A user reported her Windows 10 Professional system was running slowly. On September 14, 2017, I checked the system with SUPERAntispyware, which reported that it found the Ask Toolbar. It reported the following items associated with the toolbar:

C:\ProgramData\ASKPARTNERNETWORK\TOOLBAR
HKCU\Software\AskPartnerNetwork\Toolbar
C:\ProgramData\AskPartnerNetwork

[ More Info ]

[/security/scans] permanent link

I scanned a Windows 10 system used by a family member on July 2, 2017 with SUPERAntispyware Free Edtion, since the system was responding more slowly than I expected even for simple actions, though the system has other antivirus software on it. The first thing that SUPERAntispyware identified was the Ask Toolbar browser extension. It showed the following information for Ask Toolbar:

[ More Info ]

[/security/scans] permanent link

It identified the following Windows registry key as suspicious:

[ More Info ]

[/security/scans/20161217] permanent link

[ More Info ]

[/security/scans] permanent link

[ More Info ]

[/security/scans] permanent link

After implementing the firewall rules, I reconnected the network cable to the system.

Since accessing http://virustotal.com redirects one to http://www.virustotal.com, I wasn't able to access the VirusTotal website until I added the IP address 74.125.34.4 to the list of destination IP addresses the infected system was allowed to access through the firewall. Even though I could then access the site's webapge and select a file to upload, I was unable to actually upload a file that I wanted to check for malware.

So I then added the IP address for the Jotti's malware scan website to the permitted outbound access list for the infected system. I was able to access it with a web browser on the system and upload a suspect file to have it scanned by the 22 antivirus programs the site currently uses to scan uploaded files.

[/security/scans] permanent link

[Sat Mar 22 15:23:58 2014] [error] [client 171.216.29.98] PHP Notice: Undefined index: HTTP_USER_AGENT in /home/jdoe/public_html/index.php on line 39
[Sat Mar 22 15:23:58 2014] [error] [client 171.216.29.98] PHP Notice: Undefined index: HTTP_USER_AGENT in /home/jdoe/public_html/index.php on line 46
[Sat Mar 22 15:23:58 2014] [error] [client 171.216.29.98] attempt to invoke directory as script: /home/jdoe/public_html/blog/

The error was occurring because of PHP code in the file that checks the value for HTTP_USER_AGENT.

I found that the IP address, which is allocated to a system in China, is listed at the Stop Forum Spam site as being associated with someone trying to post spam into forums today - see 171.216.29.98. And when I checked Apache's CustomLog to check the user agent for the browser the user or software program running at the site might be using to identify itself, I found that the log entries indicated that it wasn't providing user agent information, which browsers and web crawlers normally provide. The log also showed that other than that one file at the site's document root, the user or program accessing the site only queried a directory that has "forums" as part of the path. I have blog entries posted on forum software, so that may have prompted the visit to the site from that IP address, if the person or program is looking for sites where he or it can post forum spam.

I checked the "reputation" of the IP address at other sites that provide information on whether an IP address has been noted to be associated with malicous activity and found the following:

1. Site: WatchGuard Reputation Authority
   Rating: Bad
   Reputation Score: 95/100
   Comment: The score indicates the overall ReputationAuthority reputation score, including the name and location of the ISP (Internet Service Provier), for the specified address. A score of 0-50 indicates a good to neutral reputation. 51-100 indicates that threats have been detected recently from the address and the reputation has been degraded.
2. Site: Barracuda Reputation
   Reputation: Poor
   Comment:
   
3. Site: McAfee Trusted Source
   Reputation: Unrated
   Comment:
4. Site: Check Your IP Reputation - Miracare of Mirapoint
   Reputation: High Risk
   Comment: This IP address is used for sending Spam on a regular basis
5. Site: BrightCloud Security Services URL/IP Lookup
   Reputation: High Risk
   Comment: Location - Chengdu, China. Spam Sources found. Webroot IP Reputation is listed as "High Risk", but lower down on the page the status assigned to the address is "Moderate Risk".

To stop any futher access to the server from that IP address, from the root account, I used the route command to reject access by the IP address.

# route add 171.216.29.9 reject

Note: the command is valid on a Linux system, but though the route command is available on a Microsoft Windows system, that operating system doesn't support the "reject" parameter.

The blocked route can be seen by issuing the route command with no parameters.

# route
Kernel IP routing table
Destination     Gateway         Genmask         Flags Metric Ref    Use Iface
171.216.29.9    -               255.255.255.255 !H    0      -        0 -

If I ever want to permit access to the server from that IP address again, I could use route del 171.216.29.9 to permit access from that address.

References:

1. Stopping an Attacker with the Route Reject Command
   MoonPoint Support
   Date: April 15, 2007

[/security/scans] permanent link

I ran a scan of a Windows XP Service Pack 2 system with an up-to-date version of Verizon Internet Security Suite on 2010-10-03. The software, which states it is "Powered by McAfee" reported the following:

During the full scan, McAfee detected one item that requires your attention. View the scan details to fix this issue now.

Results
Items Scanned: 324912
Items Detected: 88
Items Fixed: 87
Items Remaining: 1

Potentially Unwanted Programs Adware-Url.gen

Files Affected
C:\Program Files\Free Offers from Freeze.com\afactory.url
C:\Program Files\Free Offers from Freeze.com\bingocafe.url
C:\Program Files\Free Offers from Freeze.com\gamepipe.url
C:\Program Files\Free Offers from Freeze.com\gifart.url
C:\Program Files\Free Offers from Freeze.com\graflatscreen.url
C:\Program Files\Free Offers from Freeze.com\pcpowerscan.url
C:\Program Files\Free Offers from Freeze.com\spcasino_sep.url

I chose to have Verizon Internet Security Suite quarantine the files. When I checked on what else it had found, I found it reporting it had quarantined an instance of Spy-Agent.bw!zip, which it found in a file, bill.zip, that it found at C:\Documents and Settings\Jeanne\My Documents\Email\Embedded\bill.zip, i.e., it appeared to have quarantined an attachment to an email message. There was no indication that the file had actually led to any infection of the system, just that a zip file containing the malware had been detected. The webpage for that malware contained a link to a McAfee webpage Spy-Agent.bw, which indicated McAfee first discovered that malware on August 20, 2007.

The scan also found a lot of cookies wich the antivirus program deleted, but I consider those fairly innocuous.

[/security/scans] permanent link

When I logged into the ThelmaLou system as the administrator to check it today, I saw the following error message:

When I clicked on OK, I then saw the following:

When I clicked on "click here", I saw the following error signature information:

AppName: hkcmd.exe	 AppVer: 3.0.0.1607	 ModName: oleaut32.dll
ModVer: 5.1.2600.3266	 Offset: 000344f1 

The file C:\DOCUME~1\ADMINI~1.MAY\LOCALS~1\Temp\c0f3_appcompat.txt was associated with the error report.

I checked the system with Bazooka Adware and Spyware Scanner, even though it's malware definitions haven't been updated in almost a year; they are 340 days old now. It didn't find any malware.

I then checked the system with Spybot Search & Destroy. It reported Microsoft.WindowsSecurityCenter_disabled. with registry entry HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\wscsvc\Start (is not)W=2, but nothing else, aside from 2 cookies. I eliminated the two cookies, one for DoubleClick and one for ValueClick.

[/security/scans] permanent link