CoolWebSearch

This is a very nasty and insidious spyware/malware program. Spyware experts are now saying that the makers are borrowing code from other malicious programs to install rootkit like features on infected machines.

More recent versions of CWS spyware now have features similar to rootkits which allow the program writers to hide their files on Windows operating systems.

These new variants can hide their settings in the registry and also hide rootkit files in alternate data streams.

The software is usually installed on a machine by visits to malicious websites or emails using various ploys to get users to download and install the script.

Once installed, CoolWebSearch will hijack browsers and redirect users to some of the several bookmarks it imports. When you attempt to change your homepage back again it constantly overwrites it, it slows down general performance and causes Windows to freeze, crash or reboot, and can also make you victin to a Denial of Service (DOS) attack.

Getting rid of it is now much easier. TrendMicro have a free CoolWebSearch removal program

Use this utility to get rid of CoolWebSearch and it’s related programs.

Also download Spybot S&D and use its TeaTimer protection, which runs in the background and alerts you to any attempted registry changes.

If you are running Windows, also use Advanced Windows Care. Both of these programs will add a large number of changes to your Registry. This is nothing to be concerned about as the changes are necessary to stop any nasties from attching themselves to your pc and making changes you really don’t want.

Keep your anti-spyware up to date and if you click on any links that prompt you to download, read the EULA first.

Check for rootkits on your machine.

As with all programs, regular updates is essential to offer you greater protection.

AVG Anti-Rootkit Free

Grisoft has developed quite a following with its free (for personal, non-commercial use) security applications, and for good reason.

Now there’s an anti-rootkit utility in AVG’s free software stable, too, and for users seeking a minimum of interaction, AVG Anti-Rootkit Free may very well be the Right Tool for the Job.

Grisoft makes its free AVG Anti-Rootkit application available for download. Users download the avgarkt.exe setup file, which features simple installation.

You may download a free version of AVG Anti-Rootkit here.

In keeping with the goal to make AVG Anti-Rootkit a very simple tool, the file features a simple .exe install file that triggers a setup wizard.

Users can select between a normal interface (which Grisoft recommends and sets as the default) or a low graphics interface (which is optimized for visually impaired users who rely on screen-reading programs).

Users must accept the AVG Anti-Rootkit Free license agreement before they can use the program to check their Windows system for stealth rootkit programs.

Next, users must specify the location of the AVG Anti-Rootkit Free installation files.

As with most software programs, users must specify the name of the Start Menu Folder. This is the name the AVG Anti-Rootkit application receives on the user’s Start menu.

Once users have specified all setup information, the free anti-rootkit utility installs itself.

Due to the way most anti-rootkit applications operate, it’s necessary to reboot Windows to enable proper operation. AVG’s free anti-rootkit application is no different. AVG’s setup utility gives users the option of rebooting immediately automatically or manually rebooting later.

AVG purposefully keeps its anti-rootkit interface simple. There are very few options for users to choose, thereby helping simplify the already confusing and complex world of rootkits.

AVG includes concise educational information aimed at helping regular (non-IT professionals) better understand the threat stealth rootkit programs present.

The Learn More tab lists information on what rootkits are and how users can protect their PCs from the stealth threats. There’s also a link to Grisoft’s site where additional computer security information is made available.

Users can check for AVG Anti-Rootkit Free updates using the third tab (About & Update). Clicking the About & Update tab also reveals the current version users have installed.

An interesting note, Grisoft informs users on this third tab why the AVG Anti-Rootkit uses random window titles. The reason is that AVG’s programmers wanted intentionally to change the name of the window the free anti-rootkit application uses to help thwart detection efforts rootkit hackers might program into their malware.

If users click the Check For New Version button found on the third About & Update tab, they are directed to Grisoft’s Web site. Here users will see whether the version they are using is current or whether updates must be downloaded.

The Search For Rootkits tab is the meat of the program and the reason users will download it in the first place.

Clicking the Search For Rootkits button triggers a search of stealth rootkit programs. The free AVG application tracks its progress in the progress bar at the menu’s bottom.

By default, the Search For Rootkits button only searches critical Windows directories on the root drive.

When no rootkits are found, AVG presents a congratulations window.

When rootkits are found, AVG displays those that are found (with information on the rootkit path and type). Users can then highlight the rootkit items in question and click the Remove Selected Items button to eliminate the offending files from their Windows systems.

With the In-Depth Search, however, AVG Anti-Rootkit searches for stealth rootkit files on all the hard drives and partitions within a system.

Just as with the simple rootkit search, the AVG Anti-Rootkit Free application tracks its progress as it works. Should users wish, they can terminate the search using the provided Stop button.

These are all the options a user can select when working with AVG’s free anti-rootkit program. By purposefully keeping the application easy to use, AVG engineers have created a free malware detection utility that’s the Right Tool for regular (personal) users seeking to check their systems for unwanted stealth software.

Download your copy here

What is a rootkit?

What is a rootkit?

A rootkit is not an exploit — it’s the code or program an attacker leaves behind after a successful exploit. The rootkit then allows the hacker to hide his or her activity on a computer, and it permits access to the computer in the future. To accomplish its goal, a rootkit will modify the execution flow of the operating system or manipulate the data set that the operating system relies on.

Windows operating systems support programs or processes running in two different modes: user mode and kernel mode. Traditional Windows rootkits such as SubSeven and NetBus operate in user mode.

Also known as backdoors or Trojans, user-mode rootkits run as a separate application or within an existing application. They have the same level of system privileges as any other application running on the compromised machine. Since these rootkits operate in user mode, applications such as antivirus scanners can detect the rootkit’s existence if they have a signature file.

A kernel-mode rootkit is remarkably different — and much more powerful and elusive. Kernel-mode rootkits have total control over the operating system and can corrupt the entire system.

By design, kernel-mode rootkits control the operating system’s Application Program Interface (API). The rootkit sits between the operating system and the user programs, choosing what those programs can see and do.

In addition, it uses this position to hide itself from detection. If an application such as an antivirus scanner tries to list the contents of a directory containing the rootkit’s files, the rootkit will suppress the filename from the list. It can also hide or control any process on the rooted system.

Rootkit detection

Methods to detect rootkits fall into two categories: Signature-based and heuristic/behavior-based detection.

Signature-based detection: As its name implies, this method scans the file system for a sequence of bytes that comprise a “fingerprint” that’s unique to a particular rootkit. However, the rootkit’s tendency to hide files by interrupting the execution path of the detection software can limit the success of signature-based detection.

Heuristic/behavioral-based detection: This method works by identifying deviations in normal operating system patterns or behaviors. For example, this method could detect a rootkit by determining that a system with 200-GB hard drive that reports 160 GB of files has only 15 GB of free space available.

Rootkits are hard to detect. But there are programs – including a free one from Grisoft which I have covered in another post.

Safe P2P File Sharing

GigaTribe (also known as TribalWeb) is a revolutionary program that lets you share entire folders with friends in a private peer to peer (P2P) environment. Share all your files (home movies, pictures, documents…) no matter how large they are.

It’s secure, encrypted…and free!

You create your private network by inviting your friends.No one can join your network unless invited. You can dismiss or ban your guests at any time. Your guests can’t see each other on your network.

EasyInstall
GigaTribe, select the folders you want to share and invite your friends to join your private network! Share all your files (movies, pictures, documents…) no matter how large they are. Interrupted exchanges automatically resume with no data loss. All files are exchanged at maximum speed.

Secure
Only the folders you want to share are visible. Only the users of your network can see your shared folders. When exchanging a file, only the sender and the receiver are aware of the exchange. All data exchanged on your network is encrypted (Blowfishencryption with a 256-bit key).

Free
All these features are included in the standard version and are totally free. GigaTribe contains no adware and can be uninstalled easily.

Pick of reviews:
PC Plus June 2007 Monthly DVD - The PC Plus Essential Collection” Harnessing the power of peer to peer, GigaTribe provides a network to exchange large files with your friends.”

Computer Shopper May 2007 DVD Edition: Expert Toolkit - MaySpecials” Create a private network over the internet to share files with friends.”

Download it HERE

Virus Protection from AVG - Tutorial included

Protecting your computer from a virus is getting harder and harder each day. While it may border on the paranoid, it goes without saying that you can’t leave your guard down for one second. Even corporate giant Microsoft has found its own systems compromised on more than one occasion.

Because new viruses erupt daily, it is important that you regularly update your antivirus software. Become familiar with the software’s real-time scan feature.

Make it a habit to always scan all new programs or files no matter from where they originate.
Perform regular backups in case your system is corrupted. It may be the only way to recover your data if infected.

I suspect a lot of people get virus infections because they download random files off the internet. Kazaa/eMule and other peer-to-peer are great places to download infected items. It is important that if you use such programs that you have one dedicated folder to download too, and before opening or running anything scan it first with an anti-virus program. I recommend that people who want to exchange files over the internet (including entire folders of files) do so using encrypted solutions (and only with friends or people they know). A great new application is GigaTribe, it encrypts all exchanges, no files size limits, and is free from any spyware/adware.
Their website is http://www.gigatribe.com

AVG Anti-Virus Free Edition is a free downloadable antivirus program that has received high marks for its reliability. In the past, free downloadable antivirus programs have been viewed skeptically because of issues relating to its reliability.

However, AVG from Grisoft, remains one of the best-known free anti-virus programs available. While AVG cannot be installed on a server operating system and there is no technical support, it still makes a good choice for many home computer users.The best part is that it is free for both Windows and Linux and it checks for updates on a regular basis.

I have been using AVG free Anti-Virus for many years and install it as first choice on other peoples machines.

Get yours here:http://free.grisoft.com/doc/avg-anti-virus-free/lng/us/tpl/v5

Save the program to a folder which is easily accessible, I created one on my desktop and renamed it Downloads, this is where I download all of my utilities etc. so I have them in one easily accessible location.

Once installed AVG loads at startup and sits in your system tray.It will carry out a complete scan on a daily basis, but you can schedule it to do this at a time convenient to you. When it has completed its scan a small window will pop up with the results.

You also have the added benefit of real-time scanning as it runs in the backgound and will warn you if something you are downloading is infected.

You can also left click any folder or an item within a folder and scan it with AVG.

Important: Do NOT use more than one Anti-Virus programas it will give you false readings.

http://free.grisoft.com/doc/avg-anti-virus-free/lng/us/tpl/v5

Windows Media Player Tutorial - Click Here

CCleaner - clear your browsing history safely

I have covered this previously, but have added some new
information to this.

CCleaner is a freeware system optimization and privacy
tool. It removes unused files from your system - allowing
Windows to run faster and freeing up valuable hard disk
space by automatically cleaning the cache when run. It also
cleans traces of your online activities such as your
Internet history. It also only takes a few seconds to run
and remove these unwanted files from your pc.

There have been over 55 million downloads of this program

http://www.filehippo.com/download_ccleaner/

Internet Explorer
Temporary files, URL history, cookies, Autocomplete form
history, index.dat.

Firefox
Temporary files, URL history, cookies, download history.

Opera
Temporary files, URL history, cookies.

Windows
Recycle Bin, Recent Documents, Temporary files and Log
files.

Registry cleaner
Advanced features to remove unused and old entries,
including File Extensions, ActiveX Controls, ClassIDs,
ProgIDs, Uninstallers, Shared DLLs, Fonts, Help Files,
Application Paths, Icons, Invalid Shortcuts and more…
also comes with a comprehensive backup feature

Third-party applications
Removes temp files and recent file lists (MRUs) from many
apps including Media Player, eMule, Kazaa, Google Toolbar,
Netscape, MS Office, Nero, Adobe Acrobat, WinRAR, WinAce,
WinZip and many more…

This software does NOT contain any Spyware, Adware or
Viruses.

I set mine up as follows:
Click on the Cleaner Tab on the left and under Windows I
tick all boxes in Internet Explorer, Windows Explorer and
System. Under Advanced tick only the first 2 boxes. Then
click on the Applications tab and tick all.

Issues tab:
Unless you are competent at dealing with the registry then
leave this one alone and DO NOT run it.

If you wish to run the Issues to clean the Registry, carry
out the following first:

Backup your Registry. Go to Start, Run and type in regedit
click on OK and the Registry Editor will then open. Go to
the top Tabs and click on File, scroll down until you see
Export, left click it and this will open Export Registry File
window. Save this file to your desktop and in the File Name
box enter Registry Backup File.
Click on Save and it should now be on your desktop.
Verify the file is a good copy, in the Registry Editor
window click on File, select Import, in new panel where it
says ‘Look in’ select desktop and then click on your saved
file then click ‘Open’. Once it says it has been read in
successfully, you have a good backup.
Now if you find that some programs are no longer running
in the way that they should, restore your Registry as detailed
above. CCleaner will also create backup copies of your Registry
and I suggest that if you do choose to run the Registry Issues
untick all of the boxes and tick one box at a time and run each
one separately.

Tools tab:
Here you will find a list of Uninstall options to remove
programs from your pc, use with caution. I prefer to use
the Add/Remove function or the programs own uninstaller.

Startup:
Lists all programs that are set to run when you boot up,
if you are unsure about deleting any of these then leave it
as it is.

Options tab:
Settings - Choose your language, untick Run CCleaner when
the computer starts, tick the next 3 boxes, then look at
the Secure Deletion, tick the radio button ‘Secure file
deletion (Slower) and set it to NSA (7 passes)

Cookies - entirely up to the individual, but I don’t save
any cookies.

Custom - You can drag and drop files or folders into the
window or browse for them and on the next run they will be
securely deleted.

Advanced - Untick boxes 1-3 tick all others.

Finally click on the Cleaner tab on the left and you have
the option to Analyze or Run Cleaner. When you are
comfortable using this program you won’t use Analyze, but
initially do use it to see what can be deleted and the
approximate size of files to be deleted.

Important
This will remove any saved passwords and usernames that
you have, so make sure that you have a copy of them all
before proceeding to clean.

http://www.filehippo.com/download_ccleaner/

Windows Media Player tutorial:

http://www.a1-ebooks.co.uk/tutorials/CCleanerSetup.wmv

Open a text document, enter the URL, username and
password, save this to floppy, external drive or print it
off. Do NOT save this text file to your hard drive.

There is an excellent program for saving your passwords
etc available from http://www.roboform.com/
I will cover this in more detail another time.

As always, back-up your system or create a restore point
before making any changes.

To your safety and security online
cotojo

MRU-Blaster Guide

MRU-Blaster is a program that does one large task - detect and clean the MRU (most recently used) lists on your computer.

This program is Freeware, although donations are accepted

goto: http://www.javacoolsoftware.com/mrublaster.html

Download this program, I suggest that you place a NewFolder on your Desktop and rename it 'Downloads'. You can then download the various programs that I pass on to you in one central location, and always make back up copies.

The additional plug-ins are described below and allow you to clean out your Temporary Internet Files and Cookies. MRU-Blaster enhances the protection of your privacy!

MRU-Blaster setup: Take care setting this up.

When installed go to Settings and tick boxes1,3,4,6,7,8,9, & 10 on the left hand side.
Tick boxes 3,5,6, 7 & 8 on right hand side, then Save Setting.

Click on 'Go To Plugins' then click cookie blaster. Do not save any cookies as they are used to monitor your internet activity.

Click on 'IE Temporary Internet File Cleaner', tick EnableSecure Deletion of Files and click radio button 'Specify a custom number of passes and set to 7. Then save Settings & Run Now.
Using this program frequently only takes a few seconds and removes traces of the Most Recently Used (MRU) lists on your PC. These lists contain details of the name/locations of the files you have accessed. Traces of these are left scattered through your registry and unless removed are there for all to find.

One very important thing - do NOT save your passwords on your hard drive and do NOT tick the boxes asking to remember your login details.
Open any text document and type in the URL, Username and Password for each site that you have a password for, save this to either a floppy disc, flash drive, or other removable media, Do NOT save this text file on your hard drive।

I will cover another program for using secure passwords in the near future.

goto: http://www.javacoolsoftware.com/mrublaster.html

Safe surfing everyone
cotojo

How many spyware items are infecting your computer?

I just had, by mistake, a plug-in called Intelligent Explorer attach
to my browser. What a nightmare! I have another article on this
topic, but this brings home a point. Spyware or adware items are
continually infecting computers. Most computers have no protection
from them. Most frightening is the frequency of them. From the
InfosecWriters web site, "According to a 2004 survey by America
Online and the National Cyber Security Alliance, 91% of users
questioned were familiar with the term spyware. Only 53% believed
their computers were infected, but a scan found that 80% of their PCs
had some type of spyware installed on them." It goes on to say,
"...The average number of spyware components per computer was 93 with
one computer having well over a thousand."

What is Spyware?

Butte College (www.bctv.butte.edu/support/spyware.html) offers this
definition:

“The term ‘spyware’ is broadly defined as any program that gets into
your computer without permission and hides in the background while it
makes unwanted changes to your user experience.

Spyware is generally not designed to damage your computer. The
damage it does is more a by-product of its main mission, which is to
serve you targeted advertisements or make your browser display
certain sites or search results.

At present, most spyware targets only the Windows operating system
(Internet Explorer).”

To be fair, spyware can be harmless, for example tracking cookies
don’t do much. While such things infringe on your privacy, they don't
really harm anything. Others, however, are extremely dangerous.

So what do you do about it?

No spyware program seems to do everything, but there are a lot of
goods solutions out there that can help. Here is a list of some of
the top Spyware tools to look at:

1) Try Ad-Aware 6.0 Professional from LavaSoft (there is also a free
version with less functionality)

2) Spybot Search & Destroy from PepiMK Software

3) Xoftspy form Pareto Logic

4) Spyware Guard from Javacool Software is a free program

5) Pest Patrol (now part of Computer Associates by acquisition)

6) McAfee Anti-Spyware

One thing is for certain: you do need to take spyware seriously.
For some reason, too many people out there think anti-virus solutions
are the end-all solution. They are not.

And, when all else fails?

Finally, as drastic as it seems, if your computer has been infected
with a large number of spyware programs, the only solution you may
have is backing up your data, and performing a complete reinstall of
the operating system.