Computer Virus Removal

May 8 2011

Samsung Laptops, Now New and Improved with Keyloggers…or Not

Computer Virus Removal, Laptop, Latest News, Malware, Security, Virus

samsung laptop computer, use of keyloggers article Recently, technical blogs and Twitter feeds were full of rants about laptop manufacturer Samsung after Network World published an article with a shocking accusation; Samsung was distributing new laptops with a commercial keylogger installed. Keyloggers are malicious, secret programs used to capture everything typed on a computer, passwords, personal information – everything. In this case, the keylogger could also send the collected information to a third party without the knowledge of the user.

Collective outrage spread like a viral video across the web, complete with threats of a class action lawsuit and warnings that suggested Samsung was stealing passwords and capturing screen shots. The anger was understandable and even justified, except for one tiny detail, it wasn’t true. Queue dramatic music.

In the Network World article, a security consultant claimed to have found the commercial keylogger StarLogger installed on brand-new Samsung laptops after performing a virus scan. Mistake number one. The analyst reported that he confronted Samsung about the discovery, and that support personnel confirmed the company was aware of the software and even suggesting it was used to monitor machine performance. Mistake number two. Without confirming the findings with alternate virus scanners or another third party, the analyst published the story to Network World where chaos ensued. Mistake number three – the perfect trifecta.

Further examination found there was no keylogger; it was a false positive by the anti-Virus software. Samsung, who was shocked as the rest of us by the claims, immediately denied the accusation and began an internal investigation. The company has released an official statement that confusion occurred to control any residual damage. Continued exploration for the source of the Samsung employee who confirmed the existence of the keylogger found that call center employees had agreed with the analyst to end the call. The call center supervisor said that when the caller’s issue could not be resolved it was easier to agree and make up a reason that aligns with their theory.

This chain of events, while personally amusing, actually contains several lessons that can be beneficial to average computer users.

Virus and malware can affect even trusted companies and sites. You cannot assume safety. It is your responsibility to protect yourself from security breaches.
Keyloggers are a very dangerous form of malware. Users should ensure anti-virus programs or malware removal services have specific capabilities for identifying and disabling these dangerous programs.
Anti-virus software can be wrong. It can miss virus. It can create false reports. To minimize this possibility, you should keep your preferred anti-virus updated at all times.

It’s been quite an exciting week; too bad this didn’t happen on April 1^st.

Related posts: The Information Safety Net

April 11 2011

Malware Attack Spoofs Shipping Companies

Browsers, Computer Virus Removal, Latest News, Malware, Security

Apparently, there can be worse things in the mail than bills. This month multiple big-name shipping vendors have had their brands exploited and used in malware distribution schemes. We have written before about the security dangers of malware, and how even seemingly “safe” web destinations can harbor significant risks. This month our words of wisdom have again been validated, but we won’t say “I told you so,” at least, not again. Email is being used in all of the malware campaigns where DHL, USPS and FedEx branding is being to trick users into downloading and executing malicious files. The large number of Internet users that aren’t especially technically savvy will continue to make low-tech attacks attractive to criminals.

In the FedEx malware attack, recipients receive a letter that appears to announce the impending delivery of a package. However, the only thing that the email is actually signaling delivery of is the need for a computer virus removal service. The message with the subject “FedEx notification #random number” and the message:

Dear customer. The parcel was sent your home address. And it will arrive within 7 business day. More information and the tracking number are attached in document below. Thank you. © FedEx 1995-2011

includes attachments that when executed, attempt to download additional files and steal FTP credentials stored on the infected device.

Criminals in the DHL attack, also executed in March, used a similar technique to distribute their trojan, but apparently did not run spell-check before sending out their malware-laden spam.

In the United States Postal Service malware attack, the spam message appears to be a failed package delivery notification for express mail, with the subject “Post Express Information. Your package is available for pick up.” The message claims that an error in the shipping address caused the package to be returned to the post office, from where it can be retrieved. If users click on the attachment, they will definitely want to return the trojan and scareware that is installed.

Delivery notifications and similar techniques have been used previously in computer attacks. Users have to be aware that caution should be exercised with every link, even those that appear legitimate. How can you protect yourself? Install anti-virus and malware protection and make sure it automatically updates. Any content downloaded should be scanned with a virus scanner and malware protection should be kept current on all systems that access the Internet, including mobile devices.