Is your Windows software up to date? - The Punters Lounge

GotaFancy?(BPP) · 11-01-2008, 18:56

If not, DO IT NOW!!!! http://windowsupdate.microsoft.com/ (If your copy is not genuine, you might want to check ways around the Windows Genuine Advantage first

)

http://news.bbc.co.uk/1/hi/technology/7183008.stm

Quote:

Warning on stealthy Windows virus

The creators of the virus are after bank logins and personal data

Security experts are warning about a stealthy Windows virus that steals login details for online bank accounts.
In the last month, the malicious program has racked up about 5,000 victims - most of whom are in Europe.
Many are falling victim via booby-trapped websites that use vulnerabilities in Microsoft's browser to install the attack code.
Experts say the virus is dangerous because it buries itself deep inside Windows to avoid detection.
Old tricks
The malicious program is a type of virus known as a rootkit and it tries to overwrite part of a computer's hard drive called the Master Boot Record (MBR).
This is where a computer looks when it is switched on for information about the operating system it will be running.
"If you can control the MBR, you can control the operating system and therefore the computer it resides on," wrote Elia Florio on security company Symantec's blog.
Mr Florio pointed out that many viruses dating from the days before Windows used the Master Boot Record to get a grip on a computer.
Once installed the virus, dubbed Mebroot by Symantec, usually downloads other malicious programs, such as keyloggers, to do the work of stealing confidential information.
Most of these associated programs lie in wait on a machine until its owner logs in to the online banking systems of one of more than 900 financial institutions.
The Russian virus-writing group behind Mebroot is thought to have created the torpig family of viruses that are known to have been installed on more than 200,000 systems. This group specialises in stealing bank login information.
Security firm iDefense said Mebroot was discovered in October but started to be used in a series of attacks in early December.
Between 12 December and 7 January, iDefense detected more than 5,000 machines that had been infected with the program.
Analysis of Mebroot has shown that it uses its hidden position on the MBR as a beachhead so it can re-install these associated programs if they are deleted by anti-virus software.
Although the password-stealing programs that Mebroot installs can be found by security software, few commercial anti-virus packages currently detect its presence. Mebroot cannot be removed while a computer is running. Independent security firm GMER has produced a utility that will scan and remove the stealthy program. Computers running Windows XP, Windows Vista, Windows Server 2003 and Windows 2000 that are not fully patched are all vulnerable to the virus.

AK1979 · 11-01-2008, 18:59

Could that explain this?

Confused: Hotmail log on

GotaFancy?(BPP) · 11-01-2008, 19:04

I suppose if someone else could get your password and change it, then yes it could explain it - but that's likely to be for a host of other reasons before this virus (in reality, 5000 infections sounds pretty low - it's quite a good article for the "shock value" to stimulate people to keep their windows up to date, which IS important....)

Can you reset your password - is there a security question that will allow you to reset? Or a secondary email address which can be sent a new password?

AK1979 · 12-01-2008, 10:41

It seems my security questions were changed too - I have sorted the problem through a secondary email address so I can now get access to hotmail again but waiting for me was an mail from eBay, confirming that i'd changed my password and I havent!! So i'm trying to sort that now

Very very strange and a bit worrying to be honest.....

Galronix · 12-01-2008, 10:50

Quote:

Originally Posted by AK1979

It seems my security questions were changed too - I have sorted the problem through a secondary email address so I can now get access to hotmail again but waiting for me was an mail from eBay, confirming that i'd changed my password and I havent!! So i'm trying to sort that now

Very very strange and a bit worrying to be honest.....

Sorry to say it AK but it seems you've been hacked.

Trilobite · 12-01-2008, 11:00

I posted about Rootkits in this thread a couple of days ago, with links to free software which will try and detect any Rootkits installed.

Credit Card Fraud

These people will always target their efforts into exploiting vulnerabilities in Internet Explorer, my advise is to use another browser like Opera or Firefox.

GotaFancy?(BPP) · 12-01-2008, 11:14

Quote:

Originally Posted by AK1979

It seems my security questions were changed too - I have sorted the problem through a secondary email address so I can now get access to hotmail again but waiting for me was an mail from eBay, confirming that i'd changed my password and I havent!! So i'm trying to sort that now

Very very strange and a bit worrying to be honest.....

You need to assume you have been totally compromised and all your passwords are known - banks, email, bookies accounts - everything - you should probably assume someone still has access to your machine (they may not have - they may have just guessed your hotmail password if it was a weak one) - you probably want to save all your important data/files and rebuild your machine.....

Probably worth running full AV scans, though it won't necessarily pick up on ad hoc key loggers.....

Trilobite · 12-01-2008, 11:21

This is the website to the Rootkit detecting software that was mentioned in that article

http://www.gmer.net/index.php

11-01-2008, 18:59	#2 (permalink)
AK1979 Gooner Punter Join Date: 07 May 2001 Location: Highbury & Islington Age: 29 Posts: 11,182 Awards Showcase Total Awards: 1	Re: Is your Windows software up to date? Could that explain this? Confused: Hotmail log on __________________ WHL 71 Anfield 89 Old Trafford 02 WHL 04

11-01-2008, 19:04	#3 (permalink)
GotaFancy?(BPP) God Punter Join Date: 18 Jun 2005 Posts: 35,277 Awards Showcase Total Awards: 4	Re: Is your Windows software up to date? I suppose if someone else could get your password and change it, then yes it could explain it - but that's likely to be for a host of other reasons before this virus (in reality, 5000 infections sounds pretty low - it's quite a good article for the "shock value" to stimulate people to keep their windows up to date, which IS important....) Can you reset your password - is there a security question that will allow you to reset? Or a secondary email address which can be sent a new password?

12-01-2008, 10:41	#4 (permalink)
AK1979 Gooner Punter Join Date: 07 May 2001 Location: Highbury & Islington Age: 29 Posts: 11,182 Awards Showcase Total Awards: 1	Re: Is your Windows software up to date? It seems my security questions were changed too - I have sorted the problem through a secondary email address so I can now get access to hotmail again but waiting for me was an mail from eBay, confirming that i'd changed my password and I havent!! So i'm trying to sort that now Very very strange and a bit worrying to be honest..... __________________ WHL 71 Anfield 89 Old Trafford 02 WHL 04

12-01-2008, 11:00	#6 (permalink)
Trilobite Legendary Punter Join Date: 17 Oct 2006 Posts: 1,759 Awards Showcase Total Awards: 2	Re: Is your Windows software up to date? I posted about Rootkits in this thread a couple of days ago, with links to free software which will try and detect any Rootkits installed. Credit Card Fraud These people will always target their efforts into exploiting vulnerabilities in Internet Explorer, my advise is to use another browser like Opera or Firefox.

12-01-2008, 11:21	#8 (permalink)
Trilobite Legendary Punter Join Date: 17 Oct 2006 Posts: 1,759 Awards Showcase Total Awards: 2	Re: Is your Windows software up to date? This is the website to the Rootkit detecting software that was mentioned in that article http://www.gmer.net/index.php

Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

Football Betting Tips	Australian Free Bets HOT	Free Bets	Odds Comparison	Soccer Punter
Bookmakers	Livescore	SoccerVista	Asian Handicap Betting Guide	Euroleague Betting Picks
Soccer Picks	Super-1