Swizzor - easy removal. Swizzor removal tool

Swizzor is a new adware application with dangerous features. It hijacks your homepage, redirects searches and shows annoying popups from lop.com, maximumexperience.com, trinityacquisitions.com an other malicious web-sites. You can use manual removal (editing your registry) but remember that Swizzor can update itself. Download Spyware Doctor anti-spyware with free scan to get rid of this parasite.

Automatical Removal:
Download Swizzor removal tool and provide full system scan for spyware, viruses and security exploits.

Swizzor automatical remover

Manual removal:
Remove Swizzor registry entires:

3FFDF828-416C-B45A-CAA8-BEF6FC553ACE
A01930FF-5945-02DE-FE1A-20EB3983777D

W32.Trats - new dangerous virus. How to remove?

W32.Trats is a dangerous worm that can infect network computers and cause serious system slowdowns and even Windows crash. Download Spyware Doctor to remove this W32.Trats from your computer.

W32.Trats is a deadly virus that can infects executable files located in the Startup folder to run itself when Windows starts.
precisesecurity.com

W32.Trats Removal Tool

Remove W32.Trats registry entires:
HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\
Windows\"load" = "[RANDOM CHARACTERS].exe"
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Contro l\Lsa\
"Notification Packages" = "scecli [RANDOM CHARACTERS].dll"

Remove W32.Trats files:
%Temp%\TMP[RANDOM CHARACTERS].tmp
%System%\[RANDOM CHARACTERS].exe
%System%\[RANDOM CHARACTERS].dll

Elfwgps Toolbar Removal Tool - Remove Elfwgps Toolbar

Elfwgps Toolbar is the latest Zlob toolbar that promotes rogue software (VirusProetct and others) . It generates false positives and other commerical ad's to trick users into downloading and purchasing that badware. Use Spyware Doctor with free scan to delete Elfwgps and other parasites.

Another common symptom of The Elfwgps Toolbar is a thin yellow bar that appends itself to the top of the search results page. The message: “Warning: possible spyware or adware infection! Click here to scan your computer for spyware and adware…”. The Elfwgps Toolbar will also drop Elfwgps.dll into the system registry.

Elfwgps Toolbar automatical removal:

Elfwgps Toolbar Remover

Elfwgps Toolbar Manual removal:
Unregister Elfwgps Toolbar DLL Files:
Elfwgps.dll
byxww.dll
ssqpp.dll
ezzhjmt.dll
browsew.dll
ddcyvtt.dll
ctl3d3.dll
hggdbab.dll
toprates.dll
sprt_ads.dll
oggview32.dll
turbosearchsite.dll

Remove ElfwgpsToolbar Registry Values:
A74F3FC3-CC9A-4D4C-AFB5-B56F0CAA445D
14B65C62-1F53-4B15-9476-5D697608536F
82C8422E-86A3-41C1-9F2E-094F7BF849E2
BCBC8B3C-397C-4D98-B6BA-FF337B9671E1
17D2F953-B2D1-4D1B-BCD3-20432E09ECF1
80DFDD57-D8B8-4991-82B9-9E9D426668B0
4911E55D-9240-49DB-B878-337DE4F53E70
4090F502-6B2D-41B4-8409-B08905A3A0E6
F10587E9-0E47-4CBE-84AE-7DD20B8684BB
47EFD4AD-CB46-4549-B24B-CEE415394C56
3DAF1739-AB9E-493E-8DD7-F65CDF363BCB

EasySpywareCleaner - new rogue. Remove EasySpywareCleaner

EasySpywareCleaner is a corrupt security software that may be distributed by Trojan horses. It can damage your computer and steal sensitive data. We recomend to remove it using Spyware Doctor anti-spyware with free scan.

URL: hxxp://easyspywarecleaner.com

...Like other fake anti-spyware, EasySpywareCleaner scans your PC and gives you false positives. EasySpywareCleaner may also pop up fake security alerts to try and trick you into buying EasySpywareCleaner. You may have installed EasySpywareCleaner yourself from a website such as EasySpywareCleaner.com, or EasySpywareCleaner may have downloaded itself onto your computer through a trojan or web browser security holes...
411-spyware.com

Automatical Removal Tool:

EasySpywareCleaner Remover

Manual removal guide:
Remove EasySpywareCleaner files:
easyspywarecleaner.exe ctfmona.exe

Remove EasySpywareCleaner registry keys:
4A46AA3D-E768-417F-ACB2-4F2DBE627C91
A7466D76-5238-4DFF-80C1-1CCDA340E6DE
B089FCEA-D948-422B-AFE0-5C417ABF008A
5FB7C36E-AD5C-4186-B71D-FF9E9EECF084
9F45645D-F7EB-4AFC-A941-B4C728DAA328
69901778-1C15-417F-AB63-930E7CD23F88
6D2BA939-00E0-4DA9-983D-C20ACB19BD79
F0A32479-95AC-435C-A58B-B668D836F923
5C303CD7-9CE0-4159-9846-FD76173EDB67
23EB7E0E-1E83-4201-9424-5AE5EE09B15C
327F71DD-C3C2-4129-841C-04098BFB5597
3E4F6398-385B-4224-94C3-656B813B3C2C
F1D60ACF-F9B9-483A-BD68-C71D3C56551F
74D770CF-508C-4845-8E82-F3FC0E5D1422
7E176552-7032-4F8E-90FF-A51719107ADB
81F9FDCB-28D7-4A90-95B4-C1DE9AF3F32C
9292309A-0050-447A-BA98-B4A382C19547
F222234A-4755-4930-A782-91EDD3134EE4
01B9C0A1-0D8B-4393-8491-DB3AF10044D2
032909E3-F4D1-467F-B60F-FD5F66AEC156
F43812FA-D114-466E-83B2-EF30CF1681C4
BBF7FF3D-1551-4685-974F-5D6B56B47FD2
CD2C1141-5C60-44BC-8B62-758EF638B75D
CD522F2F-6F7E-4A8A-9860-DAE7C9E8CA81
4DAE1988-A47D-4793-9B5D-D37EF037BD13
D1B2D975-1AF5-4B6B-8D68-F743EC9DF80C
E0FB15B5-0A51-489B-A449-0DE6BB146D29
C0C73911-0016-42EA-AFDC-0E2A533C2B47
C3C7EA64-D85F-4AF1-82B9-838FCE176D19
E14F834C-1EDF-4BB2-9732-A2F82DE2DF75
E519CC61-3993-4323-9050-95E525456D2D
735AB503-0F30-4612-BD44-FD5DDD02C144
13EA307E-2496-4DF7-8640-8AF289CDD486
230D837F-B761-4CC4-A022-6FD9C9D5FFF6
4E518CC2-C99A-42A1-A8EC-80A3FCCA462D
22C0743E-3760-4F06-BE72-95DD92A0E9E2
2E58C32A-4CF2-4E4E-9857-8FC48B26AD63
7274344E-3F51-48A3-8D98-D5BC5E32BB6D
7569C223-75F5-4A2E-AAFF-3F9143770AEF
7B927BA4-1621-4D95-AF3A-0077409FCBFC
4F67ED5B-DF35-4D2D-B315-E855E17C7665
508F1A27-A919-49A5-9E7A-AFD99917B85A
5940985E-31EC-4A1E-B947-FBDD5455DA75
68901E0C-D675-4309-8905-E2F1690FF9DD
C38315D3-C8EE-41D5-827D-7CEAF0C1DA46
4260EC1C-554C-4FEA-93E0-066095DDD228
917CF956-C92B-4670-8C52-CBD6436E3E22
052A5FB6-8FB9-4515-B6D9-3DAB761B51D6
20D171FB-20BD-419A-844D-702FD207DEEF
4D5E25F0-108E-4253-8C38-F4E40E7CFBCF

Mdelk.exe removal tool. Remove Mdelk.exe process

Mdelk.exe is a malicious process that can download and execute additional spyware programs. We recomend to remove it using Spyware Doctor anti-spyware with free scan.

Mdelk.exe is actually an executable process that is the residual effect of downloading one of several worms and trojan viruses on the net today, some of which include Trojan.MitGlieder.GB and TROJ_MITGLIED.AA. The Mdelk.exe process is extremely harmful to your PC, can shut down most other processes and programs from running, including anti-spyware applications and internet access.
www.spywarenotice.com

Mdelk.exe remover

Remove allsecuritypage.com - allsecuritypage.com removal tool

Allsecuritypage.com is the latest browser hijacker that generates fake spyware detection reports to scare users and force to download rogue anti-spyware software. Allsecuritypage.com can damage your computer, steal personal data and cause REAL system errors and malware installations. We recomend to use Spyware Doctor antispyware with free scan to remove this hijacker.

Allsecuritypage.com hijacker:

Automatical removal tools:

Allsecuritypage.com remover

Manual removal instructions:

Remove registry keys and subkeys:
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\
{70d17a5f-ef27-4295-90f5-20ad6f24834f}
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\
{80ced3d6-ece9-48ba-8df8-2503d8d87c2b}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Uninstall\Messenger Service
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\
{D61D7E1A-6613-49CA-B6F9-51DB248E209D}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Explorer\Browser Helper objects\
{D61D7E1A-6613-49CA-B6F9-51DB248E209D}
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
Uninstall\IExplorer Security Plug-in
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\
Uninstall\Internet Explorer Secure Bar
HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\
{aa6d4f53-4c8d-4549-84d2-02d584acc4e9}

Remove files and dll's:
isamini.exe
isamonitor.exe
pmmon.exe
pmsngr.exe
iesplugin.dll
iesuninst.exe
isaddon.dll
Online Security Guide.url
Security Troubleshooting.url
Online Security Guide.url
Security Troubleshooting.url
pmmon.exe
pmsngr.exe
pmuninst.exe
gtawclv.dll
vjxwnn.dll
khtbpdl.dll
cfqbw.dll
fdpzgi.dll
vmlwp.dll
veptlh.dll

How to fix TrustedAntiVirus infection?

TrustedAntiVirus (www.trustedantivirus.com) is a rogue anti-spyware with dangerous behaviour. Download TrustedAntiVirus removal tool to fix your computer.

TrustedAntiVirus is a high risk fake scurity application, that can be installed by trojan or other malware.TrustedAntiVirus make fake system alerts and warnings to scare user into buying “full version” of this dangerous program. TrustedAntiVirus can open security holes in your system and install other malware. After removing, TrustedAntiVirus can recrate itself.

Automatical removal of TrustedAntiVirus

Download Spyware Doctor removal tool with free scan

Manual removal TrustedAntiVirus
Remove TrustedAntiVirus files and links: unamscan.dll, scnkrnl.dll, TrustedAntivirus.exe

Remove TrustedAntiVirus registry values: DMicrosoftWindows/CurrentVersion/Explorer/Menu/Order/Start Menu/2Programs/TrustedAntivirus

Screenshots:

Internet speed monitor popups - how to remove?

Internet Speed Monitor is a popups caused by Adware.BndDrive. It installed without your acknowledgement and starts each time Internet Explorer is opened. When you would do a search on Google or Yahoo, it would also give sidebar with additional links provided by internet speed monitor. Internet Speed Monitor can generate tonns of annoying popups. We recomend to remove Internet Speed Monitor and Internet Speed Monitor 2 using Spyware Doctor anti-spyware with free scan.

Internet speed monitor removal tool

How to remove Trojan dropper - Trojan.Dropper removal instructions

Trojan.Dropper is a common name for trojan family that includes more than 100 different trojans. Trojan Dropper can secretely install rogue anti-spyware programs and display fake security warnings and commercial popups. In addition Trojan Dropper can open large enough security hole for anonymous attackers to easily steal your information and extract sensitive data. Download Trojan.Dropper remover - Spyware Doctor, it can easily remove

Trojan dropper variants:

Trojan-Dropper.Win32.Small.jh
Trojan-Dropper.Win32.Agent.aaj
Trojan.Dropper.Payload
Trojan.Dropper-Delf
trojan.dropper.lv
Trojan-Dropper.Agent.dgo
Trojan.Dropper.Agent-ME
Trojan.Dropper.Agent-CWZ
Trojan-Dropper.Agent.qw
Trojan.Dropper-GS
TrojanDropper.Win32.Siboco.a
Trojan/Dropper/Levil.B
Trojan-Dropper.W32.Agent.pb
trojan-dropper.win32.agent.hl
Trojan-Dropper.Win32.Delf.sq
Trojan.Dropper.Delf.Op
Trojan.Dropper.Small.Atw
Trojan/Dropper/Gred
Trojan-Dropper.Paradrop.a
Trojan-Dropper.Agent.bxk
TrojanDropper.Kbind
Trojan-Dropper.agent.ack
Trojan-Dropper.Stration.J
Trojan Dropper Win32 Delf.fd
TrojanDropper.VBS.Inor
Trojan-Dropper.Win32.Agent.bcw
Trojan.Dropper.BeJoin.100
Trojan.Dropper.Small.IG
Trojan.Dropper.Delf.VP
Trojan.Dropper.Generic.DZD
Trojan-Dropper:W32/Agent.CMW

Trojan.Dropper Removal Tool with free scan

AntiSpyBoss - extradangerous rogue! Be aware of downloading!

AntiSpyBoss description:

AntiSpyBoss (www.AntiSpywareBoss.com) is the latest rogue with aggressive behaviour and fake detection mechanism. Zlob.Trojan can display AntiSpyBoss popups (www.AntiSpywareBoss.com) and fake online scanners (see screenshots) trying to scare user and force to download and purchase AntiSpywareBoss full version. This program is totally useless, it have no antispyware engine, it’s just a dummy. Remember that AntiSpyBoss can install other malicious programs and slow your computer. AntiSpyBoss may cause significant drops in processor and Internet speed, personal and financial data theft, system breakdowns Be aware of this fact and remove AntiSpyBoss immediately if you happen to be infected.
Spyware removers

Download new version of Spyware Doctor spyware remover to get rid of AntiSpyBoss.

AntiSpyBoss screenshots:

screenshot from bleepingcomputer forums

AntiSpyBoss manual removal:
Remove the following AntiSpyBoss files:

C:\Documents and Settings\yourloginname\Local Settings\Temp\512.tmp
C:\Documents and Settings\yourloginname\Local Settings\Temp\cutcr.exe
C:\Documents and Settings\yourloginname\Local Settings\Temp\gqutznet.exe
C:\Documents and Settings\yourloginname\Local Settings\Temp\homepvl.exe
C:\Documents and Settings\yourloginname\Local Settings\Temp\swaphzrp.exe
C:\Documents and Settings\yourloginname\Local Settings\Temp\tehreg.exe
C:\Documents and Settings\yourloginname\Local Settings\Temp\winblm.exe
C:\Documents and Settings\yourloginname\Local Settings\Temp\wxnphome.dll
C:\Windows\hwahchar.exe
C:\Windows\iwpvdesk.exe
C:\Windows\oycxftp.dll
C:\Windows\realhb.dll
C:\Windows\realsw.dll
C:\Windows\swappk.exe
C:\Windows\webexh.dll
C:\Windows\System32compuz.exe
C:\Windows\System32hbpuulog.dll
C:\Windows\System32mailnfwj.dll
C:\Windows\System32sepubdel.dll
C:\Windows\System32svgafiv.dll
C:\Windows\System32tasklkv.exe
C:\Windows\System32umqkmark.exe
C:\Windows\System32utilii.dll
C:\Windows\System32xpsim.exe

AntiSpyBoss removal tool

Dodolook - new chinese crap. Remove Dodolook

DODOLOOK (DODOLOOK.EXE) is a new malware designed by chinese hackers to open browser security holes and steal sensitive data (credit card numbers, PayPal accounts). Dodolook installs itself via exploits or comes bundled with other malware. DoDoLook provides an undocumented access to a programs, online services or an entire computer system. You can easily detect and remove dodolook using latest version of Spyware Doctor anti-spyware scanner and remover.

Dodolook variants:
BackDoor.Win32.Dodolook.c
BackDoor.Win32.Dodolook.d
BackDoor.Win32.Dodolook.e
BackDoor.Win32.Dodolook.f
BackDoor.Win32.Dodolook.g
BackDoor.Win32.Dodolook.h
BackDoor.Win32.Dodolook.i
BackDoor.Win32.Dodolook.j
BackDoor.Win32.Dodolook.k
BackDoor.Win32.Dodolook.l
BackDoor.Win32.Dodolook.m

Dodolook Removal Tool

Win32/VMalum.BRYL review and removal tool

Win32/VMalum.BRYL is a new virus with dangerous behaviour. It can bypass antiviruses and firewalls and install other misleading programs or\and generate commercial popups. Win32/VMalum.BRYL also can restore system settings, move or delete information on hard and flash drives. This parasite can disable some .exe files, and update itself using security holes. Win32/VMalum.BRYL may cause system slowdowns and crashes, we recomend to remove it using Spyware Doctor antispyware.

Win32/VMalum.BRYL automatical remover with free scan

Ahorrememoria - "one country" rogue with well known interface. Quitar Ahorrememoria

Ahorrememoria is the rogue anti-spyware designed specially for users from Spain and Latin America countries. This rogue comes from Russia or Ukraine (AvSystemCare clone) and it generates popups and show fake scan results to scare users and force them to purchase its full version. This misleading program may be installed from www.ahorrememoria.com, but usually it comes bundled with trojan horses (Zlob, Virtumonde). Download Spyware Doctor with free scan to remove this threat from your computer.

Ahorrememoria removal tool

Remove Sujin Virus - Sujin.com.np removal

Sujin is a virus which makes the computer slow and hide the folder option, and lock the policies. It hijacks your browser homepage with Sujin.com.np. Sujin virus may come bundled with other malware and may cause slowdowns and data loss. Download Spyware Doctor to remove Suijin virus from your computer.

Sujin removal tool

Enqvwkp Toolbar - how to remove?

Enqvwkp Toolbar is a new Zlob toolbar with annoying security pop up's and warnings. It will install rogue applications and open browser security holes. Remove it using Spyware Doctor antispyware.
Removal instructions are similiar with Leosrv toolbar.

Enqvwkp Toolbar is a new malicious toolbar (Enqvwkp clone) planted on your PC by a third party in order to secretly monitor what you do online. Moreover, it generates fake security alerts goading users to download and buy rogue software. This toolbar can easily bypass antivirus protection, Enqvwkp authors learned to make their toolbars look different from viruses and malware.
Fix slow computer

Enqvwkp Toolbar Removal Tool

Infostealer trojan virus - fast removal

Infostealer (Trojan.Infostealer) is a Trojan horse that lowers security settings and drops files on the compromised computer. Infostealer is designed to open a large security hole through which hundreds of malicious adware and spyware can be installed to your machine. In addition, Infostealer opens a backdoor that allows the remote attacker to get the full control over the infected computer. We recomend to remove Infostealer trojan (and its variants) using Spyware Doctor antispyware with free scan.

Infostealer variants:

Infostealer.Gampass
Infostealer.Yohokie
Infostealer.Bzup
Infostealer.Proxysteal
Infostealer.Multigame
Infostealer.Lineage
Infostealer.Wowcraft.D
Infostealer.Onlinegame
Infostealer.Tarno Scares
Infostealer.Banker.C
Infostealer.Snifula.B.
Infostealer.phax
Infostealer.msnbancos
Infostealer.Bankash.E
Infostealer.Monstres
Infostealer.finero
Infostealer.Orcu

InfoStealer manual removal instructions:
Find and disable this Infostealer registry entires (Start>Run>Regedit):

SOFTWARE\Microsoft\Windows\CurrentVersion\policies\
Explorer\Run\MSDWG32
SOFTWARE\Microsoft\Windows\CurrentVersion\policies\
Explorer\Run\MSDSG32
SOFTWARE\Microsoft\Windows\CurrentVersion\policies\
Explorer\Run\MSDQG32
SOFTWARE\Microsoft\Windows\CurrentVersion\policies\
Explorer\Run\MSDOG32
SOFTWARE\Microsoft\Windows\CurrentVersion\policies\
Explorer\Run\MSDMG32
SOFTWARE\Microsoft\Windows\CurrentVersion\policies\
Explorer\Run\MSDHG32
SOFTWARE\Microsoft\Windows\CurrentVersion\policies\
Explorer\Run\MSDEG32
SOFTWARE\Microsoft\Windows\CurrentVersion\policies\
Explorer\Run\MSDCG32

Infostealer automatical removal:
It’s highly recommended you use an automatic spyware scanner to determine you’re infected with Infostealer Trojan.

Download Infostealer automatical removal tool

Dcads Toolbar Removal

Dcads is a new toolbar (Internet Explorer BHO) with malicious features. It distributes dangerous malware that can completely destroy your computer. Download Spyware Doctor antispyware with free scan to get rid of this terrible toolbar.

Dcads Toolbar, also known as Superiorads, is an annoying and fake malicious spyware that takes over Internet Explorer. Dcads Toolbar will greatly degrade the performance of your system or sometimes Dcads Toolbar leads to a complete crash of the computer. Dcads Toolbar (Superiorads) also comes bundled with or promotes other softwares. Do not purchase Dcads Toolbar-promoted software under any circumstances since it is not legit.
www.pchubs.com

Dcads Removal Tool

WebCry hijacker - how to remove?!

Webcry (www.webcry.com) is a browser hijacker that makes it so whenever you search somthing using popular search-engines (Yahoo, Google, MSN), and you click the link that your looking for, it re-directs you to webcry.com and then to some sort of ad website. WebCry can also show commercial ad's (with adult and gambling content).
We recomend to use Spyware Doctor anti-spyware to remove WebCry and other spyware, trojans, viruses, tracking cookies, dialers and hijackers from your PC.

WebCry Removal Tool with free scan

Disable this registry values to remove WebCry manually:

52EA2AED-161F-45A5-EBAC-0293CA8C771C
4A4CB994-9A38-DF0F-2760-0708BFE8F63A

(NOTE: When you try to manually editing system registry, you risk destroying your PC. It’s highly recommended you use an automatic spyware scanner to determine you’re infected with WebCry and than remove it.)

MalwareCrush removal - fast and secure

MalwareCrush is the latest representative of SpyLocked\VirusProtect rogue family. There was some problems with MalwareCrush removal. This program have an ability to disable or bypass popular antiviruses (Norton, NOD32 and other). But now you can easily remove it using Spyware Doctor premium anti-spyware with free scan.

MalwareCrush snapshot

If you have good IT security skills you can remove it manually using this MalwareCrush review + removal instructions . Remember that MalwareCrush is extremely dangerous for your privacy and security and it is important to remove this parasite as soon as possible.

How do I know if my Snort implementation is working?

How do I test Snort? How do I know if Snort is sniffing packets? How do I know if Snort is running properly? How do I generate a test alert with Snort? Recently, and over the years, I have regularly seen people join the #snort channel on freenode and post these very questions to the snort mailing lists. Perhaps this little article will index properly in the search engines and end their questions, this is of course assuming that they know how to use a search engine ;-).

There are really several ways of testing snort, some much more complex than others. Probably the most simple way is to define a custom rule that you can easily produce the traffic to trigger the alert. This can be done by creating a simple rule that looks for traffic of a certain type, to a certain address or many other ways but for the purposes of this article we will be looking for traffic to a certain address (as this tends to be the most easily produced). We begin by creating a custom rule either in a new rules file or by adding the rule into an existing rules file. To simplify this you can download the rule from the url below:

https://secure.redsphereglobal.com/data/tools/security/snort/rules/snort-test.rules

Once you have downloaded this rule file and added it to your snort.conf so that Snort has loaded it, simply generate traffic from the monitored network to one or more of the following hosts: 121.175.169.102,193.71.199.6,200.123.165.130. This traffic can be of almost any type. I will typically browse via browser or telnet to a standard IRC port (at the time that I wrote this, these hosts were on the known C&C list) such as 6666, 6667 ....

Once this is done you will see the alerts being generated by snort (assuming that everything is configured properly).

As a second method, you can attempt to generate traffic that an existing snort rule can detect and alert on. To do this, I suggest using a tool such as Metasploit to generate actual attack traffic. You will want to test it against a host that you own, I certainly am not advocating attacking someones network with Metasploit from your network, this host should either be intended to be a test host, and/ or be immune to the attack. A simple example would be to enable the web-iis.rules from snort.org and launch an attack against one of your patched webservers from metasploit in an attempt to exploit MS01-23 using the Metasploit Framework Exploit. This will in-turn generate the WEB-IIS ISAPI .printer access alert to fire.

Either of those two methods should allow you to test your Snort installation, there are some other tcpreplay type tools that you can generate traffic from some signatures with, but by and large they are not effective tests.

Regards,
JJC

HeX Virtual Appliance Image: 1.0.2R

While I have not yet had time to create images for multiple Virtualization technologies, I did finish the image for VMware. Please obtain it at the below URL.

This image is 825M in size and will decompress to a 3G VM.

https://secure.redsphereglobal.com/data/tools/security/live/HeX_1.0.2_VMware.tar.gz
https://secure.redsphereglobal.com/data/tools/security/live/HeX_1.0.2_VMware.tar.gz.md5
https://secure.redsphereglobal.com/data/tools/security/live/HeX_1.0.2_VMware.tar.gz.sha256

Enjoy,
JJC

HeX 1.0.2 LiveUSB Update

Unfortunately, the previous HeX 1.0.2 LiveUSB image was not the proper release, thanks to those that pointed this out. This has since been remediated, the original links are still valid, I will re-post here for your downloading pleasure.

For additional information on the project, please read my earlier post at: http://global-security.blogspot.com/2008/01/hex-102r-liveusb-release.html

https://secure.redsphereglobal.com/data/tools/security/live/HeX-i386-1.0.2.img.gz
https://secure.redsphereglobal.com/data/tools/security/live/HeX-i386-1.0.2.img.gz.md5
https://secure.redsphereglobal.com/data/tools/security/live/HeX-i386-1.0.2.img.gz.sha256

Cheers,
JJC

Epxonwo Toolbar Removal - easy and safe

Epxonwo Toolbar is the latest malicious toolbar from Zlob Family. It shows exaggarated reports about security risks and spyware infections detected on your PC to scare you and force to download (and than buy) rogue anti-spywares, such as Files Secure and Ie Defender.
Epxonwo will add a thin yellow bar that appends itself to the top of the search results page. The message: “Warning: possible spyware or adware infection! Click here to scan your computer for spyware and adware…”. This toolbar can be dangerous for your privacy and security. You can remove it using Spyware Doctor anti-spyware with free scan. It will remove Epxonwo Toolbar safely and quickly! Also you can remove this toolbar manually.

Epxonwo Toolbar modification screenshot

Manual removal instructions:
Remove Epxonwo Toolbar files and unregister dll's:
epxonwo.dll
byxww.dll
ssqpp.dll
ezzhjmt.dll
hggdbab.dll
toprates.dll
sprt_ads.dll
browsew.dll
ddcyvtt.dll
ctl3d3.dll
oggview32.dll
turbosearchsite.dll

Remove Epxonwo registry values:
A74F3FC3-CC9A-4D4C-AFB5-B56F0CAA445D
80DFDD57-D8B8-4991-82B9-9E9D426668B0
BCBC8B3C-397C-4D98-B6BA-FF337B9671E1
17D2F953-B2D1-4D1B-BCD3-20432E09ECF1
4911E55D-9240-49DB-B878-337DE4F53E70
4090F502-6B2D-41B4-8409-B08905A3A0E6
F10587E9-0E47-4CBE-84AE-7DD20B8684BB
47EFD4AD-CB46-4549-B24B-CEE415394C56
14B65C62-1F53-4B15-9476-5D697608536F
82C8422E-86A3-41C1-9F2E-094F7BF849E2
3DAF1739-AB9E-493E-8DD7-F65CDF363BCB

Epxonwo Removal Tool

Screencast: An Introduction to NSM-Console

Dakrone has created a useful screencast of his new tool, read / see more on his blog

http://thnetos.wordpress.com/2008/01/05/screencast-an-introduction-to-nsm-console/

Cheers,
JJC

HeX 1.0.2R LiveUSB Release

As I have been away on holiday, I have been unable to release the next iteration of the HeX LiveUSB tool. Let this post serve to remediate that (albeit a bit late). Without further adeau, the download is located at the following URLs:

https://secure.redsphereglobal.com/data/tools/security/live/HeX-i386-1.0.2.img.gz
https://secure.redsphereglobal.com/data/tools/security/live/HeX-i386-1.0.2.img.gz.md5
https://secure.redsphereglobal.com/data/tools/security/live/HeX-i386-1.0.2.img.gz.sha256

For those that are not familiar with the HeX project, please read further at rawpacket.org. The LiveUSB project is a subset of the overall HeX project and adds a bit of functionality to suit your portable packet monkeying needs. Essentially it gives you a slightly larger (and writable) filesystem to do with what you please; i.e. update signatures, modify configurations, store data and the like.

To use the LiveUSB; simply download decompress and dd onto your device (example on fbsd: dd if=/path/to/HeX-i386-1.0.2.img of=/dev/da0 bs=1M). Note that for speed purposes it is important to increase your default block size in fbsd, the value of 1M takes about 200 seconds for my system to write the entire 2G image.

This release contains the NSM Console as described below.

Matthew(Dakrone) is the main developer of NSM Console, here’s the short description about it -

NSM Console (Network Security Monitoring Console) is a framework for performing analysis on packet capture files. It implements a modular structure to allow for an analyst to quickly write modules of their own without any programming language experience which means you can quickly integrate all the other NSM based tools to it. Using these modules a large amount of pcap analysis can be performed quickly using a set of global (as well as per-module) options. NSM Console also aims to be simple to run and easy to understand without lots of learning time.

If you want more information about what it is (and what it does), check out this introductory post -

http://thnetos.wordpress.com/2007/11/27/nsm-console-a-framework-for-running-things/

You can access NSM Console by clicking the menu -> NSM-Tools -> NSM Console

There are also several bug fixes in this release, as well as new nifty wallpapers (for the holiday season hah).

http://www.rawpacket.org/projects/hex/artwork

1. unicornscan run time error
2. svn run time error
3. lsof run time error
4. firefox startup issue
5. pidgin and liferea dbus issue
6. CDROM-Mount.sh syntax error
7. script command issue
8. ping setuid issue

Other known major or minor issues in the Base System are fixed, thanks to chfl4gs_.

Cheers,
JJC

Unknown Trojan - new scaring tactic!

Authors of IEDefender and Files Secure invented a new scaring tactic. These programs show message about unknown (!!!) trojan infection to scare gullible users.
Below is the message:

You can simply remove this fake trojan messages and rogue antispywares using Spyware Doctor antispyware with free scan. Also you can try to remove it manually (removal instructions are the same as Trojan.win32.BHO Removal Instructions)

Unknown Trojan Popup Message Remover

Trojan-Proxy.Win32.Small.fk - your computer becomes a proxy for attckers

Trojan-Proxy.Win32.Small.fk (or Trojan.Win32.Obfuscated.fw) is a malicious trojan that gives an opportunity to use your machine as a proxy server, transfering data through your machine and flooding your internet connection. This trojan can also install other spyware. To detect and remove Trojan-Proxy.Win32.Small.fk securely, download Spyware Doctor anti-spyware with free scan.

You can try to remove it manually deleting this registry entires:

[HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\
fade] "DllName" = ".dll" "MaxWait" = " dword: 0x00000001" "Logon" =
"Event" "Asynchronous" = "dword: 0x00000001" "Impersonate" = "dword:
0x00000001"

Trojan-Proxy.Win32.Small.fk removal tool

Ensfolr - latest Zlob.Trojan BHO - Ensfolr Toolbar Remover.

Ensfolr is the first 2008 Zlob. Toolbar (Leosrv clone). It will try to install tonns of spyware and rogue security applications. We recomend to remove it as soon as

Ensfolr Toolbar is the latest malicious browser helper object (Internet Explorer BHO) designed to promote and sell rogue anti-spyware programs. Base modification of Ensfolr toolbar have four icons: Remove Popups, Scan Spyware, Security Test, & Spam Protection. This toolbar generates spyware warnings and fake security alert to trick trustful users into downloading and purchasing dangerous rogue antispywares (Files Secure, AntiSpywareSield, VirusHeal e.t.c). Ensfolr toolbar can also hijack your browser, showing fake Security Center page. This toolbar may slow your PC, flooding internet connection and generating annoying popups.
Spyware Removers
Another common symptom of The Ensfolr Toolbar is a thin yellow bar that appends itself to the top of the search results page. The message: “Warning: possible spyware or adware infection! Click here to scan your computer for spyware and adware…”. The Ensfolr Toolbar will also drop Ensfolr.dll into the system registry.
Spywarenotice.com

You can use Manual removal instructions (same as for Leosrv.Toolbar). But to save time and avoid risking destroying your computer, we highly recommend use a spyware scanner such as Spyware Doctor with absolutely free scan. It will detect and remove all Ensfolr Toolbar files, dll's and registry values. It will also kill other spyware, adware, Trojans, keyloggers, dialers and more that can be hidden in your PC.

Ensfolr Toolbar Removal Tool

Happy New Year!

Greetings all, and Happy New Year!

I have been traveling for roughly the past three weeks and have therefore been unable to publish any updates to this site. Rest assured though that I have some good new material for the 2008 security and noob thrashing season ;-)

That said, I trust that everyone had a fantastic holiday and New Year celebration! I want to thank you all for the support and feedback that I continually receive.

Regards,
JJC

Fix XPAntiVirus - XPAntiVirus Remover

XpAntiVirus - is one of the most aggressivly promoted rogues during last week.

XPAntiVirus is the suspect anti-spyware that includes a set of features which do not work, and generates false positives to trick users, forcing them to buy commercial version of this software. XPAntiVirus may be dangerous for your computer, causing system errors and slowdowns. This misleading program can be installed manually or through browser security holes (using trojan horses or worms, installed on your computer). It also hijacked the homepage to obscure websites, sometimes with adult content. Remember that XPAntiVirus is unable to remove spyware and viruses!
www.fix-computer-problem.com

We recomend to use Spyware Doctor antispyware with 100% FREE scan. Spyware Doctor is the most technologically advanced application on the Internet for detection and removal of potentially undesired items. It will easily remove XPAntiVirus from your computer.

XPAntiVirus Remover