ICard.exe–Safe or Threat? Unknown Processes.

Sometimes I prefer to manually roam around different system directories for finding out new stuff, surprises or removing unnecessary files and folders (like those of software that I have already uninstalled, and are still grabbing my system storage). This time I went to my “Temporary folder <Temp>” located on “C:\Users\Administrator\AppData\Local\Temp” and found a few files

and when I tried to delete them manually (they are temporary files required yesterday, right?), I got an error message:

Now, I was worried that an unknown process has invaded my system, and so far, I have never noticed this executable file <ICard.exe> running on my system. I set to explore what is it. I Googled about it ‘www.google.com/search?q=ICard.exe’. It was not enough convincing seeing the search results. Most links were like naming it a threat/virus/spyware without enough information, while showcasing their software products for downloading and maintaining your PC, like some Spyware detector or Registry repairer. It was showing up in the Task Manager as

I immediately dropped into the System32 folder as most of the masquerading processes using strikingly similar names as the legitimate processes of the Operating System or other reputed/genuine software reside there.

Now, as seen, a legitimate file “icardagt.exe” from Microsoft  is present there. See the name carefully. Almost similar, but not exactly same.

More searching, I found that it was the executable file for CE100 Dialer, that dials and connects to the Tata Photon Plus broadband network that I use. Now this sounds like a holy crap.

The inputs I got from the Internet, specially http://www.prevx.com/filenames/3820543327704469073-X1/ICARD.EXE.html, shows icard.exe as a malware, potentially dangerous virus that can shield itself from antivirus programs. I must say that process file names as “icard.exe” are not a standard such as igfxsrvc.exe (Intel Common User Interface) or explorer.exe (Microsoft Windows Explorer), so many software or services can have files with the same name, but they will definitely reside in  different locations.

Recommendations:

Gain a knowledge of the basic genuine processes that always run in your PC (asking in technical forums or searching online), as always stressed, education is the first and most important step.

Frequently run your Windows Task Manager in “Administrator” mode, and verify the processes under ‘Processes’ tab.

If you have processes with same names, then the probability is maximum that some malware is executing from your system.

If you have processes with similar names (say, for example, explorer.exe and exploerer.exe, then most probably that exploerer.exe is malicious).

ØØ So always use a genuine and latest antivirus software (with latest definitions) coupled with a system garbage cleaner like IOBit Advanced SystemCare or CCleaner for cleaning your temporary folders, garbage files, repairing your registry, etc.

It is also recommended to use portable malware finder like CaSIR, and sometimes go for free online scan like BitDefender Online Scan.

NB: Deal carefully. If you are not sure, seek further assistance, else you may end up deleting a genuine process file thereby leading to a dysfunctional software or even system crash.

Spywares out there! Are you aware?

TechAspire gives you a brief introduction to “spywares”, what they are, where they’re from, what they can do, etc.,.

 

They mean?

Spywares are typical malwares meant for secretly collecting information about users whose computers they are installed on. Means without your knowledge someone’s monitoring your activities. Sounds serious? Yes!
Most spywares are installed on the users’ computers without their knowledge through piggybacking on desirable software or from the background as in case of Trojan Horses. They are not infectious and this differentiates them from viruses and worms, etc.,. Since Trojan Horses are actively identified by good anti-virus programs like AVG, Avast, McAfee, etc., they are blocked from installing on PCs which have updated anti-virus solutions installed.

Sources include

Most spywares come bundled with those harmless software which users want to install and use. Generally, the installed software will do no harm but that installer undesirably installs the spyware program(s). We give you an example. Sometimes you install some software and after installing, you are prompted to proceed with other downloads. In the installation dialog of some reputed software, you can check or uncheck additional installations. Advanced users normally reject additional unwanted installations. In many cases, visiting specific sites may start unwanted download and install in the background itself. Users may also get lured by online ads and click on them only to be led to download and install. Sometimes, users get frustrated by warning about their PC and are directed to download for solving those issues which are actually misrepresentative and false.

 

[Image Courtesy: www.CartoonStock.com]

 

Some effects and behaviors

Spywares may do bad to the end-users’ system or just be a vehicle for ecommerce. Traditionally, spywares referred to software like Keyloggers which were used by users to monitor usage of the system by other users. But with ever evolving technology and techniques, the definition has grabbed eyeballs and one of the most important issues the Internet industry faces today.
Spywares can perform many things in infected computers. We are mentioning just some of them.

• They can change your browser settings to edit homepage, add toolbars, or redirect traffic.
  
• Many of them are responsible for displaying advertisements. They can monitor your Web usage and set cookies to display you relevant advertisements the next time you visit a specific web site.
  
• They may display advertisement pop-ups following specific user instructions or periodically.
  
• When bundled with backdoors, they can send many of your information, might include personal details as well, to the person who has created it for misuse or illicit distribution against personal gains.
  
• Spyware may affect the computers too. They may interrupt network traffic, affect disk usage or run unwanted CPU threads, and even create Operating System problems.
  
• Some spyware are so created to bypass detection and may ultimately lead to format and reinstallation of software.

 

Examples

You may not know the names of all of the spyware that could possibly be in your computer. So here is a list of some of the names of spyware programs that you can look out for. The first spyware program is called Cool Web Search; this program takes advantage of Internet Explorer weakness. The Internet Optimizer is another one, this is also known as DyFuCa and this program redirects the Internet Explorer error pages to advertising. 180 Solutions which is now called Zango; this spyware transmits detailed information to advertisers about the web sites which the users have visited.
The Huntbar or aka Wintool aka Adware. Websearch, this is a small group of spyware programs that are passed out by TrafficSyndicate. These types of programs attach it self to Internet Explorer’s tool bars. The last example of spyware is called Movieland; there has been several hundred complaints to the United Stares Federal Trade Commission. The FTC has filed a suit against Movieland and is awaiting the trial.

How to save your system?

Prevention is better than cure. But as spyware remain hidden from users, their cure or repair exists in almost all cases. Yet, prevention is possible.

• Do not get lured by online ads. Do not click on what you do not require.
  
• Write perfect URLs. e.g. If it’s gmali.com in place of gmail.com!
  
• Download from trusted websites which scan the hosted files for infections and manipulations like CNET or Brothersoft etc.,.
  
• While installing any software, go through all steps carefully and reject all the additional unwanted installations/ downloads.
  
• Use updated anti-spyware solutions. All the reputed anti-virus programs have their own anti-spyware component installed, depends on its availability in the version you are using. Check out for fake ones, they account for 14% of all malware.

 

Common anti-spyware programs

1. Spybot- Search & Destroy
   
2. Ad-Aware SE
   
3. Spyware Doctor
   
4. Windows Defender
   
5. Spyware Terminator

These are specific anti-spyware software but as mentioned earlier, most reputed anti-virus solutions today have their own anti-spyware components and it depends on which version you are using. You need to visit vendor site for genuine details, and not rely on luring ads to prevent encountering crapwares, and maintain your computers. Watch out!

Basic Software that will make your PC up and running after a fresh Windows installation

 

Have you ever wondered what could be the things you’d require to get your PC up and running after a fresh installation of Windows. There’s perpetual list of software that meet your daily and future computing requirements. Well, I have compiled a list of a few software products to make it easy for you. I personally advocate open-sourcing, so I have also had a mention of open-source alternatives that are great.

The most essential software that you need are:

1. An office suite (MS Office 2003/2007/10 or OpenOffice [Open source])
2. Media players (VLC [Open source])
3. Web-browsers (Mozilla Firefox [Open source], Google Chrome)
4. File compressor/de-compressor (7-Zip [Open source], WinZip, WinRar)
5. PDF reader (Adobe Reader, Sumatra PDF [Open source])
6. Flash and browser plugins for internet applications and video (Adobe: AIR, Flash Player, Shockwave Player)
7. Photo editing/organizing (List in external site)
8. Disc burners (InfraRecorder [Open source], CDBurnerXP, Nero Burning ROM)
9. Peer-to-peer file-sharing: Ares [Open source], µTorrent
10. Anti-malwares to clean-up and protect your PC from security threats. Various products are the in the online market place. Generally, a good premium anti-virus product comes bundled with a lots of features including anti-virus, anti-spyware, online protection, and firewall, some of the big names I know are listed below:
Anti-virus: AVG, Avast, Avira, ESET NOD32/Smart Security, McAfee, Norton.
Anti-spyware: Spybot- Search & Destroy!, Malwarebytes
Firewall: List in external site
11. System maintenance/optimization: CCleaner, Advanced SystemCare.

I personally employ the following to protect my system so that I can have peace in dealing with my own computations (..whew)!
AVG Internet Security 2011, Spybot-S&D, CCleaner, Advanced SystemCare Pro

Now enjoy your freshly installed Windows. Apart from the top 10 basic requirements, you may need more software for meeting up your requirements. The list is unceasing, as I said.

Note:

1. It is highly recommended that only one anti-virus and firewall solution is used in a system, as they use similar system resources and may lead to system crash and/or malfunctioning otherwise.
2. There is no harm in bundling them with one or two additional anti-spyware solutions.
3. Kindly read consumer reviews in different forums before you purchase. The above are my personal views and experiences.
4. Buy Original and Genuine products from genuine web stores.
5. The open-source software products mentioned above are simply decent, and will meet most of your requirements.

Sniffing/Spoofing, DOS/DDOS, Hacker/Cracker- A Briefing

Hello, not long since my last post, I am glad to welcome you yet again. This time my friend at college encountered some terminology and wanted me to clarify as he emailed me the following terms. I had an idea about them, and so I decided to put them here, as they can be universally accessed here by anybody who just needs the overview. Every term is succeeded by an “External Link” for further reading.

 

1. Ethical Hacking: Ethical Hacking means that a computer security expert or analyst attacks a security system on behalf of its owners to find out vulnerabilities, that a malicious hacker could exploit. When the term "ethical" is used, it means that the hacking is done by an attacker on behalf of the owner of the system, and it is legal.

External Link: Read more

Social Engineering: This include those acts that manipulate or befool people (users) in divulging their confidential information to the attackers, without any technical tempering. For example, a rouge email into your inbox might say that you have won a lottery, and may seek your personal information like credit card details, phone numbers, addresses, etc. Most common examples also include phishing websites that sham to be genuine portals or web stores, and gain access to you credit card details.
The attacker dos not applies any technical skill, and is not even bothered about victim’s system, and in most cases, might not even come face-to-face with the victim.
e.g. (i) Pretexting, (ii) Phishing, (iii) Phone-phishing or IVR (Interactive Voice Response), (iv) Diversion Theft, (v) Baiting (Trojan Horse), etc.

External Link: Read more

Network Security Fundamentals: These are the concepts that are designed to provide a network administrator with awareness to various security related issues, and help them to implement essential measures to deploy security in a given network and manage it. Typical concepts are authentication, firewall enforcing policies on what services and how the network is accessed, implementation of anti-malwares (anti-virus, anti-spam software), Intrusion Prevention System (IPS) etc.

External Link Read more

2. System Threat Attacks- Denial Of Service (DOS) or Distributed Denial Of Service (DDOS): They include attempts to make any computer resource unavailable to its intended users, or legitimate users. That means service to legitimate users is denied. It is generally implemented by persons manually or with the help of bots, and which prevents an Internet site or service function inefficiently, or temporarily, or up to an indefinite period. One common method is to blast a phantom traffic to any target machine so that it responds slowly or even fails to respond to its legitimate traffic, and this can be achieved by consuming as much of the computer resources as possible, or by obstruction the communication channel. Other ways might include disrupting system states, blocking of communication channels partly or fully, distorting configuration, etc. More common victims include reputed banks' servers, online payment channels, etc.

External Link Read more

3. Sniffing and Spoofing: Sniffing and spoofing are two threats that target the lower layers of the networking infrastructure supporting application using the Internet. Generally, the users do not interact directly with these low layers, and typically are unaware of the lower layers, or even that they exist.

Sniffing is the use of a network interface to receive data not intended for the machine in which the interface resides. It is a passive security attack that reads data from the network, there is no deception in this case, unlike spoofing. They are of great use to network administrators, as they provide them with a great deal on information regarding data and its flow in the network. But their availability in the common market place means that they are also in the hands of malicious users, who can sniff out confidential data from the network. e.g. Network Analyzers, Token Bridges, etc.

Spoofing is an active security attack in which one machine masquerades as another (different) machine on the network, and may involve in disrupting the data flow, or inject data into the link. This masquer aims to fool other machines on the communication network to accept it as a genuine machine on the network, and try to lure the other machines into sending it intended data, or allow it to alter the data. Some network security attacks use sniffing as a prelude to spoofing, as sniffing can gather sufficient early information.

External Link: Read more

4. Web-based Password Capturing: If the attacker can’t guess your password by hit-&-trial methods, then there are tools available in various types to do the job. In broadcast networks, sniffers may be employed to look at the messages not intended for them. The phishing websites are too dangerous as they can purportedly grab your personal details if you are unaware of their malicious status. Typical tools like screen-loggers and key-loggers are also commonly used in individual systems, and are passed on with sham software products (genuine software after modification) as Trojan Horses, that remain hidden from the user until alerted by the anti-malware products installed. The screen-loggers have the capability to capture whatever is displayed on the screen, while the key-loggers are able to capture whatever keys are pressed on your keyboard. The affected software products also have a backdoor provisioned by the attacker to gain access to gathered data. There are various types of tools, and strategies available.

External Link 1, External Link 2: Read More

5. Hackers and Crackers: There are lots of definitions rolling the Internet, and you will find them contrasting too in many of the cases. The following definitions are after my analysis and personal sense only.

Hackers are those advanced users who are necessarily not great programmers. They analyze the software or system, test, and discover a broad range of possible options to find exploits, vulnerabilities, and might try to fix the flaws or use them to their gains. Hackers may accidentally find technical holes also.

Crackers are those persons who are comfortable with programming up to certain level, generally, and like to debug the software at the assembly level. They dissect the code, fix issues as desired or they may encounter, and then may even reassemble it. They have a proper understanding of the computer system and the technology, and they apply various techniques. The most common example include bypassing License Keys of various software products.

They have a collaboration. If the hacker can not get around a software, then he needs a cracker, although the hacker bears the responsibility for fixing goals.

External Link 1, External Link 2: Read More

Panda Cloud Pro Antivirus (FREE! for 48 Hours)

Panda Security is endeavoring towards making their security tools best amongst the available products in the market, and now the lightweight security suite is joined by a Web filter that will, in addition to a web browser’s native protection techniques, scan URLs (Uniform Resource Locators). And this will work perfectly for most common browsers including Opera, IE, Firefox, Safari and Chrome (as stated in the editor’s document). I don’t have any prior experience with the suite, but I am definitely going to give a try.