One million users infected with adware banner ads on My Space!!

[Breeze54]

http://www.theregister.co.uk/2006/07/21/myspace_adware_attack/

MySpace adware attack hits hard

Purity check
By John Leyden

Published Friday 21st July 2006 13:20 GMT

Online banner ads running on MySpace.com and web sites infected more than one million users
with adware, according to net security firm iDefense.

The attack exploited a Windows Metafile (WMF) exploit, fixed by Microsoft in January,
to infect vulnerable Windows machines with malware from PurityScan/ClickSpring family of adware.
The malware surreptitiously tracks internet usage while bombarding infected users with pop-up ads

The banner ad that played a staring role in the attack ostensibly advertised a site called deckoutyourdeck.com.
In reality, machines were directed to Russian-language website in Turkey, which tracked
the number of times adware programs were downloaded, the Washington Post reports.

Data on the site suggested that the adware had been installed on 1.07m PCs, a huge figure
that equates to a big payday for the unknown perpetrators of the attack and plenty of pain
for ordinary surfers.

[Atman]

1. I will NOT be the first one to mention that this happened to WINDOWS users

Ooops.

[hobbit709]

8. Yeah yeah!!!

There are Windoze users and there are Windoze users. The smart ones don't use Internet Exploder and Lookout! in the first place. I can guarantee you if Macs had a bigger market share there would be people writing shit to attack them too. Nobody wastes their time writing these things if there's a less than 1 in 10 chance of screwing somebody up. Macs and even Linux has vulnerabilities but nobody has really tried to exploit them yet.

[Atman]

10. Keep telling yourself that.

It's how Windows users justify their aggravation with their machines, I guess. But Mac OSX's Unix core just wont launch and run code all on its own like Windows will. Totally different type of OS. This hit Windows users not because there are more of them, rather, because Windows has so many holes you can build another Boston artery tunnel out of them. And you'd be just as safe driving through.

[hobbit709]

14. Go ahead try me

I'll even give you my IP and let you attempt to get into my systems. not only will you not get in, something bad may come your way in response. I have friends in low places and some of them try to hack systems just for fun-they not only couldn't get into mine after I let them try to see how secure my system is, they set me up with a little surprise that I can send back on the attempt. All OS's have their quirks-you just have to know how to work with them.

[Breeze54]

17. WTF???

"Boston artery tunnel out of them. And you'd be just as safe driving through."
:rofl:

http://www.chron.com/disp/story.mpl/nation/4060601.html
July 20, 2006, 3:15PM
Massachusetts governor orders shutdown of one Big Dig tunnel
By STEVE LeBLANC
Associated Press
BOSTON — Gov. Mitt Romney ordered an immediate shutdown of the Ted Williams Tunnel's
eastbound lanes today as the investigation continued into a deadly collapse of ceiling
panels in a connecting tunnel. ... more at link

I have run many versions of Win OS over the years and I only got hit once with a virus and that was my fault.
I cured it rather quickly.
I think a lot of windows users do not know how to protect themselves.
But I also agree that Windows has had it's share of problems.
If people would actually install updates etc. and run virus updates and scans,
they would save themselves a lot of headaches.

JMO...your milage may vary! ;)

[RebelOne]

2. Glad I have never gone to that site.

[Breeze54]

7. It wasn't 'just' on My Space! "Other" websites were included!

:wtf:

I'd get a MAC but I can't afford it! :cry: But Mac's have had some issues too!
Nobody is truly "safe" surfing the web. It's a myth!

[xultar]

3. I've see that deck out your deck in other places. I don't go to myspace

so this thing will get bigger.

[FSogol]

4. Use Firefox. n/t

[grytpype]

16. Better yet, use Firefox on Linux!

http://www.ubuntu.com/

[MADem]

5. This I don't get: equates to a big payday for the unknown perpetrators

Really???? I mean, once the victims figure out WHICH asshole is responsible for that shit, wouldn't it kinda destroy their business plan? It's like a finger in the chile, only this time it wasn't planted. It hardly gives one confidence in the advertiser who is linked to this kind of crap....

[Breeze54]

12. I think they get paid for each 'hit' or click! n/t

[MADem]

25. Yeah, but then, when shit rains down, it's a short-term payday

Unless they create shell companies and keep changing their name to protect the guilty...

[madfloridian]

6. I bought Spyware Doctor, and I have been alarmed.

They update daily and find that Purity Scan thing a lot. I don't even go to My Space, haven't been there in months. There is a huge new outbreak of all kinds of malware and adware.

I am very careful with all kinds of programs, but this one is good and thorough. Even the Trojan Remover I have starting at boot up did not catch the virtumonde and purity scan thingys.

[Breeze54]

9. I run more than one spybot killer.

And My Space wasn't the only place with the infected banner ads.
It's just they have more users, I think.

Spybot S & D is free! Spyblaster. AdAware. ;) All free!! Avast.

[madfloridian]

11. I ran spybot today...it did not find anything.

It was after I ran a Spyware Doctor scan. I have never had such downloader trojans before, never. According to a newsletter I get, it is accelerating now.

[Breeze54]

13. Do you have a firewall and anti-virus too? n/t

:shrug:

[madfloridian]

15. You name it, I have it, plus a router for my computers.

And I still got infected with those things.

Do a search on "multiple iexplore.exe running in task manager". I did, and I was stunned. People are going crazy with this stuff, and it has been going on for months.

[Breeze54]

18. ok...I'll try it. TY!

;)

READ THIS!!

View Full Version : multiple IEXPLORER.EXE in task manager
http://www.processlibrary.com/forum/archive/index.php?t-1037.html

You can remove a lot of programs from the msconfig start-up menu and avoid a lot of this shit.
If it's a program, it doesn't have to run at startup!!

I have always tweaked my msconfig startup menu to minimal at boot...only what is essential.
I'll start the programs I want manually, thank you! ;)

[hobbit709]

19. I have my firewall set

to block Internet Exploder since I won't use it and won't let any program that tries to access it to use it either.

[madfloridian]

20. I have tried others, but I like IE so I will keep using it.

It suits what I do much better than some of the others. I think it is a personal choice, and it won't be long before the others get infections as well.

[Breeze54]

21. Actually, FireFox is awesome!!

It's much better than IE and it doesn't use Active X!

Switching to Mozilla -- Mozilla Security Architecture
Recent security failings in Internet Explorer have caused experts (Including the United States Department of Homeland Security's Computer Emergency Readiness Team) to recommend that consumers stop using Internet Explorer and switch to other browsers. Mozilla Firefox and other Mozilla browsers use a fundamentally different security architecture than does Internet Explorer.

As a result, Mozilla browsers are not affected by a range of security problems that compromise Internet Explorer.
For more detail on exploits leading to the suggestion to switch see: http://www.kb.cert.org/vuls/id/713878 and http://secunia.com/advisories/12048/.

The Mozilla design approach is to provide multiple layers of defense so that
if one protection mechanism performs imperfectly,
another protection mechanism (or two or three) will act as a safety net,
thus strengthening the system's ability to defeat attacks.

Security benefits of Mozilla browsers include:

Firefox and other Mozilla browsers do not allow a website to download onto,
install onto, or execute code on a user's computer without the user's agreement.
Firefox and Mozilla browsers do not designate content as "local."
An architecture that includes the concept of "local" content and then gives such content
upgraded security permissions and allows it greater access to the user's machines,
means that content which is mistakenly treated as local has vastly more potential to do damage.

Indeed we saw this type of problem in the recent Internet Explorer vulnerabilities,
in which malicious content was secretly sent to users machines,
managed to falsely identify itself as "local" content to Internet Explorer,
was then granted enhanced access to machines running Internet Explorer,
and used that access to install a program which logged keystrokes,
including credit card numbers.

Mozilla users were not affected.
A more detailed description can be found at: http://www.kb.cert.org/vuls/id/713878.

http://www.mozilla.org/security/security-announcement.html

;)

[hobbit709]

22. No matter how good a snake handler you are

Sooner or later one of them will bite you. True there may be other vulnerabilities in other browsers but why increase the odds against you.

[Kali]

23. ack - I was just there this morning

not a member but snooping on other people.

I am on firefox, have avg and spybot s&d think I am ok?

[Breeze54]

24. Yes,,,those banner ads have been removed from the internet now!

You should be cool as long as you update your spyware; and run scans!
Anti-virus, firewall and windows updates and scans too!

I just try to keep everything upto date all the time...just like my car! ;)