Tales from the Techside

Incredifind Removal

In cruising the spyware removal foums I have noticed more and more people having problems removing incredifind. Interesting fact incredifind was one of the first pieces of spyware I worked to remove and I found it then and still a decpetive and malicious piece of software that employs every trick possible to keep itself from being removed. So if you are having problems with read on for instructions how to remove it.

To remove SpyFalcon:

Download and run hijackthis, in hijackthis check off the boxes next to the following and click remove

R3 - URLSearchHook: IncrediFindBHO Class - {5D60FF48-95BE-4956-B4C6-6BB168A70310} - C:\PROGRA~1\INCRED~1\BHO\INCFIN~1.DLL
O2 - BHO: NavErrRedir Class - {5D60FF48-95BE-4956-B4C6-6BB168A70310} - C:\PROGRA~1\INCRED~1\BHO\INCFIN~1.DLL

Using my SSQKit kill the following processes

delupdat.exe
sui.exe
wupdater.exe

Next copy the following and paste in notepad and save as killap.reg

**after you have saved the killap.reg file double click the file to add the changes to the registry

REGEDIT 4

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Search]
"SearchAssistant"="http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm"
"CustomizeSearch"="http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm"
"Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Default_Search_URL"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
[HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main]
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Search Bar"="Search Bar"="http://search.msn.com/intl/searchpane/en-au/prov2.htm"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchUrl]
""="http://home.microsoft.com/access/autosearch.asp?p=%s"
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\main]
"Search Page"="http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch"
"Search Bar"="http://search.msn.com/spbasic.htm"
"Use Custom Search URL"= dword:00000000
[-HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{CFBFAE00-17A6-11D0-99CB-00C04FD64497}"=""
[-HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL\DefaultPrefix]
@="http://"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\URL\Prefixes]
"ftp"="ftp://"
"gopher"="gopher://"
"home"="http://"
"mosaic"="http://"
"www"="http://"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\updater
[-HKEY_LOCAL_MACHINE\Software\IncrediFind]
[-HKEY_LOCAL_MACHINE\Software\updater]
[-HKEY_CLASSES_ROOT\BHO.IncrediFindBHO]
[-HKEY_CLASSES_ROOT\BHO.IncrediFindBHO.1]
[- HKEY_CLASSES_ROOT\CLSID\{5D60FF48-95BE-4956-B4C6-6BB168A70310}
[- HKEY_CLASSES_ROOT\Interface\{8B8F6968-2F24-41E3-B653-E9613226F14D}
[- HKEY_CLASSES_ROOT\TypeLib\{DE289BFA-737B-4ABB-A4EC-F8753551B875}
[ HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks\]
"{5D60FF48-95BE-4956-B4C6-6BB168A70310}"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\]
"{5D60FF48-95BE-4956-B4C6-6BB168A70310}"=-

Next using the SSQKit search for and unregister the following dll*
incfindbho.dll

In the find section type the name of the dll and then right click on it once found and choose unregister

Finally using the ssqkit find and delete the following files and folders

delupdat.exe
sui.exe
wupdater.exe
incfindbho.dll

C:\Program Files\IncrediFind
C:\Program Files\Common Files\updater

After you are all done restart your computer and once satisfied delete the backup files from c:\killit

Mac OSX Virus er Trojan or is it just Malware

I am sure I will be assaulted with plethora of emails pointing out that this does not execute any vulnerability to infect OSX machines. Truth is that the initial infection occurs through user interaction but the virus then propagates through the machine using the searchlight feature, and then sends a copy of itself via the aim and iChat buddy list. I feel confident that this is merely the first of such viruses to come for OSX I hope it isn't but it merely reinforces the fact that security through obscurity is not a valid defense. Users who believe they are protected because of their Operating System be they Apple, Linux or fully patched Windows systems still must use common sense when executing files from people they don't know and trust.

Mac Rumors: The First Mac OS X Virus? (A New OS X Trojan)

Wow this is too creepy for words

I wonder when this is going to become standard operating procedure? If so I hope I am out of the information technology field by then.

Company requires RFID injection

SpyFalcon Removal

While reading Sunbelt Software I saw a post for a new rouge anti spyware application called SpyFalcon, going to my favorite spyware assistance boards I saw a blitz of help requests regarding spy falcon. A cursory look at SpyFalcon it seems to be yet the latest fake anti-spyware application in a recent blitz of rouge anti-spyware programs that infect computers mask themselves as beneficial and then resist removal. Once installed on a users system SpyFalcon adds an icon to the system tray, the icon says the computer is "is infected with dangerous spyware parasites and asks the user to download and install a removal program". If the user says ok then spy falcon runs tell the user there is numerous issues with their system and then offers to remove the problem if they will pay for the full version of SpyFalcon.

To remove SpyFalcon:

Download and run hijackthis, in hijackthis check off the boxes next to the following and click remove

O4 - HKLM\..\Run: [SpyFalcon] C:\Program Files\SpyFalcon\SpyFalcon.exe /h

Using my SSQKit kill the following processes

spyfalcon.exe

Next copy the following and paste in notepad and save as killap.reg

**after you have saved the killap.reg file double click the file to add the changes to the registry

REGEDIT 4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\]
"SpyFalcon"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler\]
"{D1A2E7CD-F5C1-21A8-CA2C-13D0AC72D19D}"=-
[-HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{D1A2E7CD-F5C1-21A8-CA2C-13D0AC72D19D}]

Next using the SSQKit search for and unregister the following dll*
dxmpp.dll

In the find section type the name of the dll and then right click on it once found and choose unregister

Finally using the ssqkit find and delete the following files and folders

C:\Program Files\SpyFalcon
C:\Documents and Settings\[Current User]\Start Menu\Programs\SpyFalcon

From the system folder (C:\Windows\System, C:\Windows\System32 or C:\Winnt\System32) delete the following file

dxmpp.dll

After you are all done restart your computer and once satisfied delete the backup files from c:\killit

If you are running an older version of Java Update ASAP

Seven vulnerabilities have been reported in Sun Java JRE (Java Runtime
Environment), which potentially can be exploited by malicious people to
compromise a user's system.



The vulnerabilities are caused due to various unspecified errors in the
"reflection" APIs. This may be exploited by a malicious, untrusted
applet to read and write local files or execute local applications.



The following releases are affected by one or more of the seven vulnerabilities on Windows, Solaris, and Linux platforms:

* JDK and JRE 5.0 Update 5 and prior

* SDK and JRE 1.4.2_09 and prior

* SDK and JRE 1.3.1_16 and prior

Solution:
Update to the fixed versions.



JDK and JRE 5.0:

Update to JDK and JRE 5.0 Update 6 or later.

http://java.sun.com/j2se/1.5.0/download.jsp



SDK and JRE 1.4.x:

Update to SDK and JRE 1.4.2_10 or later.

http://java.sun.com/j2se/1.4.2/download.html



SDK and JRE 1.3.x:

Update to SDK and JRE 1.3.1_17 or later.

http://java.sun.com/j2se/1.3/download.html


Secunia - Advisories - Sun Java JRE "reflection" APIs Sandbox Security Bypass Vulnerabilities

Blog posting slowing as life catches up

Regular readers of Talesfromthetechside will notice that my posting frequency is slowing. This is for three factors:

1. I am studying for my MCSE and CISSP exams in March
2. I am going to school full time and doing less technical and more interpretive work that requires me to write longer more detailed papers
3. Work has put some interesting projects on my plate that have been captivating my attention even in my off time.

This doesn't mean that Talesfromthetechside is going to dry up and nothing will be posted at all. Rather that it has moved down my priorty list. Though if you email me I will be happy to reply and help you fix your computer problems or write an article on a computer security, malware, virus etc... topic of your choice.

KamaSutra Worm a dud?

FSecure is reporting that the expected turmoil to arise from the 500,000 infections of Nyxem.E / Kamasutra worm fizzled out. Even though the worm's payload became active on Friday nothing really arose from it why? FSecure's analysis of the situation is this:

• The amount of machines that were really infected
  still on Friday was much smaller than the total amount of machines that
  got infected (and cleaned) during the whole outbreak. This number is
  probably in the tens of thousands. Which is not a lot of computers out
  of, say, one billion computers in the world.
• Many of the infected machines were not rebooted on Friday. They were simply running all the time. The worm only does damage when you start the machine on the 3rd.
• Many infected home machines were shut down all of Friday, and nothing
  happened. People went to movies, bars, parties on Friday night instead
  of surfing.
• The media coverage on the whole incident prompted many people to check their system and clean them up in time.

I for one chalk KamaSutra's worm lackluster performance up to three factors first the media attention got people to clean their systems, the publicly available counter site tracking the infections was poisoned by it's being posted on social tagging sites ie. Digg, and lastly the worm only does damage on reboot on the 3rd of the month. With the growth in broadband connections people are leaving there computers on all the time more often then not. This should not lead people to become complacement, the next time we may not be so lucky. Just because this worm was a dud the next one may not be.

 

http://www.f-secure.com/weblog/#00000802

Surf Side Kick Removal

The easiest way I have found to remove surf sidekick is through the add and remove programs in the control panel. However some drive by installs make this option unavailable. Therefore to remove it you have a couple of options

If SurfSideKick is not in Add or Remove Programs, do the following:

Open Windows Explorer and locate the following:

C:\Program Files\SurfSideKick
C:\Program Files\SurfSideKick 2
C:\Program Files\SurfSideKick 3

One or all may exist.

Click Start and then Run 

Type "C:\Program Files\SurfSideKick 3\ssk.exe" /u where the folder name (SurfSideKick 3) corresponds to the folder name you found in the step above

Click OK 

Enter the given security code (generated automatically by the uninstaller) click OK
Click on YES at the reboot prompt.

Reboot and you should be clean. If this didn't work click the link below to reinstall surf sidekick:

http://www.surfsidekick.com/SurfSidekick.exe

Then:

1. Click "Start"
2. Find and select "Control Panel"
3. In the "Control Panel" click "Add/Remove Programs
4. Find "Surf Sidekick"
5. Click "Change/Remove" button
6. Enter the given security code (generated automatically by the uninstaller) > OK
7. Click on "YES" at the reboot prompt.

If you are still not clean of SurfSideKick send me an email and I will be happy to help you out.
 

Unread Email on Welcome Screen Windows XP

The Windows XP welcome screen each time you go to login tells you the number of unread emails you have. I for one find this feature annoying for several reasons:

• I generally don't want to know
• Only Outlook and Outlook Express Report the information correctly (Thunder-bird does some times but not always for me)
• Multiple accounts cause problems and it doesn't tell me what number of emails go with what account.

So all-in-all I find this feature fairly useless and actually a little irritating. So if you are like me and want to fix this then read below for how:

Select the text below and copy it. Open notepad and paste the text you selected. Save the file as disableunreadmail.reg close notepad and double click the file to add the changes to the registry

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\UnreadMail\]
"MessageExpiryDays"=dword:00000000

If for some reason you want to bring back this feature then change "MessageExpiryDays"=dword:00000000 to the number of days you want to save your unread mail so five days would be:

Windows Registry Editor Version 5.00
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\UnreadMail\]

"MessageExpiryDays"=dword:00000005

Select the text above and copy it. Open notepad and paste the text you selected. Save the file as enableunreadmail.reg close notepad and double click the file to add the changes to the registry

Exploit Ebay

A couple of weeks ago I wrote about the WMF Exploit that affected users of Microsoft Windows and would allow for mal-ware to be installed by simply viewing a malicious picture file. E-Week this morning has uncovered a story that this exploit was selling on via the "underground" a full two weeks prior to the exploit being publicly noticed. The exploit first uncovered by people who produce malicious code was up for auction a couple of weeks before anti-virus vendors were aware there was a problem.

For $4000 a spy-ware distributor could buy the exploit code and then have the perfect vehicle to distribute his or her wares. According to the article the exploit was first purchased in early December and days later it was on the web infecting random machines. Luckily the people who discovered the vulnerability were unaware of its full potential and thus only the exploit code was up for sale. If they had taken the time to develop a proof of concept this could have been much worse. As it was according to the eWeek article the lead time that the spy-ware distributor who purchased this exploit code enabled him or her to infect thousands of computers with over a 1000 exploited image files found online.

What is most chilling about this article is that it confirms a growing concern among security professionals that exploits are going up on the auction block. While this is nothing new; underground websites and IRC have long been places where script kiddies and others could get exploit code. However the organization is beginning to develop. There is big money in spy-ware and mal-ware and as such other secondary support channels are beginning to arise. I would not be surprised if in the next couple of years there will be a virtual exploit eBay with both exploit code and proof of concept code on the auction block.

 

Researcher: WMF Exploit Sold Underground for $4,000