Showing posts with label VIRUS AND SPAMS. Show all posts
Showing posts with label VIRUS AND SPAMS. Show all posts
Is your PC running slow...?
Or at least, slower than normal? Don’t quite know what’s wrong?
OK, let’s see if we can help. Most people immediately think “Malware” at this point. But that’s not always the case. Yes, some malware does indeed slow down your system and use up precious resources. But there are other possible causes as well, so let’s explore some of these, and look at some ideas to help.
Is your PC clean?
And by that I mean – is it free from dust and dirt? Dust and dirt builds up inside a computer and this can affect your cooling fans, reducing the amount of airflow. Reduced airflow can cause your processor to overheat resulting in slow operation or even unexpected shutdowns. Many of today’s processors have the ability to “throttle back” (slow down) if the core temperature reaches a certain threshold. Cleaning the inside of your system is relatively easy – you just need to take some sensible precautions. A useful guide to PC cleaning can be found here.
Clear out your Temp files.
Why? Well temp files can build up over time and eat into your precious disk space. When you install programmes, the installer uses temp (temporary) files as part of the set up process. Some programmes also use temp files when in use. These temp files should be removed when the installer or programme is finished, but this does not always happen. And, of course, your browser will collect temp files as well. A build up of temp files could leave Windows struggling to find room for its swap file (see below) – so everything slows down.
How do you clean out temp files? There are two easy ways – manually or by using a proprietary cleaning programme. Note that the cleaning programmes will often offer the option to clear out Temporary files created by your browser.
Manually (XP & Vista) – Firstly, exit all programmes, including browsers and AVs. Go to Start > Run and type%Temp% in the Run box and click OK. A folder will appear – it will contain temp files and temp folders. If you want to delete everything, press Ctrl+A (to select all) and then press the delete key. If you want to keep any files then hold down the Ctrl key and left click the file or folder. Then press the delete key. Click OKto confirm deletion. Once done, remember to go to your Recycle Bin and empty the bin.
Cleaning Programmes – there are various such programmes available for free. Among the best are
Don’t forget XP does have it’s own utility for cleaning – it can be found via Start > All Programs > Accessories > System Tools > Disk Cleanup.
Any old programmes?
Do you still have some old programmes installed? When did you last use them? Remember that ‘trial’ software you installed? Has the trial period expired? Could you perhaps uninstall it (assuming you have the original installation disks)? Uninstalling such programmes will help free vital disk space. Oh, always re-boot after uninstalling – it helps to clear away the final remnants of an uninstalled programme.
Are you using unnecessary programmes?
By this I mean some of the numerous “enhancement” programmes available, that, while they may make your desktop look terribly exciting, are actually eating up precious resources. Things like third party screensavers and fancy wallpapers, Windows Taskbar replacements, WindowBlinds, Actual Transparent Window, XP Visual Styles, Stardock Theme Manager and so on. Nothing wrong with using them – they are all respected legitimate applications – but they may be contributing towards the slow down of your system.
Reduce the number of programmes loading at start up
Many applications insist on starting either the complete programme or a component of the programme whenever Windows starts. Many of these start ups are unnecessary and can be stopped. A good way to review the number of start up programmes is by using a start up manager utility, such as Spybot Search & Destroy, StartUpLite or Autoruns. In Spybot, you’ll need to click Mode > Advanced to ensure you have access to the Tools section, then select System Startup in the left pane. A list of programmes that start when you boot up will be displayed in the right pane. You simply uncheck the ones you don’t need.
StartUpLite is very easy – just download the small file and double click StartUpLite.exe. A box appears showing programmes that don’t need to startup at boot. Choose whichever options you prefer and clickContinue.
Autoruns gives you similar information, although presented in a slightly different way, and with more detail. Again, you simply uncheck a box beside the entry you wish to disable.
Remember to research a start up if you are not sure what it is – some of the entries that may appear and which can safely be disabled are things like Update Schedule entries for Adobe Acrobat, Sun Java, QuickTime and so on. If in doubt, post in our Forums, choosing the Forum that’s relevant to your Operating System. Alternatively, you can check Startup items here.
Note: You should NOT use MSConfig to permanently disable programmes from automatically starting at boot up. This utility is meant as a trouble-shooter – not a long term solution. If you uninstall a programme that has already been disabled using MSConfig, then it’s likely there will be orphaned Registry entries left behind. These could cause potential problems when trying to start your system. Use one of the start up managers mentioned above.
Do you have enough RAM?
Lack of memory can be a real issue, especially with today’s high performance machines and Operating Systems (OS). If you’re using Windows (and let’s face it, most of us are) then you need to ensure you have the appropriate amount of RAM for your system. Microsoft list “minimum requirements” with each OS – but they are in the business of selling software. That’s why their “minimum requirements” are always at the lower end of the scale. There are numerous sites around that will advise you need “x” amount for XP and “y” amount for Vista. As a general rule, Vista works well with 2GB and XP with 1GB. You can use more, of course, but as a minimum these figures are accurate.
If you don’t have very much RAM, what happens? Well, Windows loads programmes into memory to allow fast access. When it has no more memory left, it will start using your hard disk. This is much slower than using RAM, so your programmes will appear to run more slowly. The part of the hard disk used by Windows is called a swap file. So, a lack of RAM can also eat into your hard disk space as well.
RAM is not terribly expensive at the moment, so it makes sense to upgrade. You can find out what type of RAM you need by downloading PCWizard – a system analyser (it’s free!) or going to one of the manufacturer’s sites such as Crucial and using their memory advisor tool. Once you know the type of RAM you need, there are plenty of online stores to choose from.
See here for a guide to installing your RAM.
Defrag your hard disk
Over a period of time, data written to your hard disk becomes fragmented or scattered all over the disk. This makes it harder for the system to find the data it needs. By defragging your disk, or putting the data in a more logical sequence, your system performance will improve. NOTE: Windows will not let you defrag a drive if there is less than 15% free space available. Keep an eye on your free space!
You could use a defragging utility such as Sysinternals PageDefrag – this is free and easy to use.
For a guide to defragging see
What about my swap file?
You can change the settings on your swap file to allow Windows to have more disk space to play with. This disk space is also known as Virtual Memory. For a 32 bit Operating System (which most users will have) set any amount up to a maximum of 4Gb. Try and at least match the amount of RAM in your system. Of course, you will need to have enough free disk space for this swap file.
Useful step-by-step guides can be found
Something else to consider is that the swap file should not be fragmented in order to obtain the best results. This can be done by selecting ‘No swap file’, rebooting (you have to do this, to apply the changes), defragging the drive and then resetting the swap file to a size of your choosing. The swap file will now be an area of the maximum contiguous (uninterrupted) free space – and therefore optimum performance.
Note: When choosing a value it is often suggested to set a static size swap file – set the Initial and Maximum amounts to the same value. This saves Windows from using resources to manage a dynamic swap file.
Does your hard disk contain errors?
A hard disk will not last forever. Even a new hard disk can have problems. However, many problems can be fixed, simply by running a Windows utility called ChkDsk. This will scan your hard disk and repair any file system errors while verifying the integrity of the drive. Guides from Microsoft on using ChkDsk can be found
Do your System Files contain errors?
Sometimes critical system files may become damaged or corrupt. This will obviously affect your computer’s performance. However, Windows has the ability to replace any damaged files on its own – this facility is called Windows File Protection. It can be started manually by typing a simple command into the Run box -sfc /scannow. This command immediately starts the Windows File Protection utility and it then checks and scans all system files to ensure their integrity.
For users with a pre-installed version of XP, sfc may ask you for your Windows CD in order to copy the relevant files. If you don’t have a Windows CD or if sfc cannot find the files it needs, please refer to Marc Liron’s article below.
For users who installed Service Pack 2 for XP by downloading from the internet, sfc may ask you for an XP SP2 CD – which you won’t have. You may need to create a slipstreamed CD to ensure sfc works correctly. Slipstreaming is simply a way of incorporating SP2 into your Windows installation – you create a new disk with Windows and SP2 all in one. Guides to slipstreaming can be found here and here, and a useful programme called Autostreamer, which does most of the work for you, can be downloaded here.
A detailed guide to using Windows File Protection with XP can be found here – it’s written by Microsoft MVP Marc Liron.
Note that Windows File Protection in Vista is now called Windows Resource Protection which, as well as protecting critical files, also protects the Registry. However, the basic principles are the same. To run the sfccommand in Vista, you must be logged in as an Administrator.
A guide to using WRP in Vista can be found here.
Stopping unnecessary services
Windows generally comes with a raft of running services, many of which are not really required. You can safely stop some of these services and improve the boot time and speed of your system. Many installed programmes make themselves start up as soon as you boot the PC. They just run in the background, even although you don’t actually use them. Usually these programmes can be stopped from automatically loading – if you need to start them, you can do this manually.
One service that often causes a system to slow down is the Indexing Service – this can be turned off – seehere for a guide.
For services guides see
Driver/Device Conflicts
Are all your hardware drivers up to date? Using an out of date driver could cause hardware conflicts and crash your system. Have a look at Microsoft’s suggestions on troubleshooting driver/device conflicts here.
Internet Explorer
IE 7 includes a phishing filter – very useful indeed. But it can slow down your browsing as the filter checks each web page. Have a look at Microsoft’s suggestions on this here.
Anti Virus Programmes
Never use more than one Anti Virus. Although it might sound like a great idea to run two or more, in reality it’s not. AVs usually have a ‘real time’ monitor that helps protect your system. This monitor will want to have a look at any file that changes or has been added to the system. If you have 2 AVs then every time one looks at a file, the other AV will think that file has changed so it will want to take a look as well. Now the second AV thinks that file has changed so it wants another look. So, of course, the first AV thinks that file has changed….you get the idea. You could end up with an unstable system, a really slow system or unexplained crashes.
And finally…
Having done all your tweaks and clean ups, create a new System Restore point – this gives you a ‘fall back’ position with all your new changes.
A guide to manually creating a System Restore point in XP can be found here and one for Vista can be foundhere.
No more problems? Excellent – be sure to revisit this article to help keep your system running smoothly.
Still having problems? Well, it could indeed be malware – please start here and follow the instructions to receive assistance.
Emergency Backup Procedure of operating systems
Scope:
This information is written on the assumption that you have no experience in copying files. It is a simple process. A step-by-step process is explained below.
The process makes an emergency copy of your important files such as letters, photographs, music and other important files prior to removal of malware from your computer
If you are reading this because you have an infected machine and need to backup (copy) your data files, it must be understood that there is a risk of copying contaminated files. The emergency backup made in the fashion described below must be kept quarantined until your computer is declared clean by our qualified analysts. You must not use or open any file in your backup copy until the analyst advises you. You will be given advice on checking and cleaning the emergency backup later.
Emergency Backup Procedure
This is a simple procedure and does not need any special software. It uses the built in procedure of ‘Copy & Paste’.
Windows 95, 98, ME and XP:
Most of your important data will be in ‘My Documents’.
Vista:
Vista has a slightly different folder structure. Most of your important files will be in ‘Documents’, ‘Downloads’ & ‘Music’ etc. The general copy and paste method is the same but you have to include the extra folders
Storage of emergency copy:
You can store your emergency copy on any media; Hard drive, CD/CVD/Blueray/Tape/SD or CF card or what have you.
This emergency backup is to be kept only as a temporary measure and in all probability will be deleted after it is confirmed that your machine is clear of malware and that your data is safe.
That said, as you may one day forget what is on a disk, it is not recommended to copy it to hard media such as CD/DVD for long term archiving due to the risk of re-introducing malware via contaminated files. If that is the only option, it is best to destroy the emergency copy after your machine is declared clean
The ideal place of storing an emergency backup is on a separate hard drive or other device such as an external hard drive, USB memory stick, SD/CF card or any device that will be seen as a mass storage device by your computer.
HOW TO COPY YOUR IMPORTANT FILES:
Win 95, 98 me and XP
1) Click the ‘Start’ button at the bottom left of your screen
Fig 1:
2) Click on ‘My Documents’
Fig 2:
3) My Documents folder:
Fig 3:
Hold the CTRL key down and then press ‘A’. (This is known as Ctrl-A).
This will highlight all the folders and files to be copied.
4) Select ‘Edit’ and then ‘Copy to Folder’
Fig 4:
5) Select the destination folder. In this example, the external drive ‘Pluscom WD500GB’ was chosen.
You can use a USB memory stick or even a memory card such as a CF or SD card from your camera, PDA, smart phone etc, using a card reader.
Fig 5:
Click ‘Copy’ to start the copying process.
6)
Fig 6:
This image shows the progress of the copying. (Ignore the ‘timing’ – it is never correct!).
When the progress window closes, the copying job is complete.
=================================================
Vista:
The process is fundamentally the same as XP. However the folder structure is different. ‘My documents’ becomes just ‘Documents’ Other folders containing your important files such as Music, Pictures, and videos etc are separated outside of the main ‘Documents’. So a slightly different procedure is adopted.
1) Click the ‘Start’ button at the bottom left of your screen.
Fig1 :
2) Click on ‘Documents’
Fig 2:
3) Scroll the left window until you can see your name.
Then click on your name.
Fig 3:
This places the Folder ‘Tree’ in the right hand window.
4) Place your cursor (mouse) over the first folder you want to copy.. Hold down the ‘CTRL’ key... (don’t let go until told to)... then do a single click on ‘Documents’ to highlight it. Then move the mouse to the next folder, say ‘Music’ and click that too. Continue to click only the folders you want to copy...
Fig 4
... Still holding the CTRL key down, do a single RIGHT mouse click. When you see the pop-up window you can let go of the CTRL key.
Click ‘Send To’ to open up the selection panel.
Then select the place where you want to place the copies of your folders
Fig 5:
Fig 6:
Fig 6: When the 'Copying' popup closes, the job in done.
=======================================================
We recommend that a proper and regular backup regime is implemented.
To help make this a simple and easy job, please see the sister article:-
Welcome to Tech Support Forum
Virus/Trojan/Spyware Removal Help
(formerly Hijackthis Log Help)
* DO NOT FIX ANY ENTRIES OR DELETE ANY FILES YOURSELF. Do not run any specialized tools that you see being used in other threads without direct supervision from one of our trained analysts. Be advised that running any specialized tools not listed in this topic, on your own, is done solely at your own risk
* It is also this forum's policy that we only address users with a legal copy of Windows. If during the course of a fix it is determined that the copy is not legal, we must stop the cleansing process.
=============================
How Soon Can I Expect Help?
=============================
Please be considerate of the fact that the people helping you are all volunteers, and in many cases usually have a job, and a limited amount of time to help, and therefore can only do so much. Also please note that there are many more people in need of assistance than there are trained staff members who may assist. Patience for this free assistance is required. If there is an immediate need, please take the machine to a local technician.
If no one has replied to your thread within 72hrs after you posted, please reply in your thread with the words "BUMP, please" to move it forward. Do NOT bump the thread unless 72 hours has passed. We try to work from oldest to newest posts so your wait will be longer if you bump it forward before the 72 hours is up. When looking threads to respond to, we look for threads with 0 reply, or 1 reply. If you bump, or add a post prior to the 72 hrs, your thread is highly likely to be overlooked by our queuing methods.
Additionally, do not bump more than once. If you do, it may appear as though the thread is being handled, and it may be overlooked. Early bump posts will be deleted.
NOTE: We are aware that users sometimes seek help from several Forums at the same time. Unfortunately, this can cause confusion and actually wastes time and resources - yours, ours and other Volunteers across the community. If you have already posted at another Forum, please advise us, or them, and choose just one.
Also be advised:
It is not our intent to repeatedly remove malware from the same member's machines. The intent of this free service performed by volunteers is to help remove malware from your machine, educate you on how it may have happened, and how to prevent that from happening again. To this end, we provide links to articles and tools which should make your visit to the Virus/Trojan/Spyware Help section of TSF a one time event. Please do enjoy the rest of Tech Support Forum as many times as you like!
==================================================
Change Your Login and Passwords to Financial Sites
==================================================
Many infections that the commercial scanners are failing to remove are the type of infections that allow hackers to remotely control your computer, steal critical system information and download and execute files without your knowledge.
If you do any banking or other financial transactions on the PC or if it should contain any other sensitive information, please get to a known clean computer and change all login and passwords where applicable. It would be wise to contact those same financial institutions to apprise them of your situation. Please refer toMicrosoft's Online Safety article for tips on creating a strong password.
Do not change passwords or do any transactions from the infected computer until it has been cleaned.
===========================================
Preparing for the Malware Removal Process
===========================================
While we try our hardest to avoid them, accidents do happen. With today's malware being as it is, neither Tech Support Forum nor the Analyst providing the advice may be held responsible for any loss of your data. You're following the instructions given at your own risk. We recommend that you back up any data that’s important to you beforehand, just in case the worst happens.
1. As a general rule, to offset any unexpected mishaps, your personal data should be backed up regularly. If you do not already have a process in place that backs up your data, it is highly recommended you do this now.
2. If you suspect the machine to have cracked (illegal) software installed,
3. Uninstall the following via Add or Remove Programs in Control Panel:
- If you have more than one
antivirus software installed, leave only ONE and uninstall the others. - CD emulation software, such as DAEMON Tools or Alcohol, see this link for complete instructions. These can be reinstalled once any malware removal efforts are completed.
- p2p programs like uTorrent, Bittorrent, LimeWire, Morpheus, etc., as they are a major conduit for malware and a likely source of your current issues.
=================================
Downloads and Reports Required:
=================================
Before scanning, ensure all other running programs are closed. Do not use your computer for anything else during the scan.
Also, ensure there aren't any scheduled antivirus scans running while the dds scan is being performed.
*Note - Some antivirus programs falsely detect dds.scr as a threat.
====
DDS:
====
Disable any script blocker, and then double click dds.scr to run the tool.
- When done, DDS will open two (2) logs
- DDS.txt
- Attach.txt
- Save both reports to your desktop.
=====
GMER:
=====
Ensure you have uninstalled any CD Emulation programs before you run GMER as outlined above and here
- Extract the contents of the zipped file to desktop.
- Disable your onboard Anti Virus and any other Active protection programs you have installed.
- Double click GMER.exe.
- If it gives you a warning about rootkit activity and asks if you want to run a full scan...click on NO, then use the following settings for a more complete scan..Click the image to enlarge it
- In the right panel, you will see several boxes that have been checked. Ensure the following areUNCHECKED ...
- IAT/EAT
- Drives/Partition other than Systemdrive (typically C:\)
- Show All (don't miss this one)
- Then click the Scan button & wait for it to finish.
- Once done click on the [Save..] button, and in the File name area, type in "ark.txt" or it will save as a .log file which cannot be uploaded to your post.
- Save it where you can easily find it, such as your desktop
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries
Please note:
If (and only if) there are problems using gmer as indicated above, save a scan from the initial startup scan.
- Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while the scan is being performed. Do not use your computer for anything else during the scan.
- Double click the gmer.exe file.
- The program will begin to run, and perform an initial scan. If possible rootkit activity is found, you will be asked if you would like to perform a full scan. Click No.
- In any case, after the initial scan is complete, click on the Save button, and save the log file somewhere you can easily find it, such as your desktop, and attach it in reply
===========================
How the logs should be furnished:
===========================
Copy/Paste the contents of 'DDS.txt' to be posted as text to your post
The other two logs ...
* attach.txt
* ark.txt
... should be zipped/archived before attaching to the post
When posting your reply, the zipped file may be attached by clicking the [Manage Attachments] button.
It's located under [Additonal Options] on the composition page.
Browse to where you saved the file, and click Upload.
=================================
When posting the logs please observe the following
=================================
- Describe your issue/problem in DETAIL!. We cannot second guess as to what your issue(s) may be. Please provide as much detail as possible, including virus/trojan/worm names and locations if available. The more information you can give us the better we can help
- Only Attach the logs that we've specifically requested for you to. (Otherwise post it as text in the Reply box).
- DO NOT Wrap the log using Quote or Code tags. (DO make sure notepad word-wrap is OFF)
- DO NOT Post another Program’s log (Unless we specifically ask for it)
- DO NOT Cut off the header of any log (It contains important information for the Analyst)
- DO NOT Private Message the Analyst unless asked to do so.
- DO NOT post live suspicious links. We do appreciate that you want to give as much information as possible, but the links need to be munged. Alter the links to use hxxp:// instead of http://
Click here to post the following logs in the Virus/Trojan/Spyware Help Forum
Checklist
- DDS.txt - copy/pasted directly into Reply box
- Attach.zip (contains Attach.txt and ARK.txt) - attached to post
- Rootkits that alter critical/legit Windows files are becoming more commonplace. To facilitate a more rapid cleaning of your system, also tell us whether or not you have/have access to a Windows Install disc, or a Boot CD
Once you have posted, subcribe to your thread by going to Thread Tools located at the top of the thread.
Select Subscribe. Make sure it is set to Instant Notification.
This concludes the basic steps required before posting your logs. Thank you for taking the time to read this.
With the increase of rootkit/driver based infections, Tech Support Forum added a GMER AntiRootKit scan to our pre-posting steps, to help us identify the presence of such infections before any malware removal efforts take place.
Some CD Emulators use a hidden driver which can be seen as a rootkit, and can also interfere with a correct read of the state of the machine by our tools.
Another problem with these types of software can be their interference with proper Windows Updates on aWindows XP
machine, as outlined in this Microsoft KB Article
Quote:
| These programs lock the Atapi.sys file and prevent |
In light of this, we require that our members uninstall such software before performing any of the pre-posting scans. They can be re-installed once your helper has determined the cleaning process is complete.
The following should be uninstalled via the Control Panel:
Daemon Tools and Daemon Tools Lite
Alcohol 120% and 52%
AstroBurn
StarBurn
For a complete uninstall, and so our tools may run unhindered, please also follow the steps on DuplexSecure's page for uninstalling the SPTD driver which these emulators use.
Scroll down to:
Quote:
| Q: How can I remove SPTD driver on 32-bit OS? |
Follow the instructions.
Quote:
| Q: How can I remove SPTD driver on 32-bit OS? A: To remove SPTD, simply download SPTD setup file "SPTDinst-v162-x86.exe" for Windows 2000/XP/2003/Vista (32-bit) [911,856 bytes] and execute it. In dialog that appears press "Uninstall" button and then SPTD will remove itself from your Windows installation. |
Adware
Adware is software that presents banner ads or in pop-up windows through a bar that appears on a computer screen. Those advertising spots usually can't be removed and are consequently always visible. The connection data allow many conclusions on the usage behavior and are problematic in terms of data security.
Backdoors
A backdoor can gain access to a computer by going around the computer access security mechanisms.
A program that is being executed in the background generally enables the attacker almost unlimited rights. User's personal data can be spied with the backdoor's help, but are mainly used to install further computer viruses or worms on the relevant system.
Boot viruses
The boot or master boot sector of hard drives is mainly infected by boot sector viruses. They overwrite important information necessary for the system execution. One of the awkward consequences: the computer system cannot be loaded any more…
Bot-Net
A Bot-Net is collection of softwarre bots, which run autonomously. A Bot-Net can comprise a collection of cracked machines running programs (usually referred to as worms, Trojans) under a common command and control infrastructure. Boot-Nets server various purposes, including Denial-of-service attacks, etc., partly without the affected PC user's knowledge. The main potential of Bot-Nets is that the networks can achieve dimensions on thousands of computers and its bandwidth sum bursts most conventional Internet accesses.
Dialer
A dialer is a computer programm that establishes a connection to the Internet or to another computer network through the telephone line or the digital ISDN network. Fraudsters use dialers to charge users high rates when dialing up to the Internet without their knowledge.
EICAR test file
The EICAR test file is a test pattern that was developed at the European Institute for Computer Antivirus Research for the purpose to test the functions of anti-virus programs. It is a text file which is 68 characters long and its file extension is “.COM” all virus scanners should recognize as virus.
Exploit
An exploit (vulnerability) is a computer program or script that takes advantage of a bug, glitch or vulnerability leading to privilege escalation or denial of service on a computer system. A form of an exploit for example are attacks from the Internet with the help of manipulated data packages. Programs can be infiltrated in order to obtain higher access.
Grayware
Grayware operates in a way similar to malware, but it is not spread to harm the users directly. It does not affect the system functionality as such. Mostly, information on the patterns of use is collected in order to either sell these data or to place advertisements systematically.
Hoaxes
The users have obtained virus alerts from the Internet for a few years and alerts against viruses in other networks that are supposed to spread via email. These alerts are spread per email with the request that they should be sent to the highest possible number of colleagues and to other users, in order to warn everyone against the "danger".
Honeypot
A honeypot is a service (program or server), which is installed in a network.
It has the function to monitor a network and to protocol attacks. This service is unknown to the legitime user - because of this reason he is never addressed. If an attacker examines a network for the weak points and uses the services which are offered by a Honeypot, it is protocolled and an alert sets off.
Keystroke logging
Keystroke logging is a diagnostic tool used in software development that captures the user's keystrokes. It can be useful to determine sources of error in computer systems and is sometimes used to measure employee productivity on certain clerical tasks. Like this, confidential and personal data, such as passwords or PINs, can be spied and sent to other computers via the Internet.
Macro viruses
Macro viruses are small programs that are written in the macro language of an application (e.g. WordBasic under WinWord 6.0) and that can normally only spread within documents of this application. Because of this, they are also called document viruses. In order to be active, they need that the corresponding applications are activated and that one of the infected macros has been executed. Unlike "normal" viruses, macro viruses do consequently not attack executable files but they do attack the documents of the corresponding host-application.
Polymorph viruses
Polymorph viruses are the real masters of disguise. They change their own programming codes - and are therefore very hard to detect.
Program viruses
A computer virus is a program that is capable to attach itself to other programs after being executed and cause an infection. Viruses multiply themselves unlike logic bombs and Trojans. In contrast to a worm, a virus always requires a program as host, where the virus deposits his virulent code. The program execution of the host itself is not changed as a rule.
Script viruses and worms
Such viruses are extremely easy to program and they can spread - if the required technology is on hand - within a few hours via email round the globe.
Script viruses and worms use a script language such as Javascript, VBScript etc. to infiltrate in other new scripts or to spread by activation of operating system functions. This frequently happens via email or through the exchange of files (documents).
A worm is a program that multiplies itself but that does not infect the host. Worms can consequently not form part of other program sequences. Worms are often the only possibility to infiltrate any kind of damaging programs on systems with restrictive security measures.
Spyware
Spyware are so called spy programs that intercept or take partial control of a computer's operation without the user's informed consent. Spyware is designed to expolit infected computers for commerical gain. Typical tactics furthering this goal include delivery of unsolicited pop-up advertisements. AntiVir is able to detect this kind of software with the category "ADSPY" or "adware-spyware".
Trojan horses (short Trojans)
Trojans are pretty common nowadays. We are talking about programs that pretend to have a particular function, but that show their real image after execution and carry out a different function that, in most cases, is destructive. Trojan horses cannot multiply themselves, which differenciates them from viruses and worms. Most of them have an interesting name (SEX.EXE or STARTME.EXE) with the intention to induce the user to start the Trojan. Immediately after execution they become active and can, for example, format the hard drive. A dropper is a special form of Trojan that 'drops' viruses, i.e. embeds viruses on the computer system.
Zombie
A Zombie-PC is a computer that is infected with malware programs and that enables hackers to abuse computers via remote control for criminal purposes. The affected PC, for example, can start Denial-of-Service- (DoS) attacks at command or send spam and phishing emails.
Adware is software that presents banner ads or in pop-up windows through a bar that appears on a computer screen. Those advertising spots usually can't be removed and are consequently always visible. The connection data allow many conclusions on the usage behavior and are problematic in terms of data security.
Backdoors
A backdoor can gain access to a computer by going around the computer access security mechanisms.
A program that is being executed in the background generally enables the attacker almost unlimited rights. User's personal data can be spied with the backdoor's help, but are mainly used to install further computer viruses or worms on the relevant system.
Boot viruses
The boot or master boot sector of hard drives is mainly infected by boot sector viruses. They overwrite important information necessary for the system execution. One of the awkward consequences: the computer system cannot be loaded any more…
Bot-Net
A Bot-Net is collection of softwarre bots, which run autonomously. A Bot-Net can comprise a collection of cracked machines running programs (usually referred to as worms, Trojans) under a common command and control infrastructure. Boot-Nets server various purposes, including Denial-of-service attacks, etc., partly without the affected PC user's knowledge. The main potential of Bot-Nets is that the networks can achieve dimensions on thousands of computers and its bandwidth sum bursts most conventional Internet accesses.
Dialer
A dialer is a computer programm that establishes a connection to the Internet or to another computer network through the telephone line or the digital ISDN network. Fraudsters use dialers to charge users high rates when dialing up to the Internet without their knowledge.
EICAR test file
The EICAR test file is a test pattern that was developed at the European Institute for Computer Antivirus Research for the purpose to test the functions of anti-virus programs. It is a text file which is 68 characters long and its file extension is “.COM” all virus scanners should recognize as virus.
Exploit
An exploit (vulnerability) is a computer program or script that takes advantage of a bug, glitch or vulnerability leading to privilege escalation or denial of service on a computer system. A form of an exploit for example are attacks from the Internet with the help of manipulated data packages. Programs can be infiltrated in order to obtain higher access.
Grayware
Grayware operates in a way similar to malware, but it is not spread to harm the users directly. It does not affect the system functionality as such. Mostly, information on the patterns of use is collected in order to either sell these data or to place advertisements systematically.
Hoaxes
The users have obtained virus alerts from the Internet for a few years and alerts against viruses in other networks that are supposed to spread via email. These alerts are spread per email with the request that they should be sent to the highest possible number of colleagues and to other users, in order to warn everyone against the "danger".
Honeypot
A honeypot is a service (program or server), which is installed in a network.
It has the function to monitor a network and to protocol attacks. This service is unknown to the legitime user - because of this reason he is never addressed. If an attacker examines a network for the weak points and uses the services which are offered by a Honeypot, it is protocolled and an alert sets off.
Keystroke logging
Keystroke logging is a diagnostic tool used in software development that captures the user's keystrokes. It can be useful to determine sources of error in computer systems and is sometimes used to measure employee productivity on certain clerical tasks. Like this, confidential and personal data, such as passwords or PINs, can be spied and sent to other computers via the Internet.
Macro viruses
Macro viruses are small programs that are written in the macro language of an application (e.g. WordBasic under WinWord 6.0) and that can normally only spread within documents of this application. Because of this, they are also called document viruses. In order to be active, they need that the corresponding applications are activated and that one of the infected macros has been executed. Unlike "normal" viruses, macro viruses do consequently not attack executable files but they do attack the documents of the corresponding host-application.
Polymorph viruses
Polymorph viruses are the real masters of disguise. They change their own programming codes - and are therefore very hard to detect.
Program viruses
A computer virus is a program that is capable to attach itself to other programs after being executed and cause an infection. Viruses multiply themselves unlike logic bombs and Trojans. In contrast to a worm, a virus always requires a program as host, where the virus deposits his virulent code. The program execution of the host itself is not changed as a rule.
Script viruses and worms
Such viruses are extremely easy to program and they can spread - if the required technology is on hand - within a few hours via email round the globe.
Script viruses and worms use a script language such as Javascript, VBScript etc. to infiltrate in other new scripts or to spread by activation of operating system functions. This frequently happens via email or through the exchange of files (documents).
A worm is a program that multiplies itself but that does not infect the host. Worms can consequently not form part of other program sequences. Worms are often the only possibility to infiltrate any kind of damaging programs on systems with restrictive security measures.
Spyware
Spyware are so called spy programs that intercept or take partial control of a computer's operation without the user's informed consent. Spyware is designed to expolit infected computers for commerical gain. Typical tactics furthering this goal include delivery of unsolicited pop-up advertisements. AntiVir is able to detect this kind of software with the category "ADSPY" or "adware-spyware".
Trojan horses (short Trojans)
Trojans are pretty common nowadays. We are talking about programs that pretend to have a particular function, but that show their real image after execution and carry out a different function that, in most cases, is destructive. Trojan horses cannot multiply themselves, which differenciates them from viruses and worms. Most of them have an interesting name (SEX.EXE or STARTME.EXE) with the intention to induce the user to start the Trojan. Immediately after execution they become active and can, for example, format the hard drive. A dropper is a special form of Trojan that 'drops' viruses, i.e. embeds viruses on the computer system.
Zombie
A Zombie-PC is a computer that is infected with malware programs and that enables hackers to abuse computers via remote control for criminal purposes. The affected PC, for example, can start Denial-of-Service- (DoS) attacks at command or send spam and phishing emails.
Latest descriptions |  |
| No. | Name | Type | Danger | Description | Detection added | |
| 1. | TR/PSW.Magania.azha | Trojan |  | 06 May 2009 | see here |  |
| 2. | W32/Tobin | Malware | | 04 May 2009 | see here | |
| 3. | GAME/Downloader.Gen | Malware | | 30 Apr 2009 | see here | |
| 4. | DR/Autoit.XH | Dropper | | 29 Apr 2009 | see here | |
| 5. | TR/PSW.Papras.JN | Trojan |  | 08 Apr 2009 | see here | |
| 6. | APPL/Dldr.IrcFast.Gen | Malware | | 07 Apr 2009 | see here | |
| 7. | TR/Dldr.Agent.sisq | Trojan | | 07 Apr 2009 | 17 Feb 2009 | |
| 8. | EXP/Office.G | Exploit | | 17 Mar 2009 | see here | |
| 9. | EXP/Office.I | Exploit | | 17 Mar 2009 | see here | |
| 10. | TR/Crypt.ZPACK.Gen | Trojan | | 17 Mar 2009 | see here | |
| 11. | HTML/PicFrame.Gen | Malware | | 17 Mar 2009 | see here | |
| 12. | Worm/Agent.W.45 | Worm |  | 02 Mar 2009 | 06 Feb 2009 | |
| 13. | Worm/Autorun.cbm.4 | Worm | | 25 Feb 2009 | 21 Aug 2008 | |
| 14. | TR/Rincux.AW | Trojan | | 18 Feb 2009 | 11 Jun 2008 | |
| 15. | Worm/Sohanad.bm | Worm | | 10 Feb 2009 | 25 Jan 2008 | |
| 16. | TR/Agent.85823 | Trojan | | 06 Feb 2009 | 25 Sep 2007 | |
| 17. | W32/Sality.Y | Malware |  | 28 Jan 2009 | see here | |
| 18. | TR/Dldr.Agent.bfbm | Trojan | | 27 Jan 2009 | 27 Jan 2009 | |
| 19. | TR/Patched.BB.230 | Trojan | | 27 Jan 2009 | 24 Jan 2009 | |
| 20. | TR/BHO.SecretCrush | Trojan | | 27 Jan 2009 | see here | |
| 21. | VBS/Yuyun.A | VBS script virus | | 26 Jan 2009 | 20 Jan 2009 | |
| 22. | TR/Agent.bicf | Trojan | | 21 Jan 2009 | 15 Jan 2009 | |
| 23. | Worm/Conficker | Worm | | 16 Jan 2009 | see here | |
| 24. | JS/Dldr.Agent.VG | Malware | | 15 Jan 2009 | see here | |
| 25. | EXP/MS04-028.JPEG.A | Exploit | | 13 Jan 2009 | see here |  |
| 26. | DR/Dldr.Agent.asyh.1 | Dropper | | 13 Jan 2009 | 23 Dec 2008 | |
| 27. | TR/PSW.Delf.CRW | Trojan | | 09 Jan 2009 | 30 Dec 2008 | |
| 28. | TR/Dldr.VB.FSW | Trojan | | 08 Jan 2009 | 11 Dec 2008 | |
| 29. | DR/Dldr.VB.VYP | Dropper | | 08 Jan 2009 | 11 Dec 2008 | |
| 30. | TR/Dldr.Renos.CH | Trojan | | 07 Jan 2009 | 07 Jan 2009 | |
| 31. | TR/Buzus.iij | Trojan | | 05 Jan 2009 | 09 Jun 2008 | |
| 32. | TR/Dldr.Banload.ins | Trojan | | 30 Dec 2008 | 31 Dec 2008 | |
| 33. | TR/Banker.Banker.acdq | Trojan | | 30 Dec 2008 | 25 Dec 2008 | |
| 34. | TR/Dldr.AutoRun.T.2 | Trojan | | 30 Dec 2008 | 23 Dec 2008 | |
| 35. | TR/Drop.Delf.azv | Trojan | | 30 Dec 2008 | 29 Dec 2008 | |
| 36. | VBS/Dldr.Agent.EL | VBS script virus | | 30 Dec 2008 | 23 Dec 2008 | |
| 37. | BDS/Bifrost.AQ | Backdoor Server | | 23 Dec 2008 | 22 Dec 2008 | |
| 38. | TR/BHO.abu | Trojan | | 23 Dec 2008 | 04 Sep 2008 | |
| 39. | TR/Drop.BHO.AY | Trojan | | 23 Dec 2008 | 04 Sep 2008 | |
| 40. | TR/PSW.Frethog.AJ.3 | Trojan | | 23 Dec 2008 | 23 Dec 2008 | |
