashing. In some cases, you’re going to become a mule.

3. Offers to help get a bunch of money out of some Nigerian agency are similarly frauds.

4. Offers to help in some kind of import/export deal are frauds.

5. Anything that promises money for little or no work is a lie. The only people who make huge profits for little or no work are criminals, politicians, oil company and pharmaceutical executives. 

Alex Eckelberry

The creativeness of spammers

Article in the NY Times this morning from Brad Stone (who recently moved to the Times from Newsweek):

You’re not the only one. Spam is back — in e-mail in-boxes and on everyone’s minds. In the last six months, the problem has gotten measurably worse. Worldwide spam volumes have doubled from last year, according to Ironport, a spam filtering firm, and unsolicited junk mail now accounts for more than 9 of every 10 e-mail messages sent over the Internet.

Much of that flood is made up of a nettlesome new breed of junk e-mail called image spam, in which the words of the advertisement are part of a picture, often fooling traditional spam detectors that look for telltale phrases. Image spam increased fourfold from last year and now represents 25 to 45 percent of all junk e-mail, depending on the day, Ironport says.

Link here.

Alex Eckelberry

Get your piping-hot, fresh-baked scam sites here!

Avoid these like the plague.

IP: 85.255.118.214 
checkssecurity(dot)com      
cleansoftwares(dot)com      
protectionszone(dot)com     
entertainingzone(dot)com    
outgates(dot)com           
atruesecurity(dot)com         
atotalsafety(dot)com           

IP: 85.255.118.244 
allprotections(dot)com         

Allprotections.com1262006

Atotalsafety.com1262006

Atruesecurity.com1262006

Checkssecurity.com1262006

Cleansoftwares.com_securityguide1262006

Protectionszone.com_scareads1262006

All of these sites are using a zlob trojan installed from vaxobject(dot)com.

And avoid this new fake codec, vaxobject (Video Access ActiveX Object).  It’s spyware. 

Vaxobject1123900

IP: 69.50.188.100   
vaxobject(dot)com  

Patrick Jordan and Alex Eckelberry

Sunbelt Weekly TechTips

Vista Drivers: Keeping ‘Em Coming
Vista has gone RTM, but that doesn’t mean it’s “finished,” especially in terms of things like adding hardware driver support. Jim Allchin of Microsoft assured us in his blog last week that they’ll be adding more to the 19,500+ device drivers that are included on the Vista DVD. There’s already an additional 11,700 drivers that will be available on Windows Update. Read the full post here.

Ms788199.OfficeOutlookRibbon_Fig2(en-us,office.12)

The Office Ribbon: You’ll be Seeing More of It
The “ribbon” interface is the most controversial new feature in Office 2007. It seems you either love it or hate it. So there’s good news or bad news, depending on your point of view: Microsoft is licensing the Ribbon UI to other software makers, so they can make their programs look and feel more like Office (exception: programs that compete directly with Office applications). Luckily, I like the ribbon. My husband is a ribbon-hater, so he’s not going to be happy about this. Read more here.

Zune doesn’t work with Vista?
Speaking of Vista compatibility, we’re hearing from some sources that the new Zune music player from Microsoft doesn’t work with Vista. We also hear that it will be compatible eventually, but we’re not sure when. Link here.

Microsoft Desktop Stereograms
Did you know that some of the standard desktop wallpapers that come with Windows are stereographic images? Reader Tom M. tells us to try the Feather Texture, Gone Fishing and Coffee Bean backgrounds, looking at them like regular stereograms. When they “click in,” the desktop icons will seem to hover above the background and moving your head causes an apparent perspective shift between icons and background. Sure enough, it works. Cool! And reader Jeff B. sent us this link to a site where you can make your own stereograms.

70882_smallnetmap

Vista: Exploring the Network Map
Vista includes a new look to the network connections interface, called the Network Center. The Network Map displays a diagram showing your computer and other computers and devices near it. To view the map:

  1. Click Start | Control Panel
  2. Under Network and Internet Connections (in non-classic view), click View Network Status and Tasks.
  3. In the Network Center, under Network Map, click View Full Map.

This displays the computers and devices (such as routers and switches) that Vista detected, and how they’re connected to one another. For more about this feature, click here.

How to roll back to IE 6
If you want to uninstall IE 7 and go back to IE 6, here’s how: 

  1. Click “Start,” and then click “Control Panel.”
  2. Click “Add or Remove Programs.”
  3. Check “Show Updates” at the top of the dialog box.
  4. Scroll down the list and highlight the version of Internet Explorer 7 that you are running, and then click “Change/Remove.” (If you are running Internet Explorer 7 Beta 2 Preview – March 20 or later, it is not necessary to check “Show Updates.”)

If you get an error message saying you can’t uninstall from the logged on user account, you may have to log off and log back on with a different account, or edit the registry to bypass the user account check:

  1. Click Start | Run.
  2. In the Run box, type regedit and then press ENTER.
  3. Navigate to HKEY_CURRENT_USERSoftwareMicrosoftInternet Explorer.
  4. Right-click the Internet Explorer key, select New, and click DWORD value.
  5. Type InstalledByUser as the name of the new value, and then press ENTER.

Now try the uninstallation again.

Browser Bug Puts Passwords at Risk on both IE and Firefox
A new exploit can allow hackers to embed forms in message boards, blogs and other forums where users can enter HTML messages, that can trick users’ browsers into sending password information to the hacker. Firefox is most vulnerable because of the way it stores passwords, but Internet Explorer can also be at risk. To protect against it, you should disable the password autosave feature in your browser. Read more here.  

How to display the menu bar in IE 7
I’ve heard complaints that the menu bar (File, Edit, View, Favorites, Tools and Help) is missing in IE 7. Actually, it’s still there, it’s just not displayed by default. To show it continuously, right click one of the toolbars that is displayed, and click to check “Menu Bar.” Or you can display the menu bar temporarily by hitting the ALT key.  As for sites that don’t work, sometimes this is because they don’t recognize the browser version. There’s a utility you can run that will cause IE 7 to emulate IE 6 for these sites. Direct download from here.

Computer stops responding when hibernation starts
If your XP computer stops responding when hibernation starts, it may be because you have Fast User Switching enabled. This problem can be resolved by installing the latest service pack, but if you’re unable to do so (for instance, because of a known application compatibility), there is a separate hotfix available for this problem. To find out how to get it, see KB article 834202 here.

The Add/Remove Programs tool displays installed programs incorrectly
Sometimes the Add/Remove Programs tool in Control Panel displays no listed programs, or displays the programs incorrectly. This can happen when the uninstaller removes registry entries that it shouldn’t. You can fix the problem by editing the registry to re-register the Control Panel application or recreate the missing registry keys and values. For explicit instructions on how to do so, see KB article 266668 here.

Email security and productivity tips
IT Security recently published piece entitled “Hacking Email: 99 Email Security and Productivity Tips.”  Link here.

Deb Shinder, MVP

VoIP (Voice over IP) Revisited

Telephone services that use the Internet instead of the traditional telephone network (Voice over IP) can save you a lot of money. We’ve been using Lingo’s VoIP services for our small business for almost two years now, with very few problems. We got a phone line with advanced features such as voicemail with email notification, caller ID, and 3-way conference calling for around $22 per month total (including taxes and fees). That’s about half of what we pay for a “barebones” landline with no special features. The only reason we kept the telco line at all was for the security system, faxes and the very rare occasions when we got poor quality with VoIP.

During those two years, I’ve learned a lot about VoIP. In fact, I now write a weekly VoIP column for TechRepublic and have had the opportunity to try out some new VoIP products. It’s come a long way, baby, from the early days of Skype when making a call over the ‘Net was more of a novelty than a viable business practice, when it meant plugging a headset into your computer and “dialing” on your computer screen, when you could only call other people who had the software installed on their computers.

In fact, Skype itself has come a long way, and I recently tested the beta of their latest version (v.3), which has a lot of good features for business and personal use. They even have a special corporate version for businesses, which makes it easy to deploy Skype on multiple machines and provides for centralized management of all the Skype accounts in your company. You still have to install Skype on your computer, but you can now get Skype phones that plug into your USB port or work via wireless to make the experience more “phone like.” And Skype is still a free service if you want to talk to others who have Skype installed, or for making outgoing calls to regular PSTN phones in the U.S. (through the end of 2006). If you want to make international calls or have a phone number where PSTN users can call you, you have to pay – but it’s a lot less expensive than even the traditional VoIP providers.

For just $38 per year (which comes to a little over $3 per month), you can subscribe to the SkypeIn service. You can select the phone number you want in your own area code or elsewhere, and others can call you on it. Of course, your computer has to be on to receive calls, but you can install the Skype software on multiple computers and use the same account. For example, I installed it on both my desktop and laptop. If both computers are on when a call comes in, it rings on both systems, just like extension phones in a house. You can also install Skype on Windows Mobile devices, like my Pocket PC phone. If you want to check it out, go to Skype.  

Another cool VoIP product for businesses is Asterisk, IP PBX software that’s open source. IP PBX serves the same function for VoIP systems that traditional PBX does for landlines – allows you to distribute a few incoming lines among a larger number of internal phone extensions. It’s not something you’re likely to need for your home VoIP line, but it’s great for businesses that don’t want to pay for a separate line for every employee.

It has many advanced features such as call monitoring, call queuing, and of course, voicemail. You can run it on a regular PC on top of Linux or Windows. Setting it up requires a bit of tech savvy, but there are more user-friendly versions such as TrixBox (previously called Asterisk@Home) that lets you use a graphical web interface for configuration. With Asterisk, you can do such things as set up individual block lists (sort of like spam filters for the phone, letting you refuse calls from specific callers). Asterisk can be downloaded free here.

In fact, it’s the block list feature that has us currently considering switching VoIP providers. We regularly get “junk calls” from a Canadian company which, according to Internet research on the phone number that shows up on Caller ID, is a telemarketing firm that calls people and asks to “verify their information” (name, address, etc.) – a form of phone phishing. We’d like to block this number, but Lingo doesn’t give us a way to do that (although they do let us block numbers that don’t provide Caller ID information).

A bit of web research turned up the fact that Vonage apparently doesn’t offer this feature, either, but SunRocket does. Further, if you pay annually ($199), SunRocket costs a little less than Lingo ($16.58/month before taxes and fees; Lingo is $19.95). A friend who switched reports that he’s had no problems with SunRocket, and in fact has noticed better quality on some calls than with Lingo. On the other hand, Lingo’s base price includes free calls to Western Europe, and SunRocket’s only includes the U.S. and Canada. Like everything else in life, it’s a tradeoff.

In fact, most VoIP experts agree that as the technology becomes more widespread, we can expect to see a huge growth in the problem of SPIT (Spam over Internet Telephony). Just as spammers now flood your email box with unwanted commercial messages, they’re likely to flood voicemail boxes with unwanted recordings. It’s easier to send IP voice messages in bulk, hundreds or thousands all at once, as opposed to traditional autodialers that dial one number at a time. And SPITTERs can use spoofing techniques to display fake Caller ID info to hide the origin of the call. Luckily, there are already companies working to address this problem with software that analyzes message content, recognizes SPIT and deletes it or reroutes it.

Let us know what you think about VoIP. Have you taken the plunge yet? What service(s) have you used, and what do you like or not like about it? Are you brave enough to use it as your only telephone service, or do you maintain landline and/or cellular phones for backup? What are your “must have” features: free international calling, individual call blocking, etc.? Will SPIT be the downfall of VoIP, just as spam has caused many people to abandon email? 

Deb Shinder, MVP

We’re almost at the anniversary of the WMF exploit

Those of you in the security space late last December will remember the WMF exploit.  The week the WMF exploit hit was absolutely intense, even more so since it hit right around the holidays.

James Voorhees consulted with a number of individuals and companies (including Sunbelt) and has written a good overview of what happened during that whole time, and you can read it here.  

It would be too much to say that all was calm over the Christmas weekend in 2005. All the same, Deborah Hale, a handler at the Internet Storm Center, found it so quiet on 27 December that she speculated that “Perhaps all of the script kiddies got new computers for Christmas and haven’t gotten fully up to speed yet.” (Hale, 2005). Within hours, however, frenzy would replace that quiet as telephone calls and email messages showed that a vulnerability in Windows Metafile Format (WMF) files, heretofore unknown to most of the world, was being exploited. Exploits multiplied exponentially from that time on, with 200 individual exploits and more than 1100 infectious URLs appearing before Microsoft issued a patch (Symantec, March 2006; Websense, January 5, 2006). The vulnerability gained the attention of the entire security community. Extraordinary efforts were made to find a fix for the problem. But no complete fix was available to most users until Microsoft made its patch available more than a week later, on Thursday, 5 January 2006.

Alex Eckelberry

Two recently-inducted members of my CEO hall of fame

Heads up for two CEOs who call it like it is.

First award goes to Mark Suster, CEO of Koral, who blogs openly about his recent experience with some venture capitalists (VCs):

So I’m stuck with the paper shuffler and the Blackberry man. I am not kidding you when I say that I was on the verge of literally saying, “let’s just call this meeting a day. It’s clear you have no respect for me and no interest in my company.” I bit my tongue (which my wife will tell you is rare). I finished the next 15 painful minutes and said goodbye. My only regret … the $25 I had to pay to park in their building. They were seriously the most pompous, self-centered, unprofessional group of people that I have come across in a long time. 

Beautiful.  If you’ve ever done the investment banking or money raising thing, this story will ring true — especially the jackanape on the Blackberry.  VC guys take note:  You think CEOs are stupid and don’t notice when you’re acting like idiots? 

Then there’s Bill Watkins, CEO of Seagate, who recently had these priceless quotes in an article with CNN:

“Let’s face it, we’re not changing the world. We’re building a product that helps people buy more crap – and watch porn…”. and “People worry that newspapers are going out of business. So what? It’s the content that’s important. No one gives a s**t about the delivery mechanism. Think about mail. You had the pony express, truck delivery, airmail, email. You don’t care how it gets to you. I read more now than I ever did, but I get it off my PC. I don’t need to go down to the end of the driveway and pick up the newspaper. It’s the content that’s most important.”

Here’s to CEOs who actually talk and write normally. Compare that to the uber-polished slicksters that pass for CEOs at so many companies — making only politically safe statements, peppered with the latest buzzwords and jargon. 

Nobody ever wins anything worthwhile playing it safe.  

Alex Eckelberry
(Hat tip to Valleywag)

Creating an efficient B-tree for anti-malware databases

A while back, when we were creating our Linux version of CounterSpy (for use on gateway appliances), we needed to optimize CounterSpy’s large database for highly efficient, high-volume use. 

One of our senior developers, Chandra Prakash, developed a modification of the classic B-tree data structure and the results have been quite impressive in terms of performance. He’s presenting the methodology at the AVAR conference this week. 

Being the kind and beneficent soul that I am, I’ve posted his paper here

After all, I know my competition needs all the help it can get.*

Alex Eckelberry 
*Ok, ok, I’m just kidding!

Party in Prague

In our research, we have come across some interesting photos of a festival of debauchery in Prague,  hosted by online marketer Klik Revenue. This is the group identified with several antispyware programs a as well as a number of other online ventures, such as travel, pay-per-click affiliate advertising, online ads, domain registration, and other such things.

It all started with an invitation for a big party in the “very heart of Europe” in October for their top affiliates (Borat Bebefish translated PDF text here).  A number of prizes were to be given out, including a Mercedes C-Class, Nokia 8800s, Sony T9s and Sony Vaios (graphic here).

Well, the party was a blowout success.  Situated in a beautiful castle converted to a hotel in Prague, it featured two days of strippers, piles of loot, lots of drinking and, of course, a paintball game!  All that was missing was Scarface-style bowls of cocaine.

Some of the pictures are racy, and we’ve had to do some editing (we do try to keep this blog no worse than PG-13!).  In several cases, we have simply not included pictures that are quite inappropriate.

001001005

It starts with a beautiful hotel in Prague.

001001016

001001012

The Mercedes giveaway

001001037

001001038

This t-shirt advertises the various Klik Revenue properties.

001001036

001001080

Some strippers to show off the Mercedes.

001001109adfas

0011029

0011043

A visit by the “FBI”

0011052

Yes, those are condoms.  Why?  I have no idea.

0011046

A full photo album is available here (viewer discretion advised).  

Sunbelt Research Team

The revolting Revolt-Search.com

Revolt-Search(dot)com is a search site that passes its searches through to searchadv.com.

Seems they like to scare people too.

Revoltspyware012312312

This pushes, through an affiliate link, a download of The Spy Guard, marketed by Klik Software (part of Klik Revenue).

Note that we do not recommend going to this site except in a vmware/virtual PC session. 

Alex Eckelberry
(Credit to Sunbelt researcher Patrick Jordan)

 

We’re on VirusTotal

Our CounterSpy 2.0 beta technology has been accepted as one of the scanning engines on VirusTotal. This is a big honor for us and we’re thrilled to be part of this community!

If we don’t catch a virus, don’t be surprised, as the CounterSpy 2.0 engine is fairly specific to spyware.  However, we continue to add antivirus capabilities to it. I’ll be blogging next week on the CounterSpy 2.0 platform itself and what type of technology it is. 

VirusTotal blog link here.

Alex Eckelberry