Find What's New to Clean Up Malware

My thanks to everyone who has participated in the beta test of the newest WinPatrol. I’ve heard a lot of good comments and one suggestion was so valuable I couldn’t wait for a future release to make it available.

Available today is the last beta of what will become WinPatrol 2009. If you’re like to participate you can download beta 4 at http://www.winpatrol.com/beta16.html.

The latest WinPatrol feature is so simple I can’t believe nobody has thought of it before. One of WinPatrol’s unique features is to keep track of when a program, service, hidden file or registry entry was first detected on your machine.

When any kind of infection occurs all its related files will show up as recent additions to your system. WinPatrol 2009 includes a new single list that sorts critical files and entries by their date detected. There’s a really good chance any new malware files will show up at the top of this list.

WinPatrol new Recent Tab

In the past months I’ve had a number of friends and family members bring me their laptops to clean up malware. If I had a Recent list at the time I probably could have helped them over the phone.

This should be the last beta version so if you’d like to participate I would love to hear from you. Next week I’ll be in Redmond blogging from Microsoft’s Most Valuable Professional Summit.  I hope to announce our official launch soon after I return.

Thanks!
Bill

Read More

Remove "Downadup" aka Win32/Conficker Infection

Today, Microsoft notified a number of security experts about a known vulnerability and exploitation of Windows Server service (SVCHOST.EXE). Even though Microsoft provided a fix for this vulnerability in October 2008, they say reports of the exploit are on the rise.

In October, Microsoft warned users of a critical Microsoft Security Bulletin MS08-067.

Executive Summary

This security update resolves a privately reported vulnerability in the Server service. The vulnerability could allow remote code execution if an affected system received a specially crafted RPC request. On Microsoft Windows 2000, Windows XP, and Windows Server 2003 systems, an attacker could exploit this vulnerability without authentication to run arbitrary code. It is possible that this vulnerability could be used in the crafting of a wormable exploit. Firewall best practices and standard default firewall configurations can help protect network resources from attacks that originate outside the enterprise perimeter.

This security update is rated Critical for all supported editions of Microsoft Windows 2000, Windows XP, Windows Server 2003, and rated Important for all supported editions of Windows Vista and Windows Server 2008.

Unfortunately, there seems to be too many unprotected users out in the real world. Microsoft provided details on this infection at its Malware Protection Center.

The following system changes may indicate the presence of this malware:

• The following services are disabled or fail to run:
  
  Windows Update Service
  Background Intelligent Transfer Service
  Windows Defender
  Windows Error Reporting Services
  
  

• Some accounts may be locked out due to the following registry modification, which may flood the network with connections:
  
  HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters
  "TcpNumConnections" = "0x00FFFFFE"
  
  
• Users may not be able to connect to websites or online services that contain following strings:
  virus, spyware, malware, rootkit, defender, microsoft, symantec, norton, mcafee, trendmicro, sophos, panda, etrust, networkassociates, computerassociates, f-secure, kaspersky, jotti, f-prot, nod32, eset, grisoft, drweb, centralcommand, ahnlab, esafe, avast, avira, quickheal, comodo, clamav, ewido, fortinet, gdata, hacksoft, hauri, ikarus, k7computing, norman, pctools, prevx, rising, securecomputing, sunbelt, emsisoft, arcabit, cpsecure, spamhaus, castlecops, threatexpert, wilderssecurity, windowsupdate
  
  Hmmm, should I feel bad that WinPatrol isn’t included in this list?

I recommend, as does Microsoft to keep your system updated with necessary security patches and updates. At the very least you should download the Microsoft Malicious Software Remove Tool. 

 

Read More

Malware Attacking Your Router

WinPatrol was one of the first to detect malware based on “behavior” of program and continues to follow that model. One behavior we’ve seen a lot of lately is very scary.

Instead of installing malware that continues to run like a key logger or trojan, malicious programs are increasingly attacking the network router which is common with any internet connected home and/or office. An unwanted program can quickly make a change to your router settings that will immediately open all your computers to the world. The bad guys won’t have to install a key logger, they’ll be able to record every byte that goes across your network. It’s happening now to thousands of routers which are still using their default name and password.

Do you know if the password has been changed since your router was purchased?
Do you know how to access your router to change the password?

I’ve run across a number of users who follow all the recommendations to configure their networks for WEP or WPA2 encryption but they never bother to change their default name/password. They’ll even take the time to rename their default SSID but still don’t change the name/password from the factory setting.

It probably won’t surprise you that the factory passwords don’t change much and are widely available. The WinPatrol research group dissected some recent malware threats and could see the routers they were attacking.

• Linksys, uses the name and password, “admin”. Older units use a blank user name.
  
• Belkin, uses blank password for default access
  
• Netgear, user name is “admin” and the default password is “password”. Big improvement over their old default “1234”
  
• ActionTec, Some unit don't even require an admin login. New devices use "admin" and "password". (updated)

You get the idea. The program recently submitted to our research team had a list of 28 different routers complete with address, name and password clear for anyone to read with the proper tools.

As a security professional I’m reading more and more about vulnerabilities being found in wireless and non-wireless routers. There’s only so much we all can do but the first thing should be to change the default password.

If you don’t know how to access your router, just use your favorite search engine and type in your router name and “change default password”.

Read More

Task Scheduler Provides Malware Hiding Place

One of the least used features of Windows has been its control panel applet, Task Scheduler. In 2003, I added a feature to WinPatrol 6.0 which monitored Task Scheduler jobs and warned users if some kind of malware injected itself in the Scheduler list. In the past, I found few incidence's of malware using this as a method to run programs which might take over a system, replicate or just do nasty stuff. This has always surprised me since most Anti-Malware programs won’t alert users to newly created scheduled tasks jobs.

I have noticed more legitimate programs finally using Task Scheduler but unfortunately many obnoxious programs are also taking advantage of this poorly monitored launch location. There is a variant of the nasty Adware called “Lop.com” that now adds a program to the Scheduled Task list. Malware frequently creates file names using random letters like IS-HDKEUL.exe. Lop is distinguished by file names created by random words like “BASH ACE STUPID.EXE”, “EXIT FIVE GLUE.EXE, sometimes without spaces between the words.

Some recent detections to watch for in the Task Scheduler include:
RVHOST.exe – Yahoo Messenger Worm
At1.job – Multiple worms installed using old Windows vulnerability
BLASTCLNNN.EXE – Sohana/YahLover Worm
WUNAUCLT.EXE – Possible Zoih A Trojan
WINMDS.EXE – Porn Dialer Trojan
And many LOP type using file names created with random words.

Anyone who reads this Blog knows how I feel about AutoUpdates, especially when they run in the background all the time. The Task Scheduler is an ideal place for autoupdate programs. These programs shouldn’t run constantly but it couldn’t hurt to have them scheduled to check for updates on a regular basis and then shutdown.

Some of the annoying auto updaters that need to be moved to Task Scheduler come from Google, Adobe and InstallShield which looks for updates of any programs that used InstallShield as their setup package.

According to recent requests for PLUS Info, the following are now using Task Scheduler.
MPCMDRUN.EXE – Windows Defender
SOFTWAREUPDATE.EXE – Usually Apple/iTunes/Quicktime
SYSTEMOPTIMIZER.EXE – TuneUp Software GMBH
MSFEEDSSYNC.EXE – Microsoft IE7 RSS Support
WALIGN – Window 98 File Optimizer
MSNTBUP.EXE – Microsoft Live Toolbar

Microsoft has made radical changes in Task Scheduler for Vista. This has encouraged many developers to take advantage of its power. It also has appeared to provide a little better security so that malicious programs will have a harder time infiltrating systems this way. You’ll still be surprised by how many unnecessary services run here slowing you down when you least expect it.

You’ll definitely want to keep an eye on your Scheduled Tasks either by using WinPatrol or occasionally opening the Task Scheduler applet in the Windows Control Panel. It might help explain where that “Do you want to update…?” message appears to come from.

Read More

Google Online Security

I was pleased to read in Donna’s SecurityFlash that Google has a new blog dedicated to Online Security. I expect we’ll be seeing regular posts so I have added Google Online Security to the list of “Blogs I Read”.

“Online security is an important topic for Google, our users, and anyone who uses the Internet. The related issues are complex and dynamic and we've been looking for a way to foster discussion on the topic and keep users informed. Thus, we've started this blog where we hope to periodically provide updates on recent trends, interesting findings, and efforts related to online security. Among the issues we'll tackle is malware, which is the subject of our inaugural post.”

Click to Read the Introductory Post.

I’m glad that Google is using their own Blogger software for this new initiative. Perhaps it will mean less down time for BlogSpot users.

Read More