Spyware & Virus Infections are Back, and Nastier than Ever

Yes folks, they’re back.  Just in time for the holidays!  Virus and spyware/malware activity has been very low over the past three months, but it’s picked back up again.

This new crop of virus and spyware infections looks a lot like their predecessors.  They disguise themselves as a security program or pc utility program, just like the other scareware programs we’ve seen.

Again, these are fake programs where the culprits try to get you to buy their “program”.  Don’t fall for the trick.  However, once these infections get in, they disable many of your computer’s functions, including internet access.

What makes these new infections so nasty is that they often plant files in your hard drive’s boot sector or partition.  This is a part of the hard drive you can’t see, but it controls the most basic startup processes.  In some cases, when you clean these out, it renders the whole boot sector useless and you can no longer boot into Windows.

Your data is not affected, but if this happens, you need to wipe the drive clean and reinstall Windows.  We had one such case this week.  Of course, we were able to save the data before wiping the drive, so the customer was okay in the end.

If you get one of these spyware or virus infections, we can help.  Visit our Saguaro PC Tech Website and Blog to learn more about the subject.

New “Scareware” Virus Fakes “System Recovery Failure” and Critical PC Issues

We just got a machine in with a VERY NASTY new virus.  We’ve never seen anything like it before.  It throws up fake program called “Windows 7 Recovery”, and displays a warning telling you that a system recovery operation has failed.  It hides all your desktop icons making you think you just lost all your programs and data.

If that’s not enough, it then tells you that either your hard drive, your memory, or both have experienced a critical failure.  Geez…. talk about overkill!  Of course, then they tell you that you can buy their “magic” software that will fix all of that.  Wow, must be some program!  Of course, this is all fake and you must not fall for this scam!

Good News!  It’s just another virus and we have just succeeded in removing it using our usual virus repair methods.  So don’t worry if you get this.  Your PC is okay and your data is in tact.  If you get this nasty virus, we can help you and get you back up and running pretty quickly.

For more information, please visit our Saguaro PC Tech website.  We’re always here to help.

New Spyware Infections Using Hardware Failure Scare Tactic

How’s this for a new one?  After years of distributing spyware infections posing as Antivirus or Security programs trying to grab your money, the “scamware” writers are now trying a new tactic.

We just got in a laptop sporting a big,

This infection is called “Windows Repair“.  Not a very creative name, but I guess they’re trying to make you think it’s a part of Windows.  The structure of this programs is the same as all the other spyware programs out there and we used the same virus/spyware repair methods as we always have.

So don’t fret if you get this.  You hard drive is not dying and your data is just fine.  If you do wind up getting this, or any other infection, give us a call and we’ll get your pc running again in a jiffy.  To learn more about us, please visit our sites below.  Thanks.

The Saguaro PC Tech Tucson Computer Repair website.

Or visit the Saguaro PC Tech Facebook Page for more tips and articles, bot ours and from other sites around the web.

Identifying Common Internet Threats to Your Computer – Part 2

Welcome to part two of this article.  We hope you enjoyed part one (click here if you missed it).  Here we will discuss the last two most common threats, as well as some other methods hackers use to trick people into infecting their machines.

 

Threat Category 3:  The Trojan-Horse

These programs are extremely common and popular.  They are a delivery method that works by fooling people into allowing some form of sinister program onto their PC’s.  They often come to you looking like something that is completely safe, or even desirable (hence the name).

Most of them just sneak onto your PC without your even knowing it.  The creators of these programs will hack a legitimate website and plant the Trojan on it.  Then when you visit that site, it downloads onto your computer.

The varieties are endless, so we’ll just mention one example.  Years ago, there was a program that used animated fireworks to display “Happy New Year 2000” on the PC screen.  Every time you ran the program, all it seemed to do was display this nifty animation in the form of a screen saver.  Another form of this technique was a cute program called “Bonzi Buddy”, where a cute purple gorilla danced around your screen.  What people didn’t know was that in the background, lots of nasty things were happening, such as logging your keystrokes, searching your PC for personal information, or launching pop-up ads.

A newer, more popular one these days is a Toolbar or other program that finds you coupons or great shopping deals.  Most of these “Shopping Assistants” are just crap used to launch pop-ups and send you spam.  There are a couple of “legitimate” coupon programs out there (like the “Coupon Printer” program).  If you come across such a program, avoid it.  There are other ways to find deals on the internet.  Being lazy and relying on a “shopping assistant” can get you in trouble and cost you hundreds in virus repairs, offsetting any “savings” they might find you.

 

Threat Category 4:  Back Doors

The sole purpose of these programs is to allow an authorized user to access or control the infected computer.  A popular one called Back Orifice, was one of the most complex and nasty programs ever made.  It allowed a remote user (ie hacker) to take “pictures” of what was being displayed on a PC screen, watch what was being typed, record sound from a microphone, create files, read data files and even delete files on the affected computer.  Back Orifice was a major problem worldwide and caused internet providers to institute major new security practices that still used to this day.

 

Methods Used for Distribution – How They Trick You Into Getting Infected

Method 1: Misspelled or Slightly Modified Web Address (URL’s)

The easiest way to get people to infect their computers is by tricking the eye.  Who would think that you can get a virus from popular sites such as Google, Amazon or Yahoo?  Or worse still, from your bank’s website?

The chances someone hacking these sites and setting them up to spread Malware is VERY small.  Even if someone does get lucky and hacks these sites, their 24/7 security staff, whose sole job is to monitor the sites’ traffic and watch for any irregularities, will fix the hacks in mere moments.

Yet this happens all the time.  The hackers spread emails and links to  infected web pages that appear like the real thing.  However if you look closely at the URL, or web address they took you to, you’ll find a slight typo or variation of the name.  Let’s take Bank of America for example:

Real URL    =bankofamerica.com

Fake URL1 =bankoofamerica.com

Fake URL2 =bankofamerica.js.com

Did you catch the differences?  How can you see these before you click?

When you hover you mouse over a link on a web page, the URL to the page will appear in your browser’s “Status Bar”, located at the bottom of your browser window.  Note that there is an option to turn this bar on or off in your browser’s “View” settings.  Make sure it’s on.  This is the most effective way to analyze a link before you click on it.

 

Method 2: Links Posted on Chat Rooms and Instant Messages

If you like to do instant messaging, or get on online chat rooms, be careful.  Never click on a link from someone you don’t know.  They may post a link to a “cool website”, some great pictures, or a good program you should download.  These links can bring you to a site that hosts malicious software and you could end up with any of the infections we mentioned above.

I know lots of folks like to meet new people this way.  That’s fine, but don’t trust people until at least you’ve interacted with them for a while.  Hackers and other nasty people tend not to be regulars on chat rooms.  Get to “know” people first.  Of course some nasty people, like stalkers, can stick around for a while trying to get peoples’ confidence, but that’s rare and is just a risk you take in the online world.

 

Method 3: Misleading People on a File’s True Nature by Hiding Part of the File Name

All malicious threats are programs. Programs can be written to do anything, from word processing, to photo editing, browsing the web, or just about anything else you can think of.  There are nasty ones out there too, that can do things like steal your passwords, launch pop-ups, or even delete files.  All programs have an identifying feature that they all share.  That feature is the “file type”, which is signified by the file extension.

Note:  A Lesson on File Types & Extensions:

 

When we talk about a file type, what we mean is “what kind of file is it?  Is it a picture, a document, a spreadsheet, a video, a music file or a program?  How do we know what type of file it is?  By what’s called a “file extension”.  This is the series of 3-4 letters that come after the “dot” in the file name, for example:

File1.jpg is a picture, signified by the “jpg”.

File2.mp3 is a music file, signified by the “mp3”.

File3.docx is a Word document, signified by the “docx”.

File4.exe is a program, signified by the “exe’.

File5.bin is also a program.

The main takeaway here is to recognize programs, as these are the only things that can be a virus or spyware threat.  The file extension for most programs is exe, which stands for “executable file”.  They can also be bin or bat files, but these are far less common.  Now you have a good understanding of the subject..

Okay so now you know this.  Are you safe yet?  No!  Why?  Because by default, Windows is configured not to show the file extensions.  This was a very stupid move by Microsoft.  They argue that this make things less confusing for the end users.  We highly recommend that you turn this feature on.  How do you do this?

Go to the “Control Panel” and look for an item called “Folder Options”.  Open this and you’ll see a tabbed window open up.  Click on the “View” tab and find an item called “Hide extensions for known file types”.  Uncheck the box next to it, and click OK.  If it’s already unchecked, leave it that way.  Now you’re a little safer.

So how do you use this knowledge to protect yourself?  When you see a file attached to an email, or are led to one by hitting a link to download something, you can now see if the file is truly what you were led to believe it is.  If you were led to think it was a cool picture, or a nice song, make sure the file extension is not exe, bin or bat.  If it is, you’ll know you were being misled and get out of there fast!

What the hackers do is fool you by naming a music file for example, as “CoolSong.mp3.exe.  If you had the file extensions turned off, you’d only see the name “CoolSong.mp3”, and you’d think it was a song.  Launch it and whack, the program runs and you’re infected!  Sneaky, eh?  This trick was very common with the free music download programs, like Lime Wire.  I can’t tell you how many customers of ours got infected this way.

That’s it for this post.  We’ll be posting more good articles on computer issues soon, so stay tuned.

As always, we welcome you to learn more about our company.  Please visit our Website or Facebook page.  Thanks!

Identifying Common Internet Threats to Your Computer – Part 1

Introduction:  Landscape of the Battlefield

Nowadays it seems you can’t stray off the path of major sites like Google, Amazon or Yahoo without getting some useless program installed on your PC.  You may even fear risking your security by unwittingly letting some malicious program install itself on your PC.

As you browse the web, you see all these “free” programs and utilities promising you make your PC run better.  A very small percentage of these are useful, but they often come bundled with all sorts of additional programs.  You end up installing programs that you never heard of without even knowing it.  Yes, these legitimate programs can trick you.

It doesn’t take much to get your computer infected or clogged up with so much junk software that it slows to a crawl.  Additionally, you may also end up with malicious programs that can cause even greater havoc.

It is the intention of this article to discuss the characteristics of the major internet threats out there, helping you to be aware of them, and hopefully stay out of trouble.  This knowledge was learned from our years of experience as computer technicians, having “seen it all” and having repaired thousands of computers.

One Big Big Word of Warning: Your Antivirus or Internet Security program will NEVER be 100% Effective!

Our customers always ask why they got hit when they were running a good Anti-Virus program.  The reason is because the crime syndicates that create these programs have large numbers of excellent programmers and strategists that change up their programs and methods as quickly as several times a day!  No security program can keep up.  If you are unfortunate enough to hit a page that was just hacked, the infection will get through.

To keep you eyes from glazing over, we divided this post into category sections, each one dealing with one aspect of the subject.  This post contains the first two subject categories.

Note:  We won’t be saying much about viruses.  Viruses are still out there, but they are actually not used much these days and are rarely the real problem.  The real problem is “Spyware” and/or “Malware”.

 

Threat Category 1:  Scare-Ware and Scam-Ware

These programs are designed to take money from you, plain and simple.  We’ve all heard of the e-mail scams that tried to get you to send money to someone in a poor country.  Since most people are aware of these scams by now, they hardly work anymore.  Thus a new scam has appeared to take its place.

The most popular scam nowadays is to distribute programs masquerading as “security programs”.  These programs pop up out of nowhere and tell you your computer is severely infected and that you’re in grave danger of losing your identity, or whatever (thus the term “scare-ware”).  They insist that the only way to repair the issue is to purchase the program.

These programs often appear to be valid, although they’re absolute fakes.  They sometimes use the names and even the logos of well-known security programs, even those of Microsoft itself!  Most people can’t tell the difference.  If you look really close, you’ll notice some differences, but most people won’t see them.

Once these programs get through, they often hijack your PC.  You can’t get on the web.  You can’t get to the control panel or launch any of your utilities.  If you have a security or antivirus program, they will disable it so you can’t run a cleanup scan.  Getting rid of these programs can be quite difficult and sometimes requires a bit of “reverse hacking”.

It’s interesting to note that hardly any of these programs are created North America.  If you look closely, you’ll notice poor syntax, weird slang terms that are never used, or simple misspellings.  So where do these programs come from?  Mostly Russia and the Ukraine.  Many of the developers are members of organized crime syndicates.  That’s why they’re not afraid of being sued for using legitimate companies’ logos.

 

Threat Category 2: Spyware

Spyware is a term used to describe software that…. you guessed it…. spies on you. These programs are not usually harmful, but they can be over time.  They are often the main component of most of the free stuff you see out there.  Common examples include mouse icon replacements, “fun” cursors, screen savers, “smiley’s” and wallpaper.  One that we see all the time is called “Fun Web Products”.

How do these people make money if their product is free?  Well, by collecting all kinds of data about you, then selling it to marketing companies.  This data is then used to advertise products to you.  If these programs ask you to “register”, using your email address, it would then be sold to marketers, resulting in your inbox getting stuffed with spam.

Spyware has some more dangerous variants.  There are dozens, but the nastiest are programs called “keyloggers”, which can monitor what you type and possibly get your passwords.  This could then of course compromise actives like online banking.

A Common Question: What is Malware vs. Spyware?

Malware is sort of a “catch all” name for all “MALicious softWARE”.  Both viruses and spyware fall into sub-categories of Malware. The common purpose of all these programs is to disrupt the normal operation of your computer and/or compromise your security (ie take your money).

That’s it for now.  Check back in a few days for the next part in this series.  Also please check out our website for more about us and how we can help if you get virus or spyware infection.  Be safe everyone!

To Continue to Part 2 of this Article, Click Here

Visit Our Website: http://saguaropc.com

Visit us on Facebook:  http://www.facebook.com/saguaropctech

Antivirus and Security Software Ratings: Who’s the Best?

As the owner and operator of a computer repair company, I have tried them all.  Over the years, things have changed with Antivirus software, but some have consistently rated very well year after year.

Believe it or not, some of the best Antivirus products out there are free.  Why?  It’s because these are lesser-known companies, usually European, who are trying to break into the US market.  They know that technicians will recommend them because of their superior performance, but customers may not want to change their software because they just purchased or renewed a subscription to their current software.  However if the change is free, they will usually go with the technician’s recommendation.

Eventually they hope the customer will buy the full version of the program, which has more features, better protection, plus no more prompts to upgrade to the full version.  Still, the free versions do a very good job and most of our customers have stayed with the free versions for several years.  If you are an average user, are not very adventurous in the types of websites you go to, and don’t have kids, the free versions are good enough.

Of course, no Antivirus or Security program can give you 100% protection.  The virus and spyware writers change their code so fast, that the Antivirus companies can’t keep up.  Sure, they may update their software several times a day but still, some infections do make it through.  The best you can hope for is that your software will block 97–98 percent of the infections.  This usually translates to years of virus-free computing for most people.  So essentially, the best programs will protect you, but just know that there will always be a slight chance that an infection may get through.

Just so you know, all of today’s Antivirus programs also provide Anti-Spyware and Anti-Malware protection as well, so you covered from these other threats tool.  Actually these days, most of the infections we see are Spyware (or Malware)

So what software products to we recommend?  Our favorite free programs are:

1)      AVG Antivirus

2)      Avast Antivirus

3)      Avira Antivir

Among the paid programs, we recommend getting the full security products, which add firewalls, anti-spam and parental controls to the basic antivirus protection.  If you’re going to pay, you might as well get full protection.  Our favorites are:

1)      Norton (Symantec) Internet Security 2010

2)      ESET NOD32 Smart Security 4.0

3)      Avast Professional

4)      Avira Premium Security Suite 2010

5)      Kaspersky Internet Security 2010

6)      PC Tools Internet Security 2010

Finally, we recommend getting a standalone Anti-Spyware/Anti-Malware program as well, since these types of threats are the most prevalent today.  Standalone Anti-Spyware programs generally do a better job because they are totally focused on these types of infections.

Unlike the free Antivirus products, the free Anti-Spyware programs do not run full-time in the background or automatically update.  You need to manually run them, update them and scan once a week.  Again, for the average user, this is fine.  If not, get the full versions.

The nice thing about these is that you can run them alongside your Antivirus program.  On that note, you should know that you cannot have more than one Antivirus program on your machine.  They will conflict with each other and your protection will be compromised.

Our recommendations are:

1)      MalwareByte’s Anti-Malware

2)      Ad-Aware Anti-Malware

3)      PC Tools Threat Fire

You can find all these programs at the popular website Download.com.  For more information, please visit our website.

Good luck and happy, clean computing.