Trojans

Yes, You Can Still Get Infected – Even With Anti-Virus

January 15, 2016

Scott Blake is a Senior Network Engineer with Tech Experts.

With the sudden release of a new variants of malware and ransomware such as CryptoWall, users are wondering why their anti-virus programs are not blocking the ransomware infection from infecting their computer.

As with many other forms of malware, the infection needs to exist before a cure or way to detect the threat can be created. This takes time and during this period of R&D, the malware spreads like wildfire.

While there are several forms and classifications of infections, there are basically only two different methods in which infections are released into your system: User Initiated and Self Extraction.

User Initiated infections are caused by a user clicking on a link within a webpage or email or by opening infected email attachment. Once opened, the malware is released and quickly spreads throughout your system.

Because the user manually clicked on or opened the link/document, most anti-virus programs receive this as an authorized override by the user and either internally whitelists the link/document or skips the scan.

CryptoWall is spread through this method, usually contained within an infected Word, Excel or PDF document. The creators of these programs take advantage of the programming of the document to hide the infection.

With the world becoming a paperless society, we are becoming more and more accepting of receiving and opening attachments sent to us through email. It has practically become second nature to just click and open anything we receive, regardless of any warning.

Self-Extracting infections are exactly what they’re named. These infections require no outside assistance to worm their way through your system, infecting as they go.

The number one method creators of this form use to place their software on your system is through “piggy back” downloads.

Piggy back downloads occur when you authorize the download and install of one program and other programs (related or unrelated to the original program) are automatically downloaded and installed with it. The most common way is by downloading programs promising to speed up your computer.

Infections can also exist on your system and lay dormant for long periods of time, waiting for the computer to reach a certain calendar day or time. These infections are called “time bomb” infections. Just like piggy back infections, they require no outside assistance to infect your system.

They are mostly found buried in the registry of the system or deep within the system folders. Because they are not active on the time of placement, most anti-virus programs will not detect them. Active reporting through toolbars is another means of becoming infected over time.

When a user downloads and installs a toolbar for their browser, they authorize at the time of install that it is okay to install and all of its actions are safe. However, most toolbars are actively scanning, recording, and reporting back to the creator. They also act have conduits for installations of other unwanted programs behind the scene.

If left unchecked, those additional programs can become gateways for hackers to gain access to your system and spread even more infections.

To help stop the spread of malware/ransomware such as CryptoWall and its variants, we need to become more vigilant in our actions when either surfing the Internet or opening email and attachments.

The best rule of thumb to follow for email is: if you don’t know the sender, or you didn’t ask for the attachment, delete it. As for websites, read carefully before you download anything and avoid adding toolbars.

Top Signs Your Computer May be Infected

April 30, 2015

Ranging from minor spyware and adware to complete system lock-outs courtesy of ransomware, infections have become a standard in today’s high-speed electronic age.

Even when using the latest state of the art detection software, the most modern systems are prone to infection.

Some basic low-level forms of adware and spyware are add-ons called toolbars. A toolbar is an add-on to a web browser, putting another bar at the top of your browser window below the address bar.

They can come in several different forms and functions. Some are helpful and pose no threat to your system. Others serve as a reporting tool for the toolbar’s designer.

They can collect data on surfing habits such as websites visited and search topics used. This data is then transmitted back to the designer and sold off to advertisers who, in turn, use the information to start spamming you with their client’s websites and ads.

Building off of the spam generated from the data collected from the adware and spyware, you will start to see more and more pop-ups on webpages and possibly even on your desktop.

Sometimes, these pop-ups are harmless and very easy to remove, but more often, they are the beginning stages of an invasion of malicious programs.

The pop-ups use false and misleading information to scare the user into believing they are already infected and they need to download “their” software to clean the infections.

What ends up happening is that you think you are downloading one program to clean your system, but you are really downloading and installing additional programs in the background.

I have seen instances where one so-called program install downloaded nine additional programs in the background. None of the additional programs had anything to do with “cleaning” or “speeding” up your system. They just wreak havoc on your operating system.

Through these malicious programs, more dangerous infections can occur. High-risk level malware, trojans, and viruses become residents on your system.

From this point forward, you will start to experience extreme slowness or even a complete inability to browse the Internet. You will start to see an increase in spam email and email messages containing attachments or web links to strange web addresses.

The attachments are what you need to be very cautious about. A very high-risk level malware called Crypto is primarily transmitted through these infected attachments. Once infected, the Malware spreads though your system, encrypting all of your data.

After that, there is little hope of recovering any of your data.

Viruses, malware, trojans and malicious programs are lurking on the web at every turn.

The most important thing to remember is “knowledge is power.” Don’t fall victim to the overwhelming number of companies advertising that their products can and will clean your computer of these nasty bugs and speed up the performance of your computer at the same time.

The truth is that the vast majority of these companies will install a ton of “freeware” programs on your system that will bog down your CPU and eat up your memory resources.

Once these programs are installed, get ready for Pop-Up City. It turns into a giant game of Whack-A-Mole just trying to close all the windows and pop-ups generated by these programs.

Several of these programs will also inject a proxy server into your Internet settings. This will severely limit your Internet browsing and even redirect you to predefined webpages in an attempt to lure you into purchasing additional programs to remove the programs you already installed.

For additional information or if you think you may have a virus or spyware infection, contact Tech Experts at (734) 457-5000.

Tips To Protect Your Business PC From Malware

October 31, 2014

Michael Menor is Vice President of Support Services for Tech Experts.

In today’s online world, technology users are essentially in a state of near-constant attack. Almost every day, there’s a new data breach in the news involving a well-known company and, quite often, fresh rules for protecting personal information are circulated.

Because of malware in email, phishing messages, and malicious websites with URLs that are one letter different from popular sites, employees need to maintain a high level of awareness and diligence to protect themselves and their organizations.

Phishing activities are especially pervasive, including attempts to steal users’ credentials or get them to install malicious software on their system. The astonishing success rate of phishing attacks makes them a favorite.

Why? More than 70% of people will follow the link to a phony website and, of those that followed the link, 30%-50% will routinely give up their usernames and passwords.

Many like to think of the network perimeter with all its firewalls and other fancy technologies as the front line in the cyber war, but the truth is there’s a whole other front.

Every single member of a company’s staff who uses email or the Internet is also on the front line and these people are generally considered a softer target than hardware or software. It’s simple: if the bad guys can get an employee to give up his or her user credentials or download some malware, they can likely waltz right past the technological controls, basically appearing as if they belong there.

When using a computer for personal functions, a user generally has to have the ability to install software and modify the system configurations. Typically, such administrative functions are not available to all users in a corporate environment.

As a result, even if an organization has made an effort to improve a system’s security, a user doing work on a personal computer has the ability to disable and circumvent protections and has the privileges to allow for the installation of malware.

As companies migrate toward a world of bring-your-own-device policies, some companies are developing strategies to help address these risks. But, as a rule, using a work computer for personal reasons or doing work on a personal computer (or tablet or smartphone) can significantly increase the threat level that an employer has to protect itself against.

To help their organization protect systems and data, employees need to implement some smart web browsing habits. Smart web browsing means engaging in the following activities:

Beware of downloads
Malware can be hidden, not just in applications or installation programs, but in what appear to be image and video files also. To limit the likelihood of downloading content that contains malware, only download from reputable sites. With sites that are not a household name, take the time to do a little research and see if other people have had issues.

Additionally, be sure that antivirus software is set up to automatically scan downloads. Or scan downloads manually, even when receiving them from name-brand sites, as it is not unheard of for infected files to make their way onto otherwise legitimate web sites.

This is especially true for file-sharing sites where the site owner cannot control every piece of content a user may place there.

Be wary of deceitful sites
Those running sites already breaking the law by illegally distributing copyrighted materials — like pirated music, movies or software — probably have no qualms about including malicious content in their downloads or stealing information.

Many popular web browsers today have built-in functionality that provides an alert when visiting a website that is known to be dangerous.

And if the browser doesn’t give a notice, the antivirus software may provide that function. Heed the alerts!

Employees need to protect their devices from online and in-person threats. Start by keeping the company’s system patched. Configure it to automatically apply updates or issue notifications when there are updates and then apply them as soon as possible. This doesn’t just apply to the operating system.

Keep all installed applications updated; sometimes this takes a little extra work.

Remember, the challenge of security is that the bad guy needs to find only one hole in a security system to get past it, so fix them all. Think of it as putting dead bolts on doors, but leaving the basement window wide open.

To that end, security professionals like to debate the usefulness of today’s antivirus software. And it’s true that malware continues to become more sophisticated and harder to detect. But it always amazes me how old some of the malware running around is. As a result, use antivirus software and keep it up-to-date.

Also, use a software firewall, either the Windows firewall or one provided in an antivirus package. This is especially true for laptops connected to public wireless access points at hotels or coffee shops, but it also applies to home systems. It just provides that extra layer of defense.

And finally, please, don’t ever give passwords to anyone. Be vigilant and question anything new, especially emails and forms in the web browser that request work credentials, no matter how nicely the request is made.

(Image Source: iCLIPART)

Avoiding Common Email Security Threats

September 30, 2010

Most companies today rely heavily on the use of email. Emailing is a very fast and cost effective form of communication for many different types of businesses.

Most companies use it as their main source of communication between employees. In fact, most employers do not realize the risk of using email.

Some risks range from viruses, hackers, to someone else just trying to gain a little information.

Here’s an overview of the most common email security threats in today’s Internet world.

Viruses
Viruses cause billions of dollars in damage to businesses every year.

Many corporate email systems are still quite vulnerable to viruses. In fact, in last year alone, an estimated 63 distinct email virus attacks hit the United States. These attacks come quickly and can spread quickly.

They mainly cause slowdowns across the internet. However some have been known to take down major corporation’s entire email systems.

Today’s viruses are very complex and often appear to be harmless such as personal notes, jokes, or promotions. While most viruses require recipients to download attachments in order to initiate infection and spread, some are designed to launch automatically with absolutely no user action required.

Spam
Studies have shown that 20 percent of corporate email is spam. A company that has a thousand employees could receive over two billion spam emails in a full year.

Most do not realize it until a lack of productivity ends up costing the companies billions of dollars each year.

While most spam is just annoying, some of it can be very dangerous. Most trick employees into opening malicious emails to spread faster. Also, many hackers have begun disguising viruses as spam.

Phishing
Phishing is used to trick a person into thinking the email is legit and came from a real website, usually asking the person to verify their password or to change some sort of account information.

Then, taking them to a fake website and stealing what you have typed in. This is the number one way people get their identity and personal information stolen.

Spyware
The main purpose of spyware is to install itself on the victim’s computer. It monitors all key strokes and mouse clicks so that they can later go back and collect usernames, passwords, credit card numbers and bank account numbers.

These infections can stay installed on computers for many months without an antivirus picking them up. Most are detected and removed instantly if the user keeps their antivirus up to date.

Having a great antivirus that scans files as well as emails can help prevent virus attacks, phishing and spyware.

Users should also have an up to date spam filter that prevents the infection from getting to your inbox to begin with. And most importantly never open an email attachment you didn’t specifically request.

Also, pay attention to links inside emails that appear legitimate. Many times, phishers will send you an email that looks like it came from an official source. After clicking the links, you’re redirected to a site on the hacker’s network. This is often used to collect personal information and passwords.

What is a Trojan Virus and How Does It Affect You?

June 23, 2010

We have all experienced the unfortunate virus infection on our computer; it’s not fun and most times it causes down time on the computer, cost to have it fixed, loss of data, and possible identity theft.

A trojan horse or trojan is a program that presents itself as one thing (anti-virus or a game) butactually works in the background to gain unauthorized access to information in a computer.

A trojan virus can steal all sorts of information on your computer such as credit card information, passwords, bank information and then sends the information to the virus creators who can use this information for malicious gains and identity theft.

When you are infected with a trojan infection you will also notice a substantial difference in the speed of your computer and you may even experience several pop-ups related to adult content, casinos, etc.

Don’t click on any of those pop-ups as those will only make the infection harder to remove.

The trojan infection can spread from one PC to another very quickly from e-mails and attachments sent from the infected computer.

It can even corrupt data on a hard drive which will lead to system crashes and deletions of computer files.

Trojan Win32
One of the most dangerous of all trojans is the Trojan.Win32, which is also referred to as the Win32 Trojan. This dangerous infection masquerades on your computer asa legal program, hides from the user and allows remote third parties to take partial or full control of your computer and can record keystrokes.

It can also alter the security settings of your computer to allow more malware to be delivered and installed onto the computer.

How Does it Get Into My Computer?
We have clients ask all the time, “How did my computer get infected?” Most times these infections come from freeware applications that they downloaded, free online games that were downloaded, anti-virus not being updated, firewall settings, computer security settings set too lenient, or from not performing regular updates on the operating system.

The trojan infection wraps itself inside legitimate software such as games, videos, virus and spyware programs, or any commonly downloaded file. In the end, the user ends up with a malicious piece of software that does something entirely different than what it was supposed to do.

Now that you have a general idea of what a trojan is and the most common ways that they get into your computer, what do you do if you are infected?

The first thing that you should do once you notice the infection is to shut down the computer and do not use it for anything.

If you have never dealt with virus removals before then you’ll probably want to work with a professional IT company to do the virus removal, since if not done correctly, the removal process can cause more damage than the trojan.

If you do need to get on the computer to pull some files off, disconnect it from the Internet. That way, no personal information can be sent out from thecomputer such as your credit card or banking information.

Then, you’ll want to work with your IT provider to have a virus clean-up done on the computer. The goal is to get you back online and using your computer safely.

At Technology Experts, we work with clients on virus infections on a day to day basis. Our technicians have several tools and processes to remove virus infections without damaging your system or data.