iPhone Scams Have Begun

The iPhone is out and the malware makers are already using it dupe people out of their money. Sunbelt reports that there is a new trojan that will offer pop ups to take you to a fake iphone.com webpage. Normally iPhone.com redirects to the a page on Apple.com for the iPhone, but on infected systems, a custom webpage replaces the legit one. A browser helper object is added to Internet Explorer to take you to the fake webpage:

BHO: H - {AA7F2000-EA05-489d-900C-3C7C0A5497A3} - C:\WINDOWS\system32\rwera21s1.dll

It's triggered when you go to Google.com or Yahoo.com. Some realistic looking pop ups appear and if clicked, you'll end up on the fake page. The fake page is hosted by Hostfresh, a dubious hosting company as reported by Sunbelt.

If you try to order an iPhone through these pop ups, all you'll get is an empty wallet. Check out the screenshots and other info posted at Sunbelt Blog.

VirusHeal

VirusHeal is the newest rogue program. Some say it's SpyHeal with a new name. Sunbelt reports it comes along with DVDacess, a fake codec that different web sites will trick you into installing. The whole thing is a scam. They trick you into installing the codec so you will get infected. Then they try to sell you the cure, this time called VirusHeal.

You should be able to remove this pest by using Smitfraudfix. Being new, you may have to manually uninstall Virusheal, but the zlob trojan that is making the pop ups and fake warnings should be removed.

Websites to avoid and to add to block lists:

Virusheal.com
inc-codec.com


Some of the files and registry entries that are added by VirusHeal:

%ProgramFiles%\VirusHeal 3.7\VirusHeal 3.7.exe
%ProgramFiles%\VirusHeal 3.7\msvcp71.dll
%ProgramFiles%\VirusHeal 3.7\msvcr71.dll
%ProgramFiles%\VirusHeal 3.7\antispy.vh
%UserProfile%\Start Menu\Programs\VirusHeal 3.7\VirusHeal 3.7.lnk
%UserProfile%\Start Menu\Programs\VirusHeal 3.7\VirusHeal 3.7 Website.lnk
%UserProfile%\Start Menu\Programs\VirusHeal 3.7\Uninstall VirusHeal 3.7.lnk



HKEY_CLASSES_ROOT\CLSID\{FA222968-C5BA-FA9F-6458-C63131328081}
HKEY_CLASSES_ROOT\Interface\{18F5E902-679B-4B12-BF13-BC16D02F7D80}
HKEY_CLASSES_ROOT\Interface\{1AEAAA6B-4EF6-488E-82F8-36E766F29220}
HKEY_CLASSES_ROOT\Interface\{39B58318-66E6-48D7-AB96-0208DA05FCEB}
HKEY_CLASSES_ROOT\Interface\{4E213C44-13CB-4E9F-8CBF-4C1A9EB9C2C9}
HKEY_CLASSES_ROOT\Interface\{518A840C-6647-4832-AB7D-CE4B314A1027}
HKEY_CLASSES_ROOT\Interface\{624F9366-D33B-492A-A3B7-217C14255A42}
HKEY_CLASSES_ROOT\Interface\{6AC53946-8646-42E6-B470-AD77648364C2}
HKEY_CLASSES_ROOT\Interface\{7867D50C-8459-4B0A-84B3-4F2D469A6C95}
HKEY_CLASSES_ROOT\Interface\{7BD05E7F-D2F0-42EA-B886-1A627968F9B0}
HKEY_CLASSES_ROOT\Interface\{899AE9A8-5BDD-4B68-A662-FCCDB4F9D91B}
HKEY_CLASSES_ROOT\Interface\{8B32593C-EBD5-4082-9059-708C19E153F3}
HKEY_CLASSES_ROOT\Interface\{A6FF06A4-5DC7-42D6-8960-141E676B1B8A}
HKEY_CLASSES_ROOT\Interface\{AF3E3CCE-C353-4D29-B30D-3F0E1A7C8E5B}
HKEY_CLASSES_ROOT\Interface\{C3FC451D-2851-4F5D-80D9-B15858E7B468}
HKEY_CLASSES_ROOT\Interface\{C4132813-FCCA-4F83-AF12-DC6D36F3FAB8}
HKEY_CLASSES_ROOT\Interface\{E3842CE8-9D0F-4809-A0D7-BF013946BB24}
HKEY_CLASSES_ROOT\TypeLib\{1963F207-DC66-4D6C-9A3C-B4DE1DEC24E4}

Youtube on Apple TV and iPhone

Apple announced two new ways to access Youtube from your Apple TV and iPhone.

Apple TV now has new menu choice for youtube.com if you update it software version 1.1. While you don't view the actual Youtube website, you can access many of the features and videos through the Apple TV. You can view the most popular videos, most watched, search and do most f the things you could do if you if you were on a computer. You can even log in to your account save favorites and rate videos. Not every video will initially be available. All of the videos on Youtube need to be converted to the H.264 encoded mp4 format to play on Apple TV. It will take several months to convert them all but there are still quite alot that can be viewed now. There's a good article at iLounge that describes this and has screen shots of the Apple TV using Youtube. You can also check it out at Apple.com.

The iPhone has been confirmed to include the ability to stream videos from Youtube as well. There will be 10,000 available when the iPhone launches next week, with more added over time.

Tiger Updated to Mac OS 10.4.10

Leopard is on the horizon but a new update for Tiger came out today to address a security issue, improve reliability and add new functionality. Yahoo!Sync has been added in what appears to be to allow syncing contact info with your Yahoo ID and to your iPhone. Raw file support has been added to allow processing of files from various cameras. Bluetooth and USB have updates to improve reliability with certain devices connected to a Mac. The security update addresses a potential problem with the new IPv6 protocol.

Details of the security content of this update can be found here. More details on what's new in 10.4.10 is here. Use software update to get 10.4.10. How to use software update info here.

Firefox - Kid Friendly Browser

There is an extension for Firefox that will allow you to monitor and approve which sites your children visit.  There is a list of default safe sites that come with the extension and you can add more as you go along.

The extension is called Glubble, you can download it here.  There are screenshots and more information available at CyberNet.

If you are a Vista user then don't forget you have the advantage of built in Parental Controls, please take the time to find out how to configure them to suit your needs.

Thanks to Corrine for being on the ball once again.

Q & A with the Security MVP Experts

You are invited to attend an Q&A with the Microsoft Security MVPs. In this chat the MVP experts will answer your questions regarding online safety issues such as phishing, spyware, rootkits as well as server related topics. If you have questions on how to protect your PC, please bring them to this informative chat.

When:   Thursday June 21st
Time:    4pm PST and 7pm EST
Where:  TechNet Chat Room
http://www.microsoft.com/technet/community/chats/chatroom.aspx

No password required but you will need a Windows Live ID

NB; I doubt very much if I will be there as unfortunately, 7pm EST is about 1 in the morning for me.... and it's a work night :(

System Live Protect and SpyHazard

Two new rogue programs are out there on the Net trying to get you, System Live Protect and SpyHazard. Both should be avoided like the garbage they are.

System Live Protect is trying to pass itself off as a Microsoft program and playing off the name of the real Windows Live Onecare. I just finished testing Live Onecare and the screen shots of System Live Protect look too similar. They are definitely trying to trick people. Anyways, I don't have any copies of this joke to test, but you can look at Bleeping Computer's System Live Protect removal help. Hijackthis logs will show this if you have this rogue:

O4 - HKLM\..\Run: [LiveProtect] "C:\Program Files\LiveProtect\LiveProtect.exe" -h

SpyHazard is another rogue. This one looks pretty generic compared to it's fellow fake antispyware programs like SpyCrush and SpyLocked. You'll find the following line if you run Hijackthis:

O4 - HKLM\..\Run: [SpyHazard] C:\Program Files\SpyHazard\SpyHazard.exe /h


In add or remove programs you'll find SpyHazard 3.1 which you should uninstall. It will leave behind some other junk, so follow another Bleeping Computer removal guide to get rid of the rest.

Zone Alarm For Vista

Check Point Software Technologies Ltd have announced the availability of ZoneAlarm Internet Security Suite 7.1 for the Microsoft Windows Vista operating system. ZoneAlarm Antivirus and the free ZoneAlarm firewall were also made available for Vista.

By utilizing Vista's new API and providing a deeper OS-layer firewall, ZoneAlarm can provide consumers with greater protection and stability on the Vista operating system, said Charles Kolodgy, research director at IDC. As hackers innovate, security vendors can not rely purely on old methods and old technologies - it's good to see ZoneAlarm lead the way.

With comprehensive multi-layer protection, including best-of-breed antivirus, anti-spyware, and the renowned ZoneAlarm firewall, ZoneAlarm Internet Security Suite 7.1 safeguards PC users against today's most complex online threats. Through its exclusive operating system firewall, ZoneAlarm Internet Security Suite employs the deepest levels of integration with the Vista operating system to proactively prevent threats that basic, traditional firewalls and signature-based systems miss.

See the ZoneAlarm press release for more information.

ZoneAlarm downloads, including the basic free version available here.

If you want to know what else is compatible with Vista, then Vista Bookmarks is the place to go.

FBI Take Down Botnet

As part of an ongoing CyberCrime initiative, the FBI have managed to disrupt and dismantle a botnet that had over one million IP addresses subscribed to it.

A botnet is a collection of compromised computers under the remote command and control of a criminal “botherder.” Most owners of the compromised computers are unknowing and unwitting victims. They have unintentionally allowed unauthorized access and use of their computers as a vehicle to facilitate other crimes, such as identity theft, denial of service attacks, phishing, click fraud, and the mass distribution of spam and spyware. Because of their widely distributed capabilities, botnets are a growing threat to national security, the national information infrastructure, and the economy.

The majority of victims will not even be aware that their computers have been compromised, their personal information stolen and thier computers controlled remotely and used for possible criminal activities.

The FBI are currently trying to contact the victim owners of these computers. However they stress that they will not try to contact anyone online or ask for personal information. So please be wary if you recieve any unsolicited emails.

See the full FBI press release here with contact details if you suspect you have recieved a fraudulent communication about this matter.

Spyware Doctor 3.0745 0

Spyware Doctor has been updated with new spyware definitions.

Latest Database Version: 3.0745 0
Intelli-Signatures: 195,630

Spyware Doctor protects your computer in 3 ways. First, it has the On guard monitor which watches places spyware will change your computer settings. By alerting you, Spyware Doctor gives you the option to not allow unwanted programs on your computer. Second, Spyware Doctor has a feature called Immunize that completely blocks known spyware from even installing. Third, spyware Doctor has a large detection database that removes spyware that has gotten onto your computer. I have used Spyware Doctor in tests against SpyAxe and SpyFalcon. It completely removed the those two. A restart of the computer and resetting my wallpaper was the hardest part.

A free scan is available from the Spyware Doctor Homepage:
http://www.pctools.com/spyware-doctor/

New Intelli-Signatures:
3.0745 0 - Trojan.Srchspy, Trojan.Downloader.Small.CZL, Trojan.PSW.Delf.QC

3.0744 0 - Trojan.Agent.SD, Email.Worm.Brontok.Q, Trojan.PSW.Delf.KT

Extended Intelli-Signatures:
3.0745 0 - CWS, Carpe Diem, DownloadWare, LockSky, ShowBehind, Trojan.PSW.QQPass.GE, Trojan.QQHook.A, Trojan.Downloader.Small.DTC, Trojan.Dropper.Small.AEK, Trojan.Proxy.Ranky, Trojan.Downloader.Small.CML, Worm.IM.Sohanad, Adware.Cinmus, Trojan.Tagasaurus, 2nd-thought.com

3.0744 0 - Borlander, Backdoor.Sdbot.AAD, Trojan.Downloader.Small.ATL, SpywareNo, Trojan.Agent.ABF, Trojan.PWS.Onlinegames.BS, Known Bad Sites, Trojan.PSW.QQPass.GE, Trojan.PWSteal.QQPass, Dialer.AY


General Information:
Updates are posted 5 times per week on average.
Updates are installed by running Spyware Doctors' Smart Update feature.

Safari 3 Beta For Mac and Windows

Apple has released a public beta of it's Safari web browser. Until now, it's only been available on mac computers, so this is an interesting development. Safari version 3 will be the the one that comes with the next release of Mac OS 10.5 Leopard. It is currently beta, so that means it is still being tested and worked on. It may stil have bugs or not work as expected.

The free public beta of Safari 3 is available immediately as a download at http://www.apple.com/safari, and is preview software licensed for use on a trial basis for a limited time. The final version of Safari 3 will be available as a feature in the upcoming Mac OS® X version 10.5 Leopard, and will be available as a free download to Mac OS X Tiger and Windows
users in October.


System requirements:
Safari 3 for Mac OS X requires Mac OS X Tiger 10.4.9 or later, a minimum of 256MB of memory and is designed to run on any Intel-based Mac or a Mac with a PowerPC G5, G4 or G3 processor and built-in FireWire®.
Safari 3 for Windows requires Windows XP or Windows Vista, a minimum of 256 MB of memory and a system with at least a 500 MHz Intel Pentium processor.

Yahoo Messenger Needs Security Update

If you use Yahoo Messenger, then you need to update it to prevent the hackers and crackers from getting you. F-Secure says that there are already easy to obtain ways to use the 2 vulnerabilities to let hackers, script kiddies or whatever you want to call them take control of your computer:

Very accurate and script-kiddie-friendly exploits are publicly available for both vulnerablities. It is possible that crimeware distributors will start exploiting this for drive-by downloads.

Go to Yahoo's security update page for this problem if you want to see details about it. You can also go straight to the Yahoo Messenger download page to get the latest version to fix this problem.