Tales from the Techside

Winamp Exploit Installs Spysherrif and CWS

The awesome folks over at Sunbelt are reporting that users of the popular Winamp software who failed to upgrade to resolve a recent exploit (I mentioned earlier this week), can expect to have CWS (cool websearch) and Spyware Sherrif drive by installed on their system. Apparently after going to a nasty website a malicious playlist is loaded and immediately after it loads remote code executes installing these nasty softwares on your system. So if you use Winamp and haven't updated yet do so immediately.

Update Winamp

Sunbelt BLOG: Winamp exploit found in the wild

Adware Punisher Removal

While surfing the user assistance boards I came across a plea for help regarding Adware Punisher. Adware punisher seems to be the latest in a recent blitz of rouge anti-spyware programs that infect your computer mask themselves as beneficial and then resist removal. Once installed on a users system Adware punisher will block access to websites, defed itself from removal, and let the user constantly know that their system is at risk. If the user runs the software the Adware Punisher program displays a number of false positives and also cause popups and other operating system issues to encourage the user to purchase their software.

To remove adware punisher:

Download and run hijackthis, in hijackthis check off the boxes next to the following and click remove

O4 - HKCU\..\Run: [Adware Punisher] C:\Program Files\AdwarePunisher\AdwarePunisher.exe
O4 - HKCU\..\Run: [Adware Punisher Monitor] C:\Program Files\AdwarePunisher\AdwarePunisher_monitor.exe
O2 - BHO: winapi32.MyBHO - {B439D5EB-0A61-4ED9-8C8F-EC4148BB23F7} - C:\WINDOWS\system32\winapi32.dll

Using my SSQKit kill the following processes (double click each to autofind and add to the delete queue)

adwarepunisher.exe
adwarepunisher_monitor.exe
intxt.exe
mswinb32.exe
paytime.exe
services32 .exe
shell386.exe

Next copy the following and paste in notepad and save as killap.reg

**after you have saved the killap.reg file double click the file to add the changes to the registry

REGEDIT 4

[-HKEY_CLASSES_ROOT\winapi32.Intelinks]
[-HKEY_CLASSES_ROOT\winapi32.MyBaner]
[-HKEY_CLASSES_ROOT\inapi32.MyBHO]
[- HKEY_LOCAL_MACHINE\SOFTWARE\Classes\winapi32.Intelinks]
[- HKEY_LOCAL_MACHINE\SOFTWARE\Classes\winapi32.MyBaner]
[- HKEY_LOCAL_MACHINE\SOFTWARE\Classes\winapi32.MyBHO]

Next using the SSQKit search for and unregister the following dll*
winapi32.dll

In the find section type the name of the dll and then right click on it once found and choose unregister

Finally using the ssqkit find and delete the following files and folders

C:\Program Files\AdwarePunisher

intxt.exe, mswinb32.exe, paytime.exe, services32.exe, shell386.exe, mswinb32.dll, mswinf32.dll, winapi32.dll

After you are all done restart your computer and once satisfied delete the backed up files from c:\killit

After deleting the files from the killit folder change your desktop wallpaper. To do so:

• Right-click an area on your desktop and choose "Properties".
• Select "Desktop" and   you'll find a list of images to use for wallpaper.
• Select the one you want and click "Apply"

Internet Security a Primer

In this day and age most newer computers come pre-loaded with Anti-Virus software. With that being said the vendor shift in antivirus solutions and security software providers is to promote security suites or those all inclusive "Swiss Army Knives" of computer security; Norton IS, McAfee Security Center, and even AOL just to name a few. These “Swiss Army Knives” come with everything from Anti-Virus, to real-time process monitoring, firewall, spam filters, java script and web content filters, popup blockers and Ad-ware scan removal engines.

Working for a call center that supports an online software solution I encounter at least 20 calls a day from users that after installing Norton IS or McAfee are unable to use our system. The quick response would be to fix our system but hey that’s neither always possible nor feasible given the vast number of Security Systems available so all too often users end up disabling large portions of these systems to regain access to those resources they need (though if they call us we will walk them through configuring their software correctly to play nice with our system)

Thus in the end the user may have spent upwards of 50 dollars for a software package that is in a large part disabled when they are online. This is further compounded by the fact that most users rather than disabling or configuring only those components they need end up removing or disabling large portions of the system to fix a perceived problem the result being that they are effectively naked on the internet. This means they either suffer in silence or go without virus protection. 

Alas it hardly seems that a day goes by without hearing about some new virus, worm, phishing scam on the network news. When I was a young teenager I used to scan the channels for anything of this type I could find and now that I am constantly deluged by it I am tired of it all (irony is that I find it so interesting) the end result of this of course being that most users have a general knowledge of what a virus is and worse know someone in their direct circle of friends that has been affected by mal-ware on their system but while they consider themselves protected sadly they are just as vulnerable. With virus writing and malware development becoming profit generators the developers of these systems have become much better at hiding, protecting and enabling their software, while sadly enough the heuristic library based scan engines of the anti-virus providers have remained largely unchanged. So if you are the average user you are in one of the following five categories

1. Over protected using an all-in-one antivirus suite carrying everything from a firewall to deleted files recovery system

2. Using the same service but large sections of it disabled rendering it useless

3. Using a generic scanner not configured to update running virus definitions from the original date of purchase

4. Everything is just right

5. Sliding around the internet essentially naked protected by luck or using a non standard operating system

The purpose of this article therefore is to explain what is a virus, what is a Trojan, what exactly is this mal-ware stuff, and what can you do to defend yourself from them. The internet is a big bad place and while AOL’s security center maybe the all-in-one solution to all your security needs I seriously doubt it so let’s take a minute and go over some basics.

So what is a virus, simply put a virus is a program that is able to replicate itself. Viruses spread mutate and infect much like biological vectors and can cause system damage either unintentionally or intentionally expose the user to further security issues and may cause system instability or for the lack of better terms your computer to act sick. Some other side effects of a virus include:

1. Network slowdown due to the retransmission of the virus

2. Loss of files and system data

3. Operating system instability that is recoverable

4. Operating system instability that is not recoverable

So now that we have covered viruses what exactly is a Trojan? Trojans also known as root-kits allow the creator or distributor to monitor and or manage a remote system. Most often they are used to steal data and monitor the users either for profit or because of personal gain (revenge, curiosity, or both). Trojans due their nature are usually transmitted to the user by someone they know or are acquainted with, however this is becoming a thing of the past though with the recent increase in so called zombie networks and botnets. Trojans can be very difficult to remove due to technologies designed to protect or cloak themselves from the operating system, the major difference between a Trojan and virus is that a virus is self replicating whereas a Trojan is not though this is changing. Trojans can cause the following issues:

1. System damage and file and data loss

2. Unexpected behavior due to the remote control feature

3. Personal data security is compromised

4. Unauthorized access to systems and resources

5. You becoming the node in a large spam relay network

With Trojans and viruses defined we move on to Mal-ware, mal-ware is that generic third category of software that is malicious in nature, and while it may have aspects associated with Trojans and viruses their method of infection is generally different. Mal-ware is typically associated with a larger category of malicious software known as spy-ware. Effects of mal-ware vary but for the most part they are resistant to removal self replicating, and obfuscating. Mal-ware is also quickly becoming a viable profit center for many smaller developers helping to distribute ad software that generates revenue for the program. In recent years due to surge in Mal-ware installs the browser market has shifted its scope from IE to a 3^rd party browser model. Symptoms of a mal-ware may include:

1. Change or loss of important data on your computer such as documents, music and video files, this is known as espionage

2. Unexpected behavior due to the shoddy coding of the software

3. Personal data security is compromised

4. Unauthorized access to systems and resources

5. You becoming the node in a large spam relay network

Ok so we have taken a look at the virus, Trojans, and mal-ware now why are they such a growing threat. First off it has increasingly become easier to create and distribute mal-ware using freely available systems. Using these systems almost anyone can build a piece of mal-ware and distribute it in a matter of days if not sooner. Replication modes have continued to vary and intermix with malware spreading using everything from IM (internet message clients), to email, and web pages it becomes increasing difficult to secure all infection vectors without affecting the productivity of the system. As the timeline from exploit to mal-ware continues to decrease patch management becomes a growing concern systems are becoming increasingly blended and complex this proves to be a daunting task to many end users and thus after a while they fail to keep up with patch management. Unfortunately mal-ware developers count on this fact and utilizing multiple modes of infection they can be sure their virus will continue to spread even though the exploit their software uses may be long since fixed.

Ok now that you’re scared is there light at the end of the tunnel? Yes, first off if you haven’t done so already go and get an anti-virus software and if you have the choice stay away from those all in one anti-virus security suites. If you are home user consider using a couple of free clients:

1. Avast antivirus

2. Antivir

3. AVG

If you have the money and want to pay for one go for one of these

1. F-Secure

2. Kaspersky

3. Sophos

4. Norton Antivirus (not the security suite)

If you are using an anti-virus solution already then check it to make sure it is working properly:

1. Try to run a manual update if it fails then see if your service has expired if it has then either renew or purchase a new solution

2. Download a test file and scan the test file with your anti-virus software if it fails to be detected then you may need to reinstall

3. If you have one of those Swiss Army knives open it up and make sure everything is green if not then consult your literature to see why

4. Configure your antivirus to update regularly

5. Configure your antivirus to perform a full scan at least once a week

Anti-Virus covered now if you don’t have a Swiss Army knife you probably need a firewall if you are running windows xp then update to service pack 2 the firewall with windows xp service is more than sufficient.

1. If you are on a broadband connection get a router this will act as a hardware firewall and end many of the troubles at the gate

2. If you are not running Windows XP or hate Microsoft then run a third party firewall I personally recommend kerio

3. If you are on a dial up connection consider using ICS (internet connection sharing) this way you can isolate your primary computer from infection (if interested I will write an article on doing this simply leave a commend to that effect)

Now you need anti-spy-ware (my recommendations in order of preference)

1. Sunbelt software awesome counterspy product

2. Ewido simply fantastic

3. Microsoft Anti-Spy-ware

4. Ad-aware

Once you have one of those then configure them to auto-update and auto scan your computer weekly don’t be concerned with the reoccurrence of cookies these are for the large part innocuous and misleading indications of a mal-ware infection.

Some other more generic tips

1. Use web-mail where you can if you haven’t already setup a gmail or yahoo account and use those to read and send emails

2. If your ISP offers web-mail then use it

3. Switch browsers I personally like firefox but many people may find the new Netscape more convienent

4. If you can download and use the web browser application without a doubt this is the greatest single security fix you can do

5. If you are on Windows XP setup a restricted account and use it for browsing the web

We have covered a lot but for the most part it is fairly generic and should be universally applicable if you did not get anything else from this article then please go and get an antivirus solution and configure it properly. So many things can be prevented by diligent updating and the great thing about software nowadays is that it takes the work out of this dull task and makes it a background process that should be transparent to you. All the prevention in the world means nothing if you don’t apply common sense though so if you don’t know the person and they send you an executable, picture, or anything don’t open it; if you do know the person and have even an inkling of suspicion then contact them. Ultimately learn from the experience of others and ask what it is like to be without their system for a day or lose productivity due to a file or process being lost and all this will seem well worth it. By being diligent your online experience can be fun, informative, and even profitable as with any system invest in preventative maintenance and you will extend your investment into the future.

Ultimate Way to Prevent Spyware from Installing on A Windows PC

If your a regular reader of this blog either your a personal friend or someone that has been seriously screwed by spyware running rampant on their system. All the solutions and programs out there telling you that their software will clean you up and protect your system from spyware are great as remedies but for true prevention the best tool I have seen to date has come from Vmaware.

A couple weeks ago I blogged about VmWare releasing their free virtual browser application and said I would post back after using it for a bit. Well I have been using since then and I am not looking back. Running a modified version of the ubuntu linux platform the virtual browser application is a delight. Firefox version 1.0.7 and 1.5 come preinstalled and with a whole host of extension out there available you will be on-line and spyware free in no time. The best part is it is all free.

Now many people will be quick to point out this isn't keeping your system secure because it is truly a system running within a system but I would retort that is exactly why it is secure. To date there are no real widespread viral, or malware infections for linux and there are definitely no spyware packages either and it is easy to use so the inconvenience isn't really a factor. By using their virtual browser system you are protecting your computer in three ways:

1. Isolation you are isolating your operating system from potentially dangerous areas of Internet
2. Separate from personal information and the core system if you are infected (though I can't see how) your information is stored separate from the browser appliance operating system
3. Easy to clean, if you do manage to get infected all you need do is to delete the browser application system and start over.

All in all it is a great system, so do yourself a favor and try it out.

http://www.vmware.com/vmtn/vm/browserapp.html

Start-up

Desktop

Browser

StopBadware Live

Yesterday I reported that StopBadware a collaborative effort between technology innovators, university researchers, and consumer advocacy groups was in the works. Toady they have a live site, so when you get a chance go there check out the content I know I will be.

StopBadware.org

Google backs anti-spyware resource

Google, Sun Microsystems, a Chinese computer company, prominent universities across the

United States

and consumer advocacy groups are working to help identify the makers and providers of Spyware. Aiming to be an all in one stop for information spyware removal, detection, and prevention this ambitious site will give consumers the ability to decide if it is safe to download a program and should they get infected provide the resources to resolve the infection.

I think this is great step forward for while there are a number of sites spread out across the net with snippets of information such as startup programs, and bhos; and rouge anti-spyware applications, there are no all-in-one sites that are easily navigable.

Still in creation stages the site http://www.StopBadware.org will not be available until the end of February. If you go to the site now you will be greeted with the default ruby on rails page which is a good indicator that they are building the website in Ajax. With buy in from large internet technology corporations, universities, and consumer advocacy groups this could be an invaluable resource in the future.

 

SignOnSanDiego.com > News > Technology -- University researchers launch anti-spyware site

Is iTunes Spying on their users?

First off let me apologize for going dark the past week, I had a major project for school and also for work and given the limited amount of readership I currently have for my blog I had to prioritize elsewhere. With apologies in order let us continue.

Now if you are reading this blog you are either a personal friend or really concerned about spyware and information privacy and found my blog by accident through a track back. In either case you have either read about recent iTunes shift and or heard me rant about my own personal experiences with iTunes. For those of you who just found my site or have no clue what I am talking about iTunes has started tracking what you are listening to and uploading it to a central server so they (iTunes) can offer you a customized ad offering based upon music preferences.

Now your first reaction may be ah so what who cares, at least I am getting bugged by ads I care about. Please note that for the present the iTunes MiniStore component seems to be only effecting the Mac users but I am sure that it will soon enough be irritating Windows users as well. What happens is every time you listen to a song using iTunes, iTunes sends the name of the artist back to a central server somewhere in iTunes land. Shortly after playing the song you will see directed advertisements for that artist. This is not only limited to those songs you purchased from iTunes but any MP3 or OGG vorbis file that has an artist tag associated with the song.  

In a recent press statement http://docs.info.apple.com/article.html?artnum=303066 Apple acknowledged that iTunes transmits the name of the artist, in order to display relevant ads in the MiniStore. Apple goes on to state that this information is not retained and if you disable the MiniStore, no information is sent. For me the problem is not that iTunes is doing this or even that they have added advertisements to their program. Rather that at no time did Apple inform their users that they were doing this, nor did they offer any form of informed consent in their EULA during the install of iTunes which may be why it is only effecting Mac users because iTunes comes preloaded consent is informed.

So consider yourself informed though after the fact and if the ads bug you disable the MiniStore. If you like ads but don’t want information changed then remove the artist information your mp3 tags. Hopefully Apple will learn from this and the future publicly inform their users when they make a change of this sort rather than responding to the public outrage (minimal as it may have been).

To disable the MiniStore by choose Show MiniStore or Hide MiniStore in the Edit menu or by clicking the "Show or Hide the MiniStore" button:

Spyware Consipiracy to Sell Antispyware

Mark over at Sysinternals posts a great article concerning spyware and the recent influx of antispyware fakes. Definately worth a read and thank you to Mark for the post.

http://www.sysinternals.com/blog/2006/01/antispyware-conspiracy.html

Workaround for the WMF Exploit

Un-register the Windows Picture and Fax Viewer (Shimgvw.dll)

1. Click Start, click Run, type "regsvr32 -u %windir%\system32\shimgvw.dll"
(without the quotation marks), and then click OK.

2. A dialog box appears to confirm that the un-registration process has succeeded.
Click OK to close the dialog box.

The Windows Picture and Fax Viewer will no longer be started when users click on a link to an image type that is associated with the Windows Picture and Fax Viewer.

To undo this change, simply re-register Shimgvw.dll :

1. Click Start, click Run, type "regsvr32 %windir%\system32\shimgvw.dll"
(without the quotation marks), and then click OK.

2. A dialog box appears to confirm that the registration process has succeeded.
Click OK to close the dialog box.

This workaround is better than just trying to filter files with a WMF extension. There are methods where files with other image extensions (such as BMP, GIF, PNG, JPG, JPEG, JPE, JFIF, DIB, RLE, EMF, TIF, TIFF or ICO) could be used to exploit a vulnerable machine.

MacScan: Finding Worms in the Apple

Spyware and keystroke loggers have often been thought of as a Windows only problem, but Nicholas Raba, CEO of SecureMac.com and co-author of Maximum Security says many Apple Macintosh users may have a false sense of security. SecureMac has released MacScan which detects and removes Macintosh spyware, remote administration utilities and keystroke loggers.

Link: Security expert says Mac users may have a false sense of security | TG Daily.