Oggi ho sperimentato la presenza di un fastidioso adware che mi apriva circa ogni dieci minuti una finestra di popup contenente pubblicità. Poiché la pubblicità era contestualizzata alla lingua con cui è configurato Firefox, questo adware aveva anche le caratteristiche di spyware.
La bestia si chiama NSIS Media Extension. Le finestre contenenti la pubblicità appear after a variable time since Firefox, but others also report that "attacks" on Thunderbird and Windows Explorer (and probably Internet Explorer ...) and have a title that also contains a howler in English: "ADVERTISEMENT - NSIS Media Extension ".
A type of adware pop up from this show, in particular, is quite dangerous for the majority of users are not experts. It appears a small window of Firefox (the size of a square a few pixels for a few pixels), covered with a Windows dialog box that warns us that a virus was found. The message then says, that clicking on the Ok you download a program to effectively clean your computer from this virus.
Typical
you attempt to download other malware.
The strange thing is that many antivirus and antispyware did not detect it at all, since Windows Defender, Symantec Antivirus and Avira. Besides, no popup blocker seems to be able to block the windows.
I have read in many posts that it is also hard to die, as also uninstall reappears after each reboot. To me it went well for now (touch wood). I just run the uninstaller that many reported to be a malware itself, which would have downloaded other malware. Of course I took at least a minimum precaution to monitor everything that is using the very useful Total Uninstall .
Apparently the uninstall program does exactly what it should. However there may be several versions of this adware and I have been lucky enough to peck a "benign". But as it enters the system? Given that I have enough armored car, including firewall, antivirus, antispyware, from non-admin users, etc ... comes in the simplest of ways: installed along with other applications unreliable. In my case it was (I only discovered after several searches) a variation on the theme of the most popular file sharing program that has as its icon a mule.
This story, which is hopefully over, but you never know ... it reminded me of the following lessons:
- Before you install a software you should always look at the accounts of users and if you are not sure test it in a secure environment. In this case I could imagine that being a famous scopiazzatura software, which is claimed to be faster than the original, there would be some surprises.
- not enough to have an antivirus and antispyware software to feel safe. These are measures to keep out the "big" of junk, but to avoid the latest and most dangerous threats are good habits, such as that of point 1 and to not use Administrator rights se non quando è necessario.
- Le tecniche di infezione evolvono continuamente. In questo caso, ad esempio, mi sentivo abbastanza sicuro che avrei trovato subito i processi responsabili dei popup usando ProcessExplorer di Sysinternals, ma la tecnica era un po’ meno banale del solito. Il programma maligno non appariva come processo a sé stante, ma come estensione di Firefox, programma del quale ancora siamo poco abituati a vederne le vulnerabilità. Andando a guardare nel file “browser.manifest”, una sorta di file di configurazione di Firefox, si trovava la chiamata per caricare la libreria Java NSIS.jar, che probabilmente conteneva tutto il malicious code.
Maybe my luck was that only Firefox has "infected" by failing that sort of effect monitoring loop "that makes a lot of spyware removal difficult.
Read more:
http://forum.sysinternals.com/forum_posts.asp?TID=7287&PN=1&TPN=1
http://www.wilderssecurity .com / showthread.php? t = 138307
http://forum.html.it/forum/showthread.php?s=&threadid=1007306&pagenumber=3
Programs to install because NOT install spyware, including NSIS Media Extension:
eMule + + ( http://www.download.com/eMule- / 3000-2166_4-10541345.html? tag = lst- 0-2)
Foxie ( http://www.getfoxie.com/feature/firewall/ )
0 comments:
Post a Comment