THINGS FORGOTTEN






I almost forgot about videos I shot and put on YouTube until I stumbled across one I did at a previous job. The safety committee came to me about two weeks before their annual "Safety Day" and asked me to do a humorous video loosely related to "Safety and Security". What you'll see below is two weeks of work, but the kind of work that was fun...






'Nuff Said,
Brian

HURRY!!!








GO HERE NOW!

'Nuff Said,
Brian

SCARY STATS ON MOBILE MALWARE

Kaspersky's Security section is often filled with interesting facts, news on the latest Malware to hit the wire, and much more. They said that last year 92% of all mobile Malware was aimed at the Android system (Android based phones, tablets, etc.) and said -

"During the year, Kaspersky’s Internet security experts identified more than 35,000 malicious Android programs"

Their Article can be found HERE.

Related to that story, there appears to be a "Super-Malware" out on the Internet now, attacked Android phones. One of the things it does is have your phone dial one of those $10/minute phone numbers without you realizing it.

Jumping back to Kaspersky, there are links that are relevant to the article, especially one called "Smartphone Security Tips" and you can find that HERE.

And I almost forgot a Blog post by By Joshua Cannell on Malwarebytes site regarding 7 tips for keeping you PC safe this summer. You can catch that one HERE. I would have added 1 more, making it 8 tips with number one being "don't let your kids on your computer". I can't tell you how many times someone is working out of their house - the computer being their paycheck, and they let their 6-16 year old children use it for playing games online, Facebook, IM, and other easy targets that host malware.

I'm sure you don't want to see your client list, Quickbook data file, or any other important items required for your business to get deleted or corrupted beyond repair, so:

1. Break down and buy a used one for the kids, or
2. Make sure your login has a password, create a seperate login for them, but make it a limited account

'Nuff Said,

Brian

IF IT WALKS LIKE A DUCK AND TYPES LIKE A DUCK, BUT YOU CAN'T SEE IF IT'S A DUCK

YOU'D BETTER DUCK

Nothing like cryptic Blog post headline to make one curious eh? [ed. - spoiler alert, this has nothing to do with ducks]. As well all know, you can purchase just about anything via the Internet and many folks buy cars this way.

According to the FBI, you should be suspicious of those ads (many of which appear on Craigslist) which describe the car down to tire tread wear and end their advertisement with a one liner: "Will send photos on request".

This seems not too unusual, maybe the seller didn't have his car washed yet for picture taking, but the FBI says:

"Sometimes these images are sent as attachments, other times as a link to an online gallery—but in either case, the photos can and often contain malware that infects the victim’s computer."

Just because it's a photo that doesn't mean it's harmless. There are ways to integrate Malware, secret messages, and stolen data in a photo that you would never know about. For more information you can go to the FBI News website HERE, and read all about it.

'Nuff Said,
Brian

GET YOUR KOOBFACE ON...







Anti-virus and security companies have seen a huge increase in SPAM during the first quarter of 2013, along with continued incidents of  the KOOBFACE worm which usually spreads through social networking sites and attacks the MBR (Master Boot Record) of your hard drive.  This makes it very hard to remove the infection, and sometimes removal can only be accomplished by formatting the hard drive.

Read the article HERE.

'Nuff Said,
Brian

TIMELY EMAILS MAY LEAD TO UNTIMELY COMPUTER PROBLEMS.

               

As timely news hits the airwaves, whether it be extreme weather, a school shooting, or a bomb going off in the U.S. there are a group of people lurking in the shadows that will send out thousands or more spam email with the subject line title having something to do with it, for example, "Boston bomb goes off, read the details inside".

Inside the email will be some general statement about the event along with a link to the most recent news about the story. Click on the link and you may find yourself a victim of virus and/or Trojan infection. This type of scam has been around for years and has made it's resurgence very strong. There is an article about this which you can read HERE.

'Nuff Said,

Brian

RUBY IN A BOX, CALLED A SERVER

Not quite as catchy as "Ruby in the sky with diamonds" but I only spent about 10 seconds coming up with it. "Ruby on Rails" is popular for setting up web applications and used quite a bit. A critical hole was found, and they sent a patch out in January but apparently an unknown percentage of  server administrators failed to apply it. These un-patched servers have been attacked and are now part of a larger botnet system which could distribute malware to your computer at home. The full article about it is HERE.

US WEAPONS DESIGNS VIEWED BY CHINESE HACKERS

If you watch the nightly world news then you've probably already heard about this. If you haven't, you can read about it HERE.

HOW DID I FIX THE FBI VIRUS?

I've received more than a few emails related to this and while it worked for me it may not work for you due to the number of variations out "In the Wild". Briefly, you have to be prepared BEFORE you get infected. Use one of your USB sticks or go buy one and put some popular utilities on it, occasionally updating them (once a week, download updated versions).

Scenario: You wake up, turn on the computer, or if it's always "ON" you go to your usual website or two when BAM!!! up comes the FBI warning screen and you can't do much after that.

In my scenario Safe Mode, Safe Mode w/Networking, Last Known Good Configuration did not work. the PC would go through it's processes and come up to the logon screen. I'd type the password and as soon as it looked like I was going to get into it, the screen reverted back to the logon screen and shutdown the computer. Some variations will let you it if you don't have the network cable plugged into the computer so I tried that and found out I didn't have one of those variations.

Last SAFE MODE chance was "Safe Mode Command Prompt". This, once you log in, brings you to an all black DOS looking screen and usually puts you in c:\windows\system32 [ed. - yes Matilda, brush up on your MS-Dos commands].

*NOTE - Before doing any of these I had already inserted my utility USB stick

Not knowing this persons computer I had no idea what drive letter it would assign it. With HP computers it's even worse because all of those convenient media reader slots are assigned drive letters, so I began at "E". It wasn't to long until I found my USB stick on "J" and made sure I could read it. Briefly here are the steps:

• At c:\windows\system32 type cd\j
• J:\ is now on the screen
• I typed DIR (to view directory) and saw that all my files were still there. I have a folder called DOS with some of the utilities on the USB stick, so they are in one easy place to get to them.
• At J:\ I typed "cd dos" and now it was J:\DOS
• Another DIR to verify what I had in there and chose MBAR (a beta utility from the makers of Malwarebytes), so I typed "mbar" and the program opened up, I was able to update it via the Internet and started a scan.
• Next, I typed "cleantempfiles" and the temporary file remover went into action (many types of malware hide in temp files). The computer I was working on was fairly new, fast and had a lot of memory so I knew I could run another program.
• At the DOS-like prompt I typed "Hitmanpro64" and Hitman opened and I updated it and started a scan.
• Next I typed "autoruns". This program/utility is pretty good for letting you have access to some of the registry in a GUI format. If you see something suspicious, I'd advise to just un-check the box - don't delete it.
• MBAR and Hitmanpro64 both found a variety of things including a rootkit, MBAR found what I believe to be the FBI virus because the file was called trojan.ransomware.
• In autoruns I saw a file that was set to load each time the computer booted. It had no description or publisher and the name of the file was something like 88872854444777299.exe [I un-checked this one].
• With the others finished and ready to reboot in order to finalize the removal I clicked reboot on one of them and let them do their thing.
• On reboot, I still went into safe mode only not command prompt but safe-mode w/networking. I was able to log in, didn't get the FBI screen and was able to get to the Internet via Internet Explorer.
• Next: Shutdown/Restart (into normal mode)
• Everything was like it should be, but I ran MBAR one more time (it came up clean), then ran Malwarebytes (Full scan) which also came up clean.
• Last, but never least I deleted all of the previous restore points because they were infected as well, and created a new one labeled "After FBI virus removal 052513".

So, now you know what I did. Will it work the next time I come across it? dunno. There are so many variants of this I stand a good chance of it not working - but, it's worth a shot.

Thanks for your emails -

Regards,
Brian
E-mail: ME