The University of Massachusetts Amherst
Categories
Security Virus/Malware

Arrrr! Piracy be Dangerous!

Its a trap!
Admiral Ackbar is wary of pirated copies of software.

I was reading my RSS feed for Slashdot and I came across this article. This is a great example for why piracy is dangerous. Mac users who get copies of iWork ’09 from the Internet can get a trojan virus. That’s right! While Mac OS X is generally safe against viruses, most programs require that you type in your username and password to install them. As soon as you do this, you are granting the program administrative access to your system! If the program contains a virus, you are giving it free reign.

It’s important to trust the place that you get your software. Make sure that you download software from the maker’s official website or an authorized mirror. That is to say, if you want to get a program like Firefox, you should go to http://www.mozilla.com or http://www.getfirefox.com — not some random website from Google.

Arrr! Be wary, mateys! Sometimes the booty be trapped! If you believe that you have a virus on your computer, contact OIT Help Services for assistance.

(Neither the Office of Information Technologies nor the University of Massachusetts Amherst condone the piracy of copyrighted material. For more information on copyright infringement, please visit this link.)

Instructions for removing the infected iWork package (from MacRumors):

Solution 1: This is the easiest and safest way for users to remove this Trojan. It is a small utility that has been created by the makers of MacScan AntiVirus software for Mac users. Please note that this is not officially supported by OIT Help Services and we cannot guarantee its effectiveness.

http://macscan.securemac.com/files/iWorkServicesTrojanRemovalTool.dmg

Solution 2:

Note: BE VERY, VERY CAREFUL. Typing in these commands incorrectly can delete large swaths of information from your hard drive. Use the following solution at your own risk. We recommend that you try Solution 1 first!

1) (open Terminal.app)
2) sudo -i (enter password)
3) rm -rf /System/Library/StartupItems/iWorkServices
4) rm -f /private/tmp/.iWorkServices
5) rm -f /usr/bin/iWorkServices
6) rm -rf /Library/Receipts/iWorkServices.pkg
7) killall -9 iWorkServices

Categories
Security

The Importance of Updates: A Parable

When I assist clients at our front desk, I try to explain the importance of updating operating systems (e.g. Microsoft Windows, Mac OS X, Linux.) Many clients don’t realize that updates are vital to the continued security of computers; you can’t just ignore them. So, to explain what they do, I came up with a fun analogy.

Your computer is like a medieval city with a great wall. The people who designed your city (programmers) want to protect it from from barbarian invasions (virus and malware attacks.)  When they built your city, they erected a giant wall around it for protection (a firewall.) When you started to rule it, you hired a bunch of guards ( you installed anti-virus software.) However, the architects weren’t perfect; there are many small holes in your wall and forgotten tunnels into the city (security holes.) As the architects inspect the city over time, they find these holes and tunnels. Engineers are dispatched around to patch up these holes (Windows Updates) so as to keep your city safe.

The moral of the story: lest the barbarians break in, kill all your guards, and then use your city to attack others, make sure that you install software updates!

Sometimes, you forget to patch the holes in your city or the barbarians find them first. When this happens, you can come to OIT Software Support. Like knights in shining armour, we will happily drive out the barbarians (remove viruses), restore order (fix the problems they created), and give you new and free guards (McAfee AntiVirus.) We’ll also give you advice on how to prevent future invasions; the barbarians are clever.

While all software should be updated, it can be difficult to keep track of it all. There is a program called Secunia PSI. This program will check just about every program on your computer to ensure that it is up-to-date.

If you don’t wish to install Secunia PSI, the most important things to keep updated are the following:

As always, feel free to contact OIT Help Services if you have any questions!

Categories
Hotfix Operating System Security Software Virus/Malware

“Conficker Worm Could Create World’s Biggest Botnet”

I saw this article on Slashdot today and wanted to warn everyone out there. Nine million infected computers running Microsoft systems is an incredible amount of machines compromised.

Make sure your McAfee Enterprise is up to date and your Windows machine has installed all the latest updates!

As the article states, the worm propagates through un-patched Windows systems and through USB thumb-drives. This means that having a secure system or up-to-date virus protection is NOT ENOUGH! You need a combination of both. This is good computer usage in practice anyway, but we see an incredible amount of un-patched XP and Vista systems come in with virus infections.

What you see when an infected USB-drive is plugged-in
What you see when an infected USB-drive is plugged-in
The above image shows what happens when you plug-in an infected USB-stick into a machine. Notice the “Publisher not Specified,” text in gray under the open option? That should be your first clue right there. Do NOT click on this, as this will launch the virus and infect your computer.

It’s just that little yellow icon in your system tray, that little place with icons by the time in the bottom left. Click – Express Install – Done. It’s really that simple.

For those that are interested, the Microsoft Security Bulletin can be read here.

Categories
Operating System Windows

The Blue Screen of Death ( BSOD ) in Windows

A Blue Screen of Death - From the Wikimedia Commons
A Blue Screen of Death - From the Wikimedia Commons

You will see a distinct look of fear in the eyes of anyone who has used Microsoft Windows when you mention a ‘BSOD’ or ‘Blue Screen of Death’. Sometimes they occur a single time and then go away, but other times they will recur every time that you restart the computer.

When this happens to you, there are a few things to try:

  • If your computer restarts in an endless loop and you can’t tell why, hit the F8 key repeatedly, about once a second, just as the computer starts to reboot.
  • You will get a menu that looks something like this:
The Safe Mode selection screen for Windows Vista
The Safe Mode selection screen for Windows Vista
  • Select the option entitled, “Disable automatic restart on system failure.”
  • Next time that you get the BSOD, it won’t restart automatically and you can then acquire useful information for troubleshooting the problem.
  • When you get the BSOD, copy down the complete STOP CODE which is formatted like so:
    • STOP: 0x00000000 (0x00000000, 0x00000000, 0x00000000, 0x00000000)
  • The first set of numbers (in blue) can be entered into Google or the Microsoft Knowledge Base.

You can then sometimes get useful information for fixing the problem. If nothing else, copy down the error numbers to bring to OIT Software Support. Other useful information includes the hardware (e.g. mouse, monitor, printers, scanners, USB devices) attached to the computer and the programs you remember running. The more contextual information we have, the easier it will be to solve a problem!

Categories
Operating System Virus/Malware Windows

How to delete the Windows Antivirus virus

If you have seen this screen then you know what virus I am referring to.

Here in Software Support, we use a program called ComboFix that you can download yourself by clicking here. This software will clean up most instances of this known type of virus called “Smitfraud,” and will generally leave your system much more operable than before. Recently, the number of outbreaks of this virus and ones like it have become staggering.

This software changes daily and must be downloaded every time it is run! The best way to do this is to download it on a computer that is clean and copy it over onto a USB pen drive.

Usually at Software Support there is a lull in the middle of the semester, but last fall the amount of traffic into SWS was something that I have never seen in my four years of working here.

If you feel that your computer is not running correctly, or if you think that the error messages that are popping up are not from your normally installed anti-virus or anti-spyware software, this should be your first step in alleviating the problem.

Of course, if you are having issues running the software or are not comfortable doing this, you can bring the computer in and we will run it for you.

Categories
Microsoft Software

Microsoft Word 2007 hangs when switching documents

People come into Software Support frequently with complaints about MS Word being slow or unresponsive.  I have noticed that MS Word add-ins are often to blame for these performance issues, especially by introducing a delay before starting Word or switching from one document to another.  Most of these users have multiple Word add-ins (whether they are aware of the fact or not) and so here is a very quick guide to check to see if add-ins are your issue.

The general idea is to disable add-ins and check to see if disabling a certain add-in made word significantly more responsive.  If it did, then either look into updating it or keeping it disabled if you don’t use it.  The steps for disabling an Add-in are follow:

1) Go to the Office menu, then select Word Options

2) Go to Add-Ins and take a look at the Active Application Add-ins.  Often an Adobe product will be in this list and it is often this entry that is the issue.  Select the Add-in you want to disable and press Go…

3) Deselect an Add-in (uncheck the box next to it) and hit OK.  Sometimes you’ll get the following error:

If you get this error and are running Windows Vista, close Word, navigate to C:/Program Files/Microsoft Office/Office12/ and right click on WINWORD.EXE.  Select Run as Administrator and follow the above steps again.

Categories
Virus/Malware

AIM Viruses

Many users are curious as to how their systems are infected with viruses. While there are many different ways that this can happen, one common method is via something called an AIM virus. Sent as messages over AIM or other instant messaging clients (e.g. MSN Messenger, AIM, GTalk), users receive an instant message saying something like, “Check out these pictures of you I found on Facebook (Myspace, Flickr, etc.)” When a user clicks on the link, their computer is infected with a virus which subsequently sends similar messages to all the buddies on their contact list. Currently, only Windows users are affected by AIM viruses, but all users should be wary of links that they receive.

It is important to double check with friends who send you links over AIM. You can always send a message back saying, “Hey! Did you just send me a link about pictures on Facebook? I know that viruses can look like links from people on my buddy list.” If you are unsure, it’s best to discard the link.

Getting an AIM virus can slow down your computer dramatically. Additionally, if OIT detects that your computer is trying to infect others, you may lose your Internet connection until the virus is removed. Depending on the virus that infects your computer, it is possible to get other infections.

To remove an AIM virus, you can try a fantastic little program called AIMFix, a tool developed by Jay Loden. However, in some cases, the infection may have advanced to such a point where AIMFix will not be able to remove all the viruses. Members of the UMass community can download and install McAfee Virusscan Enterprise for free from the OIT website. Just make sure that you uninstall any other antivirus programs that you have (e.g. Norton Internet Security, McAfee Security Center, AVG, Trend Micro); multiple antivirus programs can conflict and slow down your computer. If this doesn’t help or you have other questions, you can always call OIT for more assistance.