skip to main content

New Version of SpyEye Trojan Horse

14 years ago

I was doing some reading and came upon this. If like me you are an on-line banker you should take a minute to read the page.

Sometimes I think a Wi-Fi connected stand alone system dedicated solely for financial business is the most secure approach to take. This would allow the system to be physically separated from all other traditional on-line activity and reduce the possibility of infection.

It just never stops.

DA

Here is a link that might be useful: Red Tape

Sort by:Oldest

Comments (8)

anne_ct
14 years ago
"But this new flavor has more potential for success, because it involves stolen debit card numbers used at third-party merchants, creating complex transactions involving multiple banks and multiple security systems."

I read this article, too...but if I understand the quoted text above...plain old banking-on-line isn't the risk. The risk that opens the client to a potential attack lies in the use of debit cards. Wouldn't you agree?

Anne
grandms
14 years ago
"My take is that if your computer is infected with financial malware, it's game over anyway," he said. "My takeaway is you need to prevent getting infected with financial malware in the first place."

This seems to be the key. More reason than ever to be vigilant in using one's computer.
Related Discussions
New rootkit virus ??
Q
Comments (7)
Heres what the Symantic website had to say about this trojan Targeting over 400 banks and having the ability to circumvent two-factor authentication are just two of the features that push Trojan.Silentbanker into the limelight. The scale and sophistication of this emerging banking Trojan is worrying, even for someone who sees banking Trojans on a daily basis. This Trojan downloads a configuration file that contains the domain names of over 400 banks. Not only are the usual large American banks targeted but banks in many other countries are also targeted, including France, Spain, Ireland, the UK, Finland, Turkeythe list goes on. The ability of this Trojan to perform man-in-the-middle attacks on valid transactions is what is most worrying. The Trojan can intercept transactions that require two-factor authentication. It can then silently change the user-entered destination bank account details to the attacker's account details instead. Of course the Trojan ensures that the user does not notice this change by presenting the user with the details they expect to see, while all the time sending the bank the attacker's details instead. Since the user doesnÂt notice anything wrong with the transaction, they will enter the second authentication password, in effect handing over their money to the attackers. The Trojan intercepts all of this traffic before it is encrypted, so even if the transaction takes place over SSL the attack is still valid. Unfortunately, we were unable to reproduce exactly such a transaction in the lab. However, through analysis of the Trojan's code it can be seen that this feature is available to the attackers. The Trojan does not use this attack vector for all banks, however. It only uses this route when an easier route is not available. If a transaction can occur at the targeted bank using just a username and password then the Trojan will take that information, if a certificate is also required the Trojan can steal that too, if cookies are required the Trojan will steal those. In fact, even if the attacker is missing a piece of information to conduct a transaction, extra HTML can be added to the page to ask the user for that extra information. (In the example below the user is asked to enter their encryption key, in addition to the regular information.) Here is the login form viewed on a clean machine: (Insert Picture of a Regular Log In Screen) Below the form presented to an infected user is shown, the input box added by the Trojan has been marked in red: (Insert Picture of an Infected Log In Screen) When instructed, the Trojan can also redirect users to an attacker-controlled server instead of the real bank in order to perform a classic man-in-the-middle attack. Currently there is only one bank targeted in this way; however, recent updates to the Trojan change the user's DNS settings to point to an attacker-controlled server. Using this technique the Trojan can start redirecting any site to an attacker site at any time. This feature could also mean that if the Trojan is removed but the DNS settings are left unchanged then the user may still be at risk. (See below for the attackers' DNS server addresses.) Add to all of the above the ability to steal FTP, POP, Web mail, protected storage, and cached passwords and then we start to see the capabilities of this Trojan. But, it doesnÂt stop there Â don't forget the porn! The Trojan also contains over 600 pornographic Web site URLs that can be shown to the infected user so that the attacker can make money from the referrals. Lastly, the Trojan can also download updates, which it regularly does. It can also download other executables and it can use the infected machine as a proxy or as a Web server on any chosen port (in tests the http port used was 18102). The multiple configuration files that the Trojan downloads are updated several times per day and currently the Trojan is capable of injecting HTML into about 200 different URLs. The configuration files are compressed and encrypted; however, after decrypting them we can see how the Trojan works in more detail. The configuration files are structured as .ini files and each section of an .ini file represents a different task. Here is a snippet from the configuration file that was used to inject HTML into the banking form shown in the example above: jhw21] pok=insert qas=someBankSite.com/xpage/loginxxxxxxxxxs.htm njd=name="oppasswd; dfr=14 xzn=/)n xzq=2 rek=(div class="clear sep4")(/div) (label for="clave")Clave de firma: (/label) (input name="ESpass" type="password" size="8" maxlength="8" class="input01 aleft w180"/)Â req=166 The configuration options in the snippet above are as follows: Token: Purpose: pok Action to take qas URL to take action on njd String to search for xzn End string to search for rek HTML to insert The Trojan searches for the string name="oppasswd; then it finds the end tag /) then it inserts the string into the page: (div class="clear sep4")(/div) (label for="clave")Clave de firma: (/label) (input name="ESpass" type="password" size="8" maxlength="8" class="input01 aleft w180"/) Shown below is the HTML shown to the user on a non-infected computer: (label for="clave")Clave personal: (/label) (input id="clave" name="oppasswd" type="password" size="8" maxlength="8" class="input01 aleft w180"/) (/div) And on an infected computer: (label for="clave")Clave personal: (/label) (input id="clave" name="oppasswd" type="password" size="8" maxlength="8" class="input01 aleft w180"/) (div class="clear sep4")(/div) (label for="clave")Clave de firma: (/label) (input name="ESpass" type="password" size="8" maxlength="8" class="input01 aleft w180"/) (/div) Note: I substituted ) for > in the above examples. The Trojan can take any of the following actions when altering the HTML of a page: insert, delete, replace, and replace all. The Trojan uses the keyword "ESpass" (see the form above) as a keyword when the user sends a page to the bank and the Trojan checks if the page contains that keyword. Using this technique the Trojan can recognize pages it has altered and can extract the relevant data from the page and send it to the attacker as well as to the bank. The configuration files for this Trojan currently contain over 200kb of data; however, new URLs and HTML are being added to the configuration files on a daily basis. The Trojan is easily updated since the full HTML of any banking-related Web site is sent to the attackers. Using these submissions they can target banks for which they do not have bank accounts already. We are currently monitoring all of the updates to this Trojan. The Trojan accesses the following URLs for configuration, updates, and to send stolen data: Â iloveie.info Â webcounterstat.info Â microcbs.com Â reservaza.com Â screensaversfor-fun.com Â mystabcounter.info Â 85.255.119.218 The Trojan also downloads a copy of Trojan.Flush.J, which changes the users DNS settings to the following attacker settings: Â 85.255.116.133 Â 85.255.112.87 For protection, please keep your antivirus definitions up to date and block the above addresses at the firewall. Note: Not only did this Trojan grab my attention for obvious reasons, but the Trojan also installed itself as a .midi driver, causing my music to stop! For the record, the Trojan adds itself the following registry key so that it is loaded in all applications that use sound: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Drivers32\"midi1 But it also said this: Discovered: December 17, 2007 Updated: January 8, 2008 12:54:17 PM Also Known As: Spy-Agent.cm [McAfee] Type: Trojan Infection Length: 54,189 bytes and 98,304 bytes Systems Affected: Windows 2000, Windows 95, Windows 98, Windows Me, Windows NT, Windows Server 2003, Windows Vista, Windows XP Trojan.Silentbanker is a Trojan horse that records keystrokes, captures screen images, and steals confidential financial information to send to the remote attacker. Protection Initial Rapid Release version December 17, 2007 revision 023 Latest Rapid Release version January 10, 2008 revision 023 Initial Daily Certified version December 17, 2007 revision 032 Latest Daily Certified version January 15, 2008 revision 016 Initial Weekly Certified release date December 19, 2007 Click here for a more detailed description of Rapid Release and Daily Certified virus definitions. Threat Assessment Wild Wild Level: Low Number of Infections: 0 - 49 Number of Sites: 0 - 2 Geographical Distribution: Low Threat Containment: Moderate Removal: Easy Damage Damage Level: Medium Payload: Records keystrokes and captures screen images Releases Confidential Info: Steals confidential financial information Distribution Distribution Level: Low
...See More
Why did I get wierd email from my own addy?
Q
Comments (16)
Ravencajun, Last night I did another scan, It was very slow. I use Charter's High speed internet Security Suiet. It comes with my internet service. This trojan is not listed in their definitions. To be honest I have run into it previously and thought if they didn't do anything with it, it must not be serious. It was the email that allerted me to a possible connection. I also get some notices that say something that is acting as a server wants access. I always click deny! The following is the report after last night's scan. I really apperciate your concern and helpfulness! _________________________________________ Scanning Report 25 August 2009 20:30:53 - 21:55:14 Computer name: D2JGNZB1 Scanning type: Scan target Target: C:\ -------------------------------------------------------------------------------- Result No malware found -------------------------------------------------------------------------------- Riskware found Downloader.Win32.Agent.q (Riskware) C:\14B5.tmp -------------------------------------------------------------------------------- Statistics Scanned: Files: 132306 Not scanned: 21 Result: Viruses: 0 Spyware: 0 Suspicious items: 0 Riskware: 1 Actions: Disinfected: 0 Renamed: 0 Deleted: 0 Quarantined: 0 Failed: 0 Boot Sectors: Scanned: 2 Infected: 0 Suspicious items: 0 Disinfected: 0 Files not scanned: Cannot open file (click here for more info) C:\PAGEFILE.SYS Cannot open file (click here for more info) C:\WINDOWS\TEMP\AVP427.TMP Cannot open file (click here for more info) C:\WINDOWS\TEMP\AVP428.TMP Cannot open file (click here for more info) C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT Cannot open file (click here for more info) C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG Cannot open file (click here for more info) C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG Cannot open file (click here for more info) C:\WINDOWS\SYSTEM32\CONFIG\SAM Cannot open file (click here for more info) C:\WINDOWS\SYSTEM32\CONFIG\SECURITY Cannot open file (click here for more info) C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG Cannot open file (click here for more info) C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE Cannot open file (click here for more info) C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG Cannot open file (click here for more info) C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM Cannot open file (click here for more info) C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG Scanning of C:\WINDOWS\Installer\149cc.msp\stream 574 was aborted [F-Secure AVP] Scanning of C:\Program Files\Charter High-Speed Security Suite\FSAUA\content\70Software_PSC800\34\program\inst\fsma_7.80-127260.windows.fip\fsma\x86-windows\ILAUNCHR.EXE was aborted [F-Secure AVP] Scanning of C:\i386\DRIVER.CAB was aborted [F-Secure AVP] Cannot open a file in archive C:\DOCUMENTS AND SETTINGS\JUDITH HOESCHEN\LOCAL SETTINGS\APPLICATION DATA\IDENTITIES\(4E3254D7-522A-412A-9296-3F4767B3A2CB)\MICROSOFT\OUTLOOK EXPRESS\ANGUSHIRE MEDOWS.DBX Cannot open a file in archive C:\DOCUMENTS AND SETTINGS\JUDITH HOESCHEN\LOCAL SETTINGS\APPLICATION DATA\IDENTITIES\(4E3254D7-522A-412A-9296-3F4767B3A2CB)\MICROSOFT\OUTLOOK EXPRESS\COMPUTER HELPS AND TIPS.DBX Cannot open a file in archive C:\DOCUMENTS AND SETTINGS\JUDITH HOESCHEN\LOCAL SETTINGS\APPLICATION DATA\IDENTITIES\(4E3254D7-522A-412A-9296-3F4767B3A2CB)\MICROSOFT\OUTLOOK EXPRESS\INBOX.DBX Cannot open a file in archive C:\DOCUMENTS AND SETTINGS\JUDITH HOESCHEN\LOCAL SETTINGS\APPLICATION DATA\IDENTITIES\(4E3254D7-522A-412A-9296-3F4767B3A2CB)\MICROSOFT\OUTLOOK EXPRESS\HAYJUDO50.DBX Cannot open a file in archive C:\DOCUMENTS AND SETTINGS\JUDITH HOESCHEN\LOCAL SETTINGS\APPLICATION DATA\IDENTITIES\(2C545ACC-8A17-4851-B0AB-238D63125F07)\MICROSOFT\OUTLOOK EXPRESS\INBOX.DBX -------------------------------------------------------------------------------- Options Definitions version: Viruses: 2009-08-25_08 Spyware: 2009-08-25_08 Scanning Engines: F-Secure AVP: 7.00.171, 2009-08-25 F-Secure Hydra: 4.00.9271, 2009-08-25 Scanning options: Scan all files Scan inside archives Actions: Viruses: Ask after scan Spyware: Ask after scan -------------------------------------------------------------------------------- Error information "Cannot open file" error occurred: The "Cannot open file" error message means that the scanner was unable to open a file and that this file was not scanned. You can normally ignore this error message as there are many reasons for this message that do not imply a security threat, including: The file was a system file. System files are protected by the operation system by design. You can ignore this message in this case. You do not have permission to read the file. To scan the file, log in with a user account with sufficient permissions (for example the computer's administrator account) and rescan. The file was in use by an application when the scan was performed. To scan this file, close all applications and rescan. -------------------------------------------------------------------------------- Copyright 1998-2008 Product support : Send virus sample to F-Secure
...See More
how to remove trojan horse agent.4.E?
Q
Comments (9)
The first time I ran the scan I had 48 infected files. Below are the results of that scan: Malwarebytes' Anti-Malware 1.30 Database version: 1341 Windows 5.1.2600 Service Pack 3 10/31/2008 12:35:40 AM mbam-log-2008-10-31 (00-35-40).txt Scan type: Full Scan (C:\:) Objects scanned: 102474 Time elapsed: 2 hour(s), 39 minute(s), 50 second(s) Memory Processes Infected: 1 Memory Modules Infected: 0 Registry Keys Infected: 38 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 10 Memory Processes Infected: C:\WINDOWS\system32\mabidwe.exe (Trojan.Agent) -> Unloaded process successfully. Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CLASSES_ROOT\popcaploader.popcaploaderctrl2 (Adware.PopCap) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\popcaploader.popcaploaderctrl2.1 (Adware.PopCap) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\"e4e3e0f8-cd30-4380-8ce9-b96904bdefca> (Adware.PopCap) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Interface\"fe8a736f-4124-4d9c-b4b1-3b12381efabe> (Adware.PopCap) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\CLSID\"df780f87-ff2b-4df8-92d0-73db16a1543a> (Adware.PopCap) -> Quarantined and deleted successfully. HKEY_CLASSES_ROOT\Typelib\"c9c5deaf-0a1f-4660-8279-9edfad6fefe1> (Adware.PopCap) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\"df780f87-ff2b-4df8-92d0-73db16a1543a> (Adware.PopCap) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\"1d4db7d2-6ec9-47a3-bd87-1e41684e07bb> (Adware.MyWebSearch) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\"df780f87-ff2b-4df8-92d0-73db16a1543a> (Adware.PopCap) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\AFinding (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Routing (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\WServing (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\afisicx (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\afisicx (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\afisicx (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\mabidwe (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\mabidwe (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\mabidwe (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\noytcyr (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\noytcyr (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\noytcyr (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\roytctm (Trojan.Agent) -> Delete on reboot. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\roytctm (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\roytctm (Trojan.Agent) -> Delete on reboot. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\soxpeca (Trojan.Agent) -> Delete on reboot. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\soxpeca (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\soxpeca (Trojan.Agent) -> Delete on reboot. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\tdydowkc (Trojan.Agent) -> Delete on reboot. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\tdydowkc (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tdydowkc (Trojan.Agent) -> Delete on reboot. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\wsldoekd (Trojan.Agent) -> Delete on reboot. HKEY_LOCAL_MACHINE\SYSTEM\ControlSet004\Services\wsldoekd (Trojan.Agent) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wsldoekd (Trojan.Agent) -> Delete on reboot. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\macidwe (Backdoor.Bot) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\nobicyt (Backdoor.Bot) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\perfs (Backdoor.Bot) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sobicyt (Backdoor.Bot) -> Quarantined and deleted successfully. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\tdxdowkc (Backdoor.Bot) -> Quarantined and deleted successfully. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: C:\Program Files\Outlook Express\wab.exe.tmp (Trojan.Agent) -> Quarantined and deleted successfully. C:\System Volume Information\_restore"86FA0783-B9F2-4690-B09B-2E6C03E185B4>\RP113\A0017080.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\afisicx.exe (Trojan.Agent) -> Delete on reboot. C:\WINDOWS\system32\mabidwe.exe (Trojan.Agent) -> Quarantined and deleted successfully. C:\WINDOWS\system32\noytcyr.exe (Trojan.Agent) -> Delete on reboot. C:\WINDOWS\system32\roytctm.exe (Trojan.Agent) -> Delete on reboot. C:\WINDOWS\system32\soxpeca.exe (Trojan.Agent) -> Delete on reboot. C:\WINDOWS\system32\tdydowkc.exe (Trojan.Agent) -> Delete on reboot. C:\WINDOWS\system32\wsldoekd.exe (Trojan.Agent) -> Delete on reboot. C:\WINDOWS\system32\comsa32.sys (Trojan.Agent) -> Quarantined and deleted successfully. /////////////////////////////////////////////////// So I quarantined them and re-booted and ran the scan again and it showed nothing infected but the same message window that said Resident Sheild Alert Threat name: Trojan Horse Agent.4.E was there above the results of the scan. Below is the logged in results of that scan: Malwarebytes' Anti-Malware 1.30 Database version: 1341 Windows 5.1.2600 Service Pack 3 10/31/2008 1:34:54 PM mbam-log-2008-10-31 (13-34-54).txt Scan type: Full Scan (C:\:) Objects scanned: 102262 Time elapsed: 2 hour(s), 38 minute(s), 57 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) Maybe this is the end of it. Maybe. Thanks so much.
...See More
AVG users please note
Q
Comments (21)
You should not blindly react to one article from another country!! For the real story: PRESS RELEASE AVG Press Statement Regarding Problems from Product Update Last update: 2:24 p.m. EST Nov. 11, 2008 AMSTERDAM, Netherlands, Nov 11, 2008 /PRNewswire via COMTEX/ -- AVG is actively working to remedy the problem some users are experiencing related to the most recent update to commercial and free versions of AVG 7.5 and AVG 8.0 in some languages. A number of users who installed the update mistakenly received a warning that the Windows system file user32.dll product version 5.1.2600.3099 was infected with a Trojan virus and were prompted to delete a file essential to the operation of Windows XP. The problem only affects users of the Dutch, French, Italian, Portuguese, and Spanish language versions of Windows XP. AVG is taking these steps to assist users in remedying the problem: -- Immediate release of a new update to correct the problem. -- Creation of a specific informational section on the AVG website that enables users to resolve the problem. Affected users should follow the weblinks below for further information and to download the fix tool: (1) http://www.avg.com/support/HotTopics1574 FalsePositiveuser32.dll (2) http://www.avg.com/support/HotTopics1574 FalsePositiveuser32.dll - fix tool Affected users unable to use their PCs should contact their AVG reseller or ask a friend to download the information and fix tool for them. After running the fix tool, users should run the AVG update program to download and install the correct AVG update. AVG sincerely regrets the inconvenience users have experienced. We are working to remedy the problem and ensure that any other potential vulnerabilities are identified and eliminated before they can impact users. SOURCE AVG http://www.avg.com Copyright (C) 2008 PR Newswire. All rights reserved End of Story http://www.marketwatch.com/news/story/AVG-Press-Statement-Regarding-Problems/story.aspx?guid="58A31585-DD3E-4930-81C6-0DCFB355DF8D>
...See More
DA_Mccoy
Original Author
14 years ago
"The Trojan horse employs a powerful two-step process to commit the electronic crime. First, the virus lies in wait until a customer with an infected computer visits an online banking site.....".

Anne I have to agree with Bobbie here. My understanding is it is system based.

DA
anne_ct
14 years ago
Further research beyond that article and I agree with you both. But I have to say that the article we both read, DA, is a tad confusing. I've linked a more intense description provided by Trend Micro...with diagrams. ;-)

Boy! If it isn't one thing...it's another. sigh It took me years to agree that on line banking was secure enough that I would consider using it. Now this! But, as both articles point out...good AV programs are the key to protection.

However, after following the TM diagram...I don't think WiFi gives anymore protection against this particular pest. As long as you visit websites or receive email...one still would have the potential for infection. It's not the way one accesses the Internet. It's accessing it in the first place. Agreed? So...as Bobbie points out...it's protective vigilance that's important.

Anne

Here is a link that might be useful: Trend Micro info
DA_Mccoy
Original Author
14 years ago
Anne,

My Wi-Fi thought was this:

If you had a stand alone Wi-Fi connected system used ONLY (emphasis) for financial matters a user's exposure to risk could be greatly reduced. With no hard-wire connection in the network between the stand-alone and all other general purpose systems an intrusion would then have to originate from the financial sites which of course is not impossible, but highly unlikely. In other words, no cross contamination due to isolation and dedicated use.

Your referred website didn't have a published date anywhere that I could see, and SpyEye has been around in one form or another for a while. Regardless I think it is clear particularity the scenario representations positioned at 12:00(distribution) and 3:00(installed). Thanks for the link.

DA
anne_ct
14 years ago
As the following was established in the first paragraph of Trend Micros's publication...I assumed this was a rather current edition. And, at the very bottom...in wee little letters...the date span of 1998 - 2011 appears.

For clarification...I'm not a Trend Micro user nor am I encouraging it. I used the site just for the definition clarity of this particular pest.

"Trend Micro researchers recently uncovered a cybercriminal operation involving SpyEye that began as early as January 2011. The said operation was orchestrated by "Soldier" (the cybercriminal's handle), who is currently based in Russia. Trend Micro researchers had been monitoring Soldier and his activities since March 2011.>

Copyright (c) 1989-2011 Trend Micro Incorporated. All rights reserved.

As for the stand alone, dedicated WiFi system...I'm still not convinced that it would be any safer. Personally...I don't use any form of WiFi because I've seen that it can be corrupted and I have very little faith in the thought that it's any safer than my hard wired system. But...that's my personal opinion and relates only to me. Each to their own.

Anne
DA_Mccoy
Original Author
14 years ago
Anne,

You must remember I live in rural America.

In my 1000 sq. mi. county to have someone drive down my gravel back road road and pirate the Wi-Fi network established by my 3G connection, the odds are astronomical.

This desktop is hard wired to the 3G connection with the established Wi-Fi being password protected and with the password not stored. It is not a true hard wiring.

I do wish I had cable or DSL as a viable alternative.

DA
anne_ct
14 years ago
Well...I live in rural America, too, DA...but obviously, not as rural as your area. ;-) I'm indeed blessed to have cable/broadband and have all my communication services bundled. You'd love it! But it's not without its faults...especially when an integral system part blows after work hours and you're trying to complete a brain stormed written piece. Fortunately...my ISP has a dedicated midnight to dawn crew whose duty it is to repair their street side service equipment when such annoyances occur.

However...IMO...I don't believe there's any completely safe access. Some are just a tad better protected than others. Again...IMO...there will never be a time when we all won't have to be on our toes. As many before me noticed...the Internet is the [relatively] new western frontier. Some one's always going to be interested in conquering it...for good or for evil. It seems the challenge is just too tempting to resist.

In the mean time...we all try to stay abreast of whatever the latest info/news is and that's why postings like yours are so important. I spreads the word amongst other users who will now have a more educated opportunity to better protect themselves.

Anne

Related Stories

HOUZZ TOURS Houzz Tour: A Texas Home Gets a Healthy, Fresh Start

By Mitchell Parker

Mold eradication was just the beginning for this Austin family's home on a creek bed — toxins of all kinds now don't make it past the door

Sponsored

More Discussions

Tired of MS Office 365 Monthly Fees?

1