Archive for the ‘Computer Virus’ Category

Apple Ransomware

Posted by

apple now targeted by ransomewareApple computers are not immune to malware vulnerabilities. A new form of malware called “ransomware” is targeting Apple’s Mac OS X operating system. Ransomeware is a computer virus that encrypts important data such as pictures, videos, music, and documents in order to “hold it for ransom” at an unsuspecting victim’s expense. If the victim pays the ransom then, hopefully, they would receive a key to decrypt their data, known as a decryption key. Unfortunately many times there is no decryption key and the victim loses not only their data but possibly up to $700 USD in ransom payment. The ransom payment transaction occurs using an anonymous payment method in order to conceal the identity of the scammer holding the data ransom so that there is no trace. Ransomware is usually spread via email attachments, peer to peer file sharing, and more recently removable devices such as external hard drives and USB flash drives.

While this is not the first time Apple computers have been vulnerable to malware attacks, such as the FBI virus a few years ago, a recent Reuters report revealed that ransomware was targeting Apple computers for the first time. Ransomware is already rampant on computers running the Windows operating system. Many variants of the trojan horse already exist such as Bitlocker, CryptoWall, Cryptorbit, and CryptoLocker or Crypto-malware. So far the ransomware has infected Apple computers via peer to peer file sharing networks using bit torrent.

There is no easy fix for the data that has been affected by the ransomware. Without the decryption key the data is scrambled to a point that it cannot be deciphered using current technology.

“The best way to protect your data from a ransomware attack is to have an archive backup of the important data on a computer” says South City Computer security expert Nestor Wheelock. “Because the archive is completely disconnected from the live file system the ransomware will not encrypt the data”. While this form of data backup service is complex and daunting to most computer users, South City Computer offers a service package that includes this type of backup service. If you need assistance setting up this type of backup service contact South City Computer or a local computer repair store near you.

Spam Email from UPS with Computer Virus Attachment

Posted by

There seems to be a spam email allegedly from UPS in my inbox today. There also is an attachment that the body of the email is requesting I download and open in order to view my invoice (for services I didn’t order).

If you receive an email like this from UPS it is probably not real and contains a computer virus. Do not download this attachment. Do not show images. You know you don’t have a UPS account! Always stop to think before you click!

UPS

Avoid Phone Technical Support Scams

Posted by

computer-repair-scams-600x520Cybercriminals claiming to be from Microsoft or an anti-virus company may call an unsuspecting victim on the phone. The victim’s information is usually obtained through publicly available phone directories so they scammer may also know other information such as the victim’s name and address when they call.

The victim will be informed that a virus or malware was detected on their computer or that their computer is having an issue. The cybercriminal may prompt the victim to check to see if certain files are on the computer that they will claim are a virus. They may prompt the victim to go to certain websites to convince them they need tech support.

The cybercriminal may prompt the victim for a user name and password, or to install software so they can access the computer in order to fix it. If the remote access software is successfully installed, the victims private data including passwords, user names, personal documents, images, financial information, and virtually all data on the computer has been compromised.

Victims of this scam are urged to secure their accounts including their financial accounts to ensure that they do not become further victim to the scam. It is recommended that the compromised computer be reset to the manufacturer default settings in order to ensure that the cybercriminal no longer have access to the computer. NOTE: Setting a computer to the manufacturer default settings will result in data loss,and may require technical support from a local computer repair company. Contact South City Computer today for professional computer technical support.

Mystery Duqu Virus

Posted by

Computer security vulnerabilityEarlier this year cyber security software company Kapersky announced the discovery of a cyber intrusion that affected many of it’s internal computer systems which initiated a large scale investigation. They believe the virus penetrated their systems through an email attachment sent to an employee at the company. From there the virus moved stealthily through the company’s computer network targeting it’s customer’s computer networks and collecting information. Instead of removing the virus Kapersky monitored the virus on their systems in an attempt to better understand its function and purpose.

The investigation led to the discovery of a new highly sophisticated malware platform known as Duqu. The platform was developed from one of the most skilled, mysterious and powerful underground groups in malware. The virus is considered to be in the same league of complexity as the “Stuxnet” worm that was discovered in June 2010 by “Symantic” and has been nicknamed the “step-brother of Stuxnet” in the cyber security world. The Stuxnet worm was a malware created to target Iranian nuclear centrifuge control system software and reportedly ruined one-fifth of Iran’s nuclear centrifuges.

The Duqu malware platform was initially discovered in 2011 by Crysys labs in Budapest Hungary. Crysys Labs released a 60 page document to the cyber security world defining it as a cyber threat that was not related to Stuxnet as was initially believed because it was nearly identical to Stuxnet, but seemingly had a completely different purpose.

In 2012 the mysterious group responsible for Duqu seemed to have gone dark, and the Duqu virus seemed to no longer pose a threat, that is, until now.

The Duqu virus attacks Microsoft Windows computers by using a “zero-day-vulnarability” that uses a Microsoft Word document (.doc) to exploit the computer. A win32k font parsing engine actually enables the virus to install onto the victims computer when the victim downloads and tries to open the Microsoft document.

At first Duqu was thought to be targeting industrial control systems like the “Stuxnet” worm, but recent revelations have uncovered a very different purpose for the virus. The virus actually is a form of spyware targeted hotel computer systems where nuclear arms talks with the Iranian government and allied world leaders (p5+1 events) were happening throughout the world.

Costin Raiu, director of the global research and analysis team at Kaspersky, said the virus was packed with more than 100 discrete “modules” that enabled the infected computers to be controlled by someone else. Other modules found were designed to compress video feeds from surveillance cameras, and also target communications from phones to Wi-Fi networks. The attackers would know who was connected to the infected network, allowing them to eavesdrop on conversations and steal electronic information. The virus is also capable of operating two-way microphones in hotel elevators, computers and alarm systems. The virus automatically deposits a small file on the infected computer to enable a way for the attackers to monitor and return to the computer at a later date.

The only question is, who is responsible for this complex and sophisticated eavesdropping attempt? Who would benefit most from this sort of intelligence? Cyber security experts at Kapersky hinted toward involvement from the Isreali government, initially naming the virus “The Duqu Bet”. “Bet” being the second letter of the Hebrew alphabet, but later changed the name to Duqu 2.0. The Israeli government did not claim any involvement in the Duqu malware platform.

The sophistication and dedication of the Duqu group is a testament of just how complex a virus can be all in an attempt to collect information.

Social Media “Click Bait” Malware Scam

Posted by

Link Click Bait ScamsSocial media “click bait” targeting has become a big business in recent years. “Click-baiting” is when a publisher posts a link on a social media website like Facebook, Twitter, or Pinterest with a headline that lures people to click to see more, without telling them much information about what the user will really be taken to. Websites like BoredPanda, Buzzfeed, Reddit, College Humor, and Gawker (to name a few) use click bait headlines to lure users to embedded web content surrounded by advertisements. Click baiting has forced Facebook developers to re-evaluate their algorithm for what is considered relevant content, as currently the more clicks a link receives the more likely it is to appear in other users feeds. Wording a link with just the right message in order to get users to click out of the social media website is what “click baiting” is all about. While many of these links take users to relevant content (like this article), there are several new scams also using the tactic to infect computers with malware or attempt to steal personal information.

A recent scam Facebook users should watch out for is a video that is titled “[Shocking video] When you see what happens to this pregnant lady at the beach, your jaw will drop,”. The link actually takes users to a phony Facebook page which asks them to share the post before viewing the shocking video. The victim of the scam will be prompted to download a video software to view the video, but in reality only downloads malware onto the computer. The victim is never actually shown the “shocking” video but instead is taken through other various websites that attempt to steal personal information. The actually video this scam refers to is available for free at YouTube, but unfortunately is much less shocking than advertised.

Social media users should be leery on the links they click on Facebook, Twitter, and Pinterest in order to avoid being scammed or downloading malware onto their computer.

ALERT: Rombertik destroys your computer, avoids detection

Posted by

Virus AlertA new destructive virus known as Rombertik avoids detection from most anti-virus software by making a computer unusable by deleting key files on a computer and filling the hard drive with extraneous bytes of data in order to overwhelm the anti-virus software from detecting it.

Security experts from Cisco say the virus steals login information and other private data. The malware infects the computer via a malicious email attachment.

The malware is also constantly monitoring the computer for security scans in order to avoid detection. The virus will initiate a “self-destruct” sequence that makes the computer unusable by erasing the master boot record (MBR) so that the computer only reboots and never gets into the Windows operating system most likely resulting in a full system restore in order to correct the issue.

ALERT: CryptoWall 3.0 ransomware. Backup or pay BIG!

Posted by

Crypto malware scrambles dataSince 2012 a very sophisticated new form of ransom-ware has been infecting millions of Windows computers. CryptoWall, Cryptorbit, and CryptoLocker or Crypto-malware is a Trojan horse that encrypts files on the compromised computer. The malware uses RSA 2048 bit encryption to scramble important data files using public/private key cryptographic technology making the data files unusable. The victim is instructed to pay a hefty ransom fee ranging from $150 to $750 USD using an anonymous bitcoin payment method to purchase the decryption key that will allegedly decrypt the users files. Even if the user pays the ransom, there’s no guarantee that the attacker will provide the decryption key needed to unlock their files.

After the CryptoWall ransomware seemed dormant for several months a more sophisticated new release known as CryptoWall 3.0 appeared this Monday and has already infected thousands of computers.

Can the malware be removed to get the data back?

While it may be possible to remove the virus from the infected computer, it will not unlock the encrypted files.

How does the ransomware get on the computer?

The ransomware is usually disguised as a fake Windows update for applications such as Adobe Reader, Adobe Flash Player or Java. These types of updates often appear as pop-up windows when the victim visits an unsafe website. The malware may also be distributed as a spam email attachment or as a device driver download from a compromised website.

Is an external drive or cloud sync drive safe?

The ransomware looks for important user files on the hard drive and any devices connected to the computer in order to do the most damage. The ransomware also encrypts files located in the computer users sync folders such as Google Drive or DropBox. So external hard drives, thumb drives and even cloud backup solutions are vulnerable to the attack. Always unplug your external backup drives from your computer.

Can the encryption be cracked?

Currently there is no easy way to crack the encryption methods used by the Crypto malware that scrambled the users important data files. Even the most powerful super-computers cannot easily break the encryption. The only known method to attempt breaking the encryption is to brute force (guess) the private key. This is a highly unlikely solution as it would possibily take 6.5 billion years for a desktop computer to make the correct guess, but is the only solution available at this time.

Will the encryption be cracked in the future?

Possibly with the advancement of quantum computing, current forms of encryption will become less secure and possibly exploitable. Only time will tell at this point.

How to not become a victim of Crypto-malware?

The best known method to safe guard your data against cryptographic malware and other types of virus data loss is to have a reliable incremental backup solution in place. An incremental backup system keeps snapshots over time of your data that can be restored in the event of a data disaster. Talk to South City Computer about an incremental backup solution that will work for you.

Lenovo laptops infected with malware from the factory

Posted by

Computer security vulnerabilityLenovo recently released a product security advisory about a man-in-the-middle attack vulnerability that exists on some of the Lenovo Notebook laptop models sold by the company between Jan 2014 until Feb 2015.

A program called SuperFish intercepts all internet traffic using a self-signed root certificate that is stored in the local certificate store and provides a security concern. Superfish is an advertising company that develops various advertising-supported software products. The Superfish software has been described as malware or adware by security experts and anti-virus softwares. On February 20, 2015 the United States Department of Homeland Security advised uninstalling Superfish and its associated root certificate because they make computers vulnerable to serious cyber-attacks, including interception of passwords and sensitive data being transmitted through the Internet browser.

Lenovo says “SuperFish was previously included on some consumer notebook products shipped between September 2014 and February 2015 to assist customers with discovering products similar to what they are viewing. However, user feedback was not positive, and we responded quickly and decisively”.

While the the company will no longer be including Superfish in its pre-loaded factory OS image, there are still many laptops that remain infected with the malware. Lenovo laptop owners are urged to take actions to remove the program from their computer.

Lenovo laptop owners can remove the malware from their comupter by downloading a Superfish removal tool from the laptop manufacturers website here:

http://support.lenovo.com/us/en/product_security/superfish_uninstall

Alternatively Lenovo laptop owners can take their laptop to a computer repair store in their neighborhood to have Superfish removed.

Is My Lenovo laptop infected with Superfish?

Chances are yes if you purchased your Lenovo laptop at a big-box store. However if you purchased your Lenovo laptop from South City Computer, we have already removed this malware during the initial set up of your laptop.

How to fix Proxy Server Isn’t Responding issue

Posted by

Fix the proxy server isn't respondingOne of the more common computer issues we see because of malware is a misconfiguration Proxy Server connection setting in the browser. You may be able to do a quick fix to get your Internet connection back up and running, however if this has gotten set and you don’t recall doing it, this is probably because your computer is infected with malware or a virus.

NOTE: This may only temporarily fix your Internet connection issue and malware may change this setting back on reboot. It is recommended you get professional computer repair services.

In Windows Search type inetcpl.cpl.

Right click and choose to Run as administrator.

Click the Connections tab, and then click LAN settings button.

Un-check the Use a proxy server for your LAN check box.

Make sure Automatically Detect Settings is checked.

If you have already attempted this fix, and are still getting a Proxy Internet connection issue then you may need computer repair service. Bring your computer to South City Computer or to a local computer repair service and support provider near you.

Why is the Proxy Server Setting enabled?

While every issue is different, malware is usual the culprit behind this proxy setting being changed on a computer. The setting allows for all Internet traffic to be rerouted and monitored through another computer. This is likely in order to serve pop-ups and/or search your Internet traffic for usernames, emails, credit card numbers,and passwords.

10 ways to avoid getting a virus

Posted by

Registry Reviver JunkwareThe Internet can be very tricky at times, much like the streets of a large city, people can easily be fooled if they don’t use their “street-smarts” in every situation they encounter online. People who let their guard down online can easily be fooled into installing unwanted spamware, ransomeware, malware, virus, trojans, or worms. Avoide the following 10 most common ways our customer’s typically have gotten a computer virus on their computer.

1. Have an anti-virus program installed and running. Having anti-virus protection can help to reduce your risk of getting a computer virus. But do not rely too heavily on these programs, as many new viruses are still unknown to the anti-virus programs and there is always a lapse in full protection. Many new viruses have not been documented and released in the most recent virus definitions. Also most anti-virus software only do system scanning and do not do real-time system monitoring, and the ones that do offer real-time system monitoring may not always catch viruses getting installed on the computer.

2. Keep anti-virus software up-to-date with the latest virus definitions. Just having an anti-virus software installed on your computer is not enough to protect you from the latest virus and computer threats. Keep your anti-virus definitions up-to-date with the latest virus definitions. It is recommended to run anti-virus definitions updates on a daily basis to ensure the most effective anti-virus protection.

3. Keep your operating system up-to-date. This means run those pesky Windows Updates whenever your computer prompts you to. Updates oftentimes contain security patches and fixes that have been identified by the software distributor as vulnerabilities. It is best to set your computer to automatically update at a time that you would most likely not be using your computer, such as 3AM. Just remember to leave your computer on and connected to the Internet overnight to install these critical updates.

4. Only open email attachments from trusted sources and in believable situations. Most people get computer viruses by downloading attachments to emails. The attachments can seem legitimate such as a attached document, media file, or picture sent to you from friends or family. However you should be very careful not to download a virus. Sometimes friends, family, or coworkers email accounts can get hacked and will send out malicious software. Always check the file extension that is attached to an email before downloading it onto your computer. If the file extension is a .exe, .bat, .msi, .zip, .msm, .msp, .mst, .idt, .cub, .pcp file this could be a malicious software application. Common pictures file types are .jpg, .png, .gif, .tif, .bmp, and some common document file types are .doc, .docx, .xls, .xlsx, .odt, .txt. If you get an email with a strange file attached to it that doesn’t look like any of these common extensions, it is probably best to first verify with the trusted sender that they indeed sent the file. Also never click on links sent in emails that seem vague like “hey look at this link” or “click here to see my pics”.

5. Never install programs from the Internet that claim to fix a computer issue. While it may seem like a good idea to ask “Google” to fix your computer issue for you. Unfortunately most websites that claim to fix a computer issue by installing a program are not legitimate and are likely just fishing websites to get spam-ware, and other malicious software installed on your computer. Always take your computer to a legitimate computer repair business to fix your computer issue, and never search for a fix using a software program from the Internet.

6. Never illegally download pirated software, music and movies. Most illegal pirating networks, file sharing networks, and file link website will contain malicious software disguised as the newest software, movies or pop music albums. Always purchase software, music, and movies legally to avoid getting a virus from these untrusted file sources.

7. Do not try to install extraneous video and audio codecs. Sometimes you may find a file that has a strange extension. It seems logical to try to find a audio or video codec, or other program that could read this extension, however it is more likely that you would download and install a virus than the actual solution for your file type.

8. Do not install programs that claim to enhance the performance of your computer. There are some programs online that will claim to speed up your computer, or enhance the performance of your computer, or even promise to enhance the graphics capabilities of a computer. These are most likely untrusted websites that try to trick you into installing spam-ware, ransom-ware, malicious programs, and viruses onto your computer.

9. Do not install illegal software on your computer. You may find yourself in situations where a friend, family or other acquaintance has a “hot” copy of a popular software app like Microsoft Office or Adobe Creative Suite for FREE. If it sounds too good to be true…well then it probably is. Do not be fooled, these types of software cost hundreds to thousands of dollars, and the pirated “hot” copies tend to be packaged with malicious software. Always purchase software legally from trusted software distributors. Never install “hot” or “cracked” versions of a licensed software or service.

10. Do not click on pop-ups! Really, DON’T DO IT! Some pop-ups mimic Windows operating system alerts, and can look very convincing at times. Here are a few dead give-aways that you may have an untrusted pop-up:

  • has strange unfamiliar icons
  • the error message has improper English
  • the pop-up box has a message in it promissing to fix your computer issues
  • the pop-up moves around
  • the pop-up says your computer is infected with a virus

Even the most cautious computer user can sometimes be fooled into installing a computer virus. If you think you may have a computer virus on your computer, contact South City Computer for a tech visit today.

// //
//