Trojan Horse SHEUR.AFJ Detected

If you receive such a message from your antivirus program, don’t panic.

First, you maybe using AVG – it is the anti-virus program that generates this FALSE positive virus message.

And second: it alerts for fake trojans mainly at Quickbooks, AdobeRdr, DNA.exe, WDSync files.

If you have downloaded them from producer site, you can ask their support to confirm it is not infected.

The name of false trojan detected is always  SHEUR but extension may vary.

Cannot change Screensaver

If you cannot change screensaver because the tab is missing in Properties window, this is a sign you may be infected by Vundo trojan/ MS Juan ./

Also the wallpaper cannot be changed because the wallpaper tab is missing.

Also your screensaver may be changed to  Windous “Blue screen”

Another sign are many pop-ups - with ads of fake antivirus programs.

Do not click on this ads! They all are scam!

Here is a good program made especially to fight Vundo virus: http://vundofix.atribune.org/ 

Vundofix is free.  You can read about Vundofix program here: http://en.wikipedia.org/wiki/VundoFix

Free MySpace search tool by a Freelancer

I am tired doing programs for a freelance site and not choosing me.

Instead of it, I will publish here for free download some of my programs – most of them are ebay, myspace tools, scrappers and data mining. Also have forum posters, translators-dictionary, and all the Internet stuff that can be automated.

If you have ideas, questions or found bugs – please leave a short comment to let me know.

Soon will start my Autoit tutorial also.

The first program I want to give out for free is MySpace search tool: http://craigmaster.freehostia.com/MsTool.rar

No need to install – just run and type your search words, space separated:

for example: Seattle T-mobile phone, or  Clay Aiken, Dallas yoga or Ohio Google phone or California restaurant or Vegas casino, etc.

Wait program to do the search. Three files are created : the “ms.csv” – results and two temp files – you can delete them.

To terminate program use ESC.

At the end there are all friendIDs found for your search /clay aiken in example./

Soon will post second program which uses that friendID to extract more data from user profiles, even theyr MySpace layout.

Here is the source:

#include<ie.au3>
#include<inet.au3>
#include<array.au3>
#include<file.au3>
Dim $a, $aa
HotKeySet(“{ESC}”, “Terminate”)
$f = FileOpen(‘ms.csv’, 2)
$search0 = InputBox(“searcg box”, “Please type the search words separated by space”)
$search = StringReplace($search0, ‘ ‘, ‘%20′)
$u = “http://searchservice.myspace.com/index.cfm?fuseaction=sitesearch.results&qry=” & $search & “&type=AllMySpace”
InetGet($u, ‘temp.txt’)
_FileReadToArray(‘temp.txt’, $a)
For $ar = 100 To 300
 If StringInStr($a[$ar], ‘ results for’) Then
  $br = SttringBetween($a[$ar], ’span>’, ‘ results for’)
  ;ConsoleWrite($br & @CR)
  ExitLoop
 EndIf
Next
$br = StringReplace($br, ‘,’, ”)
$br = StringReplace($br, ‘of’, ”)
$br = StringReplace($br, ‘ ‘, ”)
FileWriteLine($f, ‘Found:’ & $br & ‘ results for ‘ & $search0)
$br = Number($br)
For $i = 1 To round($br/10)
 HotKeySet(“{ESC}”, “Terminate”) 
 $u1 = “http://searchservice.myspace.com/index.cfm?fuseaction=sitesearch.results&qry=” & $search & “&type=AllMySpace&searchid=f6309e4f-39f2-43c6-9b59-5adef4eaa395&pg=” & $i
 InetGet($u1, ‘temp1.txt’)
 _FileReadToArray(‘temp1.txt’, $aa)
 $lines =$aa[0]
 $rold=”
 For $j = 100 To $lines
  HotKeySet(“{ESC}”, “Terminate”)
  If StringInStr($aa[$j], ‘friendid=’) Then
   $r = SttringBetween($aa[$j], ‘friendid=’, ‘”‘)
   if $r=$rold then continueloop
   if stringlen($r)<9 then
   FileWriteLine($f, $r)
      EndIf
   $rold=$r
  EndIf
 Next
Next
MsgBox(0, ‘READY!’, ‘You can see results in ms.csv file’)
FileClose($f)

Func Terminate()
 FileClose($f)
 Exit 0
EndFunc   ;==>Terminate

Func SttringBetween($s, $from, $to)
 $x = StringInStr($s, $from) + StringLen($from)
 $y = StringInStr(StringTrimLeft($s, $x), $to)
 Return StringMid($s, $x, $y)
EndFunc   ;==>SttringBetween

===========================================================

In next post I will upload source code file in .Au3 format /Autoit/ with comments.

You will be able to compile it, change it and add more features.

Micro Antivirus 2009

Micro Antivirus 2009 is very similar to famous fake anti-spyware programs  MS Antivirus,  Vitae Antivirus 2008 and Vista Antivirus.

MicroAntivirus can be distributed by Trojans that are masked as fake video codecs.

If you try to install them, the trojan is activated. 

Then trojans issue fake security alerts.

To get rid on it you have to find in registry editor /Rubn regedt32/ all keys containing MicroAntivirus in their name and delete.

Then search computer for files containing MicroAntivirus in their name and delete them too.

Use firewall and antivirus software from wellknown and original brands /NOD32, Symantec, Panda, Kaspersky, AVG./

Antispywaremaster.com Virus

Yet another Myspace virus. It can be seen on Myspace forums. Pop ups offer you to download Antispywaremaster.com software telling you are infected with thousands of trojans and viruses. It is similar to WindowsAntivirus 2008 and AntispywareDeluxe.

The standard message is:

“Warning! xx suspicious files found! Potentially dangerous files were found on your system during the last scan! IT is highly recommended to remove them as soon as possible…
Remove Now!”

DO NOT CLICK ON THE AD!!!

The pop up is impossible to close, so you have to close the Myspace malicious page as soon as possible and use popup blockers and firewall.

If you got infected, first stop asm.exe and/or Antispywaremaster.exe processes /Alt+Ctrl+Del/ to open Task Manager, find processes and delete them.

Then run regedt32 and find and delete the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\AntiSpywareDeluxe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AntiSpywareDeluxe_is1
HKEY_LOCAL_MACHINE\SOFTWARE\AntispywareD
HKEY_CURRENT_USER\Software\AntiSpywareMaster
HKEY_CURRENT_USER\Software\{5222008A-DD62-49c7-A735-7BD18ECC7350}

/Hint – try Edit menu –> search from the root ‘MyComputer’ for ‘AntiSpyware’ and delete all results found/

At the end, find and delete the following files:

AntiSpywareMaster 7.3.url
%UserProfile%\Application Data\Microsoft\Internet Explorer\Quick Launch\AntiSpywareMaster.lnk
%UserProfile%\Desktop\AntiSpywareMaster.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\AntiSpywareMaster\AntiSpywareMaster.lnk
C:\Documents and Settings\All Users\Start Menu\Programs\AntiSpywareMaster\Uninstall AntiSpywareMaster.lnk

/Hint – try Search console –> search ‘MyComputer’ for word ’AntiSpyware’ as file name and delete all files  found/

JavaScript injection

JavaScript injection become a very popylar hacking method nowdays.

As Javascript is enabled by default in web browsers, it is easy to become a victim.

The malicious websites use installing of ActiveX controls to get control.

The way to avoid JavaScript injection is not to visit unknown sites, especially those offering pirated software. Update Windows regularry and apply the critical patches. Disable active Javascript in IE. 

And main: use firewall and anti-virus software. 

Here is a link with a list with malware sites: http://malwaredomains.com/?tag=sql-injection

It is often updated and one can see how fast is growing their number every day.

Internet Explorer Cannot load webpages – JRE 6u2 problem

This problem started after installing JavaStandardEdition 1 6 Development kit, with NetBeans.

IE started to crash or took too long to load webpages.

Sometimes it opens a blank page.

The problem was not in Internet Explorer but in java plugin code memory corruption.

The solution is uninstalling JRE 6u2 and downloading and installing another copy from the java.sun.com site.

IE7 Java Crash Problem: Internet Explorer has encountered a problem and needs to close

I received this message: Internet Explorer has encountered a problem and needs to close. We are sorry for the inconvenience. every time when visited a site with Java applets.

And buttons with “Send/Don’t Send error.”

In this case uninstalling Java Runtime does not help.

Uninstalling and then re-installing IE7 does not help too.

Even System Restore does not help.

The only method to resolve problem is looking in Objects folder:

Menu  Tools –> Internet Options –> Settings –> View Objects

If there is a  Oracle Jinitiator object, you have to remove it /Add/Remove programs./

Jinitiator is a Java Virtual Machine made by Oracle Corporation. It uses  plugin or an activex control.

Another method is to uninstall  Windows Live Assistant.

IE7 – how to show menu

As you know, in Internet Explorer 7 the Menu doesn’t show.

Here is a simple way to bring it back:

1 Start IE
2  Toolbar –> RightClick
3  Uncheck “Lock Toolbars ” menu
4  Check Links
5  Check MenuBar

Net-Worm.Win32.Koobface net worm infects Myspace and Facebook users

There is a new virus spreading among both Facebook and Muspace uswers – Net-Worm.Win32.Koobface.

It has two variants: Net-Worm.Win32.Koobface.a. /for Myspace/  and Net-Worm.Win32.Koobface.b /for  Facebook/

In  their malicious action, the net worms transform victim computers  into zombie computers to form botnets.

What is a Botnet – http://en.wikipedia.org/wiki/Botnet 

The Net-Worm.Win32.Koobface.a. /for Myspace/ worm creates many commentaries to friends’ accounts.

 The Net-Worm.Win32.Koobface.b /targets Facebook users/ creates many spam messages and sends them to the infected users’friends via the Facebook.

Messages and comments can include ’Paris Hilton Tosses Dwarf On The Street’; ‘Examiners Caught Downloading Grades From The Internet’; ‘Hello’;’ You must see it!!! LOL. My friend catched you on hidden cam’;’ Is it really celebrity? Funny Moments’ and many others.

Messages and comments include links to http://youtube     .pl.

If you click on this link, you are redirected to http://youtube      .ru,  - a site which contains a video clip.

If the user wants to watch it, a message pops up reading that you need the latest version of Flash Player to watch the funny clip.

Of course, instead of the latest version of Flash Player, a malicious file called codecsetup.exe is downloaded to  victimcomputer; this file is also a network worm.

Worm.Win32.GetCodec infects MP3 audio files

This worm was reported in July and is a new step in worms and viruses development.

The new is it converts the mp3 file into WMA file and embeds in it. When the file is opened, the Worm.Win32.GetCodec worm opens a web page telling you to download a new codec.

NEVER download and install codecs from unknown sites! It is 99% sure they are worms/trojans.

 If you agree to install the ‘codec’ file, a Trojan – known as Trojan-Proxy.Win32.Agent.arp is downloaded to your  computer, giving the hackers control of the victim’s PC.

if you got infected, use http://www.pctools.com/spyware-doctor/ to clean the worm.

AntiSpyCheck – yet another trojan

 

 Do you have noticed how many trojans with ‘Anti-’ names appeared nowdays? It seems to be the last trends among virus/trojans creators. They have masked their malware code as antivirus software with colorful GUI telling you have 345247827469726482246 trojans and viruses and have to hurry to their page and buy antivirus software which is the only one to clean your computer.    
 
Anti Spy Check Description:
Anti Spy Check, or AntiSpyCheck 2.4, is a fake antispyware and antivirus program that claims to be a spyware remover, popup blocker and trojans cleaner.

AntiSpyCheck program may install without your knowledge through a Trojan Zlob.

Trojan.Zlob is a back door Trojan. It allows the hacker to perform various malicious actions on the remote computer.

Trojan.Zlob usually is masked as a needed video codec in the form of ActiveX.

Here is a typical example of it:

 

Image taken from http://www.jahewi.nl/lists/fakecodecs/fakecodecs.html

 

Anti-SpyCheck usually pops up fake security alerts trying to make you buy their software.

How can you get rid of AntiSpyCheck?
The best spyware removal tactic is to uninstall Anti Spy Check  using the “Add/Remove Programs” from the Control Panel.

If there are still files remaining after reboot, follow the steps below: /Sistem Restore has to be disabled/

1. Run the Task Manager /“Alt+Ctrl+Del“, and “Task Manager” opens/ ! ‘+’ sign means to press three keys at once- the 3 fingers rule.

2. Find the following processes: ad-protect.exe and AntiSpyCheck.exe then select one by one and press the ‘End Process’ button.

3.  Find the files above using Search and delete them.

4.  Go to “Start” button and then click on “Run”.

5. In the Run  box  type “cmd“, and then click on “OK”  button

6. Type regsvr32 /u spamdet.dll and hit Enter. This will unregister the trojan .dll library.

7. Find and Delete spamdet.dll

8. Open registry editor /Start — Run — Regedt32/ then find and delete /if any/ the following registry keys:

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\ad-protect.EXE
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\spamdet.DLL
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{9DA1990B-9BCA-4c80-AEFB-11A40FA849F9}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\AppID\{C628512D-A058-4BD4-B47B-B036F45FA02B}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{99A753C6-E429-46BD-989E-DD4A21CD059D}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{BBBD3E11-D201-46C9-8471-091D33159287}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D2608046-DD09-A225-01BF-70C1EDD8B2E8}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D2C1986A-FBEC-4472-AABF-6D42F08DBC8E}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D7ABE914-B8CF-4602-9145-6BDAAEDA21AA}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{F3210E86-46A8-5973-963F-0EF4CF226A0C}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{214345B8-BB69-498D-A168-29F58F15D806}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{CF231820-9904-4A37-B5B0-C87EF6F6CC82}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{D2C1986A-FBEC-4472-AABF-6D42F08DBC8E}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{F51BC478-D997-4C56-988D-79D9EEAAD1EC}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{FD4DCB8B-C33A-4E70-A351-6FAB7E1071A4}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{32BD20FD-41FD-47FB-9BC9-28DCBD7D55D7}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\TypeLib\{5AA883DB-7CFD-4737-B3C3-C671595ECCE5}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Ad-Protect.Addin
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Ad-Protect.Addin.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Ad-Protect.Server
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Ad-Protect.Server.1
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\spamdet.SpamDetector
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\spamdet.SpamDetector.1
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\AntiSpyCheck.exe
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\AntiSpyCheck
HKEY_LOCAL_MACHINE\SOFTWARE\AntiSpyCheck
HKEY_CURRENT_USER\Software\Microsoft\Office\Outlook\Addins\Ad-Protect.Addin.1
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu\Programs\AntiSpyCheck  

 

After restarting the computer there will be no more annoying pop ups and slowdowns.

And one advice: there is no free lunch as you know, so when watching porn and it says wou have to download something to watch more – think first before click Yes, or better – Quickly RUN of the site without thinking!

How to close ports

When my computer becomes slow, I use to check connections established. In command prompt /Start button — Run —type  CMD — Enter/ I type command ‘netstat -a‘ and press enter.

It gives all the connections in my computer. Especcialy attention I pay to those marked as ESTABLISHED. Some of them are with my Skype friends or Internet sites I have connected.

 But if I close all the programs running /like Skype, IE, games, torrents, etc/ there are still some established connections with unknown sites in Germany, Russia, all over the world. Near them is written the port. It is known that malicious software uses higher ports number /bigger than 10000/ and ‘good’ programs use small numbered ports.

One way to close a port is to terminate the process /program/ that has opened it.  But if you don’t know the program or someone is using trojans to connect with you, the other way is to use a program to close those ports.

There are many programs for scanning and closing ports. I found this http://www.nirsoft.net/utils/cports.html an use it from time to time. It is free. I don’t know the autors but think it is a good program for non proffessionalists like me. If you have better programs in mind, please share their URL.

Google involved in spreading XP Antivirus 2009 and Vista Antivirus 2009

As my last post made a hudge interest, I made a quick research regarding those trojan which has so wide spreaded.

Almost all of my search keywords are “How to remove XP Antivirus 2008“

About removing of the trojan I have written before. Write to me if you have more questions or problems – I will try to help with advices.

If I dont know something, I ask Google.

And the irony in this case is Google told me that Google is was spreading malware via its AdWords links.

If you don’t know - AdWords is an advertising program of Google. They get paid to put ads in some pages and in main search results page too.

Some of those advertising links belonged to hackers. They had redirected the user who had clicked on their link to a trojan downloader page. This way many web users become infected with viruses just surfing the web.

The good news is Google have identified and canceled AdWords accounts which displayed malicious ads re-directing users to hacker sites.

More info can find at the official Google AdWords blog 

http://adwords.blogspot.com/2007/04/protecting-your-security-online.html

XP Antivirus 2008 is a Trojan!

I had surfing the net when a red alert in Tray menu started to appear. It read Windows Seciruty has to be updated.

It offered me a site with “XP Antivirus 2008″

As I tought it is Microsoft security center alert, entered the site  http://s c a n n e r . a n v i-s c a n n e r . c o m / 3 4 /? a d v i d  =  0 0 0 0 0 0 4 6 8 3 & H T T &  /Attention – better do not try to open/

When I saw the fake system scanning and $20 price to “clean my system” I quickly left but was too late.

Then Avira Antivir  started to alert about viruses detected. The computer became very slow.

I restarted in Safe Mode /F8/ and  ran Spyware Doctor – it found more than 20 viruses and 30 infected files. Spyware Doctor cleaned them. I had disabled System Restore in advance. /Important!/

Then ran Avira Antivir again and cleaned  17 trojans.

Open Task manager /alt+ctrl+del/ and stop the following processes:

vav.exe
XPAntivirus.exe
XPAntivirusUpdate.exe
xpa.exe
xpa2008.exe

Then Remove following XP Antivirus 2008 Registry Values:

HKEY_USERS\Software\XP antivirus
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run smrhc7nsj0e57c
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\rhc7nsj0e57c
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\rhc7nsj0e57c displayname
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\uninstall\rhc7nsj0e57c uninstallstring
HKEY_LOCAL_MACHINE\software\rhc7nsj0e57c
HKEY_LOCAL_MACHINE\software\rhc7nsj0e57c advid
HKEY_LOCAL_MACHINE\software\rhc7nsj0e57c automaticallyupdates
HKEY_LOCAL_MACHINE\software\rhc7nsj0e57c backgroundscan
HKEY_LOCAL_MACHINE\software\rhc7nsj0e57c backgroundscantimeout
HKEY_LOCAL_MACHINE\software\rhc7nsj0e57c databaseversion
HKEY_LOCAL_MACHINE\software\rhc7nsj0e57c daysinterval
HKEY_LOCAL_MACHINE\software\rhc7nsj0e57c domain
HKEY_LOCAL_MACHINE\software\rhc7nsj0e57c engineversion
HKEY_LOCAL_MACHINE\software\rhc7nsj0e57c guiversion
HKEY_LOCAL_MACHINE\software\rhc7nsj0e57c installdir
HKEY_LOCAL_MACHINE\software\rhc7nsj0e57c minimizeonstart
HKEY_LOCAL_MACHINE\software\rhc7nsj0e57c programversion
HKEY_LOCAL_MACHINE\software\rhc7nsj0e57c proxyname
HKEY_LOCAL_MACHINE\software\rhc7nsj0e57c proxyport
HKEY_LOCAL_MACHINE\software\rhc7nsj0e57c registrationdiscurl
HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run smrhc7nsj0e57c
HKEY_LOCAL_MACHINE\software\rhc7nsj0e57c registrationurl
HKEY_LOCAL_MACHINE\software\rhc7nsj0e57c scandepth
HKEY_LOCAL_MACHINE\software\rhc7nsj0e57c scanpriority
HKEY_LOCAL_MACHINE\software\rhc7nsj0e57c scansystemonstartup
HKEY_LOCAL_MACHINE\software\rhc7nsj0e57c softid

This way I cleaned my system from that annoying malware.