Phrozen VirusTotal Uploader 2.1 is now available.

As with all our programs, we listen carefully to our users’ reviews and recommendations. As of today, we released yet another updated version of Phrozen VirusTotal Uploader and the update has some important new features.

The main modification of this version is the support of column sorting and context Menu in the “Scan Result”. Now you can export the result list to text, copy result items, etc… Finally, the best improvement in this part of the program is the support of BBCode exporting. You can now export the scan result to any forums/CMS that support BBCode format.

Here is an example of scan report exported in BBCode.

Finally the change of the “Scan result”

To end this post, a little video about how to use your own VirusTotal API Key.

Download

As promised, we released the new version of PhrozenSoft VirusTotal Uploader this weekend. We were really pleased to see, read and hear many positive reviews and remarks about this program on several renowned software websites.
We at PhrozenSoft carefully read each and every post to see if users of PhrozenSoft VirusTotal Uploader make useful  suggestions about a particular function they would like to see included into the program or make a remark about an existing function that could be improved upon. If deemed valid we certainly try to implement these valuable suggestions.

We cannot add the function check if a particular file was already scanned by VirusTotal before uploading. As we use a public API, each IP-address is limited by VirusTotal itself to 4 requests per minute. Thus, implementing a system to increase the number of files to check means that it would slow down the scanning process considerably. We will continue to look for new and improved methods but at the moment the system seems to work fine.

Note: We would like to thank the Softpedia website for their official review, and giving us an “Very Good” award.

Note: This review concerns the version 1.1.1 version of the program not the new 2.0 version.

Changelog Version 2.0.

Some Screenshots

Download

As promised in our previous article,  this wekend we released a brand new tool. Actually it is our biggest project ever.

Here follows a short description about PhrozenSoft VirusTotal Uploader

PhrozenSoft VirusTotal Uploader is an easy and powerful solution to upload any suspicious file to the official VirusTotal website, and receive the results in real time.

VirusTotal is a free service which allows you to scan files using most of the well-known antivirus programs and, because it scans a file simultaneously, it is also called a Multi-Engined Virus Scanner.

Not all malware can be detected by any antivirus program because malware is ever evolving. When you download a file or files and your antivirus program tells you that is isn’t infected with malware, you might want a second opinion.
On the other hand, your antivirus programs can deem a downloaded file suspicious but you might think it to be a so-called false positive. VirusTotal is the solution to all your worries because it will inform you that a suspicious file is infected or not. Or that a possible detection was simply a false positive.

As VirusTotal is owned by Google, we would like to take the opportunity to thank Google for keeping a such amazing service free. Please note that this software will never replace a real up-to-date antivirus program — It is only another layer of security to protect you and your computer even better against malware, like viruses because it can remove some doubt you might have when you have downloaded a file that you think is suspicious.

Here are some features included in the program.

• Load and Upload — Load one or multiple files from your drive;
• Process Explorer — Submit one or multiple files from current running process;
• Startup Explorer — Submit one or multiple files from Windows Application Startup;
• Services Explorer — Submit one or multiple files from Windows Services;
• Active Connections — Submit one or multiple files from current process which are connected to the internet;
• Download and Submit — Download securely a file from a given URL and submit it to VirusTotal;
• Secure Connections — The Uploader connects to VirusTotal using a secure protocol HTTPS (SSL);
• Drag and Drop Files — We support files Drag ‘n’ Drop. Just select a bunch files and drop to the upload list to submit them to VirusTotal;
• Use last Windows API — To improve the user-friendlyness of the program, we use the latest graphical Windows API (7 & 8), if available;
• Support connect through Proxy — If you are in a company, you are probably behind a Proxy. You can configure the program to connect through this proxy with authentication if you need to;
• Fully support 32 and 64bit arch — As today recent computers comes mostly in 64bit architecture, we fully support both 32 and 64bit systems;
• Submit through Explorer — If you see a suspicious file on your desktop, just right click on it and click “Send to VirusTotal”.
• Asynchronous scan — The application is multi-threaded which means you can do a lot of things at the same time without freezing the application. You can upload or scan multiple files at the same time, view reports, etc.

Some pictures about the software.

Demonstration

Finally you can download this free application from our official website

Note:  for support, bug reports and suggestions, please refer to our Forum.

Download

That’s why VirusTotal is such an important service because scanning a suspicious file with the Multi Engined Virus Scanner from VirusTotal will remove almost any doubt you may have.

VirusTotal also has a huge community of Security Experts which share their work of detecting Virus which helps making this service even better. Because of its success, Google acquired this company in September 2012 especially to secure other Google services such as Gmail or Safebrowsing (now part of Google Chrome and Firefox).

Few weeks ago we tested the Official VirusTotal Uploader freely available from http://www.virustotal.com. We deemed it to be a very useful tool for security enthusiasts and paranoids alike. If you detect strange in your process list or your desktop you can simply right click and automatically upload the suspicious file to the VirusTotal Multi Engined Virus Scanner service.

The main problem we had with this tool was that the program has become a bit outdated. It doesn’t work well on Windows 64bit architecture because of Images Paths and it only proposes a process explorer / basic file scan and Download + Scan (which is an excellent idea indeed) — and because of this we decided at PhrozenSoft to create our own version of VirusTotal’s Uploader. As you should expect from us this Uploader will be loaded with features and of very complex design.

After few weeks of very hard work we are glad to show you a teaser of what’s going to be our biggest project since we created PhrozenSoft in the summer of last year.

Few features include:

• Load and Upload — Load one or multiple files from your drive;
• Process Explorer — Submit one or multiple files from current running process;
• Startup Explorer — Submit one or multiple files from Windows Application Startup;
• Services Explorer — Submit one or multiple files from Windows Services;
• Active Connections — Submit one or multiple files from current process which are connected to the internet;
• Download and Submit — Download securely a file from a given URL and submit it to VirusTotal;
• Secure Connections — The Uploader connects to VirusTotal using a secure protocol HTTPS (SSL);
• Drag and Drop Files — We support files Drag ‘n’ Drop. Just select a bunch files and drop to the upload list to submit them to VirusTotal;
• Use last Windows API — To improve the user-friendlyness of the program, we use the latest graphical Windows API (7 & 8), if available;
• Support connect through Proxy — If you are in a company, you are probably behind a Proxy. You can configure the program to connect through this proxy with authentication if you need to;
• Fully support 32 and 64bit arch — As today recent computers comes mostly in 64bit architecture, we fully support both 32 and 64bit systems.
• Submit through Explorer — If you see a suspicious file on your desktop, just right click on it and click “Send to VirusTotal”.
• Asynchronous scan — The application is multi-threaded which means you can do a lot of things at the same time without freezing the application. You can upload or scan multiple files at the same time, view reports, etc.

Finally, the most interesting: A video demonstrating the full power of the application.

DON’T FORGET TO WATCH THE VIDEO IN FULL HD.

Here is a copy of the original email (Sorry it is in French):

As we can see, the person behind that extremely bad joke managed to change the password  and associate email address. The first question that arose was: how the hell did he do that ?

- Was I compromised ?
- Was I the victim of a new Skype 0day vulnerability ?
- Was this simply an unknown bug in Skype ?

Immediately I checked all my computers connected to this account. I used third party programs for deep analysis and logs analysis. Nothing strange could be found so nobody managed to steal my personal data and/or my passwords.

So how did he manage to change the password?  He simply used the weakness of Skype password recovery system ietself.

How to

To do a such thing you must know few bit of information :

- Target email address
- Few target skype contact accounts
- His billing email if used.

I will not go high in details because the goal of this article is not to demonstrate to script kiddies how to have fun but to achieve a such thing you simply need to request a new password to Skype support and asking to change the password because you just forgot your email and your password (lol).

After that initial step you will need to proof you are the real owner of the account. You must give 5 contacts accounts to the support desk. That’s easy because you just have to add 5 fake temporary accounts to the target account and its done. Another option is to simply ask the intended victim which people he knows on Skype. That option wasn’t that hard because I have over 1000 contacts. Finally if you use payment for Skype credits, Skype support will request for the mail used to pay. O wait. It is the same email account.

A few moments later you are the new owner of the Skype account.

The more I think about it, the more I’m convinced that security is a big joke at Microsoft, the owners of Skype. I seems that the largest IT-company in the world has created a huge security mess. They are easy to Socially Engineer (aka Manipulate Humans) and their password system is so weak than anybody everywhere – rich and poor, the powerful and the not so powerful – could get their Skype accounts compromised in just a few clicks. It could happen tomorrow, it could happen today or it might already have happened.

In my case the hacker asked to all my contacts with an automatic message for some Liberty Reserve money. Most of them trust me and my account, so they were inclined to accept. Fortunately the hacker decided to give me back the account before Microsoft did  – maybe because I had his real personal information.

Notice that this person could potentially spread via my compromised account phishing attempts or infect my system or those of my contacts with some type of malware without any problems. In hindsight it was fortunate that the goal of this guy was simply to get some money to pay his bills.

As I previously said I manage to get his personal information but I will not post that information online because the perpetrator decided to return my account back to me.

I will of course contact Microsoft to report this serious security issue. In my view this is a critical oversight that needs to be remedied quickly.

Also Microsoft’s Support Team should make a serious effort to communicate better to their customers. At the moment they do not seem to care that much about their customers. I myself am a good client for Microsoft and Skype because I have spent a lot of money buying their professional systems.

Skype will fully replace Windows Live and that means that more and more people will start using Skype and that makes the problem even worse because more will fall victim to this problem I described above.

Note this identity spoofing is not the only security problem of that Microsoft Service. Many months after it was reported to Microsoft, Skype still suffers from a Network Weakness which can reveal your real IP Address to anybody to face to some DDoS attacks and related weak but efficient piracy methods.

I also hope to see very soon a system like Google uses and which sents you an SMS to your personal phone before changing anything. It’s system that Facebook also incorporated.

~ Jean-Pierre LESUEUR

Greets to TrojanForge security experts and friends that help me to acknowledge how all of this was done.

]]> http://phrozenblog.com/?feed=rss2&p=218 7 http://phrozenblog.com/?p=203 http://phrozenblog.com/?p=203#comments Fri, 22 Mar 2013 11:06:45 +0000 PhrozenSoft http://phrozenblog.com/?p=203 Phrozen Mirage Anti-Bot (aka Phrozen AntiMalware) is especially designed to protect you from the dangers of BotNets. BotNets sometimes consist thousands of infected computers that perform malicious tasks, like sending out spam, delivering fake security programs or trying to steal your online banking credentials (phising).

If your computer should become infected, Phrozen Mirage Anti-Bot blocks communication between your computer and compromised sites, which will effectively mean that your computer cannot download more malware or become – unbeknown to you – part of the BotNet itself.

As a security project, Phrozen Mirage Anti-Bot has become so successful that we have decided to add several new features to the program to enhance its scope and let it become even more powerful that it already is. It has been downloaded and installed by thousands of users and – as far as we know – much appreciated for its simplicity of design, its user-friendly User Interface, and its price — 100% free.

If you don’t know what Mirage Anti-Bot does or want to check it out, we recommend you to go to the following link.

In this article we will discuss Phrozen Mirage Anti-Bot v4.0, which is currently being developed and which will be – again – totally different than the previous version.

Previous versions of Phrozen Mirage Anti-Bot successfully used the Microsoft Windows Hosts file to store the malicious websites which should be blocked. This system is used by nearly every other security program and, while this is a good method to block a small amount of sites, it tends to bloat your Hosts file, causing your computer to slow down more and more. Also, some third party security software can restrict or block access to the Hosts files which makes Phrozen Mirage Anti-Bot unusable for some.

That’s why we decided to rethink the whole structure of Phrozen Mirage Anti-Bot. We needed a cleaner and more efficient way of restricting access to these malicious websites. We also reviewed the whole design of the application to give it an even more comfortable user experience and add some more functionality.

The program should also be able to collect some anonymous and statistical information about successfully blocked malicious sites. Of course, this option will be optional but highly recommended because it will help us to continuously enhance the program.

Finally, we managed to find new partners. They agreed to share their extensive databases with Phrozensoft and will ensure that Phrozen Mirage Anti-Bot will even be more powerful.

We recently reached an agreement with VirusTracker and CRDF ThreatCenter and we will add their databases to Phrozen Mirage Anti-Bot. In addition to the existing database from Abuse.ch and our own ever growing database, we can assure users that Phrozen Mirage Anti-Bot will become more powerful than ever before.

We cannot yet give a date but Phrozen Mirage Anti-Bot v4.0 should be ready within few weeks.

Basically it will grab any dropped torrent file (inside the DropBox path) and automatically start the downloading process from the computer where you installed the freeware.

For example, you could install Phrozen Dropbox Torrent at home, then when you are at work searching (and finding) for something which only exist as a torrent but you then run into problems because your internet may restricted and, as a consequence, you are unable to download that torrent. With Phrozen DropBox Torrent you simply download the torrent file, drop the torrent file in one of the DropBox synchronized paths and then wait few seconds. When the torrent disappears from the DropBox context, it means the download has started from the computer where Phrozen DropBox Torrent is installed.

Note: This is only the very beginning of the project and this project could grow in something much more powerful which not only downloads torrents but will have other interesting features as well (Phrozen DropBox Utilities).

It doesn’t require any torrent client. We use a free torrent downloader called Aria (console), which is very efficient.

Below are a few screens of the program

Main Window with a current Transfer

You can double click on an item to see more details

Result list with an example of error

Settings Window

Some notes about the Settings Window:

- Device Name is not yet used in the program but could be useful for a future version;
- DropBox Path is only here as an information;
- Logs Count is the number of logs you want to load at program start-up (previous downloaded files and/or errors);
Async Work is the number of task done at the same time, the default value is 20 which means the program will not download more than 20 torrent at the same time.

Youtube tutorial / demonstration video: 

Finally you can download this free application in our official website, notice for support / bugs / suggestion please refer to our Forum.

Download

Another problem with Windows Explorer is the fact that you cannot create Favorites such as in your browser. I know you can create a shortcut in the sidebar or in whatever folder you want but it would bump the sidebar or the shortcut folder.

Over the years I tested several types of Explorer plugins but nothing really satisfied me. But my troubles and aggravation are over now because recently a friend told me about a tool called ‘Clover’.

‘Clover’ is yet another tab management tool but it is using the tab engine of the Google Chrome browser. Since Google Chrome is my favourite browser and it’s tab engine is – in my opinion – by far the smoothest, most stable, fastest and best engineered tabs engine to date, I decided to give ‘Clover’ a try.

I found that I cannot do without it anymore and as of today PhrozenSoft recommends this little piece of software. We would like to thank our new partner for creating a such an amazing tool.

Basically, this is what ‘Clover’ can do

1. Automatically transform your default Windows Explorer in Chrome tabbed style;
2. Drag ‘n’ Drop files to another tab easily;
3. Create favorites location by drag ‘n’ drop or Ctrl+D shortcut;
4. Put files in favourite bar just by drag ‘n’ drop;
5. Show/Hide the favorite bar (We recommend to keep it visible);
6. Automatically check for updates (Which is the same as Chrome’s system).

Soon ‘Clover’ should support Themes and I hope the author will add the proxy configuration (for update system).

Some ‘Clover’ Screens

Download

If you are constantly wondering or worrying what happens on your computer when you’re away then from now on your problems are over. Afraid of the online predators that harass your children online and want to keep an eye on their online chat behavior  Wondering if your employees are not spending too much time on the internet and wasting your valuable time? Found some strange text messages on the phone of your spouse and are you now worrying about the fidelity of your spouse? Well, our software might be just the tool you need.

The Keylogger is divided in three distinct parts: the Lite version (FREE) the professional version and the Ultimate version  The Lite version contain the keylogger program only, the professional version is the Lite version with blacklisting and synchronization in more (plus some other extra functions). The Ultimate version comes with extra surveillance functions (such as Webcam and Desktop surveillance).

What is Phrozen Keylogger Lite ?

Phrozen Keylogger Lite is a powerful and user friendly keylogger especially created for Microsoft Windows systems. Phrozen Keylogger Lite is compatible with all currently supported versions of Windows, which effectively means Windows XP to the recently released Windows 8.

Phrozen Keylogger Lite has been especially created to capture all keystrokes from any type of keyboard (PS/2, USB and even Virtual Keyboards). The captured keystrokes are stored into a local database. There they are sorted by their process name and the active window into a log.

Phrozen Keylogger Lite is running silently in background. When the program is successfully installed on a computer, it will capture all keystrokes fully stealthily and the program will remain hidden from every user. It will not slow down the computer it is installed on.

If you want to consult the logs of the current day or previous days just press the so-called “Magic Shortcut” and enter your personal password and the logs will be made visible in a new window. You can easily manage, export, delete, mark as important, mail, etc. these logs.

Phrozen Keylogger Lite also gives you the possibility to manage black listed words. When such a word is entered via keystrokes you will immediately be sent a mail which contains the entire context in which that ‘black listed word’ appears. This is a very useful feature: suppose you have forbidden your son to go to a specific gambling site and he does go there against your wishes, you then immediately get a mail that warns you of this transgression.

What could he do ?

Finally few screenshots of the program 

Create a new account

Efficient logs searcher

Settings Window

List of captured logs

Capture everything even extra symbols

Finally you can download this free application in our official website, notice for support / bugs / suggestion please refer to our Forum.

Download

Phrozensoft Anti-Bot 3.0 will now automatically and silently update your host file, using data provided by the well-known antimalware site www.abuse.ch. This data consists of blocklists that are able to stop your computer from contacting all ip’s and domains which are currently used as Command&Control server (C&C) by the ZeuS crimeware, the SpyEye crimeware and the Palevo crimeware. You can now even create your own rules to block websites which may be a useful feature to stop your children from reaching certain undesirable websites. To stop other users unblock these websites, the settings of Phrozensoft Anti-Bot can be secured with a password.

Phrozensoft Anti-Bot is using a probe system that will listen to blacklisted websites that are blocked by the program. Eventually Phrozensoft Anti-Bot will be equipped with a system of notification.

Phrozensoft Anti-Bot is very easy on the recourses of your computer and does use only a very limited amount of memory. That all implies that the program is very nimble.

Phrozensoft Anti-Bot is – and will forever be – totally free.

Few screens about the software

Main Window / Update process

Malicious website list

You can create categories to block custom websites

If Probe activated, you can see when a threat was successfully blocked

Then it is logged in a local database

Finally Mirage is very customizable

Finally you can download this free application in our official website, notice for support / bugs / suggestion please refer to our Forum.

Download