ISC reader Robert detected one of his systems trying to connect to port 25 on various servers around the world. As this immediately screams: spam bot, Robert decided to analyze the box further. He captured some packets and found an interesting binary that he submitted to ISC for analysis. After analyzing this binary, they discovered
-
-
A popular way for push exploit to your PC
Hidden IFrame elements continue to be a popular way for targeting website visitors. After breaking into a server, the attacker modifies its HTML code, using a hidden IFrame tag to retrieve exploit code from another system. Maintainers of the compromised website typically don’t know that they are infecting their visitors for quite some time. ISC
-
I just go to Amazon and Citibank, so why am I seeing pop-ups for Adult Friend Finder?
A typical lament: “I just go to Amazon and Citibank, so why am I seeing pop-ups for Adult Friend Finder?” Parents, we have an answer – your teenager. One of the benefits of testing so much of the Web is that we’ve developed a good sense of where the bad guys concentrate. And smiley sites
-
More sites for your block list
Add next sites to your block list: IP: 70.86.246.35 17webplace(dot)com aurealm(dot)com authorsontour(dot)com beepwear(dot)com carterobregonlaw(dot)com cma2004(dot)com coloreal(dot)com ideagenerationmethods(dot)com indiahcsl(dot)org interacttheatre(dot)com poliblog(dot)com praxispost(dot)com salestaxsimplification(dot)org samchampion(dot)com sapsapphire-emea(dot)com scienceserver(dot)com sputnikbook(dot)com thresholdofvisibility(dot)com uscmchicago2005(dot)com All of these sites will attempt (after evaluating your computer’s OS and service pack level) to run currently patched exploits on your system to install Spyware Quake.
-
New home for Coolwebsearch / Trafficadvance
Coolwebsearch/Trafficadvance malware department have moved to a new hoster. They all seem reside under 85.249.23.x now, again in St.Petersburg, Russia. If you prefer to block their domains, here’s a list. All of the indicated domain names end in .biz. traffsale1 traffweb toolbarweb toolbarsale iframecash traffcool toolbarcool traffbucks toolbarbucks traffdollars toolbardollars traffbest toolbarbest traffnew toolbarnew traffmoney
-
SpywareQuake Automatic removal
Good news for us 🙂 Now you can remove Spyware Quake from your system using CounterSpy. If you have problems with SpywareQuake you can use manual removal instructions: How to remove SpywareQuake or try free trial version CounterSpy.
-
Top 10 spyware threats discovered for last 24 hours
Here are the top 10 spyware threats by Sunbelt Software: 01. DesktopScam 02. Hotbar – How to remove Hotbar 03. WhenU.SaveNow 04. Looking-For.Home Search Assistant 05. CmdService 06. BraveSentry – How to remove BraveSentry 07. 180search Assistant 08. iSearch.DesktopSearch 09. Vcodec – How to remove Vcodec 10. SpyFalcon – How to remove SpyFalcon If you
-
Running as Limited User – The Easy Way to keep a system free from malware
Malware has grown to epidemic proportions in the last few years. Despite applying layered security principles, including running antivirus, antispyware, and a firewall, even a careful user can fall victim to malware. Malware-infected downloads, drive-by exploits of Internet Explorer (IE) vulnerabilities, and a careless click on an Outlook attachment sent by a friend can render
-
Announcing the Launch of SiteAdvisor’s Public Trial Version
Today SiteAdvisor officially launched a Trial Version of their software . SiteAdvisor is a browser addon for Firefox or Internet Explorer that tries to interpret the relative safety of clicking on Web search results. With SiteAdvisor installed, each listing is accompanied by a small color coded icon that indicates whether the software developers have received
-
How to remove AdwarePunisher – rogue anti spyware
AdwarePunisher – rogue antispyware (1, 2) uses flawed, inadequate detection scheme; same app as AdwareBazooka, AdwarePunisher, HitSpy, RemedyAntiSpy, SystemStable, & The SpyGuard. You may want to print out or make a copy of these instructions before starting, because you will not be able to connect to the internet during most of this fix. Go to
 |
 |
 |
