VIRUS ALERT: Storm Returns – Hiding In Plain Sight

You open your eMail programme and see this headline:
“John McCain Found Unconscious”
Or this one:
“Obama Dies In Shock Accident”.
Compelling and perhaps intriguing enough for you to click on the message to learn more?
I have already discussed the Storm Virus back last December. Then it was trying to entice you with Happy New Year wishes most notably with the Happy 2008.exe. All you had to do to invite this pervasive virus onto your machine was click.
Eventually most anti-virus programmes and articles about this virus and how it arrived slowed the Storm down to almost nothing. But the clever (though malicious) people behind the Storm Worm Virus came up with another cleaver bit of social engineering. Compelling headlines delivered to your eMail in-box. In the past week, the Storm Worm has stricken countless tens of thousands across the internet using just such headlines.
The key to this particular Worm Virus is that the recipient must take some action to launch this Trojan and allow it to attack the users’ machine (or entire home network).
The best way to protect yourself is simply to not click on unsolicited eMails with enticing or alarming headlines.
The best protection against all virus’ in general is a good anti-virus programme and more specifically oftentimes even more important, that most uncommon of contemporary virtues, Common Sense.
So, dear Bulldog readers, I wanted to alert you to this newest version of an old annoyance. And if you encounter any of these outlandish (but compelling) headlines in your eMail in-box, just hit your delete key. It may be one of the best universal anti-virus tools any of us have.
If you think you have been infected, or if you just find your machine is sluggish or has slowed down inexplicably, then the solution is as follows:
Go to this URL: http://www.microsoft.com/security/malwareremove/default.mspx.
It is the home of the Microsoft Malicious Software Removal Tool.
Click on the underlined link "Skip the details and download the tool". Save it to your machine in a file: i.e., MyDownloads>Microsoft>MalwareRemover or whatever the name you use to identify the location you download to. When it has downloaded, then run the programme. You will be given the choice of either a ‘quick scan’ a ‘full scan’ or a ‘customized scan’. If you have the times (just under an hour for the full scan) run the full scan. Otherwise go for the 'quick scan'.
Note: If you downloaded this programme before, you will still need to download it again; it is updated regularly to uncover new versions of malware, spyware and Trojan viruses.
Here are some of the current headlines from the past few days that I have uncovered:
"Bill Clinton in today's Times - thank god Hilary didn't beat Obama."
“Beijing Olympics canceled upon the death of China's president."
"Obama bows out of presidential race."
"Scandal rocks Obama as lurid sex video leaked?"
"Dog digs grave for owner."
And perhaps the most fantastic of all:
"Oil falls below $100 a barrel.”

Now you are both forewarned and know what to do if you get infected.

VIRUS ALERT: Storm Passes Mega-D Rising

The STORM WORM bot-net has become a victim of its own success. Microsoft Windows malicious software removal tool has brought the storm under control, after a record run.
The Storm Worm made a feeble attempt to return for Valentine’s Day but the remnants were a danger mostly to a rapidly diminishing few. For anyone who feel’s their machine slowed significantly in the past 7 to 10 days you can insure your machine has been cleaned by running the malicious software removal tool found here: http://www.microsoft.com/security/malwareremove/default.mspx.
The good news is that for all intents and purposes the end of the storm worm storm is near, and likely will not bother our Bulldog readers any more. There is some not-so-good news.
Unfortunately, like the Maine winter and in particular this year’s Maine winter, one storm departing does not mean a clear sky above. Similar as well to our Maine’s weather the next storm is often more severe than what has dissipated. As I down-grade the Storm Worm alert, I am issuing a new ALERT for the emerging Mega-D, bot-net.
Mega-D is what is called a blended attack by security firms. It uses the usual methods to trick users into downloading and installing Mega-D on their machines. This turns that machine into a propagator and disseminator of Mega-D. It also can use Trojans to dodge anti-virus protection methods.
It has specifically targeted FaceBook users invites and a bogus Flash Player up-date. It is also using eMail come-on with free offers for a variety of herbal products.
It has variations that can hi-jack browser settings and appears to be morphing rapidly into new variants. The best way to prevent an infection is to keep your anti-virus programme current, and use common sense when opening eMails that are unfamiliar or have offers to good to be true. When you are surfing the web do no download any programme or product that pops up. It may say “Your computer has been infected” or “Spyware Detected” then tell you to “download this programme or product immediately”. Pay no attention to the warning or demand or suggestions.
If you did not go to a site to download anti-virus or spyware, then close out your browser and run a full anti-virus scan. The run a spy-ware scan with SpyBot or whatever programme you prefer.
This exploit has attacked at least two of our Bulldog readers in the past week and it caused a good deal of havoc and hassle before I was able to assist them.
If you suddenly find you cannot up-date your anti-virus programme or your computer is slow during familiar tasks, the solution is to run the Microsoft software removal tool and run the full or deep system scan. Re-boot your machine after it has run, then go to your anti-virus up-date location and get all the latest up-dates and virus definitions.
Like any trip we take, remember your computer may be in a familiar place in your home, but you can inadvertently invite a nasty visitor. Vigilance is the eternal price of a virus free, Trojan free experience.
If you have any questions as always feel free to contact me: guygriscom@gmail.com

VIRUS ALERT!

“Happy-2008.exe”
Storm Worm’s New Years Greeting

Many of us are winding down in these last days of 2007. Christmas has come and gone; store bargains have either been missed or had by now. In the tech world, things are relatively quiet.
The biggest ‘buz’ has been the Queen of England creating her own YouTube channel proof that the Internet is here to stay. When 1000-year old monarchies ‘adopt’, the technological shifts are confirmed. The Queen also saw fit to deliver a message via her new ‘web presence’. Her first ‘invitation’ was sent via YouTube eMail to her son Prince Charles. I’ll bet he was thrilled.
The next ‘big thing’ on the tech horizon is the Consumer Electronics Show in Las Vegas is not happening for a week or two. The latest and greatest tech will be on display; trend-casting will be based on what shows up there. Tech-wise, the only other imminent news is the newly minted bargains in computers and computer related equipment that begins around the twentieth of January. It is always a thrill to buy a brand new machine for more than half-off the October-November price. One of the rare times in the tech world where patience is rewarded.
So why am I breaking with Tradition and bothering my Editor during such a pleasant down-time season? The answer is simple and the reason is clear. There is a lingering danger out there in computer-land. A resurgence of a Trojan Virus that by all rights should by now have been rendered benign. By late August the ‘Storm Worm’ had infected over 10 million machines and effected networks and ISPs in 108 countries.
It is a ‘bot’ exploit which turns your machine into a spammer’s tool. It has some nasty implications, but simply put, if you were infected, your machine would slow down as if molasses hard replaced your processors. Everything would take longer. There were decent ‘fixes’ and by mid-September most in the tech world thought it had been rendered useless. By October ‘the Storm’ was no more than a small squall.
Like that lingering summer cold, it had staying power, though. Most anti-virus programmes even the worst of them like MacAfee and Norton had developed protection, and security experts thought it was finished. At the worst it was a malingering annoyance for the most part easily dealt with.
For the digerati who follow such things; it seemed another challenge to Web security was thwarted and not something to worry about. Happily for all of us, there are a core group of internet security heroes, who live, breathe and follow every virus and permutation thereof. There had been some postings on internet boards about potential dangers but everyone was lulled. Myself included.
Then the first “Storm” arrived late Christmas Eve. I was blissfully unaware. By mid-morning Christmas day, my in-box was overflowing with questions and queries from our loyal Bulldog readers. The newly opened computers delivered by Santa had some problems. That is not all that unusual.
It was not until late afternoon that I began to see a pattern. Our readers had received eMails with headings like: merrychristmasdude.com, which was in fact the Email-Worm.Win32.Zhelatin.pd. It was a ‘re-direct’ and you did not need to do more than open up an eMail to become a part of the nefarious scheme.
Aside from some delayed enjoyment though this seemed to be little more than an annoyance and not a serious security problem. I followed up and most people who were ‘hit by the Storm’ were back in action in a relatively short time. I was alerted that the ‘Storm Worm’ had staying power.
Without going into details what I want to let you know is this. The forecast for New Year’s Eve is ‘Storm’. Here is what to look for and how to protect yourselves and your families.
Update your anti-virus programmes over the week-end. The problem with this particular Trojan Virus is your anti-virus cannot protect you from opening an infected eMail.
Beware any eMails that have this in the heading or Subject: happy2008.exe, happy-2008.exe, happynewyear2008.exe. Or ‘UHavePostCard’.
If you find yourselves being inadvertently directed to a web site that has the following address: newyearcards2008.com, close down your browser IMMEDIATELY.
If despite the warnings and your precautions you find your computer is running excessively slowly on New Year’s Day or shortly thereafter, then here are two actions you can take.
Download Microsoft’s Malicious Software Removal Tool at: http://www.microsoft.com/downloads/details.aspx?familyid=ad724ae0-e72d-4f54-9ab3-75b8eb148356&displaylang=en
I know this is a long URL, but it will take you straight to the sight. The download times are:
dial-up, about 20 minutes.
DSL/Cable, about 5 minutes
I wish all my friends and Bulldog readers a Very Happy 2008. A “Storm” Free, healthy, happy and prosperous New Year!
If you have any questions about this or other computer problems you can eMail me @ guygriscom@gmail.com or for any of my new or former Bulldog articles you can find them at:
http://bulldogtipstricks.blogspot.com/