GROUP UPDATE PROVIDER FOR CSI ANTIVIRUS

A Group Update Provider is a client computer that you designate to locally distribute content updates to clients. A Group update provider download content updates from the management server and distributes the updates to itself and other clients.

One advantages of Group Update Provider use is that it helps you to conserve bandwidth by offloading processing power from the server to the Group Update Provider. Group Update Provider are ideal for delivering content updates to clients that have limited network access to the server. You can use a Group Update Provider to conserve bandwidth to clients in a remote location over a slow link. Setting up a Group Update Provider is easier than setting up an internal Live Update server. Group Update Provider are less resource-intensive and so reduce the load on the management server.

Thanks to PMU - MP Circle

How do you tell if your computer has a virus

How do you tell if your Windows computer has a virus? Seriously! You have an  antivirus software installed and you go about using the computer with the feeling that it was well-protected and hence malware-free. But maybe, just maybe, there could be malware or a Trojan or a key logger operating on your computer without your knowledge and compromising your security or damaging your data.

How do you tell if your computer has a virus

Is your Windows computer infected? Learn to recognize malware infections and signs, symptoms that will tell you if your Windows PC has a computer virus. In this post we will see some of the symptoms of malware infection, that will tell you if you computer was compromised or infected with computer virus.

Symptoms of Malware Infection

The typical symptoms that your computer may have been compromised are:

1. Change in your browsers home page or default search
2. Your web browser hangs or becomes sluggish
3. Your computer starts behaving sluggishly or hangs often
4. You are unable to open security-related sites or Microsoft.com domains.
5. You get re-directed to web pages you did not intend to visit
6. Unexpected toolbars in your browser
7. Security software or Firewall disabled
8. Your security software throws up warnings or its icon turns red or something.
9. Pop-ups while browsing, unknown or excessive
10. Balloon Notifications from your system tray
11. Excessive CPU or Memory utilization
12. Internet or data transfer activity – Modem appears to be working overtime
13. You start seeing unexpected Windows error messages
14. Some programs start automatically
15. Some important Windows functions or features disabled. Eg, Task Manager, Registry Editor, Control Panel, Command Prompt, etc.
16. New unknown unwanted software installed, etc.
17. You see new icons on your desktop suddenly.

If you see any of these signs, if is quite possible that your computer may have become infected with a virus or malware.

Starting with Windows Vista, Microsoft introduced many security features in the operating system which were further improved upon in Windows 7 and Windows 8. Nevertheless, should your computer get infected with malware.

Share this article :

What? A virus attack?

Viruses, Trojans and worms… computers too are vulnerable to infection and what’s alarming is it spreads fast. Geeta Padmanabhan on what protective measures can be taken

My system flashed several warnings. Then it locked up, went blank, started randomly, slowed down suddenly. One morning it crashed. Kaboom! Gone!

The mechanic started with a quiz. “Did you see strange error messages? Pop-up alerts about firewalls? Unsavoury pictures on the screen when you booted?” I nodded. He tickled the desktop a bit and announced, “Your system has a virus.” (Just one?) “Some people find new toolbars in the browser, new shortcuts on the desktop they didn't put there, new items in the system tray at the bottom of the screen.” (Note: new toolbars/shortcuts often come bundled with software you actually want; they may not be malicious — just annoying.)

DIFFERENT VIRUSES

 I needed computer wellness lessons. “Virus is a tiny program designed to infect a machine (files in the machine),” said an ethical hacker (EH).  “When the file is opened, it goes into memory, and infects all files opened. When an infected program is opened on another machine it infects all files in that machine also.” And yes, there are different virus types — those that infect only files, those that infect documents, excel files, boot record/partition and those smart hybrid ones which infect all the above. Classification is based on what they infect.

Then there are worms. These usually travel as a single file to infect machines, so the damage isn’t too much. (That’s kind!) The worm tags on to inbuilt communication mechanism (e-mail) to transmit itself using a weakness on a machine or through shares. Sometimes virus and worm marry. This couple is difficult to remove. Trojan (spyware) programs intercept private data — passwords, e-mails, files — it’s a Trojan war!

Most are innocent victims! “Ha, virus is created for fun by youngsters for bragging, to see it spread, it’s a high,” said EH. “Some are professional — to destroy rivals’ computers. Your computer is just a victim in this process.” What armoury do I have to fight it? “Invest in good antivirus software. It’s difficult to detect them manually.” He recommends Fprot and  Avast (avast.com). “You get a one-year home edition free once you register for Avast. Prevent Trojan (keylogger) from doing identity theft with keyscrambler personal edition (www.qfxsoftware.com)  along with antivirus software. This ensures safety of passwords of emails and net-banking.”

 Session II is with Samir Mody, Senior Manager — Threat Control Lab, K7 Computing. “A computer virus does covert actions such as stealing credit card information, sending spam,” he said. “Most computer viruses are developed for financial gain.” Great.

MALWARE AND SPYWARE

What are malware and spyware? “Malware is synonymous with computer virus. It is the superset of spyware which silently steals information like passwords, confidential data.” Watch out for any unusual behaviour — unknown process names, unusual network traffic — on the device, he said.

Giant companies fall victim to hackerazzi. An AP story tells us how international hackers ran an online advertising scam to take control of infected computers around the world. Hackers installed malicious software on the victim computers, which turned off antivirus updates. In an unusual move, FBI is encouraging users to visit http://www.dcwg.org   (till July 9) to check and fix the problem. According to a Russian anti-virus firm, more than half a million Apple computers have been infected with Flashback Trojan. It sent a unique ID to the intruder's control server to identify the infected machine. The criminals could then control the machine. Apple released its own “security update”.

F-Secure also posted instructions on how to confirm if a machine is infected and how to remove the Trojan. Apple isn’t safe?  “Anti-virus software, including K7 security products, will detect and clean up the infection automatically and without fuss,” Samir consoled. “This is not a plumbing, so don’t call local fix-it men. Maintain up-to-date anti-virus software to prevent malware infection in the first place. Be wary of and discard spam emails or social-networking messages (Facebook, Twitter) from unknown individuals or having dubious content. Refrain from clicking on links or opening attachments within such correspondence.”

 Don’t exchange memory-storage devices. Don’t use memory-storage devices on other computers. Avoid visiting websites of dubious repute. Avoid Internet Explorer as the default browser, Google Chrome and, to a lesser extent, Firefox are currently seen as less vulnerable to malware targeting. Operating systems like Linux (Ubuntu, Mint, etc.), due to their significantly smaller user base, are considered less likely to attract malware.

 My system is back in action. I scream “Virus!”  if it slows down one second.

 DEALING WITH VIRUSES

* On control panel, Security, if you can’t click/launch Windows Update, you probably have a virus.

* Many legitimate parts of Windows have virus-sounding names. Be careful when you do CTRL-ALT-DEL.

* Use multiple programs with multiple and varied virus definitions for better diagnosis.

* When you scan for viruses, be sure to turn off or disable any other security software. These programs can interfere with one another.

* Check out Safentrix.com.

* For Asian malware, read http://blog.k7computing.com/2011/11/malwasia-in-operation-since-1986-part-1/part-2/part-3 

Source : http://www.thehindu.com/ 27/06/2012

Apple releases patch for Flashback virus

Apple on Thursday released an identification and removal tool for the most widespread virus ever to hit its computers.

The Java security update removes the most common variants of the Flashback malware, which was found to have infected some 600,000 Macs last week.

The malware, discovered last week by Russian security firm Dr Web, is designed to grab passwords and other information by posing as a legitimate browser plug-in at a malicious website. Once installed, the software sends personal information back to remote servers.

The Mac operating system was previously widely thought to be immune to the widespread security issues that have plagued Windows computers over the years.

Apple’s patch was rushed to users several days after independent security companies issued their own patches for the malware.

Source : www.thehindu.com dtd 13/04/2012

Computer Security Threats

This page provides basic information on computer security threats. The computer security threats covered here are: Viruses Macro Viruses Trojan Horses Worms Zombies Phishing Internet Based Attacks Viral Web Sites Spyware, Adware and Advertising Trojans Virus Hoaxes Unsecured Wireless Access Point Bluesnarfing Social Engineering Microsoft Office Document Metadata

Viruses A software virus is a parasitic program written intentionally to alter the way your computer operates without your permission or knowledge. A virus attaches copies of itself to other files such as program files or documents and is inactive until you run an infected program or open an infected document. When activated, a virus may damage or delete files, cause erratic system behaviour, display messages or even erase your hard disk. A virus may spread through email and instant messenger attachments, through infected files on floppy disks or CD-ROMs, or by exploiting a security flaw in Microsoft Windows.

Macro Viruses Macros are simple programs that can be written to automate repetitive tasks in a document or make calculations in a spreadsheet. Macros can be written in documents created by Microsoft Word, in spreadsheets created by Microsoft Excel and in many other kinds of documents. Macro viruses are malicious macro programs that are designed to replicate themselves from file to file and can cause damage to the files on your computer. They spread whenever you open an infected file.

Trojan Horses Trojan horses are programs that appear to serve some useful purpose or provide entertainment, which encourages you to run them. But these programs also serve a covert purpose, which may be to damage files, to place a virus on your computer or to allow a hacker to gain access to your machine. More commonly these days, you can be enticed into running a Trojan by clicking a link on a viral web site or in an email. Trojans that allow a hacker to gain access to your machine, called Remote Access Trojans (RATs), are particularly prevalent at the moment. Over 50% of all spam (unsolicited email) is sent from home or work computers that have been compromised by RATs. A Trojan horse is not a virus because it does not replicate and spread like a virus.

Worms Worms are programs that replicate and spread, often opening a back door to allow hackers to gain access to the computers that they infect. Worms can spread over the Internet by expoiting security flaws in the software of computers that are connected to the Internet. Worms can also spread by copying themselves from disk to disk or by email.

Zombies A Zombie is a dormant program that lies inactive on a computer. It can be activated remotely to aid a collective attack on another computer. Zombies don’t normally damage the computer on which they reside but can damage other computers. Zombies often arrive as email attachments and when the attachment is opened they install themselves secretly and then wait to be activated.

Phishing A Phishing attack is when you are are sent an email that asks you to click on a link and re-enter your bank or credit card details. These emails can pretend to be from banks, Internet service providers, on-line stores and so on, and both the email and the web site it links to appear genuine. When you enter your bank or credit card details they are then used fraudulently.

Internet Based Attacks While your computer is connected to the Internet it can be subject to attack through your network communications. Some of the most common attacks include: Bonk – An attack on the Microsoft TCP/IP stack that can crash the attacked computer. RDS_Shell – A method of exploiting the Remote Data Services component of the Microsoft Data Access Components that lets a remote attacker run commands with system privileges. WinNuke – An exploit that can use NetBIOS to crash older Windows computers.

Viral Web Sites Users can be enticed, often by email messages, to visit web sites that contain viruses or Trojans. These sites are known as viral web sites and are often made to look like well known web sites and can have similar web addresses to the sites they are imitating. Users who visit these sites often inadvertently download and run a virus or Trojan and can then become infected or the subject of hacker attacks.

Spyware, Adware and Advertising Trojans Spyware, Adware and Advertising Trojans are often installed with other programs, usually without your knowledge. They record your behaviour on the Internet, display targeted ads to you and can even download other malicious software on to your computer. They are often included within programs that you can download free from the Internet or that are on CDs given away free by magazines. Spyware doesn’t usually carry viruses but it can use your system resources and slow down your Internet connection with the display of ads. If the Spyware contains bugs (faults) it can make your computer unstable but the main concern is your privacy. These programs record every step that you take on the Internet and forward it to an Ad Management Centre which reviews your searches and downloads to determine your shopping preferences. The Ad Management Centre will build up a detailed profile of you, without your knowledge, and can pass this on to third parties, again without your knowledge. Some Spyware can download more serious threats on to your computer, such as Trojan Horses.

Virus Hoaxes Virus hoaxes are messages, usually sent by email, that amount to little more than chain letters. They pretend to alert you to the latest "undetectable" virus and simply waste your time and Internet bandwidth. The best course of action is to delete these hoaxes - they can cause genuine fear and alarm in the disabled, elderly and other vulnerable groups.

Unsecured Wireless Access Points If a wireless access point, e.g. an ADSL (Broadband) Router, hasn't been secured then anyone with a wireless device (laptop, PDA, etc) will be able to connect to it and thereby access the Internet and all the other computers on the wireless network.

Bluesnarfing The act of stealing personal data, specifically calendar and contact information, from a Bluetooth enabled device.

Social Engineering Tricking computer users into revealing computer security or private information, e.g. passwords, email addresses, etc, by exploiting the natural tendency of a person to trust and/or by exploiting a person's emotional response. Example 1: Spammers send out an email about victims of child abuse and provide a link to click in the email for further information or to help the victims. When the link is clicked the spammers know the email address is "live" and add it to their live list which they then use to target their spam. Example 2: A company computer user is tricked into revealing the network password by someone on the telephone who is impersonating the voice of an employee in authority and who has a story of distress.

Microsoft Office Document Metadata The average Microsoft Word, Excel, etc document includes hidden metadata with details of who created it, who has worked on it, when it has been amended and quite possibly the text of all those changes as well. Viewing a Word document in a text editor can reveal the metadata in plain text at the start and finish of the document.

Computer Security Threats

This page provides basic information on computer security threats. The computer security threats covered here are: Viruses Macro Viruses Trojan Horses Worms Zombies Phishing Internet Based Attacks Viral Web Sites Spyware, Adware and Advertising Trojans Virus Hoaxes Unsecured Wireless Access Point Bluesnarfing Social Engineering Microsoft Office Document Metadata

Viruses A software virus is a parasitic program written intentionally to alter the way your computer operates without your permission or knowledge. A virus attaches copies of itself to other files such as program files or documents and is inactive until you run an infected program or open an infected document. When activated, a virus may damage or delete files, cause erratic system behaviour, display messages or even erase your hard disk. A virus may spread through email and instant messenger attachments, through infected files on floppy disks or CD-ROMs, or by exploiting a security flaw in Microsoft Windows.

Macro Viruses Macros are simple programs that can be written to automate repetitive tasks in a document or make calculations in a spreadsheet. Macros can be written in documents created by Microsoft Word, in spreadsheets created by Microsoft Excel and in many other kinds of documents. Macro viruses are malicious macro programs that are designed to replicate themselves from file to file and can cause damage to the files on your computer. They spread whenever you open an infected file.

Trojan Horses Trojan horses are programs that appear to serve some useful purpose or provide entertainment, which encourages you to run them. But these programs also serve a covert purpose, which may be to damage files, to place a virus on your computer or to allow a hacker to gain access to your machine. More commonly these days, you can be enticed into running a Trojan by clicking a link on a viral web site or in an email. Trojans that allow a hacker to gain access to your machine, called Remote Access Trojans (RATs), are particularly prevalent at the moment. Over 50% of all spam (unsolicited email) is sent from home or work computers that have been compromised by RATs. A Trojan horse is not a virus because it does not replicate and spread like a virus.

Worms Worms are programs that replicate and spread, often opening a back door to allow hackers to gain access to the computers that they infect. Worms can spread over the Internet by expoiting security flaws in the software of computers that are connected to the Internet. Worms can also spread by copying themselves from disk to disk or by email.

Zombies A Zombie is a dormant program that lies inactive on a computer. It can be activated remotely to aid a collective attack on another computer. Zombies don’t normally damage the computer on which they reside but can damage other computers. Zombies often arrive as email attachments and when the attachment is opened they install themselves secretly and then wait to be activated.

Phishing A Phishing attack is when you are are sent an email that asks you to click on a link and re-enter your bank or credit card details. These emails can pretend to be from banks, Internet service providers, on-line stores and so on, and both the email and the web site it links to appear genuine. When you enter your bank or credit card details they are then used fraudulently.

Internet Based Attacks While your computer is connected to the Internet it can be subject to attack through your network communications. Some of the most common attacks include: Bonk – An attack on the Microsoft TCP/IP stack that can crash the attacked computer. RDS_Shell – A method of exploiting the Remote Data Services component of the Microsoft Data Access Components that lets a remote attacker run commands with system privileges. WinNuke – An exploit that can use NetBIOS to crash older Windows computers.

Viral Web Sites Users can be enticed, often by email messages, to visit web sites that contain viruses or Trojans. These sites are known as viral web sites and are often made to look like well known web sites and can have similar web addresses to the sites they are imitating. Users who visit these sites often inadvertently download and run a virus or Trojan and can then become infected or the subject of hacker attacks.

Spyware, Adware and Advertising Trojans Spyware, Adware and Advertising Trojans are often installed with other programs, usually without your knowledge. They record your behaviour on the Internet, display targeted ads to you and can even download other malicious software on to your computer. They are often included within programs that you can download free from the Internet or that are on CDs given away free by magazines. Spyware doesn’t usually carry viruses but it can use your system resources and slow down your Internet connection with the display of ads. If the Spyware contains bugs (faults) it can make your computer unstable but the main concern is your privacy. These programs record every step that you take on the Internet and forward it to an Ad Management Centre which reviews your searches and downloads to determine your shopping preferences. The Ad Management Centre will build up a detailed profile of you, without your knowledge, and can pass this on to third parties, again without your knowledge. Some Spyware can download more serious threats on to your computer, such as Trojan Horses.

Virus Hoaxes Virus hoaxes are messages, usually sent by email, that amount to little more than chain letters. They pretend to alert you to the latest "undetectable" virus and simply waste your time and Internet bandwidth. The best course of action is to delete these hoaxes - they can cause genuine fear and alarm in the disabled, elderly and other vulnerable groups.

Unsecured Wireless Access Points If a wireless access point, e.g. an ADSL (Broadband) Router, hasn't been secured then anyone with a wireless device (laptop, PDA, etc) will be able to connect to it and thereby access the Internet and all the other computers on the wireless network.

Bluesnarfing The act of stealing personal data, specifically calendar and contact information, from a Bluetooth enabled device.

Social Engineering Tricking computer users into revealing computer security or private information, e.g. passwords, email addresses, etc, by exploiting the natural tendency of a person to trust and/or by exploiting a person's emotional response. Example 1: Spammers send out an email about victims of child abuse and provide a link to click in the email for further information or to help the victims. When the link is clicked the spammers know the email address is "live" and add it to their live list which they then use to target their spam. Example 2: A company computer user is tricked into revealing the network password by someone on the telephone who is impersonating the voice of an employee in authority and who has a story of distress.

Microsoft Office Document Metadata The average Microsoft Word, Excel, etc document includes hidden metadata with details of who created it, who has worked on it, when it has been amended and quite possibly the text of all those changes as well. Viewing a Word document in a text editor can reveal the metadata in plain text at the start and finish of the document.

How to Uninstall Symantec EndPoint Client If Uninstall Password is in place

Sometimes its hard to uninstall SEP client if uninstall password is lost or SEPM is down.

In such cases you may follow these steps

Start - Run

type smc -stop ( If it prompts for password; navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC, delete the smcexit key and then type smc -stop)

Navigate to HKEY_LOCAL_MACHINE\SOFTWARE\Symantec\Symantec Endpoint Protection\SMC

look for smcinstdata key; delete it

Go to add/remove program and uninstall the client..

This is also worked for removing symantec end point protection client which was installed from NIC site which was having a password.

How to Remove Norton Anti Virus from my PC completely?

It's not so easy to remove Norton by using the Windows utility. You need to carefully remove from Registry also. It's little tricky and long process. Please do the cleaning with care.

First Step

• Remove Norton using Windows utility
• Start --> Control Panel --> Add/Remove Programs.
• Select Norton application
• Click Change --> Remove All.
• You will be asked to restart your PC. Without fail Restart

Second Step

• Start --> My Computer --> Program Files.
• Right click on each Symantec folder
• Select Delete.
• Go to the Common Files folder at or near the top of the Program Files window.
• Delete every Symantec folders.
• Again restart your PC.

Third Step

• Go to Start --> Search --> All Files and Folders --> More Advanced Options.
• Check each option except for "Case sensitive"
• Type 'Norton' and Search
• Delete each Norton folder from the search results (Again, right click, choose "Delete").
• For the third time, restart your PC.

Fourth Step

• Go to Start --> Search --> All Files and Folders --> More Advanced Options.
• Check each option except for "Case sensitive"
• Type 'Symantec' and Search
• Delete each Norton folder from the search results (Again, right click, choose "Delete").
• For the third time, restart your PC.

Fifth Step
The is very very tricky. Do it with care :

• Start --> Run
• Type in "regedit"
• Go to the top of the Regedit window.
• Click (+) next to HKEY_CURRENT_USER.
• Go down the thread until you see Software.
• Click on Software
• Scroll down the thread until you see Symantec.
• Right click on Symantec and choose "Delete".
• From there go down to HKEY_LOCAL_MACHINE
• Go down the thread until you see Software.
• Click on Software
• Scroll down the thread until you see Symantec.
• Right click on Symantec and choose "Delete".
• Restart your PC.

Sixth Step

• Start --> Run
• Type in "regedit"
• Go to the top of the Regedit window.
• Click (+) next to HKEY_LOCAL_MACHINE
• Click (+) next to Software
• Click (+) next to Microsoft, Click (+) next to Windows
• Click (+) next to CurrentVersion.
• Select the Run folder
• Right-click and delete each Symantec entry you see (if present).
• Restart your PC.

I believe these steps can clean your system without Norton Antivi

Uninstall Symantec Anti Virus without a password

When removing Symantec antivirus you often need to supply a password for the uninstall to run. This can be a very big pain if you've forgotten the password or if the original install was done by an administrator that has long since left. As usual, there is a work around. Here's how to remove SAV without supplying a password:

- Press Windows Key + R (This brings up the run dialog box)

- Type regedit and press Enter (This will open the Registry editor)

- Navigate to:

HKEY_LOCAL_MACHINE\SOFTWARE\Intel\LANDesk\VirusProtect6\CurrentVersion\AdministratorOnly\Security

- Look for a DWORD value called UseVPUninstallPassword. Once you find it, double click it.

- Change the value of UseVPUninstallPassword to 0 (zero) and click OK[See pic below]