|
|
|
infect your computer system. This type of attack is called a "drive-by" attack - you don't have to do anything or, click on anything to become infected!
|
|
|
Prior to its discovery, Virus Total (www.virustotal.com - a web site where you can analyze suspicious files and URLs and a service that I brought to you in a previous article), reports that only 21 out of the 42 main virus programs recognized the attack.
|
|
|
Hopefully, now that the problem has been discovered, whatever virus protection you are running, should have been automatically updated with definitions that will recognize the attack - albeit, after the event, but for you, it may already be too late!
|
|
|
So, what does lsass.exe (the malware) do, once it downloads itself on to your computer system?
|
|
|
First of all, it creates a new user profile for itself then, installs three new components into your "programfiles" directory before adding a new registry key to enable itself to auto start after a computer re-boot.
|
|
|
Any activity in Internet Explorer, Google Chrome, Mozilla Firefox and Opera Web browsers is monitored and any searches in Google, Ask, Yahoo!, AOL, and Bing, are automatically re-directed to another website where its own search results are displayed on searches for any of the following keywords:-
|
|
|
cialis, pharma, casino, finance, mortgage, insurance, gambling, health, hotel, travel, antivirus, antivir, pocker, poker, video, baby, bany, porn, golf, diet, vocations, design, graphic, football, footbal, estate, baseball, shop, books, gifts, money, spyware, credit, loans, loan, dating, ebay, myspace, virus, film, ipod, verizon, amazon, iphone, software, movie, mobile, bank, music, cars, craigslist, game, sport, medical, school, wallpaper, military, weather, twitter, fashion, spybot, trading, tramadol, yobt, flower, cigarettes, doctor, flights, airlines and comcast.
|
|
|
It also, searches for directories on your computer to do with any of the main Peer to Peer file sharing/downloading programs - "Winmx", "Tesla", "Limewire", Morpheus", "Emule", "Edonkey", "Bearshare", "Grokster", "ICQ" and "Kazaa". If it finds any of them, it duplicates into the directories and re-names itself with any of 86 'legitimate-looking" file names with the intention of tempting someone to download it from your computer across the Peer to Peer file sharing network - thereby, spreading itself further.
|
|
|
What is the point of all this? The writer of the malware receives payment, in the form of advertising revenue, for generating traffic to the web sites that it displays in its 'hijacked' search results so, if you find that you are being 'mysteriously' diverted to alternative search results - its time to check out your PC!
|
|
|
|
|
|
A record number of updates from Microsoft (49 Window's faults were rectified)
|
|
|
|
With the main part of the "Zeus" Trojan gang arrested and facing prosecution for stealing million's from their victims bank accounts. Microsoft added a detection kit for the "Zeus" Trojan to their free Malicious Software Removal Tool for Windows
|
|
Amongst many other things, the tool now detects and remove the "Zeus" Trojan from infected machines making it more difficult for the criminal internet gangs to steal from their victims.
|
|
True, about half of computers that are infected with the Zeus Trojan are running with no virus or, malware protection or, running with out-of-date protection, but that still leaves at least half of infections credited to machines with active protection.
|
|
If you haven't got any virus or, malware protection on your computer or, have only recently installed or, updated your program and have been running without protection for any length of time, it's worth visiting Microsoft's web site and running an on-line scan of your computer.
|
|
If you try to do this and find that you cannot complete the process, alarm bells should be ringing because sophisticated malware infections such as Zeus have the ability to prevent your computer from being cleaned up.
|
|
Hopefully, your Window's computer is set to receive automatic updates and, on Tuesday this week, should have received a record number of updates from Microsoft (49 Window's faults were rectified in the update)
|
|
A number of the faults fixed errors which have been classified by Microsoft as 'critical' and a couple relate to problems in Internet Explorer so, if your computer is not set to receive updates automatically, it's worth manually updating your computer. Again, if you visit the Microsoft web site and try to update, but for some reason you can't update your version of Windows, alarm bells should be ringing and it's worth getting a 'professional' to have a look.
|
|
Malware protection experts have discovered another piece of malicious software that exploits what industry experts describe as "a weakness" in the way that the Firefox web browser handles your passwords.
|
|
When you enter a password into any account that you have on the internet (email, bank etc.) Firefox asks you whether you would like it to remember the password. This is a handy feature if you login into an account regularly and have a good, strong password that is difficult to remember because, if you agree to allow Firefox to remember your password, it removes the need for you to remember your password and type it in manually, every time you login to the account.
|
|
It also, removes the need for you to write your complicated password down onto a "stick-it" note and stick it onto the side of your computer screen where someone may see it and make a note! (Please tell me that nobody reading this actually does this)
|
|
Problem is, if your computer becomes infected with this piece of Malware, an important file within Firefox is modified so that you are no longer asked whether you would like the browser to remember your password. When you enter your login details into a secure site, they are automatically saved and uploaded to the attacker next time that you connect to the internet.
|
|
The same Malware program takes information from the Windows' registry (the protected storage area where passwords and other important details are stored) and uploads that information too! In a previous article, I recommended that internet users have a 'clean' computer, that
|
|
|
they use just for connecting to the internet to log into their important accounts and after doing what they need to do, disconnecting the computer from the internet. This computer shouldn't be used for any other internet activity. This protects the computer from becoming infected and greatly increases the users internet security. The time that this becomes a necessity as opposed to a luxury, is fast approaching!
|
|
|
|