Crimeware and Malware

Remember this post?

Sherlock's Computer Nearly Taken Hostage

This is yet another good reason to have a second account on your computer. Don't use it for anything except to use it when your computer is badly infected, installing the malware checkers after setup if they're not there already. The advantage is that when the original account is infected, the second account should not be affected.

We're familiar with Windows Security Suite and its related ilk and copycats. Now meet Reveton and its creator software.

Reveton Malware Freezes PCs, Demands Payment

Not exactly new, but Reveton builds upon previous crimeware and rasomware by adding in a twist of acting like the FBI's taken over your computer. The FBI will never do this. They will serve you a warrant/subpoena, arrest you, and/or take the computer.

In this case of infection, malware checkers should be able to clean this infection, but in some cases, a complete format and reinstall is better.

Here's an updated list of what to use. All are free:

Microsoft Security Essentials - http://windows.microsoft.com/en-US/windows/products/security-essentials
CCleaner - http://www.piriform.com/
Glary Utilities - http://www.glarysoft.com/
Malwarebytes Antimalware - http://www.malwarebytes.com/
Superantispyware - http://www.superantispyware.com/
Spybot - http://www.safer-networking.org/
AVG - http://free.grisoft.com/

Microsoft Security Essentials can easily work on its own, though you may want to use the others to help out.

Sherlock's Computer Nearly Taken Hostage

Not too long ago, I had a frantic request for help from Sherlock Steve. As it turned out, his computer was taken over by something called Security Suite Antivirus. Unfortunately, it's not a normal so-called anti-virus suite of programs. What this thing does is it just badly takes over the computer. It claims that everything you try using and running are infected. In fact, the programs that are "infected" are not. It's the Security Suite Antivirus saying these things.

Here's more on Security Suite Antivirus and how it's a scam;

Remove Windows Security Suite. Description and removal instructions
Windows Security Suite

Security Suite is ransomware. Meaning, it holds your computer hostage, allowing nothing to work, claiming it's "finding malware." It says you must pay the fee in order to get your computer back. This is similar to scareware, which runs and claims you're badly infected but doesn't quite take over the computer like Security Suite does.

Internet Explorer didn't even begin to work properly, not even allowing a new browsing tab. It kept going to Security Suite's webpage. Task Manager wouldn't work, neither would a CTRL-ALT-DEL, etc.

Next was to go into Safe Mode via F8. He had Admin mode, another account. That was one plus that helped make things easier. We followed the instructions on this page;

How To Uninstall / Remove Security Suite Virus ( Removal Guide )

Malwarebytes Antimalware found quite a few as did SuperantiSpyware, Spybot, and AVG. All four are free.

Sherlock got his computer back up and working the same day.

Computers in the Trash

One thing that's troubled me in recent years is not how many computers are in the trash. It's what's on them that can get you in trouble. I'm not saying this just because I'm a network security student. I'm saying this because there are too many reports of identity theft out there. I work for a nonprofit as a volunteer computer refurbisher which gives the refurbished computers to their students. Fortunately, the hard drives in the computers are wiped before we reinstall the operating system and other software.

I come across around several computers a year in the trash piles and in every case, they have problems. The operating system isn't updated enough, they're infected with spyware, enough personal information for a case of identity theft, imprisonment if the wrong person finds info on there and reports it to law enforcement, or a combination of the four. The best thing to do is to not just repartition and format, which leaves some info on the drive for recovery, but to do a complete wipe. You can format the hard drive around 3-5 times, which scrambles enough of the data to prevent much recovery. Best thing to use is Darik's Boot and Nuke.

One computer had an immigrant's financial aid info for attending a local college plus his green card info. Another had a few home movies of a man and woman displaying rifles together, had password info to get into his airline reservations account, and the owner's resumes, to name a few.

Look up Department of Defense 5220.22-M. This tells something about it.

http://en.wikipedia.org/wiki/ParetoLogic_Privacy_Controls

Sometimes even the government overdoes things. Someone who worked briefly on a military base said that hard drives were routinely shredded since they had secret info or similar on them. Industrial shredders are great for this. Ever seen one shred a car, boat, or other stuff? Do a search on YouTube.

Identity theft can be harder for deaf people to deal with due to the amount of time on the phone and so on. There's been stories of those who have been through it at least twice as well as from someone who had to be reissued a new SSN. What are your experiences in this?

Trashing Your Work Computer

The Deaf Sherlock's Safety with your office computer! has some good points in there. It's not too hard to find articles on this subject as well. This will tie in with my next article, Computers in the Trash. Fortunately, most systems can be cleaned up with a little effort and time if you know what to do and use. I've often used these four basic tools to do the major cleanup including Windows' other tools and others as needed;

Spybot - http://www.safer-networking.org/
AdAware - http://www.lavasoft.com/
AVG - http://free.grisoft.com/
CWShredder - http://cwshredder.net/

Then other tools to finish up can be used as needed. I repaired Sherlock's friend's computer awhile ago. He got so frustrated with it that he actually kicked the thing. When I looked at it, the CPU was out of the socket, meaning he kicked it pretty hard. Amazingly, it still powered up after I put the CPU back in. After a few hours of cleaning using the above four and msconfig, we got it mostly cleaned up with a somewhat faster bootup.

I intentionally infected a second computer I have, and it predictably started having strange behaviors. A registry editor and the malware cleaners above plus another tool got it cleaned. Unfortunately, in some cases I've seen, the OS is so hosed, that it requires a format and reinstall.

I'm continually amazed at all the stories I'm hearing about people who go where and do what they aren't supposed to while at work even while the workplace may use access control systems and maybe surveillance utilities. Too many people say yes to anything presented to them without reading them as well as downloading and running anything out there. That's a sure-fire way to a trashed operating system, zombied computers, and badly-infected computers.

Just be careful where you go while at work. Sherlock's not the only techno geek out there...