Friday, August 25, 2006

How To Clean Maytag Performa Softener Dispenser

www.google.com e Spaghetti threat

C'è un malware che gira da alcuni mesi che sta dando molto filo da torcere alle poche case di AntiVirus che si sono decise ad affrontarlo, ma che nelle ultime ore pare stia diffondendosi in maniera allarmante. Infatti stanno comparendo molte analisi fatte da vari esperti di virus non tanto per la pericolosità, della quale ancora non sono riuscito a capirne molto, quanto alle interessanti tecniche di cui fa uso.

Symantec ed altri lo hanno soprannominato Spaghetti Threat sia perché i suoi meccanismi d'infezione sono cosí intricati da ricordare una matassa di spaghetti, sia perché la sua diffusione massiccia pare stia partendo proprio da siti italiani.

Oltretutto, I would add, one of the best available technical analysis was done by Marco Giuliani and is bouncing around the world and can be downloaded from its website .

I have not yet figured out what the true extent of the problem, but it is certainly interesting. Especially the analysis of Marco Giuliani is very instructive.

Ah, I forgot ... Google has to do that? The downloader "dropped" the computer that triggers the tangle of infection is called www.google.com. It seems the URL world's most famous and instead is a clever executable file (remember that. Com is one of the extensions that run on DOS and Windows, such as. Exe?)

Sunday, August 6, 2006

Solid Concrete Blocks

E tu che lingua parli?

Researchers O'Reilly Research, the research division of leading publisher of computer books, recently published the results of a survey based on sales figures of technical books on programming, through which you can have a ' idea of \u200b\u200btrends in the programming world.

present, however, the rankings of programming languages \u200b\u200bused would be:
  1. Java
  2. C #
  3. C / C + +
  4. VisualBasic
  5. Javascript
  6. PHP
  7. Ruby
  8. Perl
  9. Python
However, looking at the graph of surveys since 2003, not can not see how Java has already begun its slow and inexorable decline, despite the titanic efforts of the Sun In fact the gap between Java and C # is not very large, considering the maturity of the young age of the first and second, there to imagine a pass soon. On the other hand married the titanic IBM, whose presindente said in the seventies who think that there would be a PC on every desk was pure madness, certainly not good luck.

The other striking thing is against the passing of Ruby Perl, another cornerstone of programmaizione Web and more. Above all, it would seem that the appearance of the Rails framework (and the consequent birth of Ruby on Rails) is the driving force capable of rivoluzionare il mondo dello sviluppo Web all'infuori del mondo Java e .NET. Riuscirà anche a scalzare PHP?

L'ultima nota è riservata al quinto posto di Javascript. Sebbene non si possa considerare un vero e proprio linguaggio di programmazione, la sua rinascita nelle vendite testimonia in realtà l'avvento e il grande successo di AJAX.

Letter To Confirm Volunteer

Fastidioso Adware per Firefox

Oggi ho sperimentato la presenza di un fastidioso adware che mi apriva circa ogni dieci minuti una finestra di popup contenente pubblicità. Poiché la pubblicità era contestualizzata alla lingua con cui è configurato Firefox, questo adware aveva anche le caratteristiche di spyware.
La bestia si chiama NSIS Media Extension. Le finestre contenenti la pubblicità appear after a variable time since Firefox, but others also report that "attacks" on Thunderbird and Windows Explorer (and probably Internet Explorer ...) and have a title that also contains a howler in English: "ADVERTISEMENT - NSIS Media Extension ".

A type of adware pop up from this show, in particular, is quite dangerous for the majority of users are not experts. It appears a small window of Firefox (the size of a square a few pixels for a few pixels), covered with a Windows dialog box that warns us that a virus was found. The message then says, that clicking on the Ok you download a program to effectively clean your computer from this virus.
Typical
you attempt to download other malware.

The strange thing is that many antivirus and antispyware did not detect it at all, since Windows Defender, Symantec Antivirus and Avira. Besides, no popup blocker seems to be able to block the windows.

I have read in many posts that it is also hard to die, as also uninstall reappears after each reboot. To me it went well for now (touch wood). I just run the uninstaller that many reported to be a malware itself, which would have downloaded other malware. Of course I took at least a minimum precaution to monitor everything that is using the very useful Total Uninstall .

Apparently the uninstall program does exactly what it should. However there may be several versions of this adware and I have been lucky enough to peck a "benign". But as it enters the system? Given that I have enough armored car, including firewall, antivirus, antispyware, from non-admin users, etc ... comes in the simplest of ways: installed along with other applications unreliable. In my case it was (I only discovered after several searches) a variation on the theme of the most popular file sharing program that has as its icon a mule.

This story, which is hopefully over, but you never know ... it reminded me of the following lessons:
  1. Before you install a software you should always look at the accounts of users and if you are not sure test it in a secure environment. In this case I could imagine that being a famous scopiazzatura software, which is claimed to be faster than the original, there would be some surprises.
  2. not enough to have an antivirus and antispyware software to feel safe. These are measures to keep out the "big" of junk, but to avoid the latest and most dangerous threats are good habits, such as that of point 1 and to not use Administrator rights se non quando è necessario.
  3. Le tecniche di infezione evolvono continuamente. In questo caso, ad esempio, mi sentivo abbastanza sicuro che avrei trovato subito i processi responsabili dei popup usando ProcessExplorer di Sysinternals, ma la tecnica era un po’ meno banale del solito. Il programma maligno non appariva come processo a sé stante, ma come estensione di Firefox, programma del quale ancora siamo poco abituati a vederne le vulnerabilità. Andando a guardare nel file “browser.manifest”, una sorta di file di configurazione di Firefox, si trovava la chiamata per caricare la libreria Java NSIS.jar, che probabilmente conteneva tutto il malicious code.

Maybe my luck was that only Firefox has "infected" by failing that sort of effect monitoring loop "that makes a lot of spyware removal difficult.

Read more:
http://forum.sysinternals.com/forum_posts.asp?TID=7287&PN=1&TPN=1
http://www.wilderssecurity .com / showthread.php? t = 138307
http://forum.html.it/forum/showthread.php?s=&threadid=1007306&pagenumber=3

Programs to install because NOT install spyware, including NSIS Media Extension:

eMule + + ( http://www.download.com/eMule- / 3000-2166_4-10541345.html? tag = lst- 0-2)
Foxie ( http://www.getfoxie.com/feature/firewall/ )