A reader send me an email last night asking if I had any information about the orbitnet.exe process that was started when Orbit Downloader was active. Zonealarm would describe the process as “P2P service of Orbit Downloader” and that seemed to have rang some alarm bells because P2P services are often used as spyware.

He experienced slow downs even when no downloads were in the queue which are indicators that something is not right. Ghacks to the rescue. I decided to investigate orbitnet.exe and see what I can find. I remembered a setting in the options of Orbit Downloader that could have something to do with this behavior.

I opened Tools > Preferences and scanned all options for a sign of Orbitnet. I found it in the Accelerate menu. Enable Orbitnet to accelerate downloads is checked by default, as is Use mirror connections to accelerate download speed and Try to download from P2P and mirror sources when the target url does not exist.

continue reading "Is Orbitnet.exe spyware ?"

If you do not know yet there is a Skype worm spreading around that is affecting Skype Windows clients. The virus automatically sends a chat message to other Skype users containing a link to an image on a website where he is prompted to download a file with the .scr extension using a simple redirection

If, and only if, the user executes the file his computer becomes infected with the w32/Ramex.A virus which uses Skype’s public API to access the infected pc. Many antivirus companies like Symantec, Kaspersky and F-Secure have already updated their virus definitions to detect and remove the worm.

It is however also possible to remove the worm manually by following the steps outlined below:

continue reading "Quick Way to Remove the Skype Worm"

Microsoft released a pdf file called MSRT - Progress Made Lessons Learned yesterday which provides an analysis of the data that the program reported when scanning computers. The tool itself was executed more than 2.7 billion times on at least 270 million unique computers since January 13th, 2005. The tool has removed more than 16 million instances of malicious software which means that on average every 311th computer was infected.

Backdoors and Trojans were found on 3,5 million unique computers which means that a backdoor trojan was active in 62% of the infected computers. Rootkits have been found in 14% of all infected computers with 6% identified as the Sony BMG Rootkit. About 80% of the computers were newly infected ones while 20% were computers that had been infected before.

continue reading "Windows Malicious Software Removal Tool Observations"

This has been around for some time now but its possible that some of you have not heard of it yet. I found a site through digg.com that has a neat list of 40000 entries that you could partially or fully add to your windows host list and prevent ads from those 40000 hosts to be shown on your system, ever again.

Whenever you open up a website that has a ad link on it it changes the hostname of the ad to the one of your computer, which means of course the ad cannot be found and thus not displayed. Its an easy trick. I would be cautious nevertheless, a list of 40000 is not easy to maintain and overlook and it could be that hosts are in that list that you want to have displayed. I´d suggest you take a look and see for yourself, maybe add only some ads to your hostfile from sites that you visit a lot.

continue reading "Block Ads Using Your Host File"

No matter which internet page you open this days you are guaranteed to find at least one article mentioning the Sony rootkit affair. Instead of providing you with the latest news on the case customer vs. Sony BMG I´d like to analyse an interesting aspect of it.

In the beginning, there was one guy, who found out about the rootkit software, analysed it in depth and wrote an entry in his blog named Mark’s Sysinternals Blog on a well frequented site. Then the ball got rolling, the news was copied and commented on other sites, big portals like slashdot.org and digg.com had articles that soon became the most popular ones for the day.

The news spread like fire in the world wide web, people from all over the world read the news. It was soon clear that there were only a few who supported Sony´s move, the majority was clearly against it.

continue reading "Sony, the rootkit and the internet community"