Malware
Black Hats Use SEO To Poison Search Results
May 23rd
Black Hat hackers continue to use SEO “Search Engine Optimization” to poison search results. I was recently called over to my wife’s PC because she clicked a link in a Google search for swine flu. The Firefox 3 window now had a warning saying that the site was a “Reported Attack Site!” We clicked the “Get me out of here!” link and then I explained SEO and search poisoning to my wife.
Black Hat hackers use the latest breaking news or most popular stories to draw users to their malicious links. Using SEO they have the malicious link elevated in the search results and then wait for the unsuspecting end user to click the link. The website will then typically do a drive by install of the latest rouge virus application.
OK, so now that you know a little more about the new risks presented by search engine poisoning, should you still search the web?
The simple answer is “yes”; but you need to always be cautious. Make sure you keep your system updated including all your 3rd party applications and always run a current Anti-Virus product with updated signatures. Never use an old browser to access the web. I see in my site stats that some of you are still running Internet Explorer 6. Running an old, insecure browser is a major cause of website borne malware infections. If you need to run IE6 for some legacy application, you can still install the latest version of Firefox and browse the web with Firefox instead of IE6.
Check the following links for more info on search engine poisoning:
http://sunbeltblog.blogspot.com/2009/05/swine-flu-search-poisoning.html Swine flu search poisoning
http://www.securityfocus.com/brief/701 SEO poisoning attacks growing
http://websitehelpers.com/seo/blackhat.html Black Hat SEO
http://www.avertlabs.com/research/blog/index.php/2009/03/10/democratsorg-blog-spam-contributes-to-google-search-poisoning/ Democrats.org Blog Spam Contributes to Google Search Poisoning
http://ddanchev.blogspot.com/2008/03/massive-iframe-seo-poisoning-attack.html Massive IFRAME SEO Poisoning Attack Continuing
Check out our Amazon Mac Store Amazon Mac Store
Free Stuff and Great Deals http://rootaid.com/deals/
Follow Me on Twitter http://twitter.com/scccpj
Follow me on Facebook http://www.facebook.com/home.php?ref=home#/pages/Port-Jervis-NY/Clark-Computer-Consulting/133104913979?ref=ts
Use the following link to get an extra 250MB of storage when you sign up for Dropbox. https://www.getdropbox.com/referrals/NTEyODQxMjE5
Conficker Removal Tools
Mar 31st
Links to my recommended Conficker removal tools.
http://www.foundstone.com/us/resources/proddesc/confickerdetectiontool.htm Conficker Detection Tool 1.0.8
http://www.sunbeltsecurity.com/DownLoads.aspx Download the Sunbelt Conficker/Downadup Removal Tool
http://download.eset.com/special/EConfickerRemover.exe ESET conficker removal tool
http://www.bdtools.net/how-to-remove-downadup.php Remove Downadup (aka Conficker or Kido)
http://vil.nai.com/vil/stinger/default.aspx Stinger Conficker removal tool
http://www.sophos.com/products/free-tools/conficker-removal-tool.html Sophos Conficker clean-up tools
http://www.shadowserver.org/wiki/pmwiki.php/Stats/Conficker#toc5 ShadowServer Conficker Remediation and Stats
What is Conficker and are you ready for its April 1st surprise
Mar 29th
OK so I keep hearing about Conficker and some bad thing that is going to happen on April 1st. What is Conficker anyway? Conficker aka Downadup is one of the many worms that are prevalent on the Internet these days.
Wikipedia defines a computer worm as…A self-replicating computer program. It uses a network to send copies of itself to other nodes (computers on the network) and it may do so without any user intervention. Unlike a virus, it does not need to attach itself to an existing program. Worms almost always cause at least some harm to the network, if only by consuming bandwidth, whereas viruses almost always corrupt or modify files on a targeted computer.
OK so is the world going to end on April 1st? Probably not. Is someone in your office going to do something really stupid and say April fools? Probably. Is the entire Internet going to crash and then turn your laptop into a toaster or turn your Mac into a PC? Probably not. Should you actually care about this new nasty worm? Well…if you have not run your Windows updates and you do not have a currently updated Antivirus program running then yes you need to worry.
There are a few very simple things that you can do that will actually keep your computer clean and safe. Drumroll please…and the 5 PC safety steps to not get infected are….
1.Do your Windows updates. Do not ignore the Windows updates. Take the time off your busy schedule to actually click the annoying yellow shield at the bottom right side of your screen and install the current set of updates. You will find it takes far less time to keep your system updated than it takes to recover your data that has been destroyed by a virus.
2. Update Adobe Flash and Adobe Reader frequently from the Adobe site and not from some web-page that says your Flash player is outdated. Always go to the official website to get the most current version of Flash and frequently check Acrobat for updates by using the update menu in Acrobat.
3. Keep your Internet Security Software updated. If your Personal Computer AV software is expired then uninstall it and install the freely available Avira Antivirus instead. If your office PC has expired Anti-virus software you really need to get an updated license ASAP. My current favorite Anti-virus is Vipre from Sunbelt http://rootaid.com/2009/03/19/vipre-antivirus-takes-a-bite-out-of-malware/
4. Use Firefox as your main browser instead of Internet Explorer. Only use Internet Explorer on sites that require Internet Explorer.
5. Do not open links or attachments in email. Do not plug your flash drive in someone else’s computer or let them plug their flash drive into your computer. Flash drives have become the modern floppy disk which was the original way of spreading viruses back in the day. http://www.eset.eu/press-threatsense-report-february-2009
F-Secure has an excellent Q and A on Conficker at the following link. http://tinyurl.com/cdlqlp
Using a modern updated AntiMalware product will prevent infection from Conficker and other similar malware. I recommend Vipre Antivirus for home or small-business use. http://rootaid.com/2009/03/19/vipre-antivirus-takes-a-bite-out-of-malware/
So before the clock rolls to 12:00 AM on the April 1st you have some homework to do. Install your windows updates and update Adobe Flash and Adobe Acrobat from the Adobe website http://www.adobe.com/. Make sure you have an updated AntiVirus application running on your computer.
So now it’s time to go and do your homework. Don’t be an update slacker…go already. Update, this means you. Why are you still here.
Have a good day and come back soon for more rootaid.com ramblings

