denz Techtronics » Security

differences between worm, virus and trojan horse

admin_denz — Fri, 19 Nov 2010 03:37:51 +0000

Most of us don’t make a real difference between worm, virus and Trojan Horse or refer to a worm or Trojan Horse as a virus. All of us know all are malicious programs that can cause very serious damage to PC. Exist differences among the three, and knowing those differences can help you better protect your computer from their often damaging effects.

A computer virus is a program or piece of code that is loaded onto your computer without your knowledge and runs against your wishes. Some viruses cause only mildly annoying effects while others can damage your hardware, software or files. Almost all viruses are attached to an executable file, which means the virus may exist on your computer but it cannot infect your computer unless you run or open the malicious program. A virus cannot be spread without a human action, (such as running an infected program) to keep it going. People continue the spread of a computer virus, mostly unknowingly, by sharing infecting files or sending e-mails with viruses as attachments in the e-mail.

A worm is a program or algorithm that replicates itself. A worm has the capability to travel without any help from a person from PC to PC and have ability to replicate itself on your system, so rather than your computer sending out a single worm, it could send out hundreds or thousands of copies of itself, creating a huge devastating effect.

A Trojan Horse is a destructive program that “working” as a benign application (like changing your desktop, adding silly active desktop icons) or can cause serious damage by deleting files and destroying information on your system. Trojans are also known to create a back door on your computer that gives malicious users access to your system, possibly allowing confidential or personal information to be compromised. Trojans do not reproduce by infecting other files nor do they self-replicate.

Added into the mix, we also have what is called a blended threat. Blended threats combine the characteristics of viruses, worms, Trojan Horses, and malicious code with server and Internet vulnerabilities. By using multiple methods and techniques, blended threats can rapidly spread and cause widespread damage. Characteristics of blended threats include: causes harm, propagates by multiple methods, attacks from multiple points, and exploits vulnerabilities. This combination of method and techniques means blended threats can spread quickly and cause widespread damage. Characteristics of blended threats include: causes harm, propagates by multiple methods, attacks from multiple points and exploits vulnerabilities. They are considered to be the worst risk to security since the inception of viruses, as most blended threats require no human intervention to propagate.

Therefore is very important to protect your PC with good anti-virus software installed on your system with the latest fixes for new viruses, worms, and Trojan horses.

In addition, you want to make sure your anti-virus program has the ability to scan e-mail and files as they are downloaded from the Internet. This will help prevent malicious programs from even reaching your computer. You should also install a system that prevents unauthorized use and access to your computer (firewall as well). A good software firewall will protect your computer from outside attempts to control or gain access your computer, and usually provides additional protection against the most common Trojan programs or e-mail worms.

Getting Rid of Spyware Problems

admin_denz — Thu, 12 Aug 2010 10:07:53 +0000

Has your system speed lessen lately? Do you get annoyed by the endless pop-pops on your screen? If yes then your computer has been infected by the spyware. The spyware gets installed in the user’s computer without the knowledge of the user and steels the personal information and give to the companies, as the result your system is flooded with never-ending pop-ups. So get the anti spyware which is the best and comes with the latest cutting edge technology for the problems caused by the spyware. It has the special removes spyware tools which scans and cleans up the spyware completely from the system registry.

None other than the spyware removal tool can completely clean the spyware from your system. If you are a regular user of internet then there is lot of chances for the spyware to get infected in your system. It steels your personal information and leads to misuse of your private information. To avoid this you should give your system the best anti spyware protection. Now you can use the internet without any hurdle. You should ensure that you get a comprehensive solution for the spyware troubles. With the anti spyware soft ware you are sure to get a real time detection and removal of spyware.

When the spyware infects your system it monitors the internet access in the background without your knowledge, and gets the personal information. It invades your privacy and cause endless troubles. The adware is the same of the spyware and monitors your access for delivering advertisements. So you should also take proper care in seeing that there is spyware adware remover in the anti spyware software you get. So protect your system in advance from the spyware before it gets serious. Whether your system is already infected with the spyware or you just going to get an internet connection you, the spyware remover helps you get rid of the nuisance. No more identity theft, network corruption, loss of productivity and also slower internet access or slow system performance. You can now sit and relax yourself while surfing the net for hours.

Facebook Hit with New Scams

admin_denz — Mon, 26 Jul 2010 03:10:13 +0000

Two new scams that prey on people’s curiosity are quickly making their way through Facebook. One claims a mother went to jail because she took a picture of her son, while the other promises to reveal the reason that might lead to the shutdown of McDonald’s.

“OMG!! Guys, you have to see this: This mother went to jail for taking this pic of her son! —> [URL]” one of the spam messages reads. Clicking on the link takes users to a rogue Facebook profile with a name similar to the message.

This profile has a page called ‘SEE HERE!’ which instructs users to “Like” it in order to see the intriguing picture. Furthermore, to entice people even more it promises that “Your jaw will drop to the floor!”

Liking the page will get users no closer to seeing a image and will instead ask them to spread more spam, this time by posting the original message on their wall for all their family and friends to see. Users who are gullible enough to accept this, will finally get a link to allegedly see the elusive picture.

Unfortunately, following it doesn’t have the expected result and prompts users to take one of four surveys as a “security check.” Taking a survey is definitely not a good idea as there are high chances of ending up being billed for some sort of premium service and compromised personal information.

The second scam is almost identical in concept as the first, but uses a different lure. In this case the spam message reads “OMG!! McDonalds might soon shut down because of this, you have to see this! –> [URL]” and no, it’s no better than the first. If you are a victim of any of them make sure to delete the rogue messages from your profile and remove the fake pages from your Like list.

“I really feel like despairing that the general public will ever learn to avoid dodgy links like this. Far too many people are prepared to endorse and share links on Facebook without properly thinking about what they are doing. In this case they’re doing it before they have any clue about what lies behind the page,” Graham Cluley, senior security at antivirus vendor Sophos, commented.

New Phishing Emails Circulating in World of Warcraft

admin_denz — Sun, 25 Jul 2010 01:05:57 +0000

Security researchers from Finnish antivirus vendor F-Secure warn that a new phishing campaign is targeting World of Warcraft players. The fake emails direct gamers to a rogue website and claim they need to verify their Battle.net accounts by providing their password.

Online gaming credentials are valuable items for cyber criminals, who sell them in bulk on the black market. World of Warcraft accounts in particular are in high-demand. According to research from Symantec released earlier this year, WoW credentials can rack up from $35 to $28,000, depending on how well the associated characters are developed.

“A World of Warcraft account could be a gold pot for phishers, depending on the player’s achievement. In-game items are in demand and could be sold for real cash value, making WoW accounts a favorite phishing target,” the F-Secure researchers, who intercepted the latest phishing campaign, explain.

The fake emails have their “From” field spoofed to appear as if they originate from a generic address on the blizzard.com domain. The messages masquerade as automatic notifications regarding suspicious account changes, however, the poor spelling is strongly indicative of their rogue nature.

“[...] blizzard to investigate the recent theft of a large number of players missing account, we may be on your World of Warcraft account. Your password has been modified recently to restore the password We recommend that you log on to restore the password verification: http://[censored]-surveyus.com,” part of the ambiguous phishing message reads.

A more close investigation of the headers reveals that the emails are sent through a @hotmail.com address, which was probably hacked. The researchers point out that a real Battle.net account changes verification process requires more than simply supplying the password. A valid ID such as driver’s license, birth certificate, state ID, passport and in the case of minors, parental consent, is necessary.

the New Email and Web Security Appliance by McAfee

admin_denz — Thu, 05 Nov 2009 14:54:36 +0000

Set your mind as ease as the world’s leading providers of security solutions and antivirus products, McAfee announced today the debut of its new Email and Web Security Appliance 5.5, specifically designed to meet the security requirements of SMB customers. The solution, which integrates both email and Web security solutions in a single unit, has been designed to protect users against the latest email and Web-borne threats, as well as manage Web and email traffic and usage. Integrating several noteworthy features, the McAfee Email and Web Security Appliance 5.5 helps customers reduce system-administration requirements, according to Softpedia.

Some of the main features that have been integrated into the company’s latest solution, McAfee has highlighted the following: Artemis and TrustedSource Technology integration, integrated URL filtering, appliance clustering with load balancing, and more. The unit has been designed to provide a simple installation process, by auto-detecting network settings and providing a user-friendly configuration wizard. According to the company, its Email and Web Security Appliance deliver a better than 99 percent spam-detection accuracy, making it a valid choice for SMB users.

Although no pricing details have yet been released, the company announced that the Email and Web Security Appliance will be available globally later this quarter. In addition, users will be able to take advantage of the company’s 30-day “Buyer’s Assurance Program,” but available only in the US, Canada and Latin America.

What is Computer Security?

admin_denz — Sun, 11 Oct 2009 02:09:28 +0000

Basically, computer security is a branch of technology known as information security as applied to computers. Information security means protecting information and information systems from unauthorized access, use, disclosure, disruption, modification, or destruction. The objective of computer security varies and can include protection of information from theft or corruption, or the preservation of availability, as defined in the security policy.

Technological and managerial procedures applied to computer systems to ensure the availability, integrity and confidentiality of information managed by the computer system. Computer security also imposes requirements on computers that are different from most system requirements because they often take the form of constraints on what computers are not supposed to do. Here are some typical approaches to improving computer security:

Physically limit access to computers to only those who will not compromise security.
Hardware mechanisms that impose rules on computer programs, thus avoiding depending on computer programs for computer security.
Operating system mechanisms that impose rules on programs to avoid trusting computer programs.
Programming strategies to make computer programs dependable and resist subversion.

Fake Emails with Trojan

admin_denz — Sat, 12 Sep 2009 12:02:25 +0000

Guys, be aware that the creators of the Bredolab computer trojan have launched a new distribution campaign, which delivers the malware via bogus order confirmation emails allegedly sent from online shops. Security researchers advise potentially curious users not to open the attachments. In fact the email security company MX Lab warns that emails with titles such as “Thank you for settling the order No.90322972″ or “Shipping confirmation for order _24204,” come with a malware attached. The fake messages use social engineering in order to trick users into believing that an unauthorized order has been made in their name.

The “From” field of the emails is spoofed and one of them reads “Thank you for shopping at our internet store! We have successfully received your payment. Your order has been shipped to your billing address. You have ordered Toshiba Satellite U400D. You can find your tracking number in attached to the e-mail document. Please print the label to get your package.” This technique has probably been chosen in order to avoid detection from basic spam filters. A randomly named .zip archive file is attached to every email.

The extracted ZIP archive contains a D*****.exe, of approx 36 kB, where * stands for random numbers and letters. The executable file is actually the Bredolab installer, which is a new computer trojan discovered by security researchers back in May. Once installed on the system, its purpose is to infect it with additional malware. So far, the trojan has been observed to download malicious applications from the FakeAV family. Users are strongly advised to keep their antivirus solutions updated with the latest definitions.

Security Issues with Twitter

admin_denz — Mon, 17 Aug 2009 08:14:31 +0000

If you can notice at the past days Twitter is getting a lot of problems with their site, so what they did is they started tapping into Google’s Safe Browsing API in order to detect and block URLs pointing to malicious websites. Security experts applaud the initiative, even though the new feature is still buggy and can be easily bypassed. It looks like the flood of security threats that Twitter users have faced this year has prompted the administration of the micro-blogging platform to take a more proactive approach at security.

Chief security expert Costin Raiu at antivirus vendor Kaspersky, suggests that Twitter is using the Google Safe Browsing API in order to determine the nature of URLs. Surely, it won’t catch everything but definitively a step forward. The implementation still has some serious imperfections, one of which being the inability to verify links generated with popular URL shorteners. This is a significant problem because of the 140-character restriction, URL shortening is the most widely used method of posting links on Twitter.

There are also issue that detection can be bypassed by stripping the www from a malicious URL or leaving it with http:// only. Nevertheless, several security experts have applauded the initiative and are sure that the service will be tweaked in time. Some of them have recommended a similar approach for other social-networking websites. Maybe, in time, Twitter will decide to tap into other blacklists as well, such as the phishing URLs one maintained at PhishTank. This service, which is operated by OpenDNS, also offers a free API for developers.

a piece of computer security advice

New Conficker Variant Discovers by Bitdefender

admin_denz — Sat, 11 Jul 2009 06:10:15 +0000

Bitdefender a malware researchers from anti-virus vendor have identified a new variant of the infamous Conficker worm. Its analysis has revealed an improved obfuscation layer and additional blocked strings. This conficker is also known as Downadup or Kido, one of the most complex and well-written pieces of malware that security researchers have seen in recent years. The original variant, Conficker.A, appeared back in November 2008, soon after Microsoft broke its patch cycle in order to release MS08-067, a fix for the critical remote code execution vulnerability in the Services service that the worm exploits in order to spread.

The company announced that they identified a new variant but details were scarce, as it was still being analyzed. According to them, the analysts got suspicious after a customer reported that he could not access www.bdtools.net, the website used by Bitdefender to host free removal tools, from his computer infected with Conficker. This was particularly interesting, because the domain name was not amongst the ones blocked by the known variants of the worm. After securing a sample and analyzing it, the researchers concluded that they were dealing with a new version.

Even though it does not bring radical changes, like Conficker.B or Conficker.C do, this variation has an extended blacklist. The newly added strings, used by the worm to block access to domains or executables containing them, are: precisesecurity, ms-mvp, mitre, enigma, bdtools, av-sc, adware, activescan, stinger, kill, cfremo and bd_rem. Downadup also features two layers of obfuscation to prevent analysis and detection.

This new version has actually been in circulation since around March 18th, but pretty much passed unobserved, Bitdefender Company says. It is currently detected as Win32.Worm.Downadup.Gen, under a generic routine able to identify any known variant of Conficker. The users who cannot access the www.bdtools.net website in order to obtain Bitdefender’s free Conficker removal tool can download it from this secure servers. And, for those people having trouble executing the tool on infected computers, should rename it to something random and try again.