Warning on stealthy Windows virus

Security experts are warning about a stealthy Windows virus that steals login details for online bank accounts.

In the last month, the malicious program has racked up about 5,000 victims - most of whom are in Europe.

Many are falling victim via booby-trapped websites that use vulnerabilities in Microsoft's browser to install the attack code.

Experts say the virus is dangerous because it buries itself deep inside Windows to avoid detection.

Old tricks

The malicious program is a type of virus known as a rootkit and it tries to overwrite part of a computer's hard drive called the Master Boot Record (MBR).

This is where a computer looks when it is switched on for information about the operating system it will be running.

"If you can control the MBR, you can control the operating system and therefore the computer it resides on," wrote Elia Florio on security company Symantec's blog.

Mr Florio pointed out that many viruses dating from the days before Windows used the Master Boot Record to get a grip on a computer.

Once installed the virus, dubbed Mebroot by Symantec, usually downloads other malicious programs, such as keyloggers, to do the work of stealing confidential information.

Most of these associated programs lie in wait on a machine until its owner logs in to the online banking systems of one of more than 900 financial institutions.

The Russian virus-writing group behind Mebroot is thought to have created the torpig family of viruses that are known to have been installed on more than 200,000 systems. This group specialises in stealing bank login information.

Security firm iDefense said Mebroot was discovered in October but started to be used in a series of attacks in early December.

Between 12 December and 7 January, iDefense detected more than 5,000 machines that had been infected with the program.

Analysis of Mebroot has shown that it uses its hidden position on the MBR as a beachhead so it can re-install these associated programs if they are deleted by anti-virus software.

Although the password-stealing programs that Mebroot installs can be found by security software, few commercial anti-virus packages currently detect its presence. Mebroot cannot be removed while a computer is running.

Independent security firm GMER has produced a utility that will scan and remove the stealthy program.

Computers running Windows XP, Windows Vista, Windows Server 2003 and Windows 2000 that are not fully patched are all vulnerable to the virus.

Support Rates for 2008

Please note that my support rates for 2008 are as follows;

 

Private (domestic) computers £30.00 per hour.

 

Business computers £45.00 per hour.

 

Many thanks

 

Roy

Who needs manuals

A quick word of advice to those who have treated themselves to new kit over the Christmas period, or been given new kit...

 

Many of my support calls in the new year are fairly quickly resolved by a brief scan through the instruction book (which is often still in pristine condition in the box/packaging).

 

If you wish to save money, try reading the manual before calling for help.

 

By the way - Happy New Year!

Just thinking about ancient bits of kit

I was reading an article on Tech Republic about ancient bits of kit still being in use and it got me thinking....

 

What is the most ancient bit of kit that you still use daily (and I dont mean the significant other!).

Just updated my website

Hope all readers of this blog had a good Christmas. I've just spent the past few days updating my website. Why not head over there and let me know what you think.

All the best

Roy

Toying with the idea of a website overhaul

I'm toying with the idea of completely re-designing my own website, but am stuck for inspiration as to what feel to apply. It is almost tempting to point my domain to one of the blogs to which I post, but again, I am torn between the feel and content of them.

Website hosting now available

I can now offer web hosting services including PHP and MySQL for active content.

An old virus hoax has resurfaced

One of my clients phoned in a bit of a panic earlier...they had received an email warning about a virus called 'life is beautiful', warning them not to open a powerpoint attachment of this name and promising all sorts of dire things would happen should they open it.

This is an old hoax virus which first surfaced in 2002. See snopes or symantec for more information.

Some interesting ideas on getting links

Sujan Patel over at singlegrain.com has some innovative ideas on getting more backlinks, particularly point 3, where he advises to upset someone!

Creating a secure password

To create a secure password that is easy for you to remember, follow these simple steps:

Do not use personal information. You should never use personal information as a part of your password. It is very easy for someone to guess things like your last name, pet's name, child's birth date and other similar details.

Dont use real words. There are tools available to help attackers guess your password. With today's computing power, it doesn't take long to try every word in the dictionary and find your password, so it is best if you avoid real words.

Mix different character types. You can make a password much more secure by mixing different types of characters. Use some uppercase letters along with lowercase letters, numbers and even special characters such as '&' or '%'. You can substitute some letters for numbers e.g. i = 1 e = 3, L = 7.

Use a passphrase. Rather than trying to remember a password created using various character types which is also not a word from the dictionary, you can use a passphrase. Think up a sentence or a line from a song or poem that you like and create a password using the first letter from each word.

For example, rather than just having a password like 'yr$1Hes', you could take a sentence such as "I like to read the news" and convert it to a password like '1l2rttn3w5". By substituting the number '2' for the word 'to' and using a 1 to replace I, you can use a variety of character types and create a secure password that is hard to crack, but much easier for you to remember.

How to show filename extensions in Windows

Windows is designed to be user-friendly, to the point where filename extensions (the bit of the filename that Windows uses to decide which program should open a file) are by default hidden.

This can have serious repercussions, where some viruses attempt to disguise themselves as an innocuous spreadsheet or word document. Double clicking on the filename does not open Word or Excel as expected, but executes the virus.

There is a simple way to ensure that filename extensions are shown however;

Double click on My Computer from the Windows Start menu. (You can use any method for launching Explorer.)

Choose Folder Options from the Tools menu. Then, click the View tab.

In the Folder Options dialog box, uncheck the Hide Extensions for Known File Types option.

Click OK.

Now when you view filenames, you can see exactly what sort of file you are about to open.

Slow computer

A new client presented me with an old computer (running Windows 2000 pro) that was running incredibly slowly for the spec (1.4G processor, 80Gbyte hard drive and 1.5Gig of ram). Lets put it this way, instead of making a cup of tea whilst waiting for it to boot (I drink coffee by the way), you could have gone out for a full dinner at your local eatery!

Loading up defrag, the analysis screen showed almost all red. After setting a defrag going and popping back the next day to check, the system was re-booted and performed almost like a new machine.

For good measure, I also ran a spyware and virus scan that fortunately turned up clean and left the client with a PC that was running as good as new.

After chatting with the client, it transpired he had never run a defrag, so a quick ad-hoc training session was organised.

Random Failures

A client of mine who runs a financial services company was experiencing random failures across his network.

In a very short space of time, he had fried two flat screen monitors and 3 power supplies. In spite of his insistence that the power into his offices were ok, the only thing that could explain the damage was power surges.

A quick trip down the local electrical shop and clearing out their stock of surge protected extension leads provided a reliable fix for the client, not to mention low cost.

Computers are sensitive devices and even a slight surge can cause inexplicable damage.

Hospitals

My son was admitted to hospital with severe breathing difficulties just before Christmas and had to stay in over the festive season. He has now been discharged and is on the road to recovery, however I met a very interesting chap in the cubicle opposite.

He describes himself as possibly the tallest ukelele player in the world!

Have a look at his site and wish his daughter well (she was still in hospital when my son and I were discharged).

Whilst I am on this topic, I would like to offer my vote of thanks to the excellent staff in Kipling Ward at the Conquest Hospital, Hastings. In spite of their unit and jobs being at risk due to NHS cuts, they provided both me and my son with faultless care and attention and ensured that in spite of my sons illness he had a good christmas (even down to a sack full of toys being at his bed on Christmas day!)

Well done to all of the staff and wishing you a Happy New Year!

Seasons Greetings - Roy

Web sites

Why is it some companies charge the earth for providing basic services?

I recently was approached by one of my private clients (an elderly gentleman) who wished to produce an on-line gallery for his paintings. Other designers had named fees well in excess of £1000.00 to produce a 7 page site which merely had scans of his paintings.

Completing the work took me no more than 2 hours and I agreed on a profit share arrangement for payment. Is it just me, or are techies getting a bit like plumbers and car mechanics?

A spot of web design

One of my long-standing clients, a retired gentleman in his 70s who could perhaps be described as eccentric approached me over the Christmas period to design a website for his new-found hobby - nude oil paintings.

He has already written a book about impotence and made a breakthrough with discovering an alternative cure for erection difficulties by means of a commonly available root vegetable. In researching his book, he hitched up with a 30 year old woman and the story takes off from there....

Trying the obvious

Most of my support calls seem to be a case of users not engaging their brain before pressing the panic button.

In my experience 90% of faults are due to something trivial, such as loose leads and the such like. Please check before calling. It is one of the first checks I will carry out when arriving to fix your problem.

What to check:

All the leads at the back of the PC are plugged in correctly (Monitor/Keyboard/Mouse/Power/Printer/USB etc)

That there is actually power going through to the socket where the PC is plugged in (if it appears completely dead).

Making websites accesible

The Disability Rights Commission in the UK have produced a report into web accessability for the visually impaired. Whilst this initiative is to be applauded, surely, if the DRC really wish to improve web access for those of less than 20-20 vision, why are they charging £30.00 for access to the report?

Spam

After my last post was spammed, comments are now restricted to members of Blogger.com.

Mind, you it is interesting that the post was actually about spam....

What is SPAM??

What is Spam?

Over the years, people have often asked me to explain the various concepts of Marketing Communications. The following analogies might help clarify the "tools of the trade."

You see a handsome guy/girl at a party. You go up to him/her and say, "I'm fantastic in bed." -- That's Direct Marketing.

You're at a party with a bunch of friends and see a handsome guy/girl. One of your friends goes up to him/her and pointing at you says, "She's/He's fantastic in bed." -- That's Advertising.

You see a handsome guy/girl at a party. You go up to him/girl and get his/her telephone number. The next day you call and say, "Hi, I'm fantastic in bed." -- That's Telemarketing.

You're at a party and see a handsome guy/girl. You get up and straighten your clothes. You walk up to him/her and pour him/her a drink. You say, "May I," and reach up to straighten their clothes brushing lightly against their arm, and then say, "By the way, I'm fantastic in bed." -- That's Public Relations.

You're at a party and see a handsome guy/girl. He/she walks up to you and says, "I hear you're fantastic in bed." -- That's Brand Recognition.

You're at a party and see a handsome guy/girl. You talk him/her into going home with your friend. -- That's a Sales Rep.

Your friend can't satisfy him/her so he/she calls you. -- That's Tech Support.

You're on your way to a party when you realize that there could be handsome men/women in all these houses you're passing. So you climb onto the roof of one situated toward the center and shout at the top of your lungs, "I'm fantastic in bed!" -- That's Spam.