Halleynet Headspace

Just a wee post to say that Power and Control Solutions Ltd. ’s new website is now live.

The site replaces a previous version which did not fully reflect the products and services PCS offer. We have worked closely with them to provide a better site which describes more fully the services in power generation to  power generating companies, generator firms and big service critical industries like telecommunications and datacentres inthe financial sector. They also work offshore both on fixed installations and ships, especially inthe Oil Sector.

The new website descibes a number of projects they have worked on globally as well as explaining information about the solutions and field services they offer using integrated control systems and components from companies like ComAp and GAC.

In building their site we used php, and some AJAX and jQuery components to provide a pleasing and simple design.

We hope the website is a success for PCS and look forward to working with them again in the future.

A client asked me to look at a PC that had been infected by a “virus”. In fact what it had been infected by was a particularly abhorrent bit of malware called Ant Spyware Soft.

It was probably inadvertantly installed by my client by clicking on one of thos warning boxes that splash up in some browser windows warning you you have an infected machine- the box looks very like a windows error but its actually not.

An article in PC Pro recently was saying this type of malware is serviced by Russian Mafia types as a way to effectively extort sums from web users by installing their dodgy AV software which then watches their internet history recoding Credit card numbers etc and relaying to the ” mother ship”.

The PC was installed with F Secure 2010 AV but the damage was done probably byt he client authorising the install unwittingly. F Secure could detect the system modification attempt by a service effectively a random string name. But it could not detect the virus it seemed nor stop its troublesome attempts to scare the user.

It did a number of bad things.

1) It kept warning that it had detected an intrusion attempt- funny as when I had the machine it was not even connected to the internet- worth a test if you ever see such a warning- disconnect and see if it persists. I always disconnect any infected machines when I am awar eof them and recommend you do too.

2)It kept flagging up spurious process crashes.

3) It disabled access to services.msc- the control panel services applet and taskmgr.exe (so you could neither id or disable it by conventional means)

4) Once you opened a IE8 browser window it went mental – constant alerts resulting in many red shields inthe system tray, and sometimes a Windows AV type window saying AntiSpyware Soft – click to purchase and enable- to sort tht eproblem. of course you would be mental to. It also sent the web browser to dodgy websites like p*rno.com and vi*gra.com (and probably others) Heightening the fear factor or the client!

5) I did a bit research onthe web (as you do and the best info i found was on www.spywareremove.com) It gae free, manual removal instructions which were spot on and worked a treat. I would say – you need to use Safe Mode to do the steps listed and be happy inthe registry. I found a couple of key s that differed from their instructions but they were easy to spot and I put it down to the variable behaviour of the malware)

6) With the files deleted its back t normal, but I have installed Google Chrome on the machine as its less susceptible to some of the aspects of such malware.