Security Risk : A New Worm Spotted

Today, a new worm has been spotted in the wild and, according to security company Trend Micro, it affects most flavors of the operating system produced by Microsoft, including Windows 98, ME, NT, 2000, XP and Server 2003.

The worm WORM_SILLYFDC.CY has a high damage potential and a high distribution potential,two elements that underline the worm's capability to reach your computer and harm the data stored on it.It can get into your PC while visiting any infected page.However, the worm may also be dropped by another piece of malware, Trend Micro explains.

The main targets of the worm are two important Windows functions: the Automatic Windows Update and the Task Manager. Both features of the operating system are disabled, so the users would not be able to update their Windows version or to check the running processes in order to shut down the infection.

Just like many other recent worms, WORM_SILLYFDC.CY spreads itself through the clean removable drives connected to the computer. Every time a removable drive is plugged into the system, the worm copies an Autorun.inf file to execute itself once the device is connect to another PC.

So,to be on the safer side,update your anti-virus with latest virus definitions and be safe.

Happy Surfing !!

Source

Read the rest...

Trojan Capitalizes on Bhutto Assassination

Whatever else malware creators might be, they're quick to take advantage of any event that might enable a new attack vector. The Storm Worm has already morphed twice in the past week, attacking with both a Christmas and a New Year's theme. Now, less than two days after the assassination of Benazir Bhutto, former Prime Minister of Pakistan and leader of the Pakistan People's Party, there's a new malicious Javascript in town. The script in question isn't brand-new, but its creators have quickly adapted it to prey on surfers interested in additional details regarding Bhutto's death.

According to Trend Micro researchers, certain sites purporting to contain information on the assassination have malicious Javascript embedded within them. End users wanting more information on the event can conceivably be directed to one of these infected sites, where the script (identified by Trend Micro as JS_AGENT.AEVE) runs and downloads a Trojan (TROJ_SMALL.LDZ). This new Trojan then downloads and installs WORM_HITAPOP.O and TROJ_AGENT.AFFR.

While the authors of this particular gem are obviously trying to exploit Bhutto's murder, Trend Micro found evidence that the malicious Javascript is actually present on a number of sites, including Autoworld, Vino, MSN, and BlogSpot. The number of infected sites that specifically discuss the assassination is small compared to the total number of sites that appear to be infected—103 vs. 4,240—but the ratio will undoubtedly shift if the topic proves to be an effective attack vector. Trend Micro has stated that its customers are already protected from the exploit; other vendors will probably be quick to follow with patches as they are needed.

Source

Read the rest...

Trojan Attacks Adsense Code

FRANKFURT (Reuters) - Advertisements placed by Google in Web pages are being hijacked by so-called trojan software that replaces the intended text with ads from a different provider, Romanian antivirus company BitDefender says.

The trojan redirects queries meant to be sent to Google servers to a rogue server, which displays ads from a third party instead of ads from Google, BitDefender said in a statement.

Google said on Wednesday: "We have cancelled customer accounts that display ads redirecting users to malicious sites or that advertise a product violating our software principles."

"We actively work to detect and remove sites that serve malware in both our ad network and in our search results. We have manual and automated processes in place to detect and enforce these policies."

The trojan, named after the mythic Trojan Horse because of its ability to enter computer systems undetected, attacks Google's AdSense service, which targets advertisements to match Web page content.

"This is a serious situation that damages users and Webmasters alike," said BitDefender virus analyst Attila Balazs.

"Users are affected because the advertisements and/or the linked sites may contain malicious code," he said. "Webmasters are affected because the trojan takes away viewers and thus a possible money source from their Websites."

BitDefender on its Web site (www.bitdefender.com) describes the trojan, which it identifies as Trojan.Qhost.WU, as spreading at a "low" level and causing "medium" damage.

Source

Read the rest...

Tutorial : To Remove Orkut Virus

Many users are facing a common problem, where Orkut.com, Youtube.com and Firefox are blocked in their systems and they get following error with a scary laugh:

Orkut IS BANNED, orkut is banned you fool The administrators didnt write this program guess who did?? r r MUHAHAHA!!

It happens because of "Heap41a / win32.USBworm" which spreads through USB pen drives and removable storage devices. There is a manual as well as an automatic method to remove the virus:

A. MANUAL METHOD:

Follow these instructions:

1. Open "Task Manager" and goto "Processes" tab.

2. Look for services with name "svchost.exe". There will be many services with the same name. Most of them will have "SYSTEM", "LOCAL SERVICE" OR "NETWORK SERVICE" as User Name but you have to look for "svchost.exe" service which has your currently logged in username as User Name.

3. You'll get approx. 2 services with the name "svchost.exe" which has your Windows username. End Task them by pressing key or by selecting them and clicking on "End Process" button. It'll confirm the action, accept it.

4. Now open "regedit" from RUN and goto following keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies
\Explorer\Run


And look for a key in right-side pane with the name "Winlogon" which will have "heap41a\svchost.exe" in its value field. If you find this key, delete it.

5. Now goto following key:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer
\Advanced\Folder\Hidden\SHOWALL

And in right-side pane, change value of "CheckedValue" to 1

6. Now enable "Show Hidden Files/Folders" option in "Tools -> Folder Options" in My Computer.

7. Right-click on Start button and select "Open". Now open "Programs" folder, here you'll see a folder "Startup". Open it and if you get a hidden file there, delete it. If its not there, then close it.

8. At last open "My Computer" and open C: drive. Disable "Hide Protected System files" option in "Tools -> Folder Options". You'll see a folder "heap41a" in C: drive. Delete it.

Thats it. After doing all this, restart your system and you'll get rid of the virus.

B. AUTOMATIC METHOD:

Just download following tool and run it:


Download Orkut blocking Worm Removal tool

Don't forget to format your pen drive or removable storage media which caused this virus infection because it would still contain the virus. If you don't want to format it, then delete following 2 files from pen drive:

microsoftpowerpoint.exe
autorun.inf

Original Source

I thank the original Author for writing such a nice tutorial.

Read the rest...

Warning : Deadly Computer Worm On The Prowl In India

A potentially dangerous computer worm called Storm has been silently infecting computers in India, creating a pathway into the system which can be exploited, either to steal data or flood your e-mail account with spams.

Having enticing subjects lines, the spam mails containing the worm baits people into opening them. Those who open the attachment then unknowingly become part of a Botnet (a collection of compromised computers running programmes having worms under a common command for nefarious purposes).

Experts in India said that the virus till now, has been infecting computers without causing serious damage. However, because it's gathering strength, experts are considering it a serious threat.

An expert said Storm travelled through spam and was showing no signs of slowing down. "It hasn't attacked till now. Yet, it is a disturbing trend. It continues to propagate and therefore grow in strength. This poses a serious threat because it may be preparing for a big attack during the festive season. Hackers could wreak serious damage if they unleash a denial-of-service attack with it. What's worse, you can't counter the attack by simply blocking a single server because its origin is distributed globally," the expert said.

A techie told TOI, "What makes Storm dangerous is that the content of the message keeps changing. It always has subject lines related to a contemporary occurrence somewhere in the globe."

Some of the subject lines have been "US secretary of state Condoleezza Rice has kicked German chancellor Angela Merkel", "a killer at 11, he's free at 21 and kills again", "British Muslims genocide", "log-in verification", "registration confirmation" and "happy labour day". The worm first appeared in January 2007 hiding in e-mail attachments with the subject line "230 dead as storm batters Europe".

For complete story follow this link

Read the rest...

Top 10 Antivirus for the Year 2007

Antivirus - A software which causes so many pain yet its very important.Every time we format our system , we need a new Antivirus software to get protected from a deadliest virus over the net.Here comes the choice of Antivirus software.

Which one is the best ??
Which one is low on resource ??
Which is paid and which is free ??
Which gives real time protection ??
Which releases updates in quick succession whenever any attack occurs ??

And many more questions come to mind....

No need to worry further here is a complete review of the TOP TEN ANTIVIRUS for the year 2007 which was based on various tests and analysis....

Click here to View the complete review

And don't forget to give feedback..

This is Shyam ,signing off.....
Have a healthy and protected PC.

Read the rest...