Just an alert that my PC is apparently compromised and most of my accounts were locked this morning before I checked them. It may take me a while to clean up after this. You also may receive emails, messages and other communications I know nothing of. Sorry for any inconvenience.

This is Noel. Reverb's at maximum an' I'm givin' 'er all she's got.

Wes, the problem is as simple as the cause, but will just take time to clean up. I left my PC running overnight, and didn't turn off Internet access.

Sometime overnight, something tried to access many of my accounts such as PayPal, email, and so on. These attempts locked all those accounts. A related piece of malware kept intercepting my logins with a generous offer to store my passwords for me. That has been removed, but I still have to identify all the affected accounts and call their customer support numbers to get access restored to my accounts. Assuming they're still my accounts.

I used to run a very annoying firewall, but under Windows 8, I've only successfully used Microsoft's. That now appears to be worthless.

I'm open to suggestions. Thanks!

This is Noel. Reverb's at maximum an' I'm givin' 'er all she's got.

Fact is, nowadays, even if you are sitting right there if you are connected you are at risk - period. And a firewall is only as good as the time one has to devote to it, in terms of Access Control Lists, permit/deny statements, etc., ad nauseum. Bad people count on folks not doing this kind of stuff with any continuity.

In this case, honestly, I would simply put a product on that I know works. It will block intrusion attempts, updates seamlessly in the background (and often), scan, repair & quarantine or get rid of such malware as you've experienced.

Corny, but good ol' Norton's Internet Security product is a damn good one, with specific support for Windoze 7 & 8 machines as well. How much is your time & financial well-being worth? How much do you spend on guitar strings in a year?

Anyway, I'm not affiliated but it has served me extremely well since I've been away from the Army (where I was protected by core & downstream firewalls from Hades). Also, that same fee gets you a license key to put on up to 3 machines in the family. I just treat it as a necessary annual bill and the wife's machine gets protected as well, since she blithely traipses around the net like an innocent babe.

If you go that route, take some steps to UN-install some of the MS krap as well as any AVG or similar junk product that your PC maker might have "bundled" with it. (In my opinion the bundled AVG stuff often found easily meets the technical definition of a virus based on their beat-you-down, take-over-your-system-to-lead-you-to-their-products approach. Just a rant.)

Also, if you are using IE for your browser, just remember that the "most widedly used" is also the biggest target, in terms of exploits already developed for it; a MS operating system with an IE browser is like low-hanging fruit. Firefox or some other browser doesn't draw as much hostile fire from the slugs out there, although they all have their quirks but so do Jags & JM's.

Thoughts? (I gotta run out & get some 50# braid for a reel 'cause the weather's getting to the point where the bass will be hiding under the lily pads.)

Wes
SoCal ex-pat with a snow shovel

DISCLAIMER: The above is opinion/suggestion only & should not be used for mission planning/navigation, tweaking of instruments, beverage selection, or wardrobe choices.

DaveF wrote:

One tip is to when you log in to any site,
Do your business, log out & close your
Browser window. Closing the window destroys any
Session info saved by the website.

I would be interested if you could expand on this. In my experience closing the browser window (dependent upon browser and the cache settings you've set) may clear your session info from your local history but certainly doesn't seem to be a tactic at the other end on the commercial internet. Otherwise one would not be seeing pop-ups & Spam later with ads about things similar to the items you may have been browsing at, say, Amazon.

(FWIW, if you have a Gmail account, and I have one of those too, the text of your emails is getting parsed as well for keywords, mined by advertisers. Yes, really & I proved it to myself recently. At what transit point does that email have in common with advertisers? Google of course. Not slamming 'em, but it may be of interest to some and should come as no surprise then how easy it is for a .gov leviathan to do the same thing.)

Wes
SoCal ex-pat with a snow shovel

DISCLAIMER: The above is opinion/suggestion only & should not be used for mission planning/navigation, tweaking of instruments, beverage selection, or wardrobe choices.

Be advised that some phishing attacks will even advise you to install (or re-install) some well-known make of AV software (e.g., Norton) as a social engineering tool to get you to feel how trustworthy they are; concerned about your welfare and all that, what could go wrong?

The AV s/w matters not, what they want you to do is trust them enough to click on a link they will provide you that - openly - looks benign but which will carry you somewhere else. As a practical tip, knowing how URLs are displayed, I always hover over one that's not one of my own shortcuts to look at the underlying actual destination at the bottom of the display.

For your night-table reading when you've cleaned up, an an interesting article on 'phisherman' from NSS labs. There are sharks in the water & if you look like a seal...

Wes
SoCal ex-pat with a snow shovel

DISCLAIMER: The above is opinion/suggestion only & should not be used for mission planning/navigation, tweaking of instruments, beverage selection, or wardrobe choices.

My hardware guy at work says some shady malware software firms create
bugs to increase demand & sales of their malware removal products.
Bastards. He didn't tell me any company names that do this.
Before installing any software, I always dig for negative reviews on
the software to see if it's legit.

Badger,

Session variables are like global pieces of info that can be carried from web page to web page. They should be used very cautiously or preferably not at all by a web programmer.
Session variables are easy to create, with a minimum of code.
Closing ALL browser windows should terminate all session variables.
You don't know if a website is using session varibles.
I assume they do & close all my browser windows as a precaution.

Here is a site that explains how websites are tracking you.
http://www.howtogeek.com/115483/htg-explains-learn-how-websites-are-tracking-you-online/

A tidbit on email ads:
http://ask-leo.com/does_google_read_my_email.html

Re: session variables

You log into your bank (or even SG101). Because http is a stateless protocol, the server doesn't know who you are and needs to be told on every browser request. So when you login, the server creates a session to store info about you while you use the site. It gives this session an ID and tells your browser to remember this ID in a cookie. A cookie is a small file that your browser creates on your device. Every time you request a web page from the server, your browser will send this cookie to the server. The server looks in the cookie, finds the session ID, and thus can tell who you are without making you login on every request. There is nothing bad about sessions; its the way the web works.

Now your bank probably tells your browser to delete the cookie when you close the tab or browser. This is because having this session ID laying around is kind of risky. If a malicious website tricked you (or your browser) to revealing this cookie / session ID, it could impersonate you and perform operations as you on your bank's website. This is why banks, etc, advise you to logout and close your browser: it ensures this cookie / session ID gets destroyed. SG101 tells your browser to destroy the cookie in 2 weeks; we are a low risk / impact site and people hate logging in every time they visit. You of course can control this yourself by explicitly logging out of SG101.

Site dude - S3 Agent #202
Need help with the site? SG101 FAQ - Send me a private message - Email me

"It starts... when it begins" -- Ralf Kilauea

I've obtained the original recovery disks from the manufacturer. Plus I've copied all my date files to flash cards. I can copy updates to them as I go along until this thing gets serviced.

The sooner this goes in, the better. Then I'll be offline until I get it back.

This is Noel. Reverb's at maximum an' I'm givin' 'er all she's got.