Comments on: Website Referral Spam and Cyber Security Malware http://strangelyperfect.tv/6622/website-referral-spam-and-cyber-security-malware/ This is Our World Tue, 07 Feb 2012 16:55:47 +0000 hourly 1 By: Strangely http://strangelyperfect.tv/6622/website-referral-spam-and-cyber-security-malware/#comment-2020 Strangely Mon, 16 Nov 2009 15:24:31 +0000 http://strangelyperfect.tv/?p=6622#comment-2020 @Tracey Yes I did/do have some Firefox plugins. Flash, a developer possibly, dictionary, picture search and screen grabber, I think (I tend to enable/disable a bit dependant on what I'm up to!!). The whole thing is pretty weird as it resizes the windows etc. I was quite amazed that big name anti-virus programs failed to react properly. Since then, I'm giving the new Opera a go again but haven't actually tested it against the threat sites. Fortunately, you don't HAVE to actually install the download once it's down. You can delete it as it doesn't have any automation(yet) to do this... But NOD32 let it install in my test, which I wasn't happy about as it's been highly effective for several years. I used Comodo several years ago, but was dissatisfied because it actually did things to the PC that could be construed as 'spying', and it wasn't that good then anyway. I haven't tried it since that time because of this. I haven't used Norton for many years although I've tested it when I've got a new mainboard as it's always on the disc! I've always found it to be an unreasonable hog of everything and then removed it after my test. @Tracey
Yes I did/do have some Firefox plugins. Flash, a developer possibly, dictionary, picture search and screen grabber, I think (I tend to enable/disable a bit dependant on what I'm up to!!). The whole thing is pretty weird as it resizes the windows etc. I was quite amazed that big name anti-virus programs failed to react properly. Since then, I'm giving the new Opera a go again but haven't actually tested it against the threat sites.

Fortunately, you don't HAVE to actually install the download once it's down. You can delete it as it doesn't have any automation(yet) to do this… But NOD32 let it install in my test, which I wasn't happy about as it's been highly effective for several years.
I used Comodo several years ago, but was dissatisfied because it actually did things to the PC that could be construed as 'spying', and it wasn't that good then anyway. I haven't tried it since that time because of this.
I haven't used Norton for many years although I've tested it when I've got a new mainboard as it's always on the disc! I've always found it to be an unreasonable hog of everything and then removed it after my test.

]]> By: Tracy http://strangelyperfect.tv/6622/website-referral-spam-and-cyber-security-malware/#comment-2019 Tracy Mon, 16 Nov 2009 15:01:58 +0000 http://strangelyperfect.tv/?p=6622#comment-2019 Hi I have recently cleaned up 2 of my friends computers that were infected with cyber security. I did a virus scan with Norton and it failed to detect anything. I used the free version of Spyware Doctor and it noticed and removed everything. The 2nd computer ran Vista and the free Comodo Internet Security which did detect a trojan/virus and prevented the installation. I was wondering if you had any Firefox extensions in use when you did your test? Hi I have recently cleaned up 2 of my friends computers that were infected with cyber security. I did a virus scan with Norton and it failed to detect anything. I used the free version of Spyware Doctor and it noticed and removed everything. The 2nd computer ran Vista and the free Comodo Internet Security which did detect a trojan/virus and prevented the installation. I was wondering if you had any Firefox extensions in use when you did your test?

]]> By: Strangely http://strangelyperfect.tv/6622/website-referral-spam-and-cyber-security-malware/#comment-1933 Strangely Sat, 31 Oct 2009 13:22:22 +0000 http://strangelyperfect.tv/?p=6622#comment-1933 <strong>spiritsoftheforce.com</strong> This is another website, hosted by ixWebhosting.com (again!) and living in Arizona (again!) that's hosting the Cyber Security malware! This time, a sub-domain isn't used and the code is springing straight off a false page in the website. This is the link, so beware. <blockquote>spiritsoftheforce.com/page.php?e=java-check-available-memory</blockquote> It's the same file download. What is particularly bad about this whole thing is that even though you can crash the browser down to get out of the loop, all the links attempt to download the file! Also, I've now tried to install the file.... <strong>RESULTS</strong> The file installs and pops up a menu to either install Cyber Security - or cancel. What happens is that it will install regardless! <strong>It is important to realise that it bypasses two different anti-virus systems</strong> that I've tried and installs into Program Files (x86)\CB\cs.exe <strong>THE ANTI-VIRUS PROGRAMS DID NOT STOP THE INSTALL!!!</strong> Naturally, in Windows 7 you have to click OK to let it run. This is your last chance of blocking the install! I repeat....<strong>THE ANTI-VIRUS PROGRAMS DID NOT STOP THE INSTALL!!!</strong> It installs into Add/Remove programs It pops up a false "Windows Security Centre" and to all intents and purposes it looks and feels like a real kosher application..... <strong>The only thing that removes it</strong>(and it's after the event anyway), is MalwareBytes in my experience, which does a thorough job. <blockquote>Because of this, I'm now re-assessing my internet connection and whole anti-malware systems for a better approach. If <strong>I</strong> can fall victim to this crap with all my experience, what hope for the mother-in-law and my click-happy former spouse? !! </blockquote> I've currently installed an XP installation into a Virtual Box install for sandbox testing. I think I'll have to use this route for general browsing of the web. These malware-laden websites are becoming ever more prevalent, and I just hope that all the stuff I've implemented here on this website is enough to keep the hackers at bay... (<em>However, the incidence of these crap sites originating from Arizona is a co-incidence that cannot be ignored! It could be by design and with the connivance of the site owners - who's to tell?</em>) <strong>USEFUL LINKS</strong> http://www.malwarebytes.org/ : reliable malware removal http://www.virtualbox.org/ : virtual operating system install system for sandbox browsing - this means that if the sandbox is infected just quickly roll-back to an un-infected version - takes a minute, tops! spiritsoftheforce.com

This is another website, hosted by ixWebhosting.com (again!) and living in Arizona (again!) that’s hosting the Cyber Security malware!

This time, a sub-domain isn’t used and the code is springing straight off a false page in the website.
This is the link, so beware.

spiritsoftheforce.com/page.php?e=java-check-available-memory

It’s the same file download.
What is particularly bad about this whole thing is that even though you can crash the browser down to get out of the loop, all the links attempt to download the file!
Also, I’ve now tried to install the file….

RESULTS

The file installs and pops up a menu to either install Cyber Security – or cancel.
What happens is that it will install regardless!

It is important to realise that it bypasses two different anti-virus systems that I’ve tried and installs into Program Files (x86)\CB\cs.exe

THE ANTI-VIRUS PROGRAMS DID NOT STOP THE INSTALL!!! Naturally, in Windows 7 you have to click OK to let it run. This is your last chance of blocking the install! I repeat….THE ANTI-VIRUS PROGRAMS DID NOT STOP THE INSTALL!!!

It installs into Add/Remove programs

It pops up a false “Windows Security Centre” and to all intents and purposes it looks and feels like a real kosher application…..

The only thing that removes it(and it’s after the event anyway), is MalwareBytes in my experience, which does a thorough job.

Because of this, I’m now re-assessing my internet connection and whole anti-malware systems for a better approach.
If I can fall victim to this crap with all my experience, what hope for the mother-in-law and my click-happy former spouse? !!

I’ve currently installed an XP installation into a Virtual Box install for sandbox testing. I think I’ll have to use this route for general browsing of the web. These malware-laden websites are becoming ever more prevalent, and I just hope that all the stuff I’ve implemented here on this website is enough to keep the hackers at bay…
(However, the incidence of these crap sites originating from Arizona is a co-incidence that cannot be ignored! It could be by design and with the connivance of the site owners – who’s to tell?)

USEFUL LINKS
http://www.malwarebytes.org/ : reliable malware removal
http://www.virtualbox.org/ : virtual operating system install system for sandbox browsing – this means that if the sandbox is infected just quickly roll-back to an un-infected version – takes a minute, tops!

]]>