Spyware news

Security experts report about Zeus virus spreading on Facebook!

2-spyware.com Support — Fri, 07 Jun 2013 08:07:34 +0000

Facebook is one of the most popular social networks, so there is no doubt that it looks more than attractive for cyber criminals. We have already announced about several variants of Facebook virus that have been used by scammers for various illegal activities. However, it seems that there is a new threat, which has been illegally embedded into this social network. As security experts announce, it can easily connect to victim’s bank account and steal the money.

According to the finance.yahoo.com, Facebook is now under the great danger of the six-year-old virus, which is known as Zeus Trojan horse. This virus has already been known for 5 years, but it seems that it’s going to stop growing. While it is still not capable to affect Mac OS X or Linux, it finds less and less problems to infiltrate those machines that run Windows. It has already been involved into such online crimes as distribution of malware, identity theft and similar. However, the most popular thing, what this virus is used for, is stealing banking data and draining the account.

So, what should we know when trying to avoid Zeus Trojan, which is spread on Facebook? The main thing, which must be remembered, is that it is spread via misreading Facebook messages that are filled with infected phishing links. As soon as user falls for such scam message, its account starts automatically spreading similar messages or links to all contacts. Pay attention that from now you should be very careful what you click while these messages or links promise to show ‘interesting’ videos or products.

While Facebook is aware of this serious issue, it seems that its representatives are still not taking it as seriously as they should. If you have been tricked into clicking on malicious message/link, scan your PC with updated anti-spyware immediately after that!

Source: finance.yahoo.com

Why you should avoid Delta Search and other fake search engines

2-spyware.com Support — Mon, 03 Jun 2013 12:42:07 +0000

Most of today’s Internet users are still NOT aware that there are hundreds of search engines that can pose a serious harm for their computers. Typically, these online charlatans rank websites unlike reputable search engines, such as Google, Yahoo or Bing, and put shady websites in the top of their search results. By doing that, they can easily direct people to domains that sell useless goods, promote unwanted services or, most shockingly, spread malware.

It is also worth mentioning that these search engines use shady schemes for getting inside their target computers and affecting all Internet browsers that are installed there. For that, they mostly rely on browser hijackers that have the ability to infiltrate PCs via security vulnerabilities and modify computers’ settings according to their needs. Another popular method, which is also used for that, is based on the freeware and shareware. These programs tend to include fake search engines to their ‘Components’ list, so please, be very careful when downloading and installing them.

One of these shady search engines, which is spread using these unfair distribution methods and then set to show search results that are filled with junk, is Delta Search. We have decided to pay exceptional attention to this search engine because its creators have started to use quite tricky scheme for convincing PC users that it is legitimate and can be trusted. For creating a misleading image that Delta Search belongs to a reputable company, scammers have started to leave comments in different forums that discuss the trustworthiness of this search engine. Here, they not only call Delta Search legitimate, but also leave their own email, which should help people to uninstall Delta Search from their computers. Of course, it fails to do that.

We highly recommend staying away from all comments that are supposedly sent by representatives of Delta Search. No matter what they claim, this fake search site is designed only to direct unaware web surfers to potentially malicious pages. If you want to feel safe when searching on the Internet, you should use well-known search engines.

New Apple certified Mac malware takes screenshots and uploads them to its servers

2-spyware.com Support — Mon, 27 May 2013 10:24:27 +0000

It seems that days when users thought that Apple Mac computers can’t be vulnerable to malware are gone. Of course, these machines are not in such danger as Windows-based computers that have been suffering from the growing number of potentially malicious programs for years. However, that should definitely be protected with decent anti-malware from now in order to prevent the attacks of cyber criminals.

According to the reputable anti-virus company, F-Secure, this malware, which should the owners of Mac computers be aware about, is called OSX/KitM.A. When it comes to infiltration, it is designed to use phishing emails that are filled with the backdoor application called as ‘macs.app’. As soon as it gets inside the system, it modifies the system a little bit and starts taking the screenshots of the affected computer. In addition, it automatically sends this data to the home directory’s MacApp folder. As F-secure’s report notifies, there are two command and control servers that are in a close relationship with this malware and are located at docsforum.info and securitytable.org. However, it seems that they are not working properly at the moment.

One of the most surprising discoveries is that this Mac malware is signed with Apple Developer ID! That, according to the F-Secure’s researchers, helps it to overcome Apple’s Gatekeeper security software.

If you are one of these unlucky Mac users, who have been affected by OSX/KitM.A malware, you should look for it in either the Applications folder, Downloads folder or in the drive’s root directory. If you haven’t been infected, you should pay attention to this example and have no doubt whether you should install reputable security software or not.

Source: macworld.co.uk

Scammers use fake telephone support for extorting money

2-spyware.com Support — Sun, 19 May 2013 12:10:33 +0000

Day by day, scammers use smarter methods for swindling the money from PC users. After relying on alerts that report about invented threats and then offer to purchase useless program, now they are starting a new era of tricking their victims. It is based on a misleading telephone support, which promises to fix the PC remotely. Of course, it is done NOT for free and it is useless.

You must have encountered or heard about those fake pop up ads that interrupt user’s browsing session and offer installing a free scanner in order to check the system for potential security risks. After getting on board, malware starts reporting about nonexistent viruses and offers to purchase its licensed version in order to remove each of these infections. As soon as you pay the money, it stops showing these false scan results and makes you believe that it has magically fixed your computer.

However, it seems that today you should also be aware about the fake telephone support. During this trickery, scammers call for their victims and claiming that they have spotted suspicious network activity. In addition they ask whether user wants to do a free check for viruses, ‘using the diagnostic software built into Windows’. These guys also like to highlight such arguments that the service is free, you may infect other people and similar. However, after testing the PC and detecting threat, they require paying the certain fee, which varies from $100 to $300.

Please, don’t fall for this scam, which is based on the scare tactics!

Fake Amazon emails spread malware

2-spyware.com Support — Sat, 18 May 2013 13:04:19 +0000

2spyware security center announces about the widespread attack, which works under the name of Amazon. It seems that it is set to attack United Kingdom in the first place because this virus spreads via emails presented as the message from its UK branch. If you happen to receive an email, which has the attachment about an order for an unnamed item, you should firstly think twice and make sure that you have ordered something from Amazon recently. If you have been tricked to download the malicious attachment on your computer, please run a full system scan with updated anti-spyware.

If you receive a message from Amazon, you should firstly pay attention to its subject line. If it says ‘Your Order with Amazon.co.uk’, this email might be malicious. Note that it contains links that, for seeking to trick more PC users, lead to legitimate website of Amazon UK. However, you should definitely stay away from the file, which is attached to this scam email. It is called ‘Your Order Details with Amazon.zip.

Every user, who falls for opening or downloading this malicious attachment, gets infected with the trojan horse, which has been reported as Mal/BredoZp-B. In addition, it can be used to install/uninstall the files, record the keystrokes and connect to its remote server.

Of course, the online retail giant Amazon has nothing to do with this trickery. Please, run a full system scan with updated anti-spyware without any delay if you have been tricked into opening this fake email attachment.

Source: nakedsecurity.sophos.com

How to start Safe Mode on Windows 8

2-spyware.com Support — Sat, 11 May 2013 13:34:50 +0000

Windows 8 has been available for more than half a year, so its normal that scammers have modified their viruses to get ability to attack this operating system easily. According to our security experts, such ransomwares as FBI virus, FBI PayPal virus or White Screen virus are now capable to invade Windows 8 without any sign. In addition, we won’t have to wait for ages until rogue anti-spywares and other threats will start infecting machines running this operating system as well. Since it’s still a relatively new system, we have decided to write a tutorial on how you can boot your PC into Safe Mode on Windows 8. This mode is essential when you are blocked by virus and you need to launch anti-spyware or terminate malicious process.

First of all, restart your computer. For that, follow these steps:

Go to Windows 8 Start Screen (or virus screen) and press ctrl+alt+del together. Now you will be brought to the blue screen.
When you are on it, hold Shift button and click ‘Restart‘ at the same time (ir appears in the bottom right of the screen).

As soon as PC restarts, follow these steps:

Go into ‘Advanced Startup options’ menu and click ‘Troubleshoot‘ button → ‘Advanced options‘ button → ‘Startup settings‘. Here, click ‘Restart’ button.
After your PC restarts, you will be brought to ‘Startup Settings‘ menu.

Here, users can choose to enable Safe Mode, Safe Mode with Networking or Safe Mode with Command Prompt. For selecting Safe Mode press F4, Safe Mode with Networking – F5, Safe Mode with Command Prompt – F6. After that, Windows will boot into the version that you need.

Avoid wasvideo.com because it may hack your Facebook account!

2-spyware.com Support — Sat, 30 Mar 2013 12:05:59 +0000

Have you heard about Scambook? This is a site, which has been created to protect Facebook users and their accounts. Here you can find all the latest information about most of the Facebook scams and also announce one if you notice anything suspicious on this social network.

The latest trickery, which was reported on the Scambook some days ago, includes the phishing site wasvideo.com. You must stay away from this website because it has been noticed for stealing Facebook login data and other sensitive information.

Of course, scammers apply misleading methods for making people visit this site against their will – they actively use Facebook message board and spread misleading texts including a link that additionally redirects people to this dangerous site.

The bogus message says:

Are you in thiss videeo on FB Natalie:P Skip to 1:43 omggg lol. Tyype in wiithout spacces and search your name ——-> www .wasvideo. com

If you click on a link, you will be redirected to another site called fizikubook.com. This domain is designed just like a front Facebook’s page, so there is great danger that many unaware PC users will be tricked to enter their account login information onto this page. Please, always pay attention to the address of the website before entering your loggin details. If you think that you may have become a victim, you have to change your Facebook password without any delay. Besides, warn your friends about it.

Source: scambook.com

A couple of new facts about FBI virus and its prevention

2-spyware.com Support — Thu, 14 Mar 2013 14:06:41 +0000

No matter that FBI virus can no longer be called a new or freshly-released virus, security researchers still fight against it. In order to make sure that you are not among those Internet users on the planet who haven’t heard about this dangerous ransomware, we’ll keep writing the posts explaining how to remove this infection and, most importantly, how to prevent it. The newest fact that should be known by all PC owners is that you don’t need to enter illegal site or download freeware in order to get infected with FBI virus. Now it can attack your PC while watching youtube’s videos or clicking on commercial pop-up ads that are usually displayed according to user’s interests. So, appropriate computer’s protection is the most important factor when trying to prevent FBI virus appearance on it. Make sure that you have both, anti-virus and anti-spyware, programs installed on your computer. Besides, don’t overdo with a number of such programs because they may start conflicting one with other.

As soon as FBI virus gets inside the PC, it convincingly tells for the victim that he/she needs to pay a fine, which ranges from $100 to $400. It covers computer’s desktop with a message, which shows PC’s IP address, location, FBI’s logo and the steps that should be followed when paying a fine. Virus also explains that this fine is for illegal user’s activities, such as the use of copyrighted content, distribution of pornographic material and similar activities. However, the most threatening thing about this infection is that it blocks computer and disables all its functions.

It’s still unknown what makes FBI virus so successful because there are thousands of people all around the world who have already paid this fine. Maybe that’s because they have been too scared to contact FBI and ask about the large notification on their desktops. Or they have paid the fine expecting that this will unlock their machines.. Beware that this has never been helping when trying to remove the lock from the system. This can only be done manually. If you are infected with this dangerous ransomware virus, we recommend following a detailed FBI virus removal guide, which includes a step-by-step guide and removal video.

Isis Prison’s computer system hacked by the hacker who is jailed in it

2-spyware.com Support — Wed, 06 Mar 2013 11:55:35 +0000

You may have heard about the biggest criminal website called GhostMarket.Net. Owned by a teenager Nicholas Webber, it had 8,500 members that were using this site to share credit card details and other sensitive information stolen from unaware PC users. As it is known by now, this hacker had stolen £8 million from 65,000 bank accounts until he was arrested back in October, 2009. In the middle of 2011, Webber was sentenced to five years imprisonment and sent to the British institution that holds offenders aged under 25. It’s called HM Prison Isis. However, even after being trapped into the prison, hacker still found a way how to continue his career. He simply signed-up for the prison’s IT class.

According to DailyMail, in 2011 Nicholas Webber was somehow approved to take the classes that train prisoners about information technology. Of course, he didn’t sit still there and tried to hack into the main computer of the prison. Now it seems that this try was successfully accomplished, especially if we would try remember that in 2012 HM Prison Isis announced about technological problems, such as fingerprint-based system’s break and similar.

All this story of 2011 has been revealed only some weeks ago because of the prison’s IT teacher Michael Fox. We hope that it won’t repeat again.. Especially when notorious hackers are let to join the course.

Source: nakedsecurity.sophos.com

Scammers use Facebook to spread fake Rihanna sex video

2-spyware.com Support — Thu, 28 Feb 2013 09:23:46 +0000

There are thousands of scams spreading on Facebook right now and there are millions of people who fall for them each day. They all promise to reveal shocking news, private details or similar facts, and typically include a misleading link which redirects people to misleading websites earning the money from users’ traffic. Be aware about the latest scam, which pretends to be a Rihanna’s sex video but seeks the same aim. If people who are in your contacts will post a message about losing all respect for this singer after watching some video, you should simply ignore it.
As it is reported, the fake message looks like that:

[VIDEO] RIHANNA SEX TAPE
I lost all respect for her after watching this >> [LINK]

After clicking on the link, soon you’ll find out that you are redirected to the Italian page, search engine, which is called y.ahoo.it. This page offers for its visitors to shorten URLs, but doesn’t show the private video of Rihanna. Clearly, its owners have designed such scam to increase the traffic to their domain.

Of course, we are all interested in the private life of such super stars as Rihanna. However, clicking on misleading links that are spread on Facebook lead people to different places than it can be expected. According to the latest news, Facebook has merked these links as malicious ones but if you have already believed this misleading message and clicked on a link, run a full system scan with updated anti-spyware and remove the fake message from his wall in order to stop its distribution.

Source: nakedsecurity.sophos.com