Kaspersky's antivirus software has rootkits-Highly disappointed!

We recently reviewed Kaspersky's antivirus software engine for a potential client and were highly impressed. Kaspersky antivirus has a technologically superior antivirus engine compared to competitors such as Symantec

But even before we had stopped applauding Kaspersky for their superior antivirus software, we realized that Kaspersky antivirus had a rootkit that monitored the antivirus software user's activity and reported back to home base.

How utterly disappointing! How can an antivirus software major such as Kaspersky antivirus stoop to such ridiculous depths..

Post note:-Not surprisingly,Symantec antivirus has also been caught including a rootkit in their antivirus software - when caught , the Symantec spokesman call the rootkit a bug in the Symantec antivirus software- Wonder which is worse, having a rootkit in your antivirus software or having buggy antivirus? :-)

Do antivirus software companies create viruses?

Are antivirus software companies responsible for creating and spreading computer viruses?
I know this is a loaded controversial subject but I am sure this is perfectly true.

It is common knowledge in tech circles that some antivirus software companies hire ex-hackers ostensibly for ethical hacking- to check out the potential vulnerabilities of any system in advance.

But is that the only work the antivirus software companies use these hackers for? I strongly believe in the conspiracy theory that antivirus software companies are responsible for creating viruses in the first place.

These antivirus software companies use a simple marketing technique - create a fear psychosis and then make people pay for it! Anyone who has read Philip K Dick's 'Foster You are Dead' can definitely understand what game the antivirus software companies are playing!

Should you download Windows Defender?

The verdict on Microsoft's Windows Defender is clear- you need to download Windows Defender today.

Microsoft's Windows Defender is expected to address at some of the spyware and virus loopholes in the Windows operating system family. Though some (including me) would object to Microsoft releasing the Microsoft Windows Defender as a separate product, I am happy to get at least some security updates to the vulnerable Microsoft Windows operating system

Benchmarking tests for Microsoft Windows Defender :

I have downloaded Microsoft Windows Defender and run it on a Sony Vaio laptop running Windows XP Professional. As part of the benchmarking test with Microsoft Windows Defender,I have deliberately installed some spyware,complicated rootkits and good ol' viruses on the laptop.

Results of the benchmarking test for Microsoft Windows Defender: (Microsoft Windows Defender is still in Beta)

The antispyware benchmarking test had Microsoft Windows Defender doing almost as good as McAfee and Norton antivirus products. However, none of the products including Microsoft Windows Defender, McAfee and Norton antivirus did a good job of identifying the rootkits on the computer. In comparison, Kaspersky antivirus seemed to do a better job at at least identifying the rootkits on the benchmarking test.

A more complex benchmarking test spanning various Windows vulnerabilities will be done next week at a Fortune 50 client- I will let you know the results of the benchmarking test and how well Microsoft Windows Defender performed in comparison to the commercial Windows antispyware products

Download Windows Defender at http://www.microsoft.com/athome/security/spyware/software/default.mspx

Why does Norton antivirus make your PC a tortoise?

Norton antivirus is (in)famous for making your PC run (or rather crawl) like a tortoise. Why does Norton antivirus really consume so much disk space and memory?

I really fail to understand why Norton antivirus and to some extent McAfee antivirus software are such memory hoggers. I mean the antivirus logic is entirely heuristic based and uses standard registry entries to identify antivirus threats.

I can understand intention based antivirus software as being memory hoggers. But the intention based antivirus software I have reviewed consume less memory and even less disk space than commercial antivirus software such as Norton and McAfee antivirus software.

Onion routers- Tor onion routers-a solution to the unsecured internet?

An article evangelising the benefits of onion routers at http://www.tech2.com/india/topstuff/networking-tools-internet/anonymizing-the-net-the-onion-router/2268/0

However, the current use of onion routers is primarily as a gateway for hackers :-) I need real commercial support, funding and more research is needed to make the equivalent of onion Tor Networks used in the right way.

Onion Router

Onion routers are in the news again these days. While onion routers really help in developing secure networks- they also are misused by hackers all around the world.

As with any technology, if onion routers are used well, it could go a long way in developing a secure internet , but onion routers could also be an invitation for hackers to use the untraceable IP feature to hack other networks.

EMC data storage to buy Avamar Tech

EMC is rapidly expanding its offerings beyond data storage to include information security and data backup competencies.
Obviously, storage software, network data security and data recovery software services are growing way faster than the traditional physical data storage business of EMC and EMC, the data storage guys,want to rapidly get into this space.

Intention based antivirus software really works

One of my friends apparently works for a intention based antivirus software company (I am not mentioning the name of the company to make it clear that I am not simply promoting his intention based antivirus company)

According to him,intention based antivirus is a technology that even companies like McAfee and Symantec are researching. Intention based antivirus software will of course revolutionize the antivirus software industry. Imagine a antivirus detection and defence world with

• No frequent antivirus updates since the intention based antivirus technology does not need updates on new viruses,spyware

• No more clogging of bandwidth due to antivirus updates- again, since intention based antivirus does not need major corporate-wide antivirus updates every month

Intention based antivirus software is definitely here to stay-If intention based antivirus software is so easy to develop - why havent the major antivirus vendors such as McAfee and Symantec adopted the new technology?

Intention based antivirus

Intention based antivirus software definitely sounds cool- I definitely dont like the prospect of downloading antivirus software updates almost every day

In addition, I am obviously worried about some antivirus program installing their own rootkit on my machine!

My only question: When are McAfee and Norton antivirus software moving to an intention based antivirus algorithm? Silence? Hmm

Easy hack to speed up your Windows XP PC!

An easy way to speed up your Windows XP PC is to load your Windows kernel into your PC's RAM.

• The registry key to be modified to speed up your Windows XP PC is HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\DisablePagingExecutive

• To speed up your Windows XP PC, set HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\DisablePagingExecutive to 1. This will disable the normal Windows XP paging logic that slows down your PC

• Who should use this technique to speed up your Windows XP PC : This Windows XP registry change should only be used for systems with 256MB or more of memory. Typically, this Windows XP hack to speed up your PC is only advised for systems with 512 MB of memory

Improve Windows XP boot time drastically!

Windows XP boot times can be improved drastically. You just need to tweak a Windows XP registry parameter.

Windows XP has a major drawback in taking a significant amount of time to boot. One option to speed up the boot time is to tweak the prefetching options in the Windows registry.

What is prefetching in Windows XP : Prefetching is caching of system boot files for faster loading. But Hey,the quantum of caching has a significant impact fon system boot time. By selecting the appropriate components for prefetching in Windows XP, the system boot time can be significantly improved

The Windows XP registry key to modify for enabling prefetching :- HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Memory Management\Prefetch Parameters\EnablePrefetcher

The options you can modify for this Windows XP registry key

1. Disable prefetching
2. Prefetch Application launch files
3. To Prefetch boot files
4. Prefetch as many files as possible.

What is pretexting? And why pretexting could lead to identity theft

• What is pretexting? Pretexting implies pretending to be someone else in order to access the private records of customers
• Why is pretexting dangerous? Pretexting is the prelude to identity theft that is nowadays practised not only by individuals but also organized crime
• What is the HP-Verizon pretexting controversy? HP hired investigators used pretexting by pretending to be telecom personnel and managed to get hold of the phone records of Verizon customers.The HP investigators used pretexting to attempt to solve the news leaks from the HP boardroom. As attorneys battle out this pretexting drama,the US Government and Congress have hopefully woken to the pretexting menace.

As you can see,pretexting is scary and Governments need to enact laws to punish pretexting and identity thefts and protect the rights of customers

'I know all about antivirus software!': The infamous Sony rootkit revisited

'I know all about antivirus software!': The infamous Sony rootkit revisited
Good article on rootkit detection. I particularly like the reviews of rootkit detection software.

Another valid question about rootkit: Why isnt the IT industry rising up in protect against rootkits - Why arent rootkits being eliminated while popups are treated like the anti-Christ.

The rootkits protection answer isnt far away - the so called protectors and industry leaders of the IT industry are themselves indulging in spreading their own rootkits. Nothing works like rootkits in intruding people privacy

Thick and thin virtualization

Interesting virtualization categories

Data storage thin virtualization can be defined as virtualization technologies that focuses on non core capabilities in data migration or global name spaces

Thick virtualization is defined as virtualization that focuses on core virtualization technologies such as data storage data replication, data cloning and snapshots.

SAS is the best data storage protocol

SAS or serial attached SCSI is the protocol with the best promise for the data storage industry.

The reasons why SAS or serial attached SCSI is likely to be successful

• SAS or serial attached SCSI uses technology that already exists in current internet infrastructure
• Performance of SAS or serial attached SCSI is almost as good as Fibre channel, with the time tested features of SCSI

Virtualization for data replication, mirroring. Unlimited power in virtualization

Virtualization has evolved to support data migration, data replication and mirroring. In fact, data replication server vendors now openly tout the benefits of virtualization products in data migration.

Why do virtualization products now offer data migration features? Imagine you run a data center with Windows boxes on a SAN- if virtualization tempts you to add a Linux box - you had better use data replication, data mirroring or some other storage technique to ensure that you can recover your data after the inevitable server crashes

EMC's Invista platform for virtualization touts data migration as a major product feature - in fact some customers may be tempted to buy the product for the data migration features.

VMware workstations or Microsoft Windows Virtual PC

Do you choose Vmware workstations or Windows Virtual PCs?
I have always been sceptical of data storage virtualization, considering the amount of marketing hype surrounding virtualization in the market.

However, the latest VMware and Windows Virtual PC announcements have made me revise my earlier sceptical outlook.

Microsoft is offering Virtual PC for workstations free and also promising better support for Linux.

Vmware is coming out with a new workstation version that should remove the kinks out of the earlier version.

All in all, both Vmware and Windows Virtual PC are great options- I choose Virtual PC if the emulation is needed on more Windows environments and Vmware workstation if there are more Linux environments.

The new Myspace adware virus- You could be infected!

Reports suggest that more than a million PCs are infected by the new Myspace adware virus- a banner advertisement that promoted a portal (name hidden for obvious reasons- we dont want to promote the creators of the adware)

The banner advertisement appeared on the 'Profiles' page of Myspace.com. The perpetrators of the adware are not known- but reports suggest they have made a lot of money since adware perpetrators usually get paid depending on the number of PCs they infect.

Invisible rootkits- You had better watch out!

Invisible rootkits are assaulting computers all over the world. Earlier rootkits could be easily detected and removed by rootkit scanners like the 'BlackLight rootkit scanner'.

However, newer almost undetectable rootkit scanners are now entering the market- the rootkit hide unside kernel and other system files so that they are undetectable by any rootkit detection software.

The battle :Aperi Consortium vs the Big 5

IBM has formed the Aperi storage consortium to challenge the BIG 5 data storage company joint effort (EMC, Hewlett-Packard, Sun, Hitachi Data Systems and Symantec) These BIG 5 companies are at least trying to form a common data storage API that will work across systems. However, IBM is still waving the non-cooperative pirate flag so that it can focus on proprietory standards using the so-called Aperi storage consortium