Viruses and you

Viruses. This tends to be incorrectly used for all types of malicious software. There are in-fact several categories of this evil software: Virus, Mal-ware, Ad-ware, Spy-ware, Root-kit and Trojan Horses. I am not going to explain what all of these do or what makes them different to each other in any great detail, there is a great article in Wikipedia that has a very detailed and technical explanation of all this: http://en.wikipedia.org/wiki/Computer_virus – Read it for more information and some great trivia on early viruses. Some of the first viruses from 1971, before the Internet we know today! I will just explain some real life facts about viruses today and what they are used for and some ways they get in. With some basic knowledge of what they are after you can be more prepared when online or looking at email.

Beware the email virus. Someone you know sends you a link or attachment, or it comes form someone you consider reputable. When you open or click the link, it doesn’t always show you anything, sometimes you open the attachment and it just says there was an error accessing the file and sometimes there is nothing, just a blank page, or there is a document that just doesn’t make any sense or appears to not be for you. In all these cases the virus may well have been delivered silently in the background and you are now infected with one of thousands of different virus’. Many more of them will come in through web sites that do not know they are infected yet. (Some statistics suggest that 1000 website get infected every day!) In all cases the goal tends to be the same: Take control of your computer to extort money from you or someone else.

There are many different types of virus and they will all have a different part to play in the overall scheme. A few of the worst and their general purpose are noted here.

Trojan Horses (Trojans) – they will get in to your system and not necessarily do any damage except for disabling antivirus software, hiding itself and opening your computer up for other nasty things to come in. Often selling space on your computer to other virus manufactures (or programmers). They are often included with a root-kit. (See below).

Root-kits – These are a particularly cleaver type of virus. They hide themselves from Windows and everything else. The will usually get in to your system and load before Windows loads. They will then be sitting there behind Windows so that, for instance, if you view all the files in a folder you will not see the virus files there. This is because when Windows is enumerating (making the list) of files in the folder the Root-kit is watching and when Windows reaches one of its files the Root-kit will block Windows from seeing it. The Root-kit can also do this with system services so that when you look in Task Manager it’s services do not appear there either, making it very difficult to detect. This will be the same if your antivirus software is looking for it, because it has a position in the root it can hide itself from anything. The only way to detect their presence is in the very small added delay between file names when enumerating a folder (or directory). By looking at the time between each item to be enumerated any added delay of millionths of a second can be detected and then you can presume the existence. To actually find them and remove them requires very special techniques.

Self hiding/restoring viruses – These types of virus are often confused and also labeled by antivirus companies as root-kits but they tend to lack the hiding effects in the same way and use other methods to hid themselves. They will, as many do, also replace themselves when discovered. Firstly, they will often tell Windows that their files are part of the system and should be protected by the system. This has the effect of hiding them from normal users and can get Windows to replace any files that are removed. They sometimes also mark themselves as needed for Safe Mode, the special start-up mode to help remove virus’ and fix other issues with Windows. When Windows starts up in this mode it only start those programs which are essential to the system starting up. There is usually more than one part to this type of virus as well. It is the job of each to look after the other parts, so when you find one of them and remove it one of the other parts will put it back again, sometimes with a different name!

Bot-Nets. These are little viruses that are controlled by someone else and use your system resources like your computer processor, memory, Internet connection. They tend to be quiet, just sitting there not doing much until they are told to attack. Most commonly they are used to take down Internet sites for some kind of monetary gain. They can be hired to take down a competitors site at a critical time or by the organised crime syndicates to extort money out of companies in the old fashioned “protection racket”.

For Example, someone says to a betting site, “wouldn’t it be a shame if your website was not available for the big match coming up? If you pay a fee of £50,000 we can make sure you will be online at that time, otherwise we can not guarantee it!” If the site doesn’t pay first time round they will next time because at the time of the big game your computer and tens of thousands of others received instructions to attempt to connect to the betting site servers at the same time and to continue trying until the stop time, typically after the match/race has finished. With all this additional traffic going to the site and not doing anything the legitimate traffic cannot get through so the site then appears “offline” with a “404 page cannot be displayed” error or an error saying that the site cannot be reached. The site will not want the bad publicity; allowing people to find out that they have been compromised is very bad for business, so they end up paying. Your computer was used to help criminals extort money from someone else!

Another type of virus, actually mal-ware or increasingly know in the industry as ransom-ware, that comes in, often through a PDF or Adobe Flash exploit, is the current and very common one that will hold you to ransom. There are several different variants to this one depending on who is controlling it but they all do essentially the same thing and that is try to take your money off you with a type of protection racket or threat of some bad thing happening.

You will first notice a pop-up box that says you have hundreds or even thousands of viruses on your system (in some cases it is a corrupt hard drive/memory, porn or some other thing is very wrong with your computer) it will state that you need something in order to fix this. You are usually presented with a dialog box to confirm you want it or not. which ever button you press the answer is yes, go ahead and install the virus. The only way to get round this is to cancel the box (best done by using Task Manager to kill the program and everything to do with it). Another common one is a page that says that the FBI are stopping you from using your computer due to inappropriate content on your computer. You are then instructed to pay a fine or risk jail if it goes to court. Once you have install the virus you will be held to ransom, not able to use your computer at all in some cases, until you pay or remove the virus.

Worms. These are more commonly used as a method of transport. They are used to get their payload to your computer in any number of ways. They self replicate, usually to many different forms of media and methods. IE Across the Internet directly to your computer, through floppy disks, USB pen drives, external drives, emails, through the network to other computers on your local network. Once in they will begin to look for the next computer to infect, some also phone home to pickup instructions, such as what payload to deliver to the computers at the moment.

Viruses are a very very big money these days, both for the virus manufacturers and the antivirus manufacturers and on all forms of operating systems.  Although Windows is still the majority platform, Apple Macs are gaining market share and so now present a nice target with people who are not so use to viruses so are more susceptible to being infected. So which ever platform you are on, be careful, even phones, which are small computers, can be infected with things that cost you money!

Beware the antivirus that is a virus! Know which antivirus you use on your system and what it looks like to help reduce the chance of getting stung by a fake one, which will then hold you to ransom as above.

When surfing the Internet remember this: If you didn’t ask for it, don’t install it! many viruses will come packaged as something nice and appealing but, if you were not looking for that exact thing then do not be tempted to install it!

A good computer maintenance regime is to not install something unless you absolutely need it. If you think you need it, make sure you check it our fully before installing it, and make sure you download it from a known good source. Where possible go to the manufacturer’s website to get it, not from someone else offering it, unless directed there by the manufacture. If it turns out that you do not need or want it, then remove it. Although removing something is not as good as not installing it in the first place, it is better than leaving it there.

Watch out for viruses, they will come and get you any way they can. It is up to you to be careful, not your antivirus, after all you can override your antivirus if the virus is cleaver enough to trick you in to believing it is good for you.

Chris.

Stories of woe from the Fraudulent phone calls

There are many cases on the Internet about the problem with fraudulent phone calls from people pretending to be from Microsoft or an ISP and getting people to pay money with what starts out as a free service. See this post for more detail – here. This case happened to a friend of someone I know.

These people phoned up and said that they were from Microsoft and want to fix the problems she had been having with her computer. After a while they convinced her they were real and she let them on to her computer. She watched what they did and to her horror, they copied all her university work off her computer and then deleted it!!

She had to pay £50 for them to “recover” it for her! For a student this is a lot of money! To be conned out of £50 is not nice for anyone.

I cannot stress enough the old rule of, if you didn’t ask them for something then under no circumstances let them in!

There are many more stories out on the Internet but I thought this one was close to home. There have been many attempts on CritchCorp Customers but luckily so far no-one has succumbed to them. Always know who looks after your computer and there is very little for free in this world and computer support is definitely not. Computer systems vary from person to person so always have someone that knows your system and you to best be able to advise you and do not let anyone else touch it!

CritchCorp.

 

 

Fraudulent Phone Calls

I have previously written in an email about this issue but it is still going on all round the world so expect that you may receive a call from one of these guys one day and be ready.

What happens is, you will receive a phone call to say that you are having problems with you computer, Internet connection or email or something else that will give them an excuse to log-on to your computer. The caller will then explain that he/she is calling from either Microsoft or your ISP (Internet Service Provider), BT, your bank or some other credible but generic source to resolve all your problems. “This service is free”, they will tell you and all they need to do is ask some questions, log-on to your computer and they will have it resolved in no time, or some other story along these lines as it does change slightly as they change their story to suite the local market they are trying to exploit. If you were at this point to ask them any specific questions there are a few responses you will get depending on how experienced the caller is, from hanging up the phone to giving generic answers or answering with a question. The truth is they do not know anything about your situation unless you tell them. They will phone everyone they can with the same story.

If you did allow them to gain access to your computer then you would find one of two things can happen. This depends on which call center is calling you as there are many of them. The first thing is they will download a virus to your computer and after trying to make you believe it was there before they started and they have just discovered it, along with a whole host of other problems (most of which are not problems). They will say that this can all be sorted out for you for fee of $50 or whatever they think they can get from you. So this free ‘service’ has now started to cost you money. Worst of all they are the problems they created or invented and they are not going to fix them when they are done. The other way is that they show you all the temp files or Internet cookies and tell you that these are bad files or corrupt files and they may even open a few in Notepad or Wordpad to show you that they are corrupt. (These files are not corrupt, they are not intended to be opened in these programs so will generally look like gobbledygook)

In both cases they will then proceed to the payment options, credit or debit cards. When you give the first card details over it will surprisingly not work. So you will need to move to another card and another and another until you have no more cards (and by that time probably no more money). Some are not as bad and only take the first payment and leave you alone, for now! 

The best thing to do is to say that you have someone that looks after your computers and they are dealing with it so they do not need to worry. Then hangup the phone.

If, like in some cases, they are persistent then I suggest trying the following. After answering the phone and identifying this type of call ask them to “please wait a moment”, put the phone down on the side and walk away for an hour or so. Come back and replace the handset. If they still continue to call, then keep doing this until they get the message. It is costing them money to call you. (granted not a lot as they tend to use VoIP, but every penny counts) Most of them will not call back after the first time. These people are people in places like India where the call center boom is now coming crashing down and there are many unemployed people with families to feed. The criminals setup the call centres and pay wages to these people who know it is wrong but need the money. This is the same type of people who send out a lot of the phishing emails, but I will talk about that later.

Chris.

CritchCorp Computers Ltd.