Custom Domain Migration, And Redirection Blocking

We see occasional frustration, in Blogger Help Forum: Get Help with an Issue, involving broken or unreliable custom domains.

I setup the Custom Domain properly, following the Google directions.

For some of my readers, my custom domain is not opening. I can see it is going in an infinite loop in the browser - and after a long time, it's throwing errors. My domain is setup, properly. Why do I have to deal with this?

And we will investigate - and in many cases, we find the domain is setup properly.

Some custom domain published blogs have problems, which have nothing to do with the domain setup.

Some custom domain problems involve custom code, added to the template, long ago.

Not everybody is in favour of the ongoing Blogger efforts to convince blog owners to force their readers to use HTTPS / SSL, in blog access.

A number of hackers are making their websites popular, by providing code that lets blogs block forced HTTPS access - just as they provided code that blocked local country domain redirection. Some blog owners add this dodgy code, to their blogs.

This hacking lets blog owners publish their blogs, and use accessories and gadgets that only support HTTP access. Unfortunately, with third party code, you get what you get.

Some third party code, which blocks HTTPS blog access, works OK - for a while.

When a blog is published to a custom domain, redirection to "blogspot.com" causes a redirect loop - or a security check.

<script type='text/javascript'>
var blog = document.location.href.toLowerCase();
if (!blog.match(/\.blogspot\.com/)) {
  blog = blog.replace(/\.blogspot\..*?\//, ".blogspot.com/ncr/");
  window.location.replace(blog);
  }
</script>

This is clever code, seen some time ago when used to block country local domain redirection. Then, as now, some blogs might be deleted or locked as malware hosts - or the blogs would become intermittently inaccessible.

Is the unreliability appropriate? You can add what code you like, to your blog. Eventually, what you add may cause you problems.

---

Some #Blogger blog owners add clever code, to block HTTPS Redirection, to their blogs. This is the same hacker provided code, used long ago to block local country domain redirection.

Like country domain redirection, the code added may work fine, for a while. Eventually, the blog will be deleted / locked for malware hosting - or will start throwing 404 errors and similar confusion.

https://productforums.google.com/forum/#!category-topic/blogger/71k8xOXxByI

Read More

Blogger Magic - Using "Add a Gadget"

One of the most useful features of Blogger is the ability to add many different accessories, to a blog.

There are accessories, for every blog - and for every owner preference. The "Add a Gadget" wizard, in the Blogger dashboard, is the best procedure for adding accessories, to customise a blog reliably.

Using "Add a Gadget" is a simple process. It will be most useful, in the long term, if used cautiously, however.

Adding a gadget is not difficult.

Start from the Blogger dashboard Layout page.

Click on any link to "Add a Gadget", to that template section.

This link, for instance, will add a gadget to the right sidebar.



Choose any of dozens of interesting and useful accessories.

Be knowledgeable, when adding accessories.

Similar to the process of adding an HTML gadget, there are a few mistakes that you can avoid, when adding a gadget in general.

1. Some sections of the Layout page may not allow gadgets to be added.
2. When you find an interesting gadget, be selective!
3. Some Blogger provided gadgets are found under "More Gadgets".
4. Don't use "Add your own" - unless you know what you're doing!
5. Add a new gadget, when adding important features.
6. A gadget, as added, will be displayed on every page of the blog.

Some sections of the Layout page may not allow gadgets to be added.

Each template section can be subject to gadget limits, and to locking. This will prevent addition, removal, and / or re positioning of gadgets.

If you're unable to add, remove, or reposition a gadget, you may have to edit the template - and change the section settings.

When you find an interesting gadget, be selective!

"Add Gadget" lists gadgets produced by third party developers, as well as by Blogger Engineering. Some non Blogger produced gadgets won't benefit your blog, in the long term.

Look for "By Blogger", for the best choices.



Not all third party gadgets are intentionally malicious - but the most reliable gadgets will be explicitly labeled "By Blogger".

Some Blogger provided gadgets are found under "More Gadgets".

The "Basics" tab in "Add a Gadget" contains mostly gadgets "By Blogger" - and most gadgets "By Blogger" are found in "Basics". Some gadgets "By Blogger" are in "More Gadgets" - and you may have to search that list, carefully, to find what you need.

Don't use "Add your own" - unless you know what you're doing!

There are 3 tabs, in "Add a Gadget".

1. Basics.
2. More Gadgets.
3. Add your own.

The latter, "Add your own", can lead to frustration.

If you are not familiar with coding XML gadgets (and probably do not need this advice), don't bother with "Add your own". Stick with "Basics" and "More Gadgets".

Add a new gadget, when adding important features.

You can install HTML code using the Template Editor - or you can add an HTML snippet into an existing HTML gadget - if you wish. I highly recommend that you add a new HTML gadget, for each important accessory, though.

A gadget, as added, will be displayed on every page of the blog.

By default, a gadget, once added, will be visible on every template page. You can, with some care and effort, make specific gadgets display selectively.

Enjoy adding accessories, properly.

So enjoy accessorising your blog - just accessorise carefully.

---

You can add any number of useful accessories, to a #Blogger blog, using the "Add a Gadget" wizard in the dashboard Layout page. The best choices are explicitly labeled "By Blogger".

Read More

Blogger Magic - Add An HTML Gadget

Many popular accessories start with raw HTML / JavaScript code, from different third party services.

One of the advantages of publishing a Blogger blog is the abundance of available accessories. With Blogger being in the top 3 of Internet publishing platforms, every third party service wants customers who publish using Blogger.

There are plenty of abusive or malicious accessories, that should not be installed, even when offered - and there are ways to best install the accessories, that can be safely installed.

Most accessories, from third party services, will be provided as HTML / JavaScript.

To add HTML / JavaScript code, to a blog, you can use any of several techniques - though a new HTML / JavaScript gadget is the smartest choice. Adding an HTML gadget, to a Blogger blog, is not difficult.

Add an HTML / JavaScript gadget, using "Add a Gadget" in Layout.

Start from the dashboard Layout page, and select any convenient link to "Add a Gadget". Select "HTML/JavaScript" from the "Basics" tab, in the "Add a Gadget" wizard.



Select "HTML/JavaScript" in "Basics".



Paste the code, that you have to add, into the "Content" window, in the "Configure HTML/JavaScript" wizard. And if you wish, give your new gadget a Title.



Paste the code that you have, into "Content" - with the wizard in HTML mode ("Rich Text" displayed).



Avoid several well known mistakes, when adding gadgets.

There are mistakes, that you can avoid - if you know what to do.

• Be selective, when adding third party code.
• Add a gadget, using "Basics".
• Edit an HTML gadget, with "Rich Text" displayed as the caption.
• With a dynamic template, attach or embed the content in a static page.
• With a mobile display, enable the gadget, if you want it to be viewed.

Be selective, when adding third party code.

It's your blog - and you are allowed to install any accessories and tweaks that interest you. For long term stability and success, though, you should try to only install code from reliable sources.

Your readers will be happier, with your blog using reliable accessories.

Add a gadget, using "Basics".

You'll start with an "Add a Gadget" link, on the dashboard Layout page - and the "Add a Gadget" wizard.

The "Add a Gadget" wizard has the "Basics" tab, with the "HTML / JavaScript" gadget in the list - and it has the "Add your own" tab. You should find the "HTML / JavaScript" gadget, in "Basics".

Edit an HTML gadget, with "Rich Text" displayed as the caption.

The "HTML" / "Text" gadgets, intriguingly have the "Edit Html" / "Rich Text" tabs. If you want to add / edit HTML or JavaScript, the caption should read "Rich Text".



The HTML gadget, in HTML mode.



With a dynamic template, attach or embed the content in a static page.

Adding gadgets to dynamic templates is not a straightforward process. Gadgets have to be written specifically to support dynamic templates - and the HTML gadget is not written for this.

If you want an HTML gadget to work in a dynamic template, you'll need to attach or embed the gadget, in a static page.

With a mobile display, enable the gadget, if you want it to be viewed.

By default, the "HTML / JavaScript" gadget does not display, on a mobile browser. You will have to use the Template Editor, and enable the gadget to display, in mobile mode.

It's your blog.

There are ways to make an HTML gadget work, differently. Long term success will be much more likely, though, with attention to the advice above.

---

One of the most common accessories, added to a #Blogger blog, starts with an HTML / JavaScript gadget. This is a very versatile gadget - and it's not difficult to install. There are several common sense details, however.

Read More

CloudFlare, Custom Domain Publishing, And HTTPS

A few blog owners, who publish blogs published to custom domains, are becoming impatient, waiting for Blogger Engineering to finish the Blogger upgrade to support HTTPS / SSL.

If I get a domain through Google Domains, will I be able to get HTTPS?

Unfortunately, no. HTTPS / SSL is simply not available, to blogs published to custom domains.

HTTPS is not available, for non BlogSpot published blogs.

Whether registered by eNom, GoDaddy, or Google Domains, it simply is not possible to publish a non BlogSpot URL as a supported custom domain, and make HTTPS / SSL available. CloudFlare, a supposed alternative, does not produce a supported custom domain.

A proxied CloudFlare domain looks like malicious redirection.

In some cases, a CloudFlare DNS "solution" tried by some blog owners, will look like dangerous / malicious redirection. Some blogs will show up as "Deceptive sites", aka "phishing".

Some blogs using CloudFlare, for custom domain publishing, will be classified as "Deceptive" sites.



Others will produce alarming warnings about malware.

"This blog is not hosted by Blogger and has not been checked for spam, viruses and other forms of malware."

Click on "Details".



Look at the warning.

Phishing sites pretend to be other websites to trick you.

And there is what you get, with a redirecting proxy service, like CloudFlare.

kireisubs.id. 300 IN A 104.27.133.198
www.kireisubs.id. 300 IN A 104.27.133.198

or

topmovies21.biz. 300 IN A 104.28.0.106
www.topmovies21.biz. 300 IN A 104.28.0.106

This is the basis for malware / phishing classification.

This is most likely a false positive - most custom domain published blogs do not contain malware. Even so, it's not likely that the "Deceptive site" classification will be easily corrected, or the malware warning interstitial removed.

And this is one more blog owner, who must next be provided instruction to correct the DNS addresses.

Having corrected as instructed, DNS addresses are now asymmetrical, and righteous.

kireisubs.id. 86400 IN A 216.239.32.21
kireisubs.id. 86400 IN A 216.239.34.21
kireisubs.id. 86400 IN A 216.239.36.21
kireisubs.id. 86400 IN A 216.239.38.21
www.kireisubs.id. 86400 IN CNAME ghs.google.com.

With DNS corrected, Google shows "Not dangerous" - but the warning still displays.

"Not dangerous".

Note "CloudFlare" is still seen as the host.

You can report an error, to SafeBrowsing.



False classification now requires time consuming site review.

Use "Report Incorrect Phishing Warning", if you believe the site is safe.

Finally, get the site reviewed, from the Security Issues page in Security Console (Webmaster Tools) - Security Issues.

And while the blog remains offline, search reputation - and the owner - will suffer.

---

Some #Blogger blog owners want to provide blogs published to custom domains - and offer HTTPS connectivity. Since Blogger cannot provide custom domains with HTTPS right now, the blog owners are using CloudFlare, which provides an HTTPS proxy.

Unfortunately, a CloudFlare proxy looks like malicious redirection - and blogs using CloudFlare are being labeled as "Deceptive" sites.

https://productforums.google.com/forum/#!category-topic/blogger/ApuJ58a4-kg

https://productforums.google.com/forum/#!category-topic/blogger/-LoJCeX6DEA

https://productforums.google.com/forum/#!category-topic/blogger/DhAFOtJFoCw

Read More

Train Security Products, And Keep Your Blog Clean

Everybody who uses a computer - and expects to use their computer for any amount of time - has one or more protective products on their computer.

Anybody who publishes a blog, with an audience that has any need for security, is going to receive occasional reports from would be readers.

I can't read your blog! My computer displays an "Unsafe website!" warning!

All computer security products, unfortunately, will occasionally generate false positives. Analysing false positive malware reports is as much a part of every security product, as identifying the actual malware.

If you publish a blog, you need to know how to handle reader malware alert reports.

Know online tools, for researching reported problems.

Google provides 2 websites, for analysis of blog / website malware alerts. Both Google SafeBrowsing, and VirusTotal, are Google products that can help to identify actual problems with blogs and websites.

Besides the two Google products above, I use 3 security analysis websites, which can identify specific security problems in blog / website code. Quttera Online Website Malware Scanner, and Sucuri SiteCheck, and Trend Micro SIte Safety Center, have been useful at various times, when a security problem is reported.

You may, from time to time, use all of these - and possibly others - in identifying and verifying a security problem with your blog, or with blogs and websites that you link. For best results, always specify the canonical blog URL, when requesting security analysis - and when sharing the blog, or individual posts.

Specify the canonical URL.

Not a country local domain.



Know what you need to do, to keep your blog healthy.

As a blog publisher, you will occasionally have 2 jobs to do, when receiving a malware alert report which references your blog.

1. Verify / identify / remove any actual malicious content.
2. Report false positives, to the protective service displaying a false positive.

Everybody who publishes a blog, with any reader audience, has seen this advice, or something similar, when surfing their blog.



Know how to keep your blog clean - and your reputation clean.

You have to use online malware analysis services, to identify any problem which you may have created, by installing the latest "gotta have this!" accessory on your blog. And, you have to report any false positive alert, to the owners of any security product, that falsely identifies your blog as a problem.

You do both, to support your readers. You do not want your readers computers hacked, through your inappropriately accessorising your blog - but at the same time,you want your readers to be able to read your blog.

1. Keep your blog content clean.
2. Keep your blog reputation clean.

Do both - or you may not have readers, to read your blog.

---

Any #Blogger blog owner needs to support the blog readers, by publishing a blog clean of any malware, and with a good reputation with the various security products that prevent malicious action by dangerous blogs and websites. Your readers need the ability to use their computers to read your blog - and they need their security to not falsely identify your blog as a problem.

Read More

Custom Domain Publishing, And Alias Blocking

Some blog owners setup their new custom domain, check all settings carefully (and correctly) - then find that it does not work.

We see the confusion, in Blogger Help Forum: Get Help with an Issue.

The addresses were right - and all the DNS servers updated correctly. But when I open the website, it does not open. It continuously reloads for 5 minutes and after 5 minutes it shows an error.

It's frustrating, when everything is setup properly - but still no results.

It's also frustrating, when you forget about unsupported tweaks that you made, to the blog - then have to ask for help.

Whenever changing the URL, check for - and remove - any redirecting scripts.

Before you publish a blog to a new URL, you need to check the template, for any redirecting scripts, that you may have previously installed.

<script·type='text/javascript'>
var·blog·=·document.location.href.toLowerCase();
if·(!blog.match(/\.blogspot\.com/))·{
  blog·=·blog.replace(/\.blogspot\..*?\//,·".blogspot.com/ncr/");
  window.location.replace(blog);
  }
</script>

Scripts which redirect - or block redirecting, when the blog is published to BlogSpot - will not work for you, when you publish to a non BlogSpot URL.

You will need to connect URLs, when possible - without scripts interfering.

Any time you change the URL of the blog, you're going to need some ability to link from the old URL to the new URL. Before you change the URL - either BlogSpot to BlogSpot, or BlogSpot to custom domain - check the template, for redirecting scripts.

Any redirecting scripts, that might have helped you with the blog originally published, will be a problem, when you change the URL. Remove any scripts, before changing the URL.

Better yet, don't add redirecting scripts. If you got this far, without having the blog classified as a malware host, consider yourself lucky.

---

Some blog owners install mysterious scripts, to "protect" against unwanted Blogger features - and forget about their unwise tweaks. When they change the URL of the blog - and the blog, under the new URL reacts to the previously installed tweaks - they are clueless.

If you make unsupported tweaks to your blog, only you can correct problems that arise, later.

Read More

Cybergate RAT Tutorial For Beginners

1) What is a R.A.T?
R.A.T is remote administration tool. In other words, if a RAT is set up correctly, then a person (hacker) would gain acces on victim's computer. That hacker can do any stuff in victim's pc.
For example: a)will be able to move his mouse and keyboards
b)will be able to see your victim by hacking his webcam and etc.

2) Which is the best RAT?
I dont use many RATs. The best that i ever used is Cybergate RAT

So now, lets get started.
First of all you guys download this:

Cybergate Download Link(click here to download)

this download link was not made by me.download and use it at your own risk
this application is called cybergate and it will used to create rat server.
this app might be detected as virus by some antivirus.but dont worry it is not backdoored.

download it and extract it to a folder.

==============================================================
Secondly set up the no-ip client

to do that you must go to :
NO-IP SITE(click here)

register there.

once you have logged in, you must "add a host"

Image has been scaled down 36% (758x329). Click this bar to view original image (1174x509). Click image to open in new window.




Now type in your name at hostname.and choose any domain. you dont have to follow the same name like in the picture below.



now you can see that you have successfully created a host.
now download the no-ip duc client that is available at that site.

Image has been scaled down 16% (758x273). Click this bar to view original image (902x324). Click image to open in new window.



click the windows version.

once done downloading, run the program. sign in using your no-ip username and password.
and press select host and you can see your host there. click at the box and press save .


===========================================================
now its time to set up your cybergate RAT seRVER
LETS CONTINUE

run the cybergate rat that you have extracted into a folder.
there will be agreement which you got to wait for a few seconds before agreeing.

next: Control center-->start


now a box would appear.you have type in 100 and press the go image button.
and type in the connection password as 123456
and click save

Image has been scaled down 26% (758x344). Click this bar to view original image (1012x458). Click image to open in new window.



now press: control center--->builder--->create server

Image has been scaled down 25% (758x345). Click this bar to view original image (1009x459). Click image to open in new window.




now a box would appear.
click new
press the name of the new user and ok

Image has been scaled down 25% (758x344). Click this bar to view original image (1009x457). Click image to open in new window.



now double click the new user.

Image has been scaled down 25% (758x342). Click this bar to view original image (1009x455). Click image to open in new window.


after that you will the connection tab.
view the picture for better understanding.

if you want to test the server on yourself or same lan networkk, then you have to edit the 127.0.0.1:999 to 127.0.0.1:100
if you want to test on others, then add:
yourhost.no-ip.info:100

Image has been scaled down 25% (758x346). Click this bar to view original image (1010x460). Click image to open in new window.


change the identification to cyber and password to 123456

Image has been scaled down 26% (758x344). Click this bar to view original image (1011x458). Click image to open in new window.



now press the installation tab and use the same setting as mine.
Install directory is the where the server installs
%System%
%Windows%
%Root%
%Program Files%
%Other%
it is more better to use "system"
Boot: this will be the startup option. check everything and press random 5 times so that the server will start everytime your victim start the computer
Directory is the place where the server will be situated
File Name will be the name of the server in the directory
change the creation date
persistence will inject the server into the victim,s pc until success
for inject into just use default browser
dont choose hide file because it will make your server detectable by all antivirus

Image has been scaled down 25% (758x345). Click this bar to view original image (1008x458). Click image to open in new window.



go to anti debug tab and check all

Image has been scaled down 25% (758x343). Click this bar to view original image (1010x456). Click image to open in new window.


and then go to create server tab
check use icon,delayed execution, and google chrome password
delayed execution will be the time taken for the server to inject into victim's pc .
google chrome password will help you to steal google chrome passwords.
a pop up will appear and just press ok

Image has been scaled down 25% (758x344). Click this bar to view original image (1008x457). Click image to open in new window.


now you have done setting up your server.
===================================================================
PortForwarding
Q: So, what is portforwarding?
A:Port forwarding allows remote computers, for example, computers on the Internet, to connect to a specific computer or service within a private local area network (LAN)
so lets start portforwarding.

remember that your the port that you have choosen is 100.
to make it easier.lets download the simpleportforward tool from this site:

SIMPLE PORT FORWARDING(click here)

from here pc wintech TuT starts ., all credits of port forwarding goes to Pc win tech.com
now, once it is downloaded,run the program.

1)firstly update your router list and set your router.

Image has been scaled down 38% (758x341). Click this bar to view original image (1216x547). Click image to open in new window.


and press the "choose which port you need to forward" by pressing the "do it now"
and press the "add custom"
type
name:anything
type: tcp/udp
start port:99
end port:100
and then press "add"

now click "update router"


when you have pressed update router, you can see the program accessing your router and editing whatever you have typed just now.
and now the last step, which is to check whether your port 100 is open or not.
but before that close your cybergate program.
and now do like in the below picture

Image has been scaled down 9% (758x551). Click this bar to view original image (829x602). Click image to open in new window.



if the portforwarding is failed, then you have to start from the beginning of portforwarding
======================================================================
now,you have done it.
what you have to do now is spread your server.
good luck

---------------------------------------------------------knox d3cryptor/Team 73cyf

Read More

Types of Computer VIRUS

What is a Computer Virus?
A potentially damaging computer programme capable of reproducing itself causing great harm to files or other programs without permission or knowledge of the user.

Virus - A program that when run, has the ability to self-replicate by infecting other programs and files on your computer. These programs can have many effects ranging from wiping your hard drive, displaying a joke in a small box, or doing nothing at all except to replicate itself. These types of infections tend to be localized to your computer and not have the ability to spread to another computer on their own. The word virus has incorrectly become a general term that encompasses Trojans, worms, and viruses.

Types of viruses:-
The different types of viruses are as follows-

1) Boot Sector Virus: - Boot sector viruses infect either the master boot record of the hard disk or the floppy drive. The boot record program responsible for the booting of operating system is replaced by the virus. The virus either copies the master boot program to another part of the hard disk or overwrites it. They infect a computer when it boots up or when it accesses the infected floppy disk in the floppy drive. i.e. Once a system is infected with a boot-sector virus, any non-write-protected disk accessed by this system will become infected.

Examples of boot- sector viruses are Michelangelo and Stoned.

2) File or Program Viruses :-Some files/programs, when executed, load the virus in the memory and perform predefined functions to infect the system. They infect program files with extensions like .EXE, .COM, .BIN, .DRV and .SYS .
Some common file viruses are Sunday, Cascade.

3) Multipartite Viruses:-A multipartite virus is a computer virus that infects multiple different target platforms, and remains recursively infective in each target. It attempts to attack both the boot sector and the executable, or programs, files at the same time. When the virus attaches to the boot sector, it will in turn affect the system’s files, and when the virus attaches to the files, it will in turn infect the boot sector.
This type of virus can re-infect a system over and over again if all parts of the virus are not eradicated.

Ghost ball was the first multipartite virus, discovered by Fridrik Skulason in October 1989.
Other examples are Invader, Flip, etc.

4) Stealth Viruses:-These viruses are stealthy in nature means it uses various methods for hiding themselves to avoid detection. They sometimes remove themselves from the memory temporarily to avoid detection by antivirus. They are somewhat difficult to detect. When an antivirus program tries to detect the virus, the stealth virus feeds the antivirus program a clean image of the file or boot sector.

5) Polymorphic Viruses:-Polymorphic viruses have the ability to mutate implying that they change the viral code known as the signature each time they spread or infect. Thus an antivirus program which is scanning for specific virus codes unable to detect it's presence.

6) Macro Viruses: - A macro virus is a computer virus that "infects" a Microsoft Word or similar application and causes a sequence of actions to be performed automatically when the application is started or something else triggers it. Macro viruses tend to be surprising but relatively harmless. A macro virus is often spread as an e-mail virus. Well-known examples are Concept Virus and Melissa Worm.

If you use a computer, read the newspaper, or watch the news, you will know about computer viruses or other malware. These are those malicious programs that once they infect your machine will start causing havoc on your computer. What many people do not know is that there are many different types of infections that are categorized in the general category of Malware.

Malware - Malware is programming or files that are developed for the purpose of doing harm. Thus, malware includes computer viruses, worms, Trojan horses, spyware, hijackers, and certain type of adware.

This article will focus on those malware that are considered viruses, trojans, worms, and viruses, though this information can be used to remove the other types of malware as well. We will not go into specific details about any one particular infection, but rather provide a broad overview of how these infections can be removed. For the most part these instructions should allow you to remove a good deal of infections, but there are some that need special steps to be removed and these won't be covered under this tutorial.

Before we continue it is important to understand the generic malware terms that you will be reading about.

Backdoor- A program that allows a remote user to execute commands and tasks on your computer without your permission. These types of programs are typically used to launch attacks on other computers, distribute copyrighted software or media, or hack other computers.

Hijackers- A program that attempts to hijack certain Internet functions like redirecting your start page to the hijacker's own start page, redirecting search queries to a undesired search engine, or replace search results from popular search engines with their own information.

Spyware- A program that monitors your activity or information on your computer and sends that information to a remote computer without your Knowledge.

Adware- A program that generates popups on your computer or displays advertisements. It is important to note that not all adware programs are necessarily considered malware.

There are many legitimate programs that are given for free that display ads in their programs in order to generate revenue. As long as this information is provided up front then they are generally not considered malware.

Dialler - A program that typically dials a premium rate number that has per minute charges over and above the typical call charge. These calls are with the intent of gaining access to pornographic material.

Trojan- A program that has been designed to appear innocent but has been intentionally designed to cause some malicious activity or to provide a backdoor to your system.

Worm- A program that when run, has the ability to spread to other computers on its own using either mass-mailing techniques to email addresses found on your computer or by using the Internet to infect a remote computer using known security holes.

Read More

Fb spam with hacker

Hi, after a Long time came to Post one of the serious issue roaming with us,I tried to get this to You as clear as possible to show How danger is this......As a long gap to this blog i learnt some  of the techniques to reverse engineer an malware (i.e) how it infects,how it places their infections,how to get rid of this and all.....So Keep Proceed to read this Post and get rid of this Things...

Recently I logged in to my Facebook account as normal Purpose,Recently  I had a chat from one of my Friend asusual  i continue chat with him,but i didnt know he is infected or hacked by some of the Facebook spam (Since Lot more there)..suddenly he left from chat and dropped a link,I don't know whats happens, finally i concluded that its a spam link but its not a spam link its actually a severe Trojan (You'll know at the end of this post),because he doesn't knows as much in internet and confused of this link,I came across some of the Facebook spam ,so i Like to spread how curious this infection to my friends so researched that Trojan according to my basic Knowledge and delivered to You, continue with me

Observation 1:

The chat we had

Observation 2:

Then i clicked that link,Really i shocked,check This Image....

Then i noticed one Youtube Page is opened with title"my facebook name IS IN THE LEADING ROLE.SHOCKING PERFORMANCE"  and have Likes ,i shocked my name is in the youtube page and some video is there related to me(actually nothing there) finally i noticed its a phishing page, LOL suddenly i switched My  session to VM (virtual Machine)...

Observation 3:

And i started to search some of the clarification whether its original or not,I opened that Page in my VM and checked again and i noticed two things

I Tried to Play this File and its asked to download the Flash Player and asked to install to view this video,LOL i already had Flash Player,and i noticed the IP its 46.147.149.162,and Had a clarification with nslookup that this IP is not related to Youtube The original servers of Youtube are

Its ok where this IP located i trace that IP in IPLOOKUP and found some interesting,

So i continued to download that file....and had a virus scan in virustotal.com,Check the Virustotal Report Here

Click To view The virus scan report

Observation 4:

And i executed that File in my VM ,It started their Process by unpacking ,and got placed in their respective Locations,And suddenly my Internet Speed is drastically downs,I cant even Browse Google that much slow,Its started Making connections to their servers,so i Gone through the Process and noticed a bulk of curious Services and process running behind

Oh boy how many crap process are running these are all make my internet downs,then i started to research all of them The process,Most of the process are running from TEMP folders,In a simple term no EXE files or Process are not run from TEMP folders except Installation.....But these Files are currently running from these locations on every Startups, 

Observation 5:

Then i started exploring Startups in registry and found interesting

Yes,these trojans occupy their Locations in RUN key,These made executing on every startups

Observation 6:

Then i continued to trace their services and their Successful Connections established and found that all trojans we noticed had a connection with their remote servers,actually they send something to the respected IPs

NOTE: i never opened any Browsers and i didnt run any services related to Internet but still many Process trying to communicate with their servers and sending something,

Observation 7:

And i eagerly wants to know what makes my internet connection down,Then i noticed some annoying thing running background

Gosh! abulk of packets sending and receiving through some IPs these made my internet connection down,

Actually what they are sending means Its executed in Your system and start sending your confidential things to their respected servers,Like it acts like a Keylogger in Our computer and send our Logs ,Logins to their servers like bank accounts,email accounts our chat logs,not only as a keylogger ,the attackers controls your whole system and take you remote view without your knowledge,If you have webcam means you are viewed by the attacker without your knowledge its a simple example These files acts as a backdoor and make a path to the attacker

Then i traced that IP 68.9.127.143

and i eagerly want to shows how curious it is ,we just downloaded one file Flash-player.exe and executed but its got unpacked to many files and start executing see this

Really this is a serious infection,One thing i have to tell on main Process of this trojan is it hacks your facebook account and start sending this Link to your friends without your knowledge Then what this chain continues.....I hard to kill this trojans.........Finally i killed all of the infections but still i have a loss ,I lost my VM because its corrupted the registry files,but its just a VM.....LOL

Summary of this infection:

Memory Processes Infected: 9

Memory Modules Infected: 0

Registry Keys Infected: 10

Registry Values Infected: 13

Registry Data Items Infected: 3

Folders Infected: 1

Files Infected: 39

Process of this trojan

• It will takes your system as botnets
• It will uses your Internet as Proxies(Mainly Hackers do this for Illegal purpose)
• Act as a Keylogger(Which records Keystrokes and sends)
• Hacker remotely views Your system and contols your system
• crash your computer
• Hacker downloads our Confidential files without our knowledge
• Steals your data

How to Avoid:

• Never ever try some catchy things in social-network sites..
• Scan the links from Online scanners like urlvoid.com.
• Scan the untrusted files which are downloaded from internet in sites like virustotal.com , novirusthanks.org
• Scan the files with your updated antivirus
• Dont directly download files from untrusted Links.
• Avoid using Torrents(if you are not trusted)
• Dont click on Nasty ads like free smilies, online games ,etc more are there
• Update your Antivirus and stay safe

all the credits of this TUT is to Mr Hworm 

Read More