Crimeware

Crimewares are applications that are developed to steal the personal information or to commit a crime. Usually crimeware are used to steal money from the accounts of the companies or the traders that makes the thief richer. Crimeware uses several methods. The attacker can use a keylogger trojan fro stealing the kestrokes from the user. The user may be an employ of a bank or other finantial institution. The attacker can use this stealed information for his job. Another method is by redirecting the user to a fake website even if the user has entered the url correctly. the crimeware allows the attacker to wait till the user login in to his account and the he can steal the information without identified by the user. The crimeware can steal password from the cache of the browser. The crimeware uses the vulnerabilities in the applications that uses internet connection. The attack may also in the form of an e-mail which provides fake sender details.

Want to know about Rootkits ?

You may noticed that while you perform scan for the virus with an anti virus software, it may sometimes display Rootkits found. Want to know about the Rootkits? Here is a small description about the Rootkits. Rootkit is a software which is a program or a combination of more programs that are designed to hide the fact that a system has been compromised. The rootkits are to be installed by the attacker in the target machine phisically by himself or by exploiting the system vulnerabilities. Once the rootkit is installed in the target system, the attacker can modify the system files and hide the running process of the attacker installed files. The rootkits often forms a back door in the system allowing the attacker to steal the data from the system without knowing the user.
Actually Rootkits are evolved as a software to handle the system when the system falls in to a non-responsive state. Later the hackers have turned this to a malware. The applications which creates the virtual devices like Demon Tools uses the Rootkits to hide certain system activity and to supress certain process of the system. The Kaspersky antivirus uses the rootkits to hide and protect their files from the attack of the malwares.
Most antiviruses are not capable of finding the rootkits. Even some of the antiviruses found certain types of rootkits, they cannot find all types of the Rookits. Fortunatley softwares for finding the Rootkits (like Rootkit Revealer) are available in the market for finding and deleting the Rootkits. Most of the Rootkits are installed in the target machine by the user in the form of patch or key generator. Lots of Rootkits are available in the internet for downloading. If you want one visit: http://vx.netlux.org/.

A zombie computer

Many people knew that a hacker can use a computer connected to internet for his illegal purposes. Such computers which are connected to the internet that obeys a hacker via a virus or trojan is called a zombie computer. The computer became a zombie when a virus or trojan gets installed the computer. There may be several such computers working simultaneously for a particular hacker. This makes it difficult to trace the hacker. Since the owner of the computer is unaware of this, the computer is known as zombies.
Zombies are generally used for sending spam emails and for the spreading of the trojans or computer viruses. This help the spammers not only to save their bandwidth cost but also to remain undetected. Certain hackers use zombies to commit click fraud against the sites displaying the pay per click advertisement. The hackers use the zombies for the Denial of Service (DoS) attack. Here the hacker sends unnecessary packets to the targeted website so that the legal users cannot access the website. The intense flooding can be easily found out and prevented, but the pulsating flooding remain unidentified for several months or years. The DoS attack is even done against the top sites like yahoo,ebay etc.
Network Intrusion-prevention systems (NIPS) are usually useful for preventing, detecting and blocking zombie computers.Computer users frequently perform backups and delete suspicious mail messages as preventive measures against infection.

Keylogger Trojan

Keylogger Trojan is a malicious program that steals your user name and password and logging them to a file and send to the attackers. Some keyloggers are available in the market for buying. They are generally used by the parents to track the online activities of their children and also by the people who want to track the contacts and online activities of their life partner. Some keyloggers are capable of monitering your web browser. If a desired responce is found it tracks the required information and sent to the remote attacker. The desired responce may be the opening of a site of the bank in which you may have a account. Some sites requires pointing by mouse rather than the keystrokes. This reduces some of the attack. But some trojans send the screenshot of the victims application to the remote attacker.
The keyloggers are installed in the victim's machine by making him belive that they are useful software. The most of the infection are through the P to P network.
To avoid the infection connect only to trusted network. Download softwares only from trusted sources. Use an updated Antivirus software and install a firewall.

Trojan. Dropper

Trojan. Droppers are trojans that instals in a system without the informing the user about their presence. Usually virus writers and hackers create trojan droppers to install other applications or placing the backdoor applications. It was discovered in february 2000. It is also known as virus.dropper. It affects Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows XP. However the threat level is low and can be easily removed.

However prevention will reduce the risk of infection. Some of the preventive measures are given below:

• Use a firewall to block all the applications that are trying to connect the internet without your permission. This will reduce the risk even after the infection.



• If Bluetooth is not required for mobile devices, it should be turned off. If you require its use, ensure that the device's visibility is set to "Hidden" so that it cannot be scanned by other Bluetooth devices. If device pairing must be used, ensure that all devices are set to "Unauthorized", requiring authorization for each connection request. Do not accept applications that are unsigned or sent from unknown sources.



• Isolate the infected computers quickly to prevent the trojan from spreading further. Perform a forensic analysis and restore the computers using trusted anti-trojan software.



• Enforce a password policy. Complex passwords make it difficult to crack password files on infected computers. This helps to prevent or limit damage when a computer is infected.



• Ensure that programs and users of the computer use the lowest level of privileges necessary to complete a task. When prompted for a root or UAC password, ensure that the program asking for administration-level access is a legitimate application.



• Disable AutoPlay to prevent the automatic launching of executable files on network and removable drives, and disconnect the drives when not required. If write access is not required, enable read-only mode if the option is available. I have put a post on disabling the autoplay in XP and vista earlier.



• Turn off file sharing if not needed. If file sharing is required, use ACLs and password protection to limit access. Disable anonymous access to shared folders. Grant access only to user accounts with strong passwords to folders that must be shared.



• Turn off and remove unnecessary services. By default, many operating systems install auxiliary services that are not critical. These services are avenues of attack. If they are removed, threats have less avenues of attack.



• If a threat exploits one or more network services, disable, or block access to, those services until a patch is applied. Always keep your patch levels up-to-date, especially on computers that host public services and are accessible through the firewall, such as HTTP, FTP, mail, and DNS services.



• Configure your email server to block or remove email that contains file attachments that are commonly used to spread threats, such as .vbs, .bat, .exe, .pif and .scr files.



• Train employees not to open attachments unless they are expecting them. Also, do not execute software that is downloaded from the Internet unless it has been scanned for viruses. Simply visiting a compromised Web site can cause infection if certain browser vulnerabilities are not patched.



• It is recommended to disable the system restore. You will get more information about enabling and diabling the system restore XP and other OS.

Disable or enable Windows Me System Restore

Disable or enable Windows XP System Restore

Beware of Trojans

Trojans are the most dangerous among the malicious software. They have the capability of wide range of destruction of data and can even disable the software that are installed to defend the computer from trojans and viruses. As the internet became more sophisticated more and more types of trojans arosed. Hacker are responsible for the creation of trojans. Generally a trojan is masked by the author in some useful applications and allows the victim to download and use the software. The author may even declare that the use of product will not cause any harm to the computer. But the trojan attached to the software will do its job sincerely. It will send the data to the attackers computer. Using this data the attacker can validate several things including the browsing habit of the victim. Such trojans even send the private data to the attacker's computer. Some trojans kill the security software and make deals with several useful softwares like browsers for its action. Such trojan can take you to a fake site that looks like the original site and takes information like account number.

Most of the trojans were made for the purpose of spying. As many of you know that the trojan has two module: a server and the client. The sever is installed in the attacker's computer and the client is installed in the victim's computer. The client in the victim's machine send the data in the victim's computer to the server in the attacker's computer. Trojans have the capability to read the keystrokes from the victim's computer and send to the the attacker's computer. Some trojans even send the screen shot of the applications running in the victim's machine.
You can download several types of outdated trojans and easily detected by anti-trojan softwares from VX Heavens (http://vx.netlux.org/). This site also provide several viruses, worms, constructors, simulators, source codes of viruses and more...But keep in mind that making or promotion of malicious software is strictly illegal.
You can protect your system from trojans by installing the anti-trojan softwares. Today several anti-trojan softwares are available in the internet for downloading. It is always better to use a well updated anti-trojan in your system. You will get more information about trojan in http://www.anti-trojan.org/

Some useful links are given below:

http://www.anti-trojan-software-reviews.com/
Contains a survey of some of the top anti-trojan softwares

http://www.anti-trojan.org/
Gives you more information about trojans and related malicious softwares. The site also gives some anti-trojans for downloading.

http://ezinearticles.com/?How-Trojan-Virus-Threats-on-Your-Computer-Can-Put-Your-Financial-Information-at-Risk&id=1585959
This site contain an article about the trojan.

Other Malicious Softwares

In the olden days of computing the only thing the viruses spread through is the infected floppies. The booting from infected floppies causes the viruses to spread in to the host machine. With the advancement of the technology the medium of spreading also widened. The medium of spreading became internet, pen drives etc. The internet service has resulted in the formation of several malicious softwares. There are several such softwares available in the internet.

• Trojans

The most important difference between the Trojans and viruses is that Trojans cannot spread themselves whereas the viruses spread themselves. The Trojans disguise themselves as useful softwares and the user will download and install it thinking that it is a useful software. He only recognizes the harmful effect of Trojans only after it has started its job.

The Trojan has two parts: a server and a client. The server is the part that is installed in the attacker's system. It is the client that disguised themselves as a useful software and get installed in the victims machine. The client is present in the peer to peer networks and unofficial download sites. Once the Trojans enter in to the victims site, it has vast capability of destruction. The Trojans are highly sophisticated that they can be used according to the wish of the attacker. The attacker can decide the degree of harmness that can be caused by the Trojans. There are different types of Trojans. Some of them are listed below. A Trojan could have any or one of the combination of the below mentioned functionalities.

• Remote Access Trojans

These Trojans give full control of the victim's machine to the attacker. The attacker can gather several information from the victim's machine including confidential thins like passwords, credit card number etc stored in the victim's machine.

• Password Sending Trojans

These type of Trojans possesses great threats even today. The purpose of these Trojans is to send the password stored in the cached memory. They can also steal the passwords as you enter the passwords. They then send it to the specified e-mail without the users knowledge. Passwords of the restricted sites, e-mail, messaging services and FTP services come under the threat of these Trojans.

• Keyloggers

These Trojans log victim's keystroke end send the log files to the attacker. They can be active in two modes: one in online mode and the other in the offline mode. The attacker can get several information including the passwords. The logs are send in the daily basis.

• Destructive

The only function of these Trojans is to destroy all files in the core system. They performs the destructive work according to the will of the programmer or can be programmed to work as a logic bomb which can be activated in a special date or time.

• Denial of Service (DoS) Attack Trojans

The main aim of this kind of Trojans is to reduce the bandwidth of the victims machine by increasing the net traffic. This makes the internet connection too overloaded to let the user to visit a website or download anything. One of the variation of this type of Trojans is the mail-bomb Trojan, whose main aim aim is to infect maximum systems as possible and simultaneously attack a specific e-mail address with random subjects and content that cannot be filtered. However today the e-mail service providers use advanced filters to filter out these malicious softwares upto an extend.

• Proxy/Wingate Trojans

These Trojans turn the victim's system into a Proxy/Wingate server. Thus the victim's machine will be opened to many other systems connected to the network. The attacker can easily use this victim's system to anonymously browse in to the restricted sites and access various risky internet services. The attacker can register domains or access pornographic sites with stolen credit card number or can perform several similar illegal activities.

• FTP Trojans

These Trojans are commonly very simple. But most of them does not exist today. It does nothing but opens the port for the FTP transfer that is port 21. So everyone connected to the network can access files from the victim's machine. Today the systems are password protected so that only attacker can connect to the computer.

• Software Detection Killers

The main aim of these Trojans is to kill the softwares or firewalls that protect your computer from malicious softwares. This will reduces your computer's defense to the malicious softwares and becomes easily vulnerable to attacks. These Trojans exists even today. Some anti-virus asks the displays a confirmation message when they are to be uninstalled.

• Worms

Computer worms are programs that reproduce themselves and run independently. They can travel across the network connections They are platform independent, so they can attack system running on any operating system. The difference between a worm and a virus is the method in which they reproduce and spread. A virus is dependent on a host file or a boot sector, and transfer of files between the machines to spread, while a worm can run completely independent and spread of its own through the network connections.

The security threat of worm is same as that of the viruses. Worms are capable of doing wide range of damages such as destroying essential files in the victim's computer, slowing it down to the maximum extend and even causes some of the essential programs to crash. Two famous worms are MS-Blaster and Sasser worms.

• Spyware

Spyware is also an Adware (advertising-supported software). Advertising in shareware products is a way for shareware authors to make money, other than by selling it to the user. There are several large companies that offer to place banner ads in their products in exchange for a portion of the revenue from banner sales. If the user finds the banner annoying, there is usually an opinion to get rid of it by paying the license fee.

Unfortunately, the advertising companies often also install additional tracking software in your system that is continuously using your internet connection to send the statistical data back to the advertisers. Although the companies claims that they did not collect any personal information from the user so that he will be anonymous, the fact is that there is a server running in your computer that will send the information about you and your surfing habits to a remote location using the bandwidth of your internet connection.

Spyware slows down the speed of your internet connection. They also reduces the processing power of your computer. Sometimes unwanted pop ups will irritate the user. It also changes the settings of your browser like changing the home page or default search engines. Many people does not consider it as illegal. But unfortunately there is no way to get rid of such nuisance.