A vast, hole in security

[Théière]

Avast has been discussed many times on the forum, I had the worst virus,spyware, trojan attack yesterday at 2.30pm. It arrived hidden in an email from UPS simply stating they were unable to deliver a parcel, the email was not addressed to me.

The biggest culpritt was a nasy little **** by the name of Internet security 2010 which invades and takes over your PC.

It went straight through AVAST like it wasn't there, I have checked on the Avast site only 1 of the treats put on my PC was on their list. It will therefore come as no surprise that Avast is no longer on my PC.

AVG had many of the threats listed so it's going back on my machine.

To remove Internet security 2010 and all it's nastys I used Stopzilla

Internet security 2010 is the 28th most searched item on Google in the last hour. IT IS A SERIOUS THREAT!

[JohnRoss]

Nasty. According to this http://www.bleepingcomputer.com/virus-removal/remove-internet-security-2010 it would seem to be a con where false infections are put on your computer and they want you to buy the programme to get rid of them. I notice that the name, Internet Security 2010, is the name of programmes sold by a number of people including Kapersky, nothing to do with them I assume. I dumped AVG recently and am trying Microsoft Security Essentials, freeware, and so far it has trapped several alleged nasty things and does not slow the computer down as much as AVG did when scanning. Have you an opinion on MSE at all.........................JR

[tj]

[quote user="Théière"]

It arrived hidden in an email IT IS A SERIOUS THREAT!

[/quote] Thats why you should always download just the email "headers" which detail sender subject and size, and choose the mail you want,before actually downloading the mail, and deleting the rest on the server. and never have "check email every ? mins" switched on

[Chancer]

Did you open the E-mail Théière?

You can tell I dont know much about this subject and I am an Avast user to boot, it used to be AVG and I had to click on the icon to be sure which one I have.

I use Hotmail, I dont know if that makes any difference, and try never to open E-mails that I dont think are for me but sometimes they are from someone that I know whose address book has been infiltrated.

[DerekJ]

With any unknown, suspicious email I ....

single right click on it (so as not to open it)

Click on Properties >> Details >> Message Source

This allows me to read it without opening it.

On the subject of virus infected UPS emails.. had few but never opened them.  I got the impression that there was an attachment with them that they were trying to lure you into opening.

[AnOther]

Don't mean to doubt you but I don't believe what happened was the result of merely opening an email, are you sure you did not open an attachement purporting to be a label or notice of some sort.

This would appear to be what you got but as per previous versions of the same scam it relies on you opening the attached .zip file.

http://www.wincert.net/news/security/1859-ups-tracking-number-virus-warning.html

Before you condemn AVAST, if you still have the email open the file again with AVG and see if that fares any better, you might be surprised.

[Quillan]

Sad to say there's a load of these type of things going around "Your bank statement is attached" to name another. A certain amount is common sense is really needed, a UPS or TNT email will be branded and sent to you by name, a one or two line email with an attachment, unless from somebody you know should always be treated carefully. I usually delete them straight away, if they are real and important they will always try to send them again. Having said that if 'they' whoever 'they' may be can't deliver they always leave a slip in my post box or phone me for directions if they can't find me.

Because of the quantity of email address's I have I use a product called MailWasher Pro which scans all my emails for spam before they come to me. It runs on my computer in the background and I check first, delete the junk before down loading in to Outlook. I think I have only 'lost' 3 emails in 5 years using this product but then it puts them in a recycle bin so you can always get them back. You can try a 30 day trial version free, just search on Mailwasher to find their website. They use databases by Spamcop and Spamhaus, the same databases as many other corporate email systems (yahoo uses Spamhaus for example). It also has antivirus built in but I don't trust it so I use AVG as a second line of defence as it were.

[tel]

I am with AN O on this one, I and just about everyone else receive these types of emails on a regular basis, I just delete them making sure I DON'T click on any attachment or link in the message body.

I disagree with you about Avast it is an excellent free Anti-Virus programme, though I must admit I use Avira Antivir which I found to be much better, I have had to rid several computers of the Malware 'Internet Security 2010' and ALL of them had AVG not Avast.  To clean the infected PC's I had to manually remove all the programmes files then used Avira and MS Security Essentials to complete the process.

 

Regards

[Théière]

Ooh you clever lot [:)]

Can't you tell it wasn't me who opened the email and attachment, Twas the O/H who was crying and soooo upset, just trying to help me etc.

You are right of course don't open attachments that you are unsure of, my point is if you look through the Avast database they are missing lots of the virus's that I found on my machine. Virus's, trojans and malware that others have like AVG, stopzilla etc, so Avast excellent? not in my book!

It is possible that the writers of such virus's whose aim is always to disable your virus software if possible suceeded in their aim which also brings into question how secure is Avast from attack?

That sentence is because having removed the threat with stopzilla when I rebooted, Avast sprung into life with a warning about a virus I had just removed.  I make my judgements based on real occurances post attack and not on some journalistic bilge published in a mag.

I am also looking at other alternatives, just posting a warning, be carefl out there

[AnOther]

No AV is perfect nor will any catch each and every nasty.

Likewise no 2 reviews will rank the various programmes identically but at last showing, or at least as recently as Aug 09, Avast was well up there with the rest of it's peers.

http://www.pcworld.com/reviews/collection/1597/free_antivirus_software.html

[suein56]

[quote user="AnOther"]No AV is perfect nor will any catch each and every nasty. [/quote]

Precisely, my thoughts exactly; and not even if you pay for the product instead of trusting in the 'free' version.

Free is good.

[Théière]

[quote user="AnOther"]No AV is perfect nor will any catch each and every nasty.

Likewise no 2 reviews will rank the various programmes identically but at last showing, or at least as recently as Aug 09, Avast was well up there with the rest of it's peers.

http://www.pcworld.com/reviews/collection/1597/free_antivirus_software.html


[/quote]

My Jan 2010 review post attack however doesn't rate it so highly.

From the initial attack, the computer was disconnected from the Internet as fast as possible.

A deep scan was run with Avast and it found 1 threat which was quarantined.

Computer re-started in windows safe mode with minimum settings and another deep scan was carried out with Avast, this took over 5 hours and reported the machine was clean of all threats, hmm

Research of the Internet security 2010 virus resulted in scan with Stopzilla which reported 9 different virus's, Trojan's and malware and multiple installations of some.  Names of the threats was checked against the database of Avast which made mention of only 1 and AVG and Zone Alarm which featured a lot more on their databases  $9.99 for one year of Stopzilla cleaned the PC of all threats, used specifically for it's ability to remove Internet security 2010. 

As I said the virus writer may have disabled Avast but that in itself is a bit of a worry.

Sorry if this report upsets the apple cart but it is a true account of what I found, when needed Avast failed to meet the need, who's in denial?

[suein56]

[quote user="Théière"]Sorry if this report upsets the apple cart but it is a true account of what I found, when needed Avast failed to meet the need, who's in denial?[/quote]

IMHO you are. You are not facing the facts that have been put in front of you, but that is your perogative.

http://www.wincert.net/news/security/1859-ups-tracking-number-virus-warning.html

http://www.bleepingcomputer.com/virus-removal/remove-internet-security-2010

[Théière]

Oh wise after the event! where were you yesterday [Www]

Your first link was a post yesterday, updated today! Difficult to read when your computer is going haywire and disconnected from the net [blink]

Your second post, read it and Stopzilla, wonder where I got that from.

Avast is wonderful! Its' the best!

You Are completely safe from threats if you run Avast.

Yeah right

Caveat emptor!

Sorry I bothered to mention it to anyone

 

[suein56]

[quote user="Théière"]Sorry I bothered to mention it to anyone[/quote]

Well I'm not; as it is always good to learn what might happen in certain circumstances. You, and your computer, have survived intact and that is the most important thing. Now you have an AV you have more confidence in, all good news.

[AnOther]

I'm sure we can all understand that you are angry and upset about what happened but with respect sarcasm is unhelpful and your emotions would be better directed at the actual root cause of your problem which was simply an unfortunate lack of awareness.

[cooperlola]

[quote user="AnOther"]t the actual root cause of your problem which was simply an unfortunate lack of awareness.

[/quote]Well, I'd venture to say that it's the *rs*h*l* who planted the virus, but....

It does seem a shame when a warning against something like this turns into a slanging match.  We get enough of this sort of thing on the healthcare threads and now it's spreading to computing of all things.  Are we all bored or what?

[JohnRoss]

Rather than YANA it would appear that we are not alone. http://forums.chroniclelive.co.uk/viewtopic.php?t=19772 .....JR

PS Any comments about MSE would be helpful

[Quillan]

[quote user="cooperlola"][quote user="AnOther"]t the actual root cause of your problem which was simply an unfortunate lack of awareness.

[/quote]Well, I'd venture to say that it's the *rs*h*l* who planted the virus, but....

It does seem a shame when a warning against something like this turns into a slanging match.  We get enough of this sort of thing on the healthcare threads and now it's spreading to computing of all things.  Are we all bored or what?
[/quote]

Exactly, I guess its the old 'I know considerably more than you' syndrome.

That aside it is difficult to discover what is the best because all the review sites seem to have different results. What does seem to come over, even in the independent sites, is that for better protection you need to pay. I had always thought that but had been 'converted' to free versions after ready many positive comments here about AVG which I now use. However, and I think this is true even if you buy anti virus software, a little bit of common sense is always required. Its a bit like having ABS on a car, brilliant idea but it still does not stop you driving up the back of the car in front if you drive too close.

[AnOther]

I'm thinking of doing an experiment on a gash hard drive with a sacrificial install of XP but I need the UPS payload file if anybody has it or knows where I can get it from.

[cooperlola]

[quote user="JohnRoss"]

Rather than YANA i

[/quote]OK I give up.  I've googled it and Wiki'd it but I still have no idea what YANA means. 

[Bugsy]

Sorry, but what's a virus?

[Www][:D]

[AnOther]

Stop it now...............!

No one is immune [;-)]

http://theappleblog.com/2009/01/26/more-mac-viruses-similar-sources-time-to-worry/

[JohnRoss]

http://www.youtube.com/watch?v=a7Qz4AVvABM

[Frederick]

 Quote   "  It is possible that the writers of such virus's whose aim is always to disable your virus software .."................." Bring back the stocks I say "