RegistryFix Tool

Every Microsoft Windows operating system has a registry. Your system registry holds a wealth of information about your computer. which is why we constantly hear from users that after using their PC for a short length of time, it no longer works the way it used to. This is due in part to invalid entries that exist in your system registry, that might exist because of software you are no longer using or software that was not properly removed. By removing these invalid sometimes infected entries, you can significantly increase the performance of your PC. 

Read More

Backdoor.Tidserv Removal Tool

Backdoor.Tidserv is a trojan virus that sneaks onto your PC through security exploits and allows remote unauthorized access to your computer by creating a backdoor port. Backdoor.Tidserv may also modify various Windows system tools in order to prevent you from removing the threat and running virus checks. The tool is designed to remove the infections of Backdoor.Tidserv 

How to download and run the removal tool: 

You must have administrative rights to run this tool on Windows XP, Windows Vista, or Windows 7.

1. Download the FixTDSS.exe file from: http://www.symantec.com/content/en/us/global/removal_tool/threat_writeups/FixTDSS.exe 
   
   
    

Save the file to a convenient location, such as your Windows desktop.

Close all running programs.

If you are running Windows XP, turn off System Restore.

Locate the file that you just downloaded.

Double-click the FixTDSS.exe file to start the removal tool.

Click Run to begin the process, and then allow the tool to run. 

Restart the computer when prompted by the tool by clicking on proceed.

After the computer has started, the tool will inform you of the state of infection.

If you are running Windows XP, re-enable System Restore.

Run LiveUpdate to make sure that you are using the most current virus definitions

When the tool has finished running, you will see a message indicating whether the threat has infected the computer.

You can kill the infection by clicking the "repair" option.

What the tool does
The Removal Tool does the following:

• Terminates the associated processes of infection.
• Deletes the associated files of infection.
• Removes hidden partition unconditionally if detection occurs.

Read More

ADW_THREAT.C

Adware is software that displays advertising banners on Web browsers such as Internet Explorer and Mozilla. While not categorized as malware, many users consider adware invasive. Adware programs will display pop-ups on a system which are annoying popup ads and, in some instances, the degradation in either network connection or system performance where they will take over the network on the system. They are bundled with certain free software online as well. They are also often installed in tandem with spyware programs and both programs feed off of each other's functionalities - spyware programs profile users' Internet behavior, while adware programs display targeted ads that correspond to the gathered user profiles.

Pop-Ups of different Ads

Read More

Preventing DNS poisoning

DNS poisoning could lead to crime ware by Identity theft, purchasing a fake anti-virus, getting unwanted malware without knowledge. These could lead to severe consequences like taking the punishment for someone else's crime.

Preventing DNS poisoning:
The First thing we can do to prevent DNS poisoning is to make sure that we have the latest version of DNS. DNS based on BIND 9.3.x or Microsoft Windows Server 2003 is far more secure than DNS implemented with earlier versions.
Recursive queries should be limited to internal DNS servers. If Internet facing recursive queries are required, only queries from internal addresses should be accepted. This will help prevent outside systems from sending queries with malicious intent.

Many cache poisoning attacks can be prevented on DNS servers by trusting the information to a lesser extent passed to them by other DNS servers, and ignoring any DNS records passed back which are not directly relevant to the query. We can use cryptography help to help secure our DNS servers from being poisoned.

Adding additional security to the LAN with the encrypting technology like DNSSEC where it uses cryptographic electronic signatures signed with a trusted public key certificate to determine the authenticity of data. DNSSEC can counter cache poisoning. Clearing the cookies when we go to any particular suspicious site having a good firewall, Updating the Internet Security Definitions regularly will help mitigate the poisoning.

• Use TSIG to digitally signed zone transfers and zone updates – one of the best ways to prevent poisoning is to force identification of the sending authoritative source

•  Restrict dynamic DNS updates when possible
• Hide the version of BIND being used on the DNS servers 
• Remove unnecessary services running on the DNS servers and use dedicated appliances instead of multi-purpose servers that allow unauthenticated Server queries
• Physically separate external and internal DNS servers
• Restrict Zone transfers.

Read More

Consequences of Cache Poisoning

There are several risks that will result in DNS poisoning. Since the DNS server's cache is poisoned it will have many things attached to it. Pharming is the primary risk associated with cache poisoning which means it means a site will be redirected to a different site that has full access of Attacker.Four reasons why crackers employ pharming are identity theft, distribution of malware, dissemination of false information, and man-in-the-middle attacks.

Read More

DNS is abbreviation of Domain Named System which helps in changing the IP addresses to names given to their respective domain names. This avoids the task of remembering numerous IP addresses that are there in the world. Its poisoning means the compromise occurs when data is introduced into a DNS name server's cache database that did not originate from authorized DNS sources. It may be a deliberate attempt of a maliciously crafted attack on a named server.When a DNS server has received such non-authentic data and caches it for performance optimization, it is considered poisoned, supplying the non-authentic data to the clients of the server.Domain Named Server translates a domain name in to an IP address that Internet hosts use to  contact Internet Resources of that particular domain.If a DNS server is poisoned, it may return an incorrect IP address, diverting traffic to another computer.

Read More

SCADA systems under attack by STUXNET

Stuxnet, a multi- component infection that has a worm, a worm assisting file and a rootkit that assists the worm in implementing the routines has infected SCADA systems in a typical way. The nature of Stuxnet itself reveals that it is not intended to affect home users or common domestic users. Worm_Stuxnet.A has looks for legitimate dll file S7OTBXDX.DLL which is used by Siemens WinCC systems in windows systems folder and renames it to S7OTBXSX.DLL then drops its copies in it and replaces the original file.

Read More