The official definition is “the art and science of getting people to comply to your wishes” which is why it is so fascinating and addictive to people who desire control or power. It is essentially an art in its own right, as very few people can manipulate people, whilst the person not knowing they are being manipulated.

One notorious master of Social Engineering is the famous hacker Kevin Mitnick. Kevin used his skills to gain access to some of the largest corporations in the world. Kevin now does seminars on computer security, helping people avoid some tricks he actually perfected.

One example Mr. Mitnick uses, delightfully illustrates Social Engineering. Kevin picks his target and then carefully waits for weeks on end for a snow storm. When a snow storm occurs, Kevin rings the security guard, distrought, complaining he cannot get to the office to complete a project. He asks the security guard to enter the computer room, and type in a simple command (which unkown to him, creates an administrator account). Mitnick thanks the guard for the help on the ‘project’ and asks him to print out a file list and return to his office. Mitnick then rings the guard, tells him to throw the file list in the bin, thereby framing the security guard. Mitnick has access to all the information he needs and more.

With people so worried about software vulnerabilitys, they fail to see that a person can compromise a whole system and render millions of dollars spent on security utterly useless. Although ‘Social Engineering’ is not a widely used term, you have probably heard of ‘phising’, which impersonate companys or people, to gain passwords. One such company, Ebay, is particularly a target for attack. The problem is even if it is from sender X@Y.com, it can still be impersonated, to look like it came from Y@X.com

Social Engineering is also popular through phone attacks, like "Hi I am John at Microsoft Security, we had a report of fake windows versions in the area, please read us your Windows serial, so we can identify it." The hacker the uses the fake serial number and ships it with thousands of fake copys of Windows, thus leaving the trail of evidence pointing to the victim.

Nothing can fully stop Social Engineering, but companies must educate staff and governments and the general public, about these kind of attacks and how to avoid them. Awarness is the key to thwarting all the would be hackers.

This Article was written by Neil Grogan (Duey Finster)

About the Author
Neil is a computer expert who runs an information site all about technology and security.

For More Information: http://www.dueyfinster.eu

ALL RIGHTS RESERVED ©2005 dueyfinster.com

What is computer security?
Computer security is the process of preventing and detecting unauthorized use of your computer. Prevention measures help you to stop unauthorized users (also known as "intruders") from accessing any part of your computer system. Detection helps you to determine whether or not someone attempted to break into your system, if they were successful, and what they may have done.

Why should I care about computer security?
We use computers for everything from banking and investing to shopping and communicating with others through email or chat programs. Although you may not consider your communications "top secret," you probably do not want strangers reading your email, using your computer to attack other systems, sending forged email from your computer, or examining personal information stored on your computer (such as financial statements).

Who would want to break into my computer at home?
Intruders (also referred to as hackers, attackers, or crackers) may not care about your identity. Often they want to gain control of your computer so they can use it to launch attacks on other computer systems.

Having control of your computer gives them the ability to hide their true location as they launch attacks, often against high-profile computer systems such as government or financial systems. Even if you have a computer connected to the Internet only to play the latest games or to send email to friends and family, your computer may be a target.

Intruders may be able to watch all your actions on the computer, or cause damage to your computer by reformatting your hard drive or changing your data.

How easy is it to break into my computer?
Unfortunately, intruders are always discovering new vulnerabilities (informally called "holes") to exploit in computer software. The complexity of software makes it increasingly difficult to thoroughly test the security of computer systems.

When holes are discovered, computer vendors will usually develop patches to address the problem(s). However, it is up to you, the user, to obtain and install the patches, or correctly configure the software to operate more securely. Most of the incident reports of computer break-ins received at the CERT/CC could have been prevented if system administrators and users kept their computers up-to-date with patches and security fixes.

Also, some software applications have default settings that allow other users to access your computer unless you change the settings to be more secure. Examples include chat programs that let outsiders execute commands on your computer or web browsers that could allow someone to place harmful programs on your computer that run when you click on them.

Technology
This section provides a basic introduction to the technologies that underlie the Internet. It was written with the novice end-user in mind and is not intended to be a comprehensive survey of all Internet-based technologies. Subsections provide a short overview of each topic. This section is a basic primer on the relevant technologies. For those who desire a deeper understanding of the concepts covered here, we include links to additional information.

What does broadband mean?
"Broadband" is the general term used to refer to high-speed network connections. In this context, Internet connections via cable modem and Digital Subscriber Line (DSL) are frequently referred to as broadband Internet connections. "Bandwidth" is the term used to describe the relative speed of a network connection — for example, most current dial-up modems can support a bandwidth of 56 kbps (thousand bits per second). There is no set bandwidth threshold required for a connection to be referred to as "broadband", but it is typical for connections in excess of 1 Megabit per second (Mbps) to be so named.

What is cable modem access?
A cable modem allows a single computer (or network of computers) to connect to the Internet via the cable TV network. The cable modem usually has an Ethernet LAN (Local Area Network) connection to the computer, and is capable of speeds in excess of 5 Mbps.

Typical speeds tend to be lower than the maximum, however, since cable providers turn entire neighborhoods into LANs which share the same bandwidth. Because of this "shared-medium" topology, cable modem users may experience somewhat slower network access during periods of peak demand, and may be more susceptible to risks such as packet sniffing and unprotected windows shares than users with other types of connectivity. (See the "Computer security risks to home users" section of this document.)

What is DSL access?
Digital Subscriber Line (DSL) Internet connectivity, unlike cable modem-based service, provides the user with dedicated bandwidth. However, the maximum bandwidth available to DSL users is usually lower than the maximum cable modem rate because of differences in their respective network technologies. Also, the "dedicated bandwidth" is only dedicated between your home and the DSL provider’s central office — the providers offer little or no guarantee of bandwidth all the way across the Internet.

DSL access is not as susceptible to packet sniffing as cable modem access, but many of the other security risks we’ll cover apply to both DSL and cable modem access. (See the "Computer security risks to home users" section of this document.)

How are broadband services different from traditional dial-up services? Traditional dial-up Internet services are sometimes referred to as "dial-on-demand" services. That is, your computer only connects to the Internet when it has something to send, such as email or a request to load a web page. Once there is no more data to be sent, or after a certain amount of idle time, the computer disconnects the call. Also, in most cases each call connects to a pool of modems at the ISP, and since the modem IP addresses are dynamically assigned, your computer is usually assigned a different IP address on each call. As a result, it is more difficult (not impossible, just difficult) for an attacker to take advantage of vulnerable network services to take control of your computer.

Broadband services are referred to as "always-on" services because there is no call setup when your computer has something to send. The computer is always on the network, ready to send or receive data through its network interface card (NIC). Since the connection is always up, your computer’s IP address will change less frequently (if at all), thus making it more of a fixed target for attack.

What’s more, many broadband service providers use well-known IP addresses for home users. So while an attacker may not be able to single out your specific computer as belonging to you, they may at least be able to know that your service providers’ broadband customers are within a certain address range, thereby making your computer a more likely target than it might have been otherwise.

The table below shows a brief comparison of traditional dial-up and broadband services.

Dial-up Broadband
Connection type Dial on demand Always on
IP address Changes on each call Static or infrequently changing
Relative connection speed Low High
Remote control potential Computer must be dialed in to control remotely
Computer is always connected, so remote control can occur anytime
ISP-provided security Little or none Little or none
Table 1: Comparison of Dial-up and Broadband Services

How is broadband access different from the network I use at work?
Corporate and government networks are typically protected by many layers of security, ranging from network firewalls to encryption. In addition, they usually have support staff who maintain the security and availability of these network connections.

Although your ISP is responsible for maintaining the services they provide to you, you probably won’t have dedicated staff on hand to manage and operate your home network. You are ultimately responsible for your own computers. As a result, it is up to you to take reasonable precautions to secure your computers from accidental or intentional misuse.

What is a protocol?
A protocol is a well-defined specification that allows computers to communicate across a network. In a way, protocols define the "grammar" that computers can use to "talk" to each other.

What is IP?
IP stands for "Internet Protocol". It can be thought of as the common language of computers on the Internet. There are a number of detailed descriptions of IP given elsewhere, so we won’t cover it in detail in this document. However, it is important to know a few things about IP in order to understand how to secure your computer. Here we’ll cover IP addresses, static vs. dynamic addressing, NAT, and TCP and UDP Ports.

An overview of TCP/IP can be found in the TCP/IP Frequently Asked Questions (FAQ) at

http://www.faqs.org/faqs/internet/tcp-ip/tcp-ip-faq/part1/ and

http://www.faqs.org/faqs/internet/tcp-ip/tcp-ip-faq/part2/

What is an IP address?
IP addresses are analogous to telephone numbers – when you want to call someone on the telephone, you must first know their telephone number. Similarly, when a computer on the Internet needs to send data to another computer, it must first know its IP address. IP addresses are typically shown as four numbers separated by decimal points, or “dots”. For example, 10.24.254.3 and 192.168.62.231 are IP addresses.

If you need to make a telephone call but you only know the person’s name, you can look them up in the telephone directory (or call directory services) to get their telephone number. On the Internet, that directory is called the Domain Name System, or DNS for short. If you know the name of a server, say www.cert.org, and you type this into your web browser, your computer will then go ask its DNS server what the numeric IP address is that is associated with that name.

Every computer on the Internet has an IP address associated with it that uniquely identifies it. However, that address may change over time, especially if the computer is

dialing into an Internet Service Provider (ISP)
connected behind a network firewall
connected to a broadband service using dynamic IP addressing.

What are static and dynamic addressing?
Static IP addressing occurs when an ISP permanently assigns one or more IP addresses for each user. These addresses do not change over time. However, if a static address is assigned but not in use, it is effectively wasted. Since ISPs have a limited number of addresses allocated to them, they sometimes need to make more efficient use of their addresses.

Dynamic IP addressing allows the ISP to efficiently utilize their address space. Using dynamic IP addressing, the IP addresses of individual user computers may change over time. If a dynamic address is not in use, it can be automatically reassigned to another computer as needed.

What is NAT?
Network Address Translation (NAT) provides a way to hide the IP addresses of a private network from the Internet while still allowing computers on that network to access the Internet. NAT can be used in many different ways, but one method frequently used by home users is called "masquerading".

Using NAT masquerading, one or more devices on a LAN can be made to appear as a single IP address to the outside Internet. This allows for multiple computers in a home network to use a single cable modem or DSL connection without requiring the ISP to provide more than one IP address to the user. Using this method, the ISP-assigned IP address can be either static or dynamic. Most network firewalls support NAT masquerading.

What are TCP and UDP Ports?
TCP (Transmission Control Protocol) and UDP (User Datagram Protocol) are both protocols that use IP. Whereas IP allows two computers to talk to each other across the Internet, TCP and UDP allow individual applications (also known as "services") on those computers to talk to each other.

In the same way that a telephone number or physical mail box might be associated with more than one person, a computer might have multiple applications (e.g. email, file services, web services) running on the same IP address. Ports allow a computer to differentiate services such as email data from web data. A port is simply a number associated with each application that uniquely identifies that service on that computer. Both TCP and UDP use ports to identify services. Some common port numbers are 80 for web (HTTP), 25 for email (SMTP), and 53 for Domain Name System (DNS).

What is a firewall?
The Firewalls FAQ (http://www.faqs.org/faqs/firewalls-faq/) defines a firewall as "a system or group of systems that enforces an access control policy between two networks." In the context of home networks, a firewall typically takes one of two forms:

Software firewall - specialized software running on an individual computer, or

Network firewall - a dedicated device designed to protect one or more computers.

Both types of firewall allow the user to define access policies for inbound connections to the computers they are protecting. Many also provide the ability to control what services (ports) the protected computers are able to access on the Internet (outbound access). Most firewalls intended for home use come with pre-configured security policies from which the user chooses, and some allow the user to customize these policies for their specific needs.

More information on firewalls can be found in the Additional resources section of this document.

What does antivirus software do?
There are a variety of antivirus software packages that operate in many different ways, depending on how the vendor chose to implement their software. What they have in common, though, is that they all look for patterns in the files or memory of your computer that indicate the possible presence of a known virus. Antivirus packages know what to look for through the use of virus profiles (sometimes called "signatures") provided by the vendor.

New viruses are discovered daily. The effectiveness of antivirus software is dependent on having the latest virus profiles installed on your computer so that it can look for recently discovered viruses. It is important to keep these profiles up to date.

More information about viruses and antivirus software can be found on the CERT Computer Virus Resource page

http://www.cert.org/other_sources/viruses.html Computer security risks to home users

What is at risk?
Information security is concerned with three main areas:

Confidentiality - information should be available only to those who rightfully have access to it

Integrity — information should be modified only by those who are authorized to do so

Availability — information should be accessible to those who need it when they need it

These concepts apply to home Internet users just as much as they would to any corporate or government network. You probably wouldn’t let a stranger look through your important documents. In the same way, you may want to keep the tasks you perform on your computer confidential, whether it’s tracking your investments or sending email messages to family and friends. Also, you should have some assurance that the information you enter into your computer remains intact and is available when you need it.

Some security risks arise from the possibility of intentional misuse of your computer by intruders via the Internet. Others are risks that you would face even if you weren’t connected to the Internet (e.g. hard disk failures, theft, power outages). The bad news is that you probably cannot plan for every possible risk. The good news is that you can take some simple steps to reduce the chance that you’ll be affected by the most common threats — and some of those steps help with both the intentional and accidental risks you’re likely to face.

Before we get to what you can do to protect your computer or home network, let’s take a closer look at some of these risks.

Intentional misuse of your computer
The most common methods used by intruders to gain control of home computers are briefly described below. More detailed information is available by reviewing the URLs listed in the References section below.

Trojan horse programs
Back door and remote administration programs
Denial of service
Being an intermediary for another attack
Unprotected Windows shares
Mobile code (Java, JavaScript, and ActiveX)
Cross-site scripting
Email spoofing
Email-borne viruses
Hidden file extensions
Chat clients
Packet sniffing
Trojan horse programs
Trojan horse programs are a common way for intruders to trick you (sometimes referred to as "social engineering") into installing "back door" programs. These can allow intruders easy access to your computer without your knowledge, change your system configurations, or infect your computer with a computer virus. More information about Trojan horses can be found in the following document.

http://www.cert.org/advisories/CA-1999-02.html

Back door and remote administration programs
On Windows computers, three tools commonly used by intruders to gain remote access to your computer are BackOrifice, Netbus, and SubSeven. These back door or remote administration programs, once installed, allow other people to access and control your computer. We recommend that you review the CERT vulnerability note about Back Orifice. This document describes how it works, how to detect it, and how to protect your computers from it:

http://www.cert.org/vul_notes/VN-98.07.backorifice.html

Denial of service
Another form of attack is called a denial-of-service (DoS) attack. This type of attack causes your computer to crash or to become so busy processing data that you are unable to use it. In most cases, the latest patches will prevent the attack. The following documents describe denial-of-service attacks in greater detail.

http://www.cert.org/advisories/CA-2000-01.html
http://www.cert.org/archive/pdf/DoS_trends.pdf

It is important to note that in addition to being the target of a DoS attack, it is possible for your computer to be used as a participant in a denial-of-service attack on another system.

Being an intermediary for another attack
Intruders will frequently use compromised computers as launching pads for attacking other systems. An example of this is how distributed denial-of-service (DDoS) tools are used. The intruders install an "agent" (frequently through a Trojan horse program) that runs on the compromised computer awaiting further instructions. Then, when a number of agents are running on different computers, a single "handler" can instruct all of them to launch a denial-of-service attack on another system. Thus, the end target of the attack is not your own computer, but someone else’s — your computer is just a convenient tool in a larger attack.

Unprotected Windows shares
Unprotected Windows networking shares can be exploited by intruders in an automated way to place tools on large numbers of Windows-based computers attached to the Internet. Because site security on the Internet is interdependent, a compromised computer not only creates problems for the computer’s owner, but it is also a threat to other sites on the Internet. The greater immediate risk to the Internet community is the potentially large number of computers attached to the Internet with unprotected Windows networking shares combined with distributed attack tools such as those described in http://www.cert.org/incident_notes/IN-2000-01.html

Another threat includes malicious and destructive code, such as viruses or worms, which leverage unprotected Windows networking shares to propagate. One such example is the 911 worm described in http://www.cert.org/incident_notes/IN-2000-03.html

There is great potential for the emergence of other intruder tools that leverage unprotected Windows networking shares on a widespread basis.

more…
please visit site…

For complete article please visit: http://ramis.aspfreeserver.com/Home_Network_Security.asp

There are several basic concepts to keep in mind when deciding to stay spyware free for good. This article will outline a spyware checklist for you to keep in mind when getting tough on spyware and taking back control of your computer using two popular free applications, Ad-Aware,and Spybot - S&D. Using these two programs in conjunction will eliminate a vast majority of spyware problems from your computer. For the purposes of this article, "spyware" refers also to adware, malware, and other not-so-nice "features" of today’s computing reality.

These are some tell-tale warning signs that your computer may be suffering from spyware-

· You receive many pop-ups

· Your computer is running slowly

· You may have invasive toolbars hijacking your browser

· Your home page may have been hijacked

Your first step to escaping spyware’s wrath is to download and run Ad-Aware and Spybot - S&D, the two leading spyware fighting tools out there, boasting millions of downloads each. Please remember it’s always safest to backup your system before installing a new program or executing one. After downloading the two programs, be sure to run the update feature to be sure they are current when it comes to detecting the latest threats. Remove the detected spyware using these two programs, then move to step two.

The second step in staying spyware free involves you to be proactive. At this point your computer should be free from spyware. What you want to do now is keep it this way, to do that there are helpful tips to guide you. In Windows 98 you can use msconfig to view the startup programs on your computer. This is helpful because you can control what programs automatically load when you boot your computer. To access this invaluable tool, go to START >> RUN, type MSCONFIG. If you check the startup programs occasionally you may see a new spyware entry that will alert you it’s time to clean out the spyware again.

The third step involves your web browsing habits. It means you must never click on an activex screen that asks you if you want to allow an innocuous looking toolbar, or "surfing aid"be installed. By clicking "allow" you are effectively giving these perfidious spyware authors free reign over your system and personal information. If possible you should surf with the security settings on "maximum" for safest surfing.

In summary, it’s important to avoid spyware for your computer and personal identity health. To do so, use free tools available to you and be mindful of your computer settings and surf the Internet responsibly. Following these easy steps will ensure a safe and spyware free existence for you and your computer!

Written by Erich Bihlman, of Bihlman Consulting - PC and Internet Tutoring and Website Design in Prescott, Arizona. Bihlman.com. For additional helpful articles visit IQZone

Recently, my site and other internet accounts ( http://www.nabaza.com/sites.htm ) have been hacked maliciously for the purpose of getting all my online sales and transferring it to his/her account. I’ve learned a valuable lesson that I would like to share with you so as to avoid becoming the next victim for this hacker.

Steps to protect your web site:

1. Don’t give out your username/password to anyone else.

Even if it’s your own net/web/system admin. Chances are he/she already knows it for he/she can just login as admin to the control panel and look at your password.

2. Change your password once in a while.

It’s better to write them down instead of saving them on a hard disk with insufficient firewall protection.

3. Don’t use any word that can be found in dictionary or anything that signifies your birthdate, your street number to make it difficult for the hackers to guess.

4. Disable the "Forgot Password" utility on your site. This utility is very convenient to most end users, so fast that it gives out password so easy to for hackers to play with.

5. Make your password question / password answer (the one used to remind your forgotten password) difficult to guess. Treat it as a password. If anyone can just guess it, chances are hackers will start exploring with your account.

6. Make sure you are in constant contact with your web provider so they know your real identity and they can help you out as soon as there’s hacking going on in your site.

7. Don’t use any irc (internet relay chat) based chat system for it connects to ports 6660 to 6669. Hackers will exploit these ports and will upload trojan virus in your computer that can get your username/password on most of your accounts.

If you are going to use any irc chat system, don’t even use it without the aid of psybnc or bnc. For more details and pricing of this tool, email: sales@nabaza.com with Subject: psybnc or go to http://www.nabaza.com/support.htm and post your request there.

8. Don’t trust any email (even if it’s an email message coming from your trusted friend) message that has .exe file attachment. Chances are it came from a malicious programmer and this .exe file already spreadand infected/duplicated in all email addresses in your addressbook including yours. For antivirus information, go to http://www.nabaza.com/antivirus.htm

Nabaza.comspecializes in building, designing, implementing, managing and maintaining corporate website to boost sales of your company. Email william@nabaza.com for information on functional, dynamic webpage designing with affordable packages. Subscribe for free! http://www.nabaza.com/subscribe.htm

Rebrandable ebooks, software for free
Free Advertising Space
Put Nabaza.com In your desktop

Manual Spy Bot Removal > BookedSpace

BookedSpace is an Internet Explorer Browser Helper Object used to show advertising.

Free PC Health Check - find bad files fast! How many corrupt and redundant files are lurking inside your PC ready to cause harmful errors? Find these harmful "time-bomb" files instantly and keep your computer ERROR FREE 24 hours a day!

Variants
BookedSpace/Remanent : early variant (around July 2003) with filename rem00001.dll, controlling server 66.225.192.199.

BookedSpace/BS2 and BookedSpace/BS3 : newer revisions (August 2003) with filename bs2.dll or bs3.dll, controlling server www.bookedspace.com.

Distribution
BookedSpace/Remanent is silently installed by MThree MP3 to WAV converter. BookedSpace/BS2 is silently installed by FreeWire’s FreeMP3Player. The origin of BookedSpace/BS3 is currently unknown.

Advertising
Yes. BookedSpace can contact its controlling server when a new page is visited, which may direct it to open pop-up ads.

Privacy violation
Yes. When the controlling server is contacted, the URL of the current page is passed along with a user ID for tracking purposes.

Security issues
Yes. May download and install third-party software as directed by its controlling server. BookedSpace/BS2 has been seen to install the BargainBuddy , nCase and eBates parasites.

Stability problems
Seems to stop IE address bar searches from working.

Removal
Open a DOS command prompt windows (from Start->Programs->Accessories), and enter the following commands, for the Remanent variant:

cd "%WinDir%\System"
regsvr32 /u "..\rem00001.dll"
Or, for the BS2 variant:

cd "%WinDir%\System"
regsvr32 /u "..\bs2.dll"
Or, for the BS3 variant:

cd "%WinDir%\System"
regsvr32 /u "..\bs3.dll"

Next, for BS2 and BS3, open the registry (click ‘Start’, choose ‘Run’, enter ‘regedit’), find the key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run, and delete the entry ‘BookedSpace’ (BS2 variant) or ‘Bsx3′ (BS3 variant).

Restart the computer and you should be able to delete the ‘rem00001.dll’, ‘bs2.dll’ or ‘bs3.dll’ file in the Windows folder. You can also open the registry and delete the key HKEY_LOCAL_MACHINE\Software\Remanent or HKEY_LOCAL_MACHINE_Software\BookedSpace to clean up, if you like.

Free PC Health Check - find bad files fast! How many corrupt and redundant files are lurking inside your PC ready to cause harmful errors? Find these harmful "time-bomb" files instantly and keep your computer ERROR FREE 24 hours a day!

MS Media Player GUID

Overview
MS Media Player GUID is a warning that the Window Media player may transmits an anonymous Global Uniquie IDentifier (GUID) to the streaming servers when you download content.

The following is the information given at Microsoft Security Bulletin MS01-029: "… a potential privacy vulnerability that was recently identified. This issue could be exploited by a malicious set of web sites to distinguish a user. While this issue would not by itself enable a web site to identify the user, it could enable the correlation of user information to potentially build a composite description of the user." Source

The existance of this GUID on your system may also indicated that your system does not have all critical updates and service packs installed.

Detection
Bazooka Adware and Spyware Scanner detects MS Media Player GUID. Bazooka is freeware and detects spyware, adware, foistware, trojan horses, viruses, worms and other potentially unwanted applications. Read more »

How to remove the GUID

Go to www.windowsupdate.com and install all critical updates and service packs. Go on with the following steps if Bazooka still reports MS Media Player GUID.

Windows Media Player 6.4 users: the privacy setting is selected via a new option, which can be reached by going to the menu item View / Options then selecting the player tab and de-selecting "Allow Internet sites to uniquely identify your player".

Windows Media Player 7.1 users: the privacy setting is toggled via the existing option under the tools menu, on the player tab and deselect the option "Allow Internet sites to uniquely identify your player". Windows Media Player 9.0 users: Click Tools -> Options -> Privacy, uncheck "Send unique Player ID to content providers."

If Bazooka still reports MS Media Player GUID, go on with the following steps.

Start the registry editor. This is done by clicking Start then Run. (The Run dialog will appear.) Type regedit and click OK. (The registry editor will open.)

Delete ‘HKEY_CURRENT_USER \ Software \ Microsoft \ MediaPlayer \ Player \ Settings \ Client ID’.

Exit the registry editor.

Problems uninstalling? Click here.

Please support me
Thank you for using my site. Please help me to keep this site and software up-to-date.

Contact information for MS Media Player GUID’s vendor In order to provide correct, accurate and updated information about MS Media Player GUID I encourage the vendor to contact me if any part of this write-up needs a revision.

Free PC Health Check - find bad files fast! How many corrupt and redundant files are lurking inside your PC ready to cause harmful errors? Find these harmful "time-bomb" files instantly and keep your computer ERROR FREE 24 hours a day!

W32.Backdoor.Nibu

Overview
W32.Backdoor.Nibu is a trojan horse, with many variants. You can read more at Symantec.

Classification
Trojan Horse

Files
load32.exe, Dllreg.exe, Vxdmgr32.exe, Rundllw.exe, patch.exe, netda.exe, swchost.exe

Log references
[1] [2] [3] [4] [5] [6] [7] [8] [9] [10] [11] [12] [13] [14]

Detection
Bazooka Adware and Spyware Scanner detects W32.Backdoor.Nibu. Bazooka is freeware and detects spyware, adware, foistware, trojan horses, viruses, worms and other potentially unwanted applications. Read more »

Uninstall procedure
Please go to the anti-virus recommendation page. You can find both free products or use one of the trials to remove the virus.

Manual removal
Please follow the instructions below if you would like to remove W32.Backdoor.Nibu manually. Please notice that you must follow the instructions very carefully and delete everything that is mentioned. In most cases the removal will fail if one single item is not deleted. If W32.Backdoor.Nibu remains on your system after stepping through the removal instructions, please double-check by stepping through them again. Start your computer in safe mode.

Start the registry editor. This is done by clicking Start then Run. (The Run dialog will appear.) Type regedit and click OK. (The registry editor will open.)

Browse to the key:

‘HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run’
In the right pane, delete the value called ‘load32′, if it exists.
Exit the registry editor.
Restart your computer.
Start Windows Explorer and delete:
%SystemDir%\swchost.exe
%SystemDir%\netda.exe
%SystemDir%\load32.exe
Note: %SystemDir% is a variable (?). By default, this is C:\Windows\System (Windows 95/98/Me), C:\WINNT\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Free PC Health Check - find bad files fast! How many corrupt and redundant files are lurking inside your PC ready to cause harmful errors? Find these harmful "time-bomb" files instantly and keep your computer ERROR FREE 24 hours a day!

FavoriteMan has many variants:

FavoriteMan/Lwz installs lwz.dll. Data file is SysLdr.dll. Controlling server is www.f1organizer.com.
FavoriteMan/F1 installs F1.dll. Data file is SysLdr.dll. Controlling server is www.prize4all.com.
FavoriteMan/FOne
FavoriteMan/FOne is a replacement for the Lwz variant. Filename is FOne.dll, data file is SysLdr.dll. Controlling server is www.f1organizer.com.
FavoriteMan/Ofrg’s program file is called ofrg.dll. It stores its data in a file called favboot.dll. Its controlling server is www.yourspecialoffers.com. FavoriteMan/Favorite installs favorite.dll. Data file is FavMan.dll. Controlling server is also www.yourspecialoffers.com.

FavoriteMan/SpyAssault
FavoriteMan sometimes causes IE to lock up for a variable period of time, occasionally indefinitely, when a new browser process is started. This may be something to do with its trying to contact its servers on startup. Also crashes may occur when very long URLs are used.

How to Remove FavoriteMan?

FavoriteMan/F1 and FavoriteMan/ZZ offer a removal feature: Click Start >Settings > Control Panel > Add/Remove programs, choose ‘F1′ or ‘ZZ’ and click ‘Remove’.

To manually remove other variants of FavoriteMan:

Unregister FavoriteMan. Open a DOS command prompt window (Click Start > Run, type ‘command’(for Windows 98/Me) or ‘cmd’ (for Windows 2000/XP) and enter the following commands: cd "%WinDir%\System" regsvr32 /u favorite.dll

Note: Change the filename ‘favorite.dll’ to match the variant you have. This can be ofrg.dll, favorite.dll, lwz.dll, F1.dll, ZZ.dll, mpz300.dll, trk.dll, Gr02.dll, Aess.dll, Ss32.dll or emesx.dll; in in the case of the IMZ variant it will have a random eleven-letter filename. (eg. troallystbr.dll). You can usually find the culprit by opening the System folder choosing View->Arrange icons by->Modified, then looking near the bottom of the window.

Restarting the computer.

Delete the program file. The software can be found in the System folder. On Windows 95/98/Me this is the folder called ‘System’ in the Windows folder; on Windows NT, 2000 and XP it is called ‘System32′. Look for one of the filenames listed above.

Delete the data file favboot.dll, FavMan.dll, SysLdr.dll, mbr32.dll, im64.dll or dlh0st.dll in the same folder (it isn’t a DLL at all). Open the registry editor ( Start > Run, type regedit) , locate the key ‘HKEY_CURRENT_USER\Software\Microsoft\Windows’,find and delete the entries ‘Counter’, ‘Server’ and ‘Object’ in it.

Free PC Health Check - find bad files fast! How many corrupt and redundant files are lurking inside your PC ready to cause harmful errors? Find these harmful "time-bomb" files instantly and keep your computer ERROR FREE 24 hours a day!

Online Trojan

Overview
Online Trojan changes your Internet Explorer settings.

Classification
Trojan Horse

Files
svchost.exe, msto32.dll, svchostc.exe, svchosts.exe

Log references
Log 89

Vendor
Unknown

Privacy policy
No privacy policy available.

Detection
Bazooka Adware and Spyware Scanner detects Online Trojan. Bazooka is freeware and detects spyware, adware, foistware, trojan horses, viruses, worms and other potentially unwanted applications. Read more »

Manual removal
Please follow the instructions below if you would like to remove Online Trojan manually. Please notice that you must follow the instructions very carefully and delete everything that is mentioned. In most cases the removal will fail if one single item is not deleted. If Online Trojan remains on your system after stepping through the removal instructions, please double-check by stepping through them again. Start your computer in safe mode.

Start the registry editor. This is done by clicking Start then Run. (The Run dialog will appear.) Type regedit and click OK. (The registry editor will open.)

Browse to the key:
‘HKEY_LOCAL_MACHINE \ SOFTWARE \ Microsoft \ Windows \ CurrentVersion \ Run’
In the right pane, delete the value called ‘Online Service’, if it exists.
Exit the registry editor.
Start Windows Explorer and delete:
%WinDir%\svchost.exe
%WinDir%\msto32.dll
%SystemDir%\svchostc.exe
%SystemDir%\svchosts.exe
Note: %SystemDir% is a variable (?). By default, this is C:\Windows\System (Windows 95/98/Me), C:\WINNT\System32 (Windows NT/2000), or C:\Windows\System32 (Windows XP).

Note: %WinDir% is a variable (?). By default, this is C:\Windows (Windows 95/98/Me/XP) or C:\WINNT (Windows NT/2000).

Start Microsoft Internet Explorer.
In Internet Explorer, click Tools -> Internet Options.
Click the Programs tab -> Reset Web Settings.

Nabaza.com specializes in building, designing, implementing, managing and maintaining corporate website to boost sales of your company. Email william@nabaza.com for information on functional, dynamic webpage designing with affordable packages. Subscribe for free: http://www.nabaza.com/subscribe.htm

Rebrandable ebooks, software for free
Free Advertising Space
Put Nabaza.com In your desktop

Identity Theft and Your Personal Information
——————————————–
Identity theft is apparently the “in thing” these days. By media accounts, hackers and evildoers lurk everywhere trying to steal your personal information. In the past few months, one company after another is being forced to admit customer data has been lost or stolen.

In many cases, they have then come forth repeatedly over the next few weeks, or even months revising the estimated number of impacted customers. To date, I don’t think any have ever lowered those numbers.

Identity Theft and Respected Companies
————————————–
Generally speaking, these aren’t fly-by-night organizations. These are respected companies who we’ve come to trust. In many instances, the loss wasn’t even the work of a “malicious hacker” or other mystical force beyond their control; it was simple carelessness. The frequency of such reports of identity theft is making it difficult for consumers to feel confident in those with whom we do business. Customers are outraged that companies are not doing more to protect their information from the forces of evil.

You and Your Personal Information
———————————
What about you? How are you at keeping you personal information under wraps? Some of these high profile incidents were the result of a trivial mistake that could have happened to anyone, including you.

Let’s consider two events that didn’t make the front page of C|Net or CNN.

The Keys To The Castle
———————-
I consult for a client who doesn’t trust me. It’s nothing personal, they don’t trust anyone. Whenever I visit this site, I am forced to contact the client throughout the visit to have them type a credential, or password, to grant access to a server or router. It’s really annoying.

I really respect this client.

They don’t really know me; I’m “the consultant”. They’re taking the proper steps when dealing with a consultant, providing the absolute minimum amount of information required. They would never give me unsupervised access to the network, and certainly wouldn’t consider giving me passwords to their servers or routers. Not on purpose anyway.

Then there was the day I was working alongside the client and needed to reconfigure a router to complete a task. It’s a long walk to the client’s office to get the password for that particular router. Yes, this is a client who apparently has a unique password for every piece of equipment they own. Conveniently the client does keep a password protected file on a USB key that contained the needed information. The client was completely appropriate and even asked permission before using my laptop to fetch the file. I consented, and even made the gesture of turning away while he unlocked the file and retrieved the required password.

Have you ever used Google Desktop Search? It’s a very cool, and aptly named, program that is a Google for your PC. It will index your files and make them searchable through a fast, flexible, and easy to use interface. It’ll even cache the contents of files so if you move it off your hard drive, you’ll still be able to see the contents of what was once there. Normally it does all this in the background when you computer is sitting idle. It also does it anytime you open a file.

Your Personal Information Is The Prize
————————————–
You guessed it. Logins, passwords, public and private IP addresses. You name it, I had it. The client who would never give me a single password had turned over all of them at once.

What kind of wondrous data was now available? Personnel records, salary data, trade secrets? Maybe, if this was a corporate client. What about an academic, a University even? Student records, financial aid forms, and grant information. The possibilities were endless.

I promptly deleted the cache. The customer didn’t want me to have the information, nor did I.

Would You Hand Your Credit Card To A Stranger?
———————————————-
The previous example showed how simple it is to inadvertently reveal a large amount of data. It’s funny how easily a person can dismiss this type of loss. After all, it’s not your data, right?

So let’s get a bit more personal.

Convenience And Computer Security Are Rarely Compatible
——————————————————-
I have a good trust relationship with my next client. She is quite comfortable with me administering and securing the corporate network. When it comes to her personal credit card information however, well, not so much.

Pretty much every web browser available these days has quite a few convenience features designed to make your day to day “net experience simpler”. One of these convenience features came into play in this example, specifically the Firefox browser’s auto-completion feature.

Not too long ago, I was tasked by this client to make arrangements for transfer of an internet domain to their ownership. Not a difficult task, she could have handled it herself. She was quite a capable computer user; she just didn’t want to be bothered with the process.

I set aside 20 minutes to go through her domain registrar’s step-by-step transfer wizard. I summoned the client to explain the details of the transfer displayed on my laptop screen. Facing the payment options screen the client asked if she could proceed. I relinquished control of my laptop and she entered the credit card information required to complete the transaction.

Web Browsers Cache Your Personal Information
——————————————–
Most modern web browsers, for convenience, will cache information entered into web forms. The intent is to be able to recall this information if it’s requested by another form. The following day, I was in the process of registering another domain with the same registrar and was surprised, for half a second, when the payment screen pre-populated using the same information used the day before. In addition to the credit card information I also had my client’s personal home address, and telephone number. This was quite a bit of personal information the client never had any intention of giving me.

So What’s Your Point?
———————
These two examples are very different but do share two important attributes. First, data the client intended to keep private was revealed to me. Second, the reason for the “compromise” of the data was due to the “victim” working with said data on a computer they neither owned nor were familiar with. Under different circumstances, the end results could have been quite devastating.

Conclusion
———-
When using a computer system you do not own, perhaps at a kiosk, or Internet Café, be aware that the computer itself is going to remember a lot of what you’ve done as part of basic functionality. Additionally, most entities that are going to provide you with access to a computer, including your employer, probably have systems in place that could collect additional data you don’t desire to share. Even WiFi hotspots that allow you to use your own notebook or PDA to surf the web while sipping coffee can be a potential information collector.

The moral of the story is, when dealing with computer systems that aren’t your own, never handle data or documents that you wouldn’t want left behind unprotected. In all odds, once you walk away from that computer, you’ve done just that.

About The Author
—————-
Erich currently specializes in providing network and security solutions for small to medium businesses that frequently have to resolve the conflict of need versus budget. His commitment to precision and excellence is eclipsed only by his fascination with gadgets, particularly ones that are shiny, or that blink, or that beep. Erich is a staff writer for http://www.defendingthenet.com and several other e-zines. If you would like to contact Erich you can e-mail him at erich.heintz@gmail.com or DefendTheNet@ParaLogic.Net.

May. 16th 2005 - MicroWorld has reported the discovery of Troj/Sober-Q, which is a mass mailing spamming internet Trojan for the Windows platform.

Some of the spam emails sent by this Trojan takes to respectable German news outlets, such as Spiegel etc., as reported by MicroWorld, which contain articles on:

1. "Necessasity of Health Reforms";

2. "asylum seekers receive first class private supply while medical supply for Germans abolished";

3. "Dentists- enormous content increases expense of the contribution payers" etc.

It affects Windows operating system and is also know by aliases such as Email-Worm.Win32.Sober.q and W32/Sober.q@MM

In order to protect yourself from this worm ensure that you have the very latest update of the eScan/MailScan software. MicroWorld provides Hourly Updates to its customer.

For further information on detection and removal of "Troj/Sober-Q" please visit the below mentioned link.

http://www.mwti.net/virusnews/virusalertd.asp?id=610

Download the free MicroWorld Anti Virus Toolkit that detects viruses in system registry and running processes

Link 1 — ftp://ftp.microworldsystems.com/download/tools/mwav.exe
Link 2 — ftp://update.mailscan.info/download/tools/mwav.exe

For more information please write to manish@mwti.net

For technical support please mail to support@mwti.net

MicroWorld (http://www.mwti.net) is the publisher of world’s first real time antivirus and content security software eScan and MailScan, for desktops, file servers, citrix servers, proxy servers and Mail Servers. Working on revolutionary MicroWorld Winsock Layer(MWL) technology, MicroWorld’s time tested and reliable products have seen bestowed with certificates and awards by some of the most prestigious testing bodies like Virus Bulletin, Checkmark, TUCOWS, and Advanced CheckVir, Red Hat Ready, Novell Ready etc.

MicroWorld Technologies is one of the leading solution providers for Information Technology, Content Security and Communications Software. MicroWorld’s Revolutionary "MicroWorld-WinSock-Layer (MWL)" technology, the first of its kind in the world. It deals with these threats before they enter your network, in the same way that a firewall controls user access.

Viruses, Bugs, Worms, Dataminers, Spybots, and Trojan horses. The Internet is a veritable minefield of things that can invade your PC and affect it’s Security and Performance.

You can do something about it and you can do it FREE, using some or all of the following programs and tips.

Anti-Virus protection.

One of the best Free programs for this is AntiVir Personal Edition Anti-Virus software. Download it from: http://www.free-av.com Install on your PC and leave it running to block any incoming bugs or viruses! It can also be used to scan your system for any previous invasions, but be patient, this takes about 15 minutes to complete. Worth running periodically, to check all is ok.

FireWalls and Broadband.

If you are on Broadband, consider using Firewall software. Most good ISP’s now supply free. (eg AOL). If yours doesn’t, you can get a reasonably good Free personal firewall system from ‘ZoneAlarm’ at http://www.zonelabs.com . Tip – DON’T leave your PC connected to the Internet when you are not using it! Reduce the chance of something loading while you are not monitoring things !

SpyBot finders and Ad blockers.

Various programs available on the web, both ‘Paid’ and ‘Free’. You can get good results from using 2 Free packages that are available. These are ‘SpyBot Search & Destroy’ and ‘Ad-Aware’. Downloads available at http://www.lavasoft.de for AD-Aware http://www.safer-networking.org for SpyBot Using both of these packages ensures that, you get with one, any ‘bots’ that the other one misses.

Suspect you have a virus?

If you think you already have a virus, a good Free tool for checking and killing them is McAfee Stinger. Free download at: http://us.mcafee.com/virusInfo/default.asp?id=stinger

Some General Tips

Get in the habit of, every time you disconnect from the web, deleting ALL files from the following folders:

C:/WINDOWS/Cookies
C:/WINDOWS/Temporary Internet

Beware ‘Boys Toys’ and ‘Freebies’! Think, if someone wants to spread a bug, get tracking software onto your PC etc, the best place for them to do it is places where you go to get ‘freebies’ to download! The above sites are normally ‘ad free’, but be aware that if you download porn, free music, free games, free software, there is often a ‘price’ to pay. Always use the above programs after visiting ANY of these sorts of sites!

John Roberts is a Freelance Training Consultant and Director of JayrConsulting Ltd. (http://www.jayrconsulting.co.uk) John is also an active member of TrainerBase (http://www.trainerbase.co.uk) and is always open to discussion on any training topics.

Spyware and adware are becoming major problems for online surfers and PC owners. Some highly respected sources such as AOL, Earthlink and Webroot place the rate of infection at 80-90% of all computers. Granted, some of this percentage is taken up by relatively benign tracking cookies, but other types like keyword logging, system monitors, worms and Trojans present a major threat to your privacy and may even do serious damage to your computer.

With the occurrences of Spyware increasing daily, chances are high that you will be going into battle against Spyware very soon — so if you need a battle plan — Try these 5 Tips:

1. Go on the offensive. Fight spyware before it even arrives on your computer. Make sure you have a good ‘anti-virus software’ program running on your PC. Many ISPs (Internet Service Providers) now offer anti-virus programs or even purchasing a commercial product is to your advantage. Get a program or product that is regularly updated to fend off the latest viruses, adware, worms, trojans and spyware.

2. Put up a Firewall. A Firewall should be one of your first lines of defense against spyware. A Firewall is simply a system or gateway designed to prevent unauthorized access to your computer or network. Check out www.zonealarm.com, they provide a free Firewall for individual users. Download their program and place it on your PC.

3. Don’t open Emails and Attachments from people you don’t know. Use common sense, DON’T open any emails from people you don’t know. Especially, do not open any Attachments until they are scanned for spyware and viruses. Many mail servers will do these scans for free.

4. Keep Your Operating System Up to Date. Be aware of what’s on your system — do regular spyware and adware scans to see exactly what’s on your computer. Know your machine! You may be horrified to learn someone may be monitoring your every ‘keystroke’ and every ‘image’ you’ve viewed on your computer. So scan regularly and also make sure you download the newest updates from your Operating System; these often contain patches or fixes for serious breaches of security on your PC.

5. Back-up Your System. If all the above steps fail, nothing is foolproof, any computer that uses the Internet can be hacked, so you need to back- up your important data. You can use floppy disks, CDs or use a second computer that’s not connected to the net just for storage or back-up of your sensitive data/programs. An inexpensive notebook computer can be used to make daily/weekly back-ups of your vital data and programs.

In conclusion, the best defense against any spyware is a strong offense. Be prepared, be aware, but most of all, be battle-ready: have a system in place that will nuke these spyware agents before they even reach your computer. Choose your weapons carefully, be merciless, be thorough and take no prisoners! This is a battle you can’t afford to lose.

Implement and Use these 5 helpful ‘Spyware Fighting’ tips and the Victory is yours!

To learn more Spyware and Adware, read our Spyware Removal Guide

Copyright © 2005 Titus Hoskins of http://www.bizwaremagic.com.

This article may be freely distributed if this resource box stays attached.

Spyware is software that runs on a personal computer without the knowledge or consent of the owner of that computer. The Spyware then collects personal information about the user or users of the infected computer. The personal information collected is usually the name of the user; the users email address, Websites visited, online shopping habits, as well as various other information about the user.

Spyware is also sometimes known as Scumware, and Adware. Although Adware is slightly different in that the makers claim that the users are aware that they are collecting information about the user. Sometimes this is true, other times it is not. Many times these terms are used interchangeably because many feel that they present the same problems. This however goes to the definition of what Spyware is, making it sometimes difficult to combat from a legal standpoint. This is generally due to how Adware works in that the user downloads a program that they feel is useful for some reason and, that program also collects user information as described above. Although the government is currently taking steps to protect users from these programs it is a slow process because of the current definitions.

Once this information is collected, the Spyware then can send your personal information to advertisers that will then send you targeted advertisements through annoying popups, and spam in your email. They can also hijack your web browser and redirect you to a page that they want you to see with their advertising targeted to you through your personal information. This redirecting is sophisticated enough to notice what you are attempting to purchase on one site and can redirect you to another site with the same or similar products so that you make the purchase through them.

In addition to the problems of "stealing" your personal information, Spyware runs in the background on your computer using up valuable system resources. This is a major cause of your PC “running slow.”

The statistics are 9 of 10 computers connected to the internet are infected with some type of Spyware. This could probably be taken a step further to say all PC’s connected to the internet are infected with some type of Spyware. The reason for this is because all of the best Anti-Spyware software on the market today can only stop software that it knows or recognizes as Spyware. These Spyware killers work in a way similar to Anti-Virus software and need to be updated on a regular basis to be effective.

Spyware is also a large cause of popups occurring on your computer as well. Popups are messages that “pop up” onto your computer screen generally through your internet browser. These popups can be reduced and at times stopped completely by using a web browser other than IE (Internet Explorer) such as Firefox by Mozilla.org and Opera located at:

http://www.mozilla.org/
http://opera.com/

Both are adept at stopping popups from occurring. If you choose to use one of these browsers be sure to periodically check for updates to get the best protection available.

One of the ways to defend against Spyware is to use a third party firewall. Although the current version of Windows XP comes with a firewall it is not effective at stopping Spyware as of this writing. Third party firewalls can block unwanted traffic from passing to and from the internet to your computer. Some of the better third party firewalls listed below are:

• Kerio Personal Firewall

• ZoneAlarm Firewall

• Sygate Firewall

Kerio Personal Firewall can be downloaded from its Website at the following URL:

http://www.kerio.com/us/kpf_download.html

Although they have a limited free version it does not provide the same level of protection as the paid version does. I would recommend the paid version of their firewall at $45.00. Next there is ZoneAlarm which is perhaps one of the more recognized firewall around. You can get the free version for non business users at the following URL:

http://www.zonelabs.com/store/content/company/products/
znalm/freeDownload.jsp

business users can get the paid version here http://www.zonelabs.com/store/content/home.jsp

Sygate also has a good firewall that is available for $39.95 available at the URL:

http://smb.sygate.com/products/spf_pro.htm

Firewalls are effective at stopping many Spyware programs as well as other potential problems but they are not a cure all. To be more effective you will want to use Anti-Spyware software along with your firewall.

Some of the top Anti-Spyware programs are Webroot Spy Sweeper which you can buy for $29.95 and Spyware Doctor also $29.95, Ad-Aware SE Personal Edition which is free. Also free is Spybot Search and Destroy. All are good and considered some of the best at Spyware detection and removal. All four of these programs can be downloaded at download.com at URL:

http://www.download.com/spyware-center/2001-2023_4-0.html

You can also use the above URL for additional information about Spyware.

Also available now is the Microsoft beta version of its Spyware blocker.

http://www.microsoft.com/downloads/details.aspx?
FamilyID=321cd7a2-6a57-4c57-a8bd-dbf62eda9671&displaylang=en

Unfortunately there are also some very unscrupulous people out there who will purposefully cause your computer problems if you use their software. This software will often “miss” or “overlook” some Spyware leaving it unsuspectingly on your computer. Worse yet, some of these supposed Anti-Spyware programs will actually place Spyware onto your computer as well. Some of these programs are Spyblaster, Spyware Assasin, as well as many others. The best way to check to see if you are using an Anti-Spyware program that fits into this category is to visit The following URL:

http://www.spywarewarrior.com/rogue_anti-spyware.htm

If you are using any of the programs in this listing you should remove it immediately and use one of the known good programs such as the ones I listed above to check your computer.

You can also keep up to date and learn more about the on going threat of Spyware by visiting the following websites.

http://www.ftc.gov/infosecurity/

http://www.ftc.gov/bcp/workshops/spyware

http://spywareinfo.com/

http://spywarewarrior.com/

Copyright © Keith Erwood, 2005 All Rights Reserved Worldwide.

Keith Erwood, is an author, and head consultant and owner of Dyanmic Network Technologies a computer consulting and services business located in New York City.

Visit us at Dynamic Network Technologies