Songbird Audio Player

Songbird is free of charge and release basis application, which is used for audio singing and net browsing. It is a primary web player. It is initially an audio player. When it comes to auditory player then a large amount of people decided it among the three or four most fashionable apps;  for example itunes, Winamp, VLC, Aimp player, but present are lots of additional appealing choices like Songbird. Songbirdplayer be capable of play and realize music. The primary thing you resolve observe about songbird is its similarity to the itunes boundary, which revenue that if you’ve ever used itunes you won’t have any dilemma in learning how to apply                                   songbird.

Then as you discover the program’s bill of fare and choice, you willpower start discovering all the goodies it has to propose. But, you know how to also set a song or all of them to do again style, closure between major player and minute player mode, opt for the boundary talking and topic, modify the media outlook ( filter pan, list ), change to full partition method, zoom in and away, select the page technique and personality indoctrination, use upright shortcuts and more. Additionally, you be capable of generate playlist and analysis the maximum rated, lately added and recently played songs, sight artwork, in addition to use the “undo” and “redo” key a seek occupation and an equalizer. Finally, songbird is a absolute, full-featured music entertainer and manager with prop up for block – in and an widespread user group of people.   

If you download this Player click here….
  

UM Media Player

UM Player (worldwide media player) is a without charge and release basis multimedia entertainer. It is anchored in UMPlayer that plays approximately each audio and video layout and youtube and SHOUT transmit tributary video play by it. UM Player be obtainable for Windows, Linux and Mac OS X. It agree to the playing of together music and videocassette natively. UMPlayer chains over 270 video and audio layout, counting disk formats for instance DVD and VCD and the folder are AVI, FLV, MKV,  MP4,  MOV,  OGG,  VOB,  WMV, and audio design like MP3, FLAC, AC3, MLP and loads of others. At the moment UMPlayer integrated dozen of sophisticated facial appearance such as sinkable boundary, built in subtitles seek, sift rendering and more.

Um player crossing point is fresh and easy and it also come up to with subject matter prop up which resources its emergence can be personalized using downloadable enclose. This means each person can personalize it according to their savor. UM Player is a modish and commanding media player which is chains a lot of audio and video formats. It is further suitable for screening movie and video songs. It is an unusual but effectual media player. On the whole, Um Player is a fine supplementary to the media player bazaar. So, you can make use of it with no doubt.

 

If you want to download this Player click here……

League of Legends RP hack

I recently blogged about a (still current) scam targeting players of the online game League of Legends: Free Riot codes scam . See the conclusion at the end of this post for tips and tricks.

When re-checking several websites and Facebook pages, I came across an interesting file that will supposedly generate Riot Codes for you:


League of Legends RP hack 2012. Looks legit.

You need to insert your username, password and the RP value. Looks legit. No wait, it doesn't generate anything, it will just send your credentials to the scriptkiddie. The file is obviously written (read: copy/paste) in Visual Basic and uses the SmtpClient class to send your credentials to a certain mail address:



Voila, here's the email being used
Thanks to the mail address provided, I was able to pull more information by performing a simple Google search; for example real mail address, Facebook, age, location ... I will however not publish any details.


League of Legends RP hack 2012.exe
Result: 2/42
MD5: f6c05598e9b4b7ae2264e4f0a8bcb6ca
VirusTotal Report


In case you're wondering, the file on itself is not malicious. It will only do harm if you filled in your username and password and actually clicked the "Press here for RP" button. In that case, change your password immediately.


There are similar programs out there, a few examples:


Example #1



Example #2



Conclusion

Conclusion is pretty straightforward: besides the normal scams I see "programs" like this rise more and more, not only on Facebook, but also on forums and mainly on YouTube as well.

Don't be fooled by a nice interface or promising words, it's all fake. Remember:
if it looks too good to be true, it probably is!

Also as stated before, the programs I encountered above are not malicious on itself. However, it is possible some of these are in fact malicious and may contain a keylogger or viruses. Always be wary when downloading something you don't really know. Use a service like VirusTotal to check for any malicious activity, or run the program in a Sandbox.

Has your account been hacked? Head to the following link from Riot to recover it as soon as possible: http://forums.euw.leagueoflegends.com/board/showthread.php?t=1064749 

Some DO's and DO NOT's by Riot themselves:
https://support.leagueoflegends.com/entries/21552105-Protecting-Your-Account

Repeating: if it looks too good to be true, it probably is!

LinkedIn spam, exploits and Zeus: a deadly combination ?

Is this the perfect recipe for a cybercriminal ?:

1. Hacking LinkedIn's password (and possibly user-) database.
2. Sending an email to all obtained email addresses, which is urging you to check your LinkedIn inbox as soon as possible.
3. A user unawarely clicking on the link.
4. An exploit gets loaded. Malware gets dropped. Malware gets executed.
5. User's computer is now a zombie (part of a botnet).

I would definitely say YES.

A reader of my blog contacted me today, he had received an email from LinkedIn which was looking phishy. We can verify that Step 1 is accomplished, by the simple fact that in the "To" and/or "CC" field of the email below, there are about ~100 email addresses. A quick look-up of a few of them on LinkedIn reveals the unconvenient truth...

Here's the email in question:


Reminder from LinkedIn. You got a new message !


Subjects of this email might be:
"Relationship LinkedIn Mail‏", "Communication LinkedIn Mail‏", "Link LinkedIn Mail" or "Urgent LinkedIn Mail‏". No doubt the subjects of this email will vary, and are not limited to these four.


Step 1 and step 2 of the cybercrook's scheme are already fulfilled. Now he just has to wait until someone clicks on one of the links. Which brings us to point 3.

Suppose someone clicks on the link. What will happen exactly ? This depends on the version of these programs that may be installed on your computer:

• Adobe Reader
  
• Java

In some cases, your browser will crash. In other cases, the page will just appear to sit there and nothing happens. In unfortunate cases, the exploit will begin doing its work. As said before, a mixed flavor of Adobe & Java exploits are used.

In this case, we will review the specific Adobe exploit. We will check with Process Explorer what exactly is happening:


The green highlighting indicates the spawning of a new process

What's this ? There's a process from Adobe Reader loaded under our Internet Explorer ? Which seems to spawn a .dll file ? Which in turn spawns another file .... Okay, you get the point here.

The PDF file has several embedded files, which are dropping malicious executables and executing them. After the process of spawning and dropping processes and executables, the malware will also clean-up any leftovers, including the PDF file at first:


Message from Adobe Reader it has crashed. Have a guess why

After the user clicks OK, everything looks fine. Right ? No, of course not. Ultimately, there's a malicious executable which will start every time the computer boots.

Interesting to note is, that there is also an attempt to exploit CVE-2006-0003. An exploit from 2006 nonetheless !

Step 3 and 4 have also been accomplished now. The user clicked on the link, the exploit(s) got loaded and the user is now infected. With what you may ask ? Well, let's review all the associated files:


The initial Java exploit - set.jar -
(when I first uploaded this sample a few hours before this blogpost, there were ZERO detections)
Result: 2/42
MD5: b0697a5808e77b0e8fd9f85656bd7a80
VirusTotal Report
ThreatExpert Report

I just now re-uploaded set.jar (17:47:41 UTC), it has now 6 detections. Most probably the Blackhole exploit kit is responsible for this attack. Microsoft identifies the file as
"Exploit:Java/CVE-2010-0840.NQ".
The corresponding CVE can be found here.



"I got Java patched, always", you might say. Great ! How about Adobe Reader ?
c283e[1].pdf
Result: 11/38
MD5: ad5c7e3e018e6aa995f0ec2c960280ab
VirusTotal Report
PDFXray Report
MWTracker Report


Thanks to PDFiD, we are able to see there's an AcroForm action and 6 embedded files. Basically, AcroForm is just another way to execute JavaScript in a PDF document. Embedded files are... files hidden in your PDF document:


PDFiD results



Here's our first dropped file - calc[1].exe
Result: 5/38
MD5: 4eead3bbf4b07bd362c74f2f3ea72dc4
VirusTotal Report
ThreatExpert Report
Anubis Report


Calc[1].exe will drop other files. Examples:


amutwa.exe
Result: 9/42
MD5: e7e25999ef52e5886979f700ed022e3d
VirusTotal Report
ThreatExpert Report
Anubis Report


nyyst.exe
Result: 10/42
MD5: fbc4bb046449fd9cef8a497941457f4f
VirusTotal Report
ThreatExpert Report
Anubis Report


The malware will try to 'phone home' or connect to the following IP addresses:
188.40.248.150 - IPVoid Result
46.105.125.7 - IPVoid Result

The IPs above (188.40.248.150 in particular) are part of a known botnet.

After all 4 steps have been executed, Step 5 of the process is completed as well and the machine will be successfully part of a botnet. The Zeus botnet. For more information about Zeus, you can read upon the (limited in information, but sufficient) Wikipedia article:
Zeus (Trojan Horse)

There are also numerous articles on the Zeus botnet, the takedowns by Microsoft (whether they were successful or not, I'll leave in the middle), and many other reports.



Conclusion

So, what did we learn today ? If you do not know the answer to this question, please re-read the article again.

PATCH PATCH PATCH people ! Keep ALL of your software up-to-date ! This means Adobe, Java, but don't forget other software, for example VLC, Windows Media Player.... You get the picture.

This also includes installing your Windows patches, keeping your browser up-to-date as well as any plugins or add-ons you might have installed.

If possible, avoid using Adobe and/or Java. There are alternatives. An alternative for Adobe is for example Sumatra PDF. Just don't forget to patch the alternatives as well !

Finally, use an up-to-date Antivirus product to keep your machine safe should you not have done any patching. Chances are you might still be infected, but are already less likely.

If you are in a corporate or business network, take the necessary actions and include several layers of protection. This also includes informing your users to not click on everything in an email ! Applying the appropriate Security Rights on a machine can prevent you from having a whole lot of work.... and lack of sleep ;-) .


Note:
If you are interested in the files discussed in this post, contact me on Twitter:
@bartblaze

WinZip

WinZip is a document firmness utility for windows. It urbanized by WinZip. It tolerate to you condense the mass of great document and records dissimilar files in to one large file. WinZip is a extremely realistic to firmness document, document encryption, folder sharing and records flip side up device. Its boundary is very customer welcoming in addition to visually appending. You can hurriedly and firmly zip and Unzip documents to preserve storage space, velocity up email communication and decrease download times. WinZip is the mainly trusted system to work with firmness files. No other firmness utility as easy to use as WinZip. It offers inclusive and effectively ornamental move toward. With this application you know how to pack and Unzip documents dimension as you desire.

You as well can divide up them by online by means of your associates or amass them on outside tool. WinZip hold up most of the normally old formats for records and you can make a code word for your recently shaped archived documents. This application is similar to WinRAR software.It downloads and set up progression is very easy and comfortable. Its body feature is very clear and eye-catching. At this time a day WinZip is most all the rage and most uses documents solidity tool. Finally, if you want a prevailing density tool that reduce file size as much as likely without injurious file value. So you can desire it devoid of reservation.       

For Download ( It is a 45- days trial version) click here.........