Nokia’s now mostly retired Symbian operating system still sits in a resounding first place with just under three quarters of all malware, but Android now has a malware problem that is growing exponentially according to the security company’s quarterly threats report…

Last quarter the Android mobile operating system (OS) became the most “popular” platform for new malware. This quarter Android became the exclusive platform for all new mobile malware. The Symbian OS (for Nokia handsets) remains the platform with the all-time greatest number of malware, but Android is clearly today’s target.

They say that SMS-sending trojans are still the biggest threat but that trojans that record phone calls to steal sensitive information are now beginning to appear.

While Google’s problems with malware on their Android platform are well known it should be pointed out that this report makes no mention at all of either Apple’s iOS, Microsoft’s Windows Phone or RIM’s Blackberry apps security.  It is odd that the chart they provide doesn’t single out these operating systems at all, merely referring to “Others” at around 10% of the malware problem.

Ten percent of all smartphone malware however is still a huge issue and assuming that 10 percent is split equally three ways (which is just an assumption to highlight a point), while it would only be about 16% of the total malware available for Android, we’re still talking about huge numbers indeed.

Mobile malware is a continuing problem and one I highlight as often as I can.  The reason for this being that this malware can cost you real money in premium rate texts or other mobile charges that can’t occur on your PC.  It’s entirely within the gift of your mobile operator as to whether they will refund such costs, but as the mobile malware problem escalates it will become more and more likely that operators will simply blame the user for downloading and installing the malware (which is fair to be honest) and refuse to issue any credits.

As the introduction to the report the company says…

The third quarter of 2011 offered its fair share of noise and signal: Malware continues to be produced daily at high levels, but we often miss its sophistication—which lies buried beneath the big numbers.  McAfee Labs saw some significant increases this quarter in stealth malware techniques, often referred to as rootkits, especially from the TDSS family. We also observed the continued emphasis on mobile malware, specifically targeting the Android operating system. In fact, this quarter Android was the sole target of mobile malware writers. A true portent indeed!

Unfortunately the mobile malware problem generally is receiving precious little widespread publicity.  While IT Enthusiasts might be increasingly aware of the need to install an anti-virus package on their handsets, the bulk of consumers will still see the their smartphones as embedded OS devices that will just work in the way their TV or toaster does.  They won’t necessarily see it as a device that can be infected and compromised.

While the report is clearly intended to shock, without the exact figures for iOS, Windows Phone and Blackberry’s being released it is hard to guage overall how bad the problem is and to make a judgement over how much more of a target Android is over the next platform.

When users try to open the McAfee ScriptScan or McAfee SiteAdvisor page at the official Mozilla Add-on repository, they are redirected to the add-on’s Blocklist entry.

The reason for blocking the add-on is a high volume of crashes according to that page. Affected by the block are all ScriptScan versions 14.4.0 and below for Firefox and Seamonkey, and users of McAfee SiteAdvisor.

Firefox users who run one of the blocked add-ons in the browser will see the following message in the web browser: Firefox has determined that the following add-ons are known to cause stability or security problems

A click on Restart will disable the add-ons completely. Users who try to install the add-on see a similar message: The add-on name has a high risk of causing stability or security problems and can’t be installed.

The initial bug report requested to add McAfee ScriptScan and McAfee SiteAdvisor add-ons to the blocklist. It also mentions that both add-ons have caused more than 10,000 crashes in a one week period for Firefox 6.0.2 and Firefox 7 users.

Even worse, if you follow the initial bug reports you will find a comment by Robert Kaiser who mentioned that Mcafee ScriptScan alone was responsible for more than 15,000 crashes on September 28.

We had 1555 processed crashes on 6.* yesterday, with the 10% throttling rate, this means that roughly 15,000 crashes happened during a single day with this signature!

Something really needs to happen here, do we have any contact with them to get on this fast?

The Blocklist page only lists the block of McAfee ScriptScan on October 3. If you go through the list you find a McAfee SiteAdvisor from March 14.

Users who try to open the McAfee SiteAdvisor add-on page get the same blocked information page though, which means that both add-ons have been blocked by Mozilla.

It is good to see that Mozilla is taking a stand, even if it means to pull add-ons from a big company from the site. It is not the first time that big companies got hit with a block. If you look at the list you will see applications by Microsoft, Yahoo, AVG or Skype on there as well.

McAfee reportedly is working on a fix, according to a moderator response:

1) It’s NOT a security issue

2) It’s a decision made by Mozilla based on crashes that have been reported to Mozilla

3) McAfee is aware of it, has a bug filed and is working with Mozilla to address the problem

4) Until it is fixed, the primary workaround is to re-enable the ScriptScanner. Alternatives include use another browser for now (with most browsers you can import bookmarks and homepages). Also, SiteAdvisor 3.4 will provide *some* overlapping protection, specifically for scripts run in iFrames on webpages

Ed Bott now suspects that McAfee is not solely to blame for the crashes. In his opinion, it is the rapid release process that “plays havoc with the makers of browser add-ons”. Bott supports the claim by mentioning that Symantec also experienced compatibility issues in some of their products.

What’s your take on the issue?

Despite that, popularity has risen and more and more companies have created services to shorten long urls. The latest to join the ranks is security company McAfee which adds a twist to the game.

One of the biggest problems of nearly every url shortener is that the user does not know what’s behind the link. Some services offer intermediary pages to provide the user with the information, while most do not.

A click can lead to a legit site, or something else. Possibilities range from direct links to viruses and trojans, distasteful sites or other sites that try to attack or exploit.

The McAfee url shortener looks on first glance like any other service of its kind. The main page consists of a form and a shorten button.

mcafee url shortener

Users enter or paste an url into the form and click on shorten to create a short version of the url. This is displayed on the next page. Several sharing options are displayed on that page including the popular choices Twitter, Facebook, Email and Google Buzz.

What makes the service interesting is that the destination will automatically be scanned for malicious contents. By default, a frame is displayed on top of the destination that indicates if a page has been deemed safe by McAfeee.

mcafee

Creators of the shortened link can configure the service to bypass that frame if the site is clean. That’s optional on the other hand. Users who visited the site can close the frame as well.

The web page contents are not displayed if the website has been classified as malicious or otherwise dangerous by the service.

mcafee blocked site

It is possible to still see the page that is blocked by the service, but that requires some manual work. There is no option to bypass by clicking a link. Instead, the link to the destination page is displayed needs to be copied manually and pasted into the address form of the browser.

The url shortening service has a few restrictions regarding the links that can be shortened:

• No links to other url shortening services, including McAf.ee url shortening links
• No links to private IP space
• No links to badly formed domain names
• No domain names with XSS, or tags

Users can access the McAfee url shortening service directly on the page. There is also a Google Chrome extension that can be used to create the shortened links.

Intel says it will utilise McAfee to help it build security features into it’s processors, which currently power the majority of all PCs and Apple Macs around the world.

Both companies have already been working together for the last 18 months and both parties hope that regulatory approval for the buy-out will be granted after both boards for directors agreed the deal unanimously.

News of the surprise move for Intel sent McAfee’s shares soaring y 58% for $47.17 while Intel’s shares fell slightly by 3.2%, though probably not on the basis of this news.

Tim Danton, editor of PC Pro magazine, said the announcement came out of the blue.

“Intel does buy a lot of companies and it does have a lot of more cash than anyone else out there. So it making a big acquisition isn’t a surprise, but you may have thought it more likely to buy another hardware firm,” he told the BBC.

“No doubt Intel is looking ahead and seeing that the laptop and desktop market are probably past their heyday and the big growth area is mobile.

“For a company like Intel, it’s nowhere near as strong in the mobile area as it is in the laptop and desktop areas, so it’s probably looking for new ways to get streams and revenues in the future.”

But he added: “Perhaps that is Intel’s point of view but not everybody else’s. The reaction from investors has been quite negative.”

McAffe was founded in 1987 and has revenues of $2bn a year.  Intel, founded in 1968 has annual revenues of $35bn.

So called anti virus removal tools have been created to effectively remove traces of anti virus software from the computer system. They usually run a series of processes that delete files, Registry settings and other parameters or options that have been installed by the antivirus software during installation.

Below is a collection of anti virus software removal tools that have been created by the developers of the programs to aid their users if they encounter difficulties uninstalling it.

• AntiVir Registry Cleaner
• Avast Removal Tool
• AVG Remover
• Bitdefender Uninstallation Tool
• F-Secure Uninstallation Tool
• Kaspersky Removal Tool
• McAfee Consumer Products Removal
• Microsoft One Care Uninstall Cleanup Tool
• Norton Removal Tool
• Panda Anti Virus 2008 Uninstaller
• Symantec Corporate Products Clean Up Tool

Did we miss antivirus software uninstallation tools in the list? Let us know in the comments.

The last time I used one was when I bought a new laptop which had all kinds of trialware installed. The McAfee Consumer Product Removal Tool removes all 2005, 2006, 2007, and 2008 versions of McAfee consumer products including trial versions.

The tool works on all Windows NT systems including Windows XP and Windows Vista. The interesting aspect is that McAfee recommends to remove the product from the Remove Programs option in Windows before running the cleanup tool.

After removing the McAfee product from the Remove Programs option in Windows the McAfee Consumer Product Removal Tool has to be used to remove any files, folders and Registry keys that have not been removed by the default Windows uninstallation process.

Windows Vista users have to start MCPR.exe as administrators by right-clicking the file and selecting Run As Administrator from the menu.

If the cleanup fails a Cleanup Unsuccessful notification appears that provides access to a detailed log file. A simple text document that can be analyzed or send to McAfee support for further details.

A Dangerous Downloads warning means that the website is serving potentially dangerous software that contains viruses or spyware. Unsolicited Emails on the other hand refers to websites that either send unsolicited emails to users or sell user emails. Sites that are flagged as Browser Exploits will not appear in the search engines anymore.

The options provide a way to change the default Searchscan setting which warns the user from potentially dangerous websites to removing those websites from the search results list or disabling Searchscan altogether.

The warning message appears above all search results to warn the user that some of the websites in the results are potentially dangerous and are also appearing right beneath the title of the website using red text and an exclamation mark icon.

This could help protect users who do not care enough about the dangerous corners of the Internet. I’m not sure on the other hand about the effectiveness of the service. How often is the database updated, how are new sites added to the list ? Still, all in all, it’s good to see that search engines start to take responsibilities.

I personally do not install software like this especially if it has Norton / Symantec or McAfee written on it. Still this might be useful for some and it is free after all. Here are the steps that you need to do: (Thanks to Raymond for finding another great offer)

Visit the Natwest website and click on the huge banner at the bottom saying Free PC Security, Protect your PC for 12 months with McAfee VirusScan Plus. This will lead you to a McAfee website that has a Register Now button. Click on that button and fill out the registration form.

McAfree VirusScan Plus 2008 Features

• Safe Search, Safe Surf. McAfee® SiteAdvisor™ adds ratings to websites to help you avoid online dangers.
• Home License Subscription Service. Automatically delivers the latest software features and threat updates and lets you easily manage security subscriptions for all your PCs.
• Stops Viruses. Blocks and removes viruses and even stops them before they even get to your PC.
• Stops Hackers. Protects and conceals your computer from hackers.
• Blocks Spyware. Blocks spyware before it installs on your computer and removes existing spyware.
• Improves PC Health. Cleans clutter off your computer so it stays healthy and secure.

It requires your name, email and a password. You might want to uncheck the options below the form so that you do not subscribe to those newsletters. Click on the I Agree button to proceed and in the next window on the Go To My Account button.

This should load the account window and you should see the McAfee VirusScan Plus 2008 subscription in a table on that page. A download / install button is available in the same row, click that button to download the file DMSetup.exe and execute it when the download is finished.

You should be automatically logged into your account, if not the option is given in the tool. Just click on the Download button to download the real product which takes a while. Once the download is completed you click on Install to install the product.

The Register Now link is not working all the time. My first test through up an error message. Just try it again and it should work afte all.