The Computer Clarity Blog

As has become tradition, PandaLabs, the anti-malware laboratory of Panda Security -The Cloud Security Company- has published its 2009 Virus Yearbook, reviewing the malicious codes that have appeared over the last 12 months and examining those that have stood out for one reason or another.
Rather than a ranking of the most widespread viruses, or those that have caused most infections, PandaLabs has selected those which, either for their use of social engineering or their visible effects on computers, stood out most last year. For this reason, some of the more well-known malicious codes (such as the Koobface virus) are absent from the list.

So here are the viruses we believe deserve a mention:

- The biggest headache. There can be no doubt that Conficker.C has been the most obnoxious virus over the last 12 months. It first appeared on December 31, 2008, and has spent the last year causing serious infections to companies and home users alike. The insidious and tenacious nature of this malicious code has earned it first place in our ranking.

- The Harry Potter of viruses. Although there is no reference to the world’s most popular fictional wizard, the on-screen messages Samal.A displays are all about magic. When it infects a computer, users will see the message “Ah ah you didn’t say the magic word” (see photo on Flickr), and the cursor then flickers waiting for users to enter a word. The truth is, it doesn’t matter what is entered, because after three attempts, the phrase “Samael has come. This the end” (see photo here), will be displayed and the computer is restarted.

- V for Vendetta. We still don’t know who is the real target of this vendetta, but DirDel.A wreaks vengeance on infected users, progressively replacing folders in different directories with copies of itself. The worm is carried in a file called Vendetta.exe with a typical Windows folder icon (see photo on Flickr).

- Plane nuisance. The Sinowal.VZR Trojan has infected thousands of computers under the guise of plane tickets supposedly purchased by the user (see photo on Flickr).

- The all-action virus. We are talking about Whizz.A. Once infected, computers will start emitting a series of beeps, the mouse pointer moves uncontrollably around the screen, the CD/DVD tray opens and closes, while the screen is ‘decorated’ with a row of bars like those in the image.

- The snooper. Waledac.AX ensnares its victims by claiming to offer a free application for reading SMS messages on anyone’s cell phone. Ideal for those that want to check up on their partners. Perhaps that’s why so many users fell victim to this intelligent virus.

- The most affectionate. BckPatcher.C tops this category, as it changes the desktop wallpaper to an image reading “virus kiss 2009” (see photo on Flickr. What a charmer!

- A touch of the sniffles. We couldn’t fail to mention here a couple of the viruses,WinVNC.A and Sinowal.WRN that used the widespread alarm surrounding swine flu to trick users and infect their systems.

- And the award for incompetent newcomer goes to… Ransom.K. This Trojan encrypts documents on infected computers, and then asks for a $100 ransom to release them. However its reator, probably lacking in experience, included a programming error which allows users to release the files with a simple key combination.

- The most deceitful. This year, the winner in this category is FakeWindows.A, which infects users by passing itself off as a license activation process for Windows XP.

- The party animal. Banbra.GMH arrives in an email promising photos of Brazilian parties (with dancing girls included)… Who could resist?

Computer Clarity

This week’s PandaLabs report looks at two fake antiviruses: PcLiveGuard and GreatDefender.

This type of malware passes itself off as legitimate software applications in order to steal users’ money by tricking them into believing that they will eliminate threats on their computers.  Panda Security has published a report on fake antiviruses, available at:

http://www.pandasecurity.com/img/enc/The%20Business%20of%20Rogueware.pdf

Similarly, the PandaLabs Annual Report also provides information about the situation of this malware at:http://www.pandasecurity.com/img/enc/Annual_Report_PandaLabs_2009.pdf

PcLiveGuard’s icon resembles a legitimate antivirus icon. When run, a typical screen is displayed, asking users if they want to scan their PCs. See pic at: http://www.flickr.com/photos/panda_security/4255539533/

Regardless of whether users accept or not, it will indicate their computer is infected. Here is the image that will be displayed if users scan their PC (http://www.flickr.com/photos/panda_security/4256301498/).

If users do not scan their PC with the fake antivirus, infection warnings are displayed to scare them into purchasing the product.

GreatDefender is a fake antivirus which informs about potentially dangerous software on the computer, due to it not being correctly protected. It tries to get users to pay with their credit cards in order to install the solution.  The objective of the antivirus is to collect personal and bank details provided by users on purchasing it. As this type of malware cannot reproduce itself, it requires user interaction to infect the PC. To do so, it uses its own websites on which it is advertised as one of the best anti-spyware solutions in the market.

Picture available at: http://www.flickr.com/photos/panda_security/4256301526/

When users access the website, they are given the option to download the antivirus, but when they try, the trial version is unavailable and they are redirected to the pay version.  The installation process is similar to that of any antivirus, allowing users to select the language and location of the files. Once the installation ends, the fake antivirus carries out a full system scan.  It then falsely ensures users that their computers are free from any infections.  To make users believe they are protected, an icon is displayed in the Windows desktop, the quick taskbar and the Windows start menu, to make it look as authentic as possible.

Computer Clarity

Three Rules To Prevent Computer Virus Infections

First Rule: Read Your Computer Screens.

Read the window that pops up on your computer screen before you hit “Okay”, “Cancel”, “Run”, “Yes”, “No”, or even “Maybe”! People are like monkeys. Any monkey can be trained to hit a button to get what it wants. We have been trained with a Pavlovian response to hit a button, get something out of our face, then we get what we want. Every virus writer knows this! Most viruses don’t get you because of sophisticated programming code. They get you with social engineering. They get you because they know that most humans don’t think. Like monkeys, most humans will hit the button until we get what we want, regardless of what that button really does. So, many of the viruses I am hired at expensive rates to remove, are installed by the user because they were tricked into hitting a button without reading the screen. But the really insidious part of this scenario is that one screen is often a EULA (End User License agreement) This is a legally binding contract that, by hitting the “Okay” button, affirms your agreement to the terms and conditions of proceeding with the installation. In other words, even if you know the person who did this to you and you had them in court in front of a judge, you could not hold them liable for the damage to your computer system because you legally agreed to the installation that caused the damage. They screwed ya, and you legally asked for it. You must read your screens!

Second Rule: Google Everything.

Now, this doesn’t mean that you must use Google, any search engine will do. But, anything that you don’t understand…Google It! This can apply to anything of life’s issues in today’s world, but in this context, if you read your screens and you come across a company you don’t know, a program you don’t recognize, or a message that just don’t make any sense to you…GOOGLE IT!. If the company, its software, or its messages are legitimate, your Google search will reveal information supporting its legitimacy. If it is a fake trying to trick you into a disaster, you will see thousands of websites all saying how bad it is and all of the problems it causes. You don’t need to read any further; in a heartbeat, you know to close every window before this thing really gets you into trouble.  Read this article:  One of The Most Common Infection Tactics Today for instructions on closing dangerous windows.

Third Rule: Maintain, Trust, and use YOUR Antivirus Properly.

This involves a few things. First, just like the lock on your front door, if it isn’t installed properly, maintained properly, and used properly, it won’t keep bad guys out. Installed properly is fairly obvious. If there is an error during installation, it ain’t werkin. Remove the antivirus, reinstall it, or pick a different one. Second, maintaining the security system properly. If the subscription runs out or the software stops updating, it is not properly maintained. Just like the lock on your front door, if the screws are hanging out, it ain’t protecting you. Fix it or you will have an intrusion. Second, you have a security system. This is like your computers security guarding company. If your house is guarded by Brink’s Home Security, you wouldn’t trust a guy from ACME Security Systems to come and fix a security problem, but this is exactly what happens. Some fake antivirus warning pops in front of your face warning you of all of these infections, but if it is not YOUR antivirus, RUN!!! Third, Use Your Security System Properly. If you have a lock on your front door that you never lock and you invite anyone who knocks to “come on in”, no lock can protect you. Using your antivirus properly means that you do not invite everyone in and that you scan everything that you download before you run it. If you don’t use your antivirus properly, you will get infected and your computer will die. Just like the lock on your front door, its only a matter of time until a bad guy tries to open it.

These are the three rules to avoid getting a virus on your computer. These are the three rules that, if everybody followed, I would loose 80% of my computer repair business overnight. But these are the three rules that so few people follow, so, my job is secure. Keep breaking these rules and, as a computer repair technician, I’ll always have work. But, if you can follow these rules, I can finally stop that insanity and do something I really like. So, be smart, be careful, and be virus free.

Computer Clarity

I ran into one of the most common infection techniques several times on different computers today.  It goes something like this:

An average person goes surfing sites, often regular sites, and in the middle of this average normal internet cruise…WHAMMO…some popup gets in your face telling you about 48 infections, viruses, spyware, Trojans, and worms are all up in your computer and you must click here to remove.  Many at this point click the window and the real virus infection begins.  Others are wary and try to close the window with the red “x” in the top right corner.  Unfortunately, many of these trick warnings are designed to launch the virus if you touch any part of the window.

Average computer users have two obvious problems.  First, how can a user tell the difference between a legitimate warning and one of these tricks?  Second, how do you close one of these damned fake warning windows without getting the virus?

To answer the first question, look in the top bar of the warning window.  This bar, usually blue, is designed by windows to display the name of the software that is running in that window.  If a warning is from any software other than Windows or your installed antivirus software, it is probably a trick!  Don’t Touch It!  If you see the name and you’re not sure what software it is, Google it.  If it is good, you’ll see some websites that describe it.  If the software is bad, you will see ten thousand websites talking about how bad it is and giving suggestions for removing it.  In a heartbeat, you can know for sure if the warning is real or the beginning of your nightmare.

To answer the second question, “How do you close that damned window without touching it?”  There are three ways to get out of this.  Try them in order.  First, look at the bar at the bottom of the whole screen.  This is the bar with the start button on the left and the clock on the right.  In the middle section there are wide buttons that represent the windows that are currently open.  Find the one that represents the warning window, right click it, and choose “Close” from the menu.  If you are not sure which one to right click, close them all.  The second thing to try is to hold down the “ctrl” and “alt” keys and tap “del” once.  This will give you access to the task manager where you can forcibly kill programs and processes.

The third option that you have to avoid the impending doom looming over your computer in the form of this fake warning is a simple, effective, and full proof method.  However it is drastic.  You will lose anything you haven’t saved and you may have to endure an hour long Windows scan disc routine but you will avoid hours or days dealing with the other mess.  If you can’t find a way out of this window without touching it and you can’t locate the button, program, or process to kill, kill the computer.  Press and hold the power button for about five seconds or until the computer shuts off.  Then reboot as normal.  If the virus was not launched, your computer will be fine.  If the virus was launched, it’s too late already.  I am so sorry, but look for my post on virus removal.  I will tell you what to do after an infection.

Computer Clarity