Malware fight goes public on the wed

The original article by Ben Grubb (SMH) goes on to outline the numbers of Australian computer IP numbers that were found to be infected by Bot's and Trojan malware. For the lay-people... you are assigned an IP address when you access the internet via your ISP. Malware signatures can be detected by the 'packets' of information your computer sends and receives.

Please don't be fooled by tele-marketers telling you you are infected, you may be, but they only want remote access to your PC in order to plant malware of their choice, and to get you to pay them for it.

The Government would like the ISP to contact their users and offer assistance to remove the infection from the end users PC. This however is a BIG ask and can be quite difficult.

The ACMA (Australian Communication and Media Authority) have published a page that outlines the statistics daily - click here for that page. The page details the total numbers and type of infection that it has detected.

I have listed the malware variants (outlined by ACMA) below:

1. Zeus targets Microsoft Windows machines. It does not work on Mac OS X, or Linux.
2. Conficker Exploits the Windows Server Services.
3. IRCBot affects Microsoft Windows XP Professional SP2.
4. Ramnit only infects Windows. Mainly known for spreading via USB devices.
5. Mebroot infects all Windows O/S'.
6. Virut infects all Windows O/S'.
7. Rootkit TDSS infects all Windows O/S'.
8. Flashback is a virus that infects Apple's OSX.
9. Sality infects all Windows O/S' and spreads through Windows networks.
10. Slenfbot infects all Windows O/S'.
11. Festi infects all Windows O/S'.
12. Cutwail infects Windows XP, Vista and 7.
13. Kelihos infects all Windows O/S'.
14. Waledac infects all Windows O/S'.
15. Nitol Botnet, interestingly, came installed in Windows PC's manufactured in China. Meaning it was installed at the factory.
16. Spyeye infects all Windows O/S'.
17. Lethic infects all Windows O/S'.
18. Darkmailer infects all Windows O/S'.
19. Trojan Pony - Found inside Pirated Apple & Windows versions of Adobe Illustrator CS4.
20. Dorkbot infects all Windows O/S'.
21. Pushdo infects all Windows O/S'.

Only two are capable of infecting Apple Mac computers the rest will infect all Windows operating systems. None quoted affect Linux.

Particularly interesting is 'Nitol' came pre-installed on some PC's manufactured in China. Clearly this is a real worry. The other worry is that pirated versions of software from Adobe (Illustrator CS4) came with the trojan Pony. The CS series of Adobe products are so expensive ($1800 approx) that people without the ability to buy them were forced to install pirated versions. I prefer to encourage people to use 'Open Source' instead. A good example is Gimp. Possibly not as comprehensive as Illustrator but how much do you need... really.

Flashback uses a well known exploit. It tricks the user into thinking that it is a real Adobe Flash player and asks the user to authorise it's installation. Seems Steve Jobs had good reason to disallow iPads from using flash. Unfortunately Flashback will infect Apple Macs.

So what do you do?

From my experience (if you are a Windows fan) you need to start from a clean operating system. Installed from an 'original Microsoft' disc. Even if your PC is pre-installed... format it and install from the original disc. You will not have the 'Bloat-ware' installed by your PC manufacturer. You should also be able to install the appropriate drivers from the manufacturer's disc's. If the manufacturer does not supply the disc's choose a different manufacturer's PC. Many of the cheaper Chinese PC's don't come with original disc's. Stay away from those. Once you have a clean PC, install a good virus scanner. My choice would be Avast, available here for free.

If you already have a PC (or more), and want to use a cheap PC but also want to be safe... format them and install Linux instead. Linux Ubuntu is my choice but Linux Mint is also a favourite as it is the most similar to Windows XP in it's interface. You will not require a drivers disc as they will sense your hardware and install the drivers automatically during the installation process. Both have support for all your Windows document/image/music/video formats and are the easiest to use for beginners. Both are also perfect of corporate desktop applications as they support Windows RDP sessions and VPN connections to Windows Servers.

Drop me a message on Google+ if you need help/advice.