<?xml version="1.0" encoding="UTF-8"?><rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>#malware &#8211; Startupware: Managing Startups</title>
	<atom:link href="https://www.startupware.com/tag/malware/feed/" rel="self" type="application/rss+xml" />
	<link>https://www.startupware.com</link>
	<description>Autorunning Software &#38; Running a Software Business</description>
	<lastBuildDate>Thu, 12 Mar 2020 20:30:48 +0000</lastBuildDate>
	<language>en-US</language>
	<sy:updatePeriod>
	hourly	</sy:updatePeriod>
	<sy:updateFrequency>
	1	</sy:updateFrequency>
	<generator>https://wordpress.org/?v=6.9.4</generator>
	<item>
		<title>Why Computers and Commuters Both Need Coffee</title>
		<link>https://www.startupware.com/working-models/why-computers-and-commuters-both-need-coffee/</link>
		
		<dc:creator><![CDATA[Jerry Stern]]></dc:creator>
		<pubDate>Thu, 02 May 2019 14:30:55 +0000</pubDate>
				<category><![CDATA[Definitions]]></category>
		<category><![CDATA[#malware]]></category>
		<category><![CDATA[computer tuneup]]></category>
		<category><![CDATA[printer drivers]]></category>
		<category><![CDATA[startup software]]></category>
		<guid isPermaLink="false">https://www.startupware.com/?p=1948</guid>

					<description><![CDATA[<p>Old computers aren’t always slow  because they’re old. If they were not budget computers on day one, they  shouldn’t act like junk in year three.</p>
<p>The post <a rel="nofollow" href="https://www.startupware.com/working-models/why-computers-and-commuters-both-need-coffee/">Why Computers and Commuters Both Need Coffee</a> appeared first on Startupware.com. Visit to read more about software design, malware, and computer security.</p>
]]></description>
										<content:encoded><![CDATA[
<figure class="wp-block-image"><img fetchpriority="high" decoding="async" width="500" height="338" src="https://www.startupware.com/wp-content/uploads/2019/05/traffic-500.jpg" alt="Computers slow down from too much traffic" class="wp-image-1949" srcset="https://www.startupware.com/wp-content/uploads/2019/05/traffic-500.jpg 500w, https://www.startupware.com/wp-content/uploads/2019/05/traffic-500-300x203.jpg 300w" sizes="(max-width: 500px) 100vw, 500px" /></figure>



<p>The best explanation for why Windows is
 slow that I’ve heard was an explanation of ‘building funnels” from a 
state highway engineer. Roughly: “That commuting route is beyond planned
 capacity. Yes, we could add lanes to it and increase the capacity, fit 
more cars, and even increase the speed limit if we make it limited 
access. No problem there. But these commutes don’t end in highways, they
 end in neighborhoods, in areas we can’t control, county roads and other
 states. So adding capacity encourages more use, which results in 
building funnels at both ends of the commute where the extra lanes are 
taken away, and the funnel and resulting merges back up the traffic.” <br /></p>



<p>And then, darker, “Sure, we could 
co-ordinate work with other states to extend things, but why should we 
invest anything to encourage building in areas that don’t give us any 
tax revenues but add to our highway costs? And worse, developers build 
homes on a much shorter timeline than we can plan state highways, let 
alone fund them and build them.”</p>



<p>Of course, the people who live 
alongside these racetrack routes, the worst of the commuter single-lane 
state highways, have things to say on these topics.</p>



<p>But back to technology. This is the 
classic Windows stupidity of running background tasks when the system is
 slow, but not in sleep mode. So let’s set a service, we’ll call it 
“Street Cleaning” just to make it non-techy, and say “We don’t want that
 to run during rush hour. Let’s have it run whenever the controller sees
 that traffic is low. Can’t do it when there is no traffic at all, 
because we’re turning off the streetlights when nobody’s on the road. So
 when the streetlights come on, check recent traffic, see that it’s 
zero, and start cleaning the streets. Excellent.”&nbsp;</p>



<p>This, of course, turns on the  streetlights based on a motion sensor, and sequentially starts  “Street  Cleaning” at the moment that a car enters the parkway. Or triggers some  service to start doing complex background stuff because you woke the  computer and started typing. Or set twenty to fifty services to start  running and phoning home for updates when the computer is first turned  on. Which leads most users to start the computer, and then start the  coffee pot, and not come back until both computer and operator have been  thoroughly woken up. </p>



<h2 class="wp-block-heading" id="mce_3">Preventing Startup Buildup </h2>



<p>Old computers aren’t always slow 
because they’re old. If they were not budget computers on day one, they 
shouldn’t act like junk in year three. If they do, and the hardware 
tests out OK, the remaining cause for ‘slow’ or ‘erratic’ is generally 
“too much software trying to run at the same time.” That’s a traffic 
condition, background junk that does not need to be there. Some of it is
 malware, and a lot of it is just un-needed junk that is not remotely 
evil. But all auto-starting software adds to startup time.</p>



<p>So, to prevent that, you have to avoid 
software that adds auto-starting stuff to the system. I’ve told many of 
you this before, here it is again. It’s important: When you install 
software, always choose the Custom install. Always. Even if you have no 
plans to change anything, even if you’re afraid of even touching it. 
Always. And then read the screens during the setup, and pay attention to
 the options. The default options will work, they’re tested heavily, but
 they were not tested on every possible computer configuration.&nbsp;</p>



<p>What you’re looking for in those option  screens are the choices that mention “Also install this&#8230;” or “Start  with Windows”. Those always require a moment of asking why would that be  a good thing? Why allow that? Why allow a Hewlett Packard printer to  run a program at startup that phones home to Hewlett Packard for a new  driver, waiting for an overloaded server to respond, for the life of the  computer? Think about that–not the life of the printer, and not the  life of the printer warranty, but forever. Now multiply that by a dozen,  and that’s a typical HP printer setup. </p>



<div class="wp-block-image"><figure class="alignleft"><img decoding="async" width="327" height="493" src="https://www.startupware.com/wp-content/uploads/2019/05/JustSayNo.jpg" alt="Auto-running software is a problem" class="wp-image-1950" srcset="https://www.startupware.com/wp-content/uploads/2019/05/JustSayNo.jpg 327w, https://www.startupware.com/wp-content/uploads/2019/05/JustSayNo-199x300.jpg 199w" sizes="(max-width: 327px) 100vw, 327px" /></figure></div>



<p>Now all of these startup items are not 
available to “just say no” to during setup, and I can follow up later 
during a tuneup to remove the useless autoplays, but for those choices 
that appear, if you won’t need a listed feature, don’t install it. And 
if it’s a third-party program, as in “we also recommend,” that’s a 
malware installation tactic. While not all software that arrives in that
 way is evil, you didn’t go looking for it, so you don’t need it, so 
don’t let it install.&nbsp;</p>



<p>There are a lot of small utility 
programs that suggest ‘Run with Windows.’ OK, let’s see, it’s a little 
utility that you have never needed before, that converts something to 
something else, and it wants to start with Windows because you will need
 it every day, forever. No. Just say no.</p>



<h2 class="wp-block-heading">As the Printers Die</h2>



<p>Reminder: If you bought a new printer 
to replace another, go to Control Panel, Uninstall a program, and remove
 the software that installed with the former printer. Also check the 
printer list, in Settings, Devices, Printers &amp; scanners, and remove 
the old driver there. It’s easier to do that before installing the new 
software, especially if the new and old printers are the same brand. The
 rule is like any other cleanup rule: Demolition before rebuilding. Make
 space before organizing. Remove that old plumbing before adding the new
 pipes. Or wires, or software. That helps you identify the old stuff, 
wipe it out before adding the new stuff.&nbsp;</p>



<p>Other old software should also be 
removed. Any program that has an annual version can cause problems, so 
don’t allow them to build up forever. If you will never use these 
products past, say, year 3, then delete the “three years back” version 
when you add the latest version.&nbsp;</p>



<h2 class="wp-block-heading">Do Hard Drives Fill Up?</h2>



<p>The answer is generally “not from 
saving documents.” But software can fill them, as can video editing in 
high resolution, or Windows errors that cause log files to never ever go
 away–that’s currently a recurring issue in Windows 7. If there is very 
little software on your system, but there are ‘full’ warnings in 
Windows, it can be the log files–call for a cleanup.</p>
<p>The post <a rel="nofollow" href="https://www.startupware.com/working-models/why-computers-and-commuters-both-need-coffee/">Why Computers and Commuters Both Need Coffee</a> appeared first on Startupware.com. Visit to read more about software design, malware, and computer security.</p>
<p>Original article: <a href="https://www.startupware.com/working-models/why-computers-and-commuters-both-need-coffee/">Why Computers and Commuters Both Need Coffee</a>.</p>]]></content:encoded>
					
		
		
			</item>
		<item>
		<title>Caution: Your Computer is in a Bad Neighborhood</title>
		<link>https://www.startupware.com/newsletter-reprints/caution-computer-bad-neighborhood/</link>
		
		<dc:creator><![CDATA[Jerry Stern]]></dc:creator>
		<pubDate>Tue, 25 Jul 2017 13:00:35 +0000</pubDate>
				<category><![CDATA[Newsletter Reprints]]></category>
		<category><![CDATA[#malware]]></category>
		<category><![CDATA[fake tech support]]></category>
		<category><![CDATA[fraudulent computer support]]></category>
		<guid isPermaLink="false">https://www.startupware.com/?p=1771</guid>

					<description><![CDATA[<p>Microsoft does not, ever, place phone numbers in error messages. Most big technology companies don't want phone calls, and their phone numbers are only on their support and stock holder pages. There may be an exception for sales and training events, but not much else.</p>
<p>Not every page you find on a search engine result is a safe page. There are poisonous results all over the place. The worst web results are for this search: “tech support phone number (company name).”</p>
<p>The post <a rel="nofollow" href="https://www.startupware.com/newsletter-reprints/caution-computer-bad-neighborhood/">Caution: Your Computer is in a Bad Neighborhood</a> appeared first on Startupware.com. Visit to read more about software design, malware, and computer security.</p>
]]></description>
										<content:encoded><![CDATA[<p>A reprint from the <a href="https://www.startupware.com/newsletter/">PC410 Security Newsletter</a>:</p>
<p><img decoding="async" src="https://www.pc410.com/art/2017/FakeAlert2016-500.jpg" width="500" height="362" alt="Fake tech support popup" class="alignnone size-full" /></p>
<p>Here&#8217;s what that bad neighborhood looks like. there&#8217;s a scary message on your screen. it is designed to make you panic. There&#8217;s a hardware error message starting with a blue screen of death, but the blue screen message isn&#8217;t full-screen. It&#8217;s a fake. There is a urgent message to call a toll free number to have a Microsoft certified technician fix the problem immediately.</p>
<p>Microsoft does not, ever, place phone numbers in error messages. Most big technology companies don&#8217;t want phone calls, and their phone numbers are only on their support and stock holder pages. There may be an exception for sales and training events, but not much else. Every other phone call is an expense, and they will do everything that they can do to prevent you from calling them.</p>
<p>Next , Microsoft does not give away technical Consulting Services, or free computer repairs. They provide lots of reference materials on their websites, and free training for partners in various categories. For example, I am a Microsoft partner in their OEM and Refurbisher and Technical Sales programs, and have been through training in those areas. But even I can&#8217;t just call Microsoft and ask for a free diagnostic of a system, most of which consists of other companies&#8217; hardware. If you actually reach them, don&#8217; t expect more than a link to: http://support.microsoft.com/en-us</p>
<p><img loading="lazy" decoding="async" src="https://www.pc410.com/art/2017/dead-end-sign-500.jpg" width="500" height="334" alt="Beyond this point, there is malware. (And dragons)" class="alignnone size-full" /></p>
<p>But enough about Microsoft. Amazon is involved here. If the web address is visible on the popup, there&#8217;s a good chance that it includes aws.com, or Amazon web services, which is basically a web host with massive and scalable computing power, online and for rent. To anyone, anywhere, with computer approval based on the validity of your payment. In other words, gun for hire. Yes, they have terms of service that prohibit use for anything illegal or tasteless, but they are applied retroactively, and there is no approval process for new pages going up. You pay your money and you put up your page, and if someone complains, then a human being will look at it and if it doesn&#8217;t comply with their terms of service, it will go down until the authors create a new account and start again.</p>
<p>Now I&#8217;m going to pick on Google and Bing and all the other search engines. Not every page you find on a search engine result is a safe page. There are poisonous results all over the place. The worst web results are for this search: “tech support phone number (company name).”</p>
<p>Nearly all searches for tech phone numbers lead to scam companies that will want to log into your computer, show you the event logs, and claim that the lengthy list of routine messages means that you need $249 to $399 of repairs and an annual service contract. Never search for tech support phone numbers: Go to the company web site, and follow the menu links for support, or call me for help–I have additional resources for many tech companies.</p>
<p>But how do these bad phone numbers end up at the top of a Google page? Google can be fooled, temporarily, by a black hat SEO campaign (basically, evil search engine optimization). When a search engine sees a thousand links to a site means it is popular, and it isn&#8217;t recognized as good or bad; that happens later after Gooogle has found and indexed what appears to be a keyword-heavy page, with ‘tech support phone” used repeatedly, which will never be the case of a real technology company web site. Later, Google will see that the links were identical and planted in web sites by malware, and will remove the search result, but it&#8217;s a numbers game, and it all starts again.</p>
<p>The bad guys do more things. They buy up expired domains that previously had moderate traffic, and they put their fraudulent sites up. The search engines mostly fail to remove the old site descriptions and search results because they&#8217;re not always checking to see if the web page is suddenly on a new server somewhere else than where it started. They catch up eventually. The bad guys are also buying up bulk misspellings of popular web sites, so typing in any popular site with an extra letter is probably going to land you on random and dangerous garbage.</p>
<p>Now do I blame Microsoft/Bing, Google, and Amazon? Well, it&#8217;s an arms race, largely based in parts of the world where there are no internet laws. They could say, &#8220;We want you to trust us, but first be sure that what you are visiting is really us. Here&#8217;s is how to tell the difference.&#8221; They don’t.</p>
<p>Years ago, Google’s official policy was to index all of the web without any commentary or analysis, ranked as best they could to guess the intent of the searcher. Now, of course, they block criminal activity in a few categories, but they’ll still show blatantly illegal content, scams, fake news, and so on.</p>
<p>In all fairness, the search engines want a way to decide if a site is illegal, without any risk of being sued for de-listing sites that retain lawyers. Yes, the larger illegal sites have legal counsel. So if there is any chance that a site that looks like a service company is legit, and can only be proven as a scam by doing business with them, that site remains in search results.</p>
<p>And you need to stay far, far away. Stay suspicious. When it’s too good to be true, it’s a scam. And when it looks like a company with no history of phone support is giving it away for free on random web pages but not on their own pages, it’s not them.</p>
<p><strong>Jerry Stern</strong><br />
Chief Technology Officer, <a href="http://www.pc410.com" target="_blank" rel="noopener">PC410.com</a></p>
<p>The post <a rel="nofollow" href="https://www.startupware.com/newsletter-reprints/caution-computer-bad-neighborhood/">Caution: Your Computer is in a Bad Neighborhood</a> appeared first on Startupware.com. Visit to read more about software design, malware, and computer security.</p>
<p>Original article: <a href="https://www.startupware.com/newsletter-reprints/caution-computer-bad-neighborhood/">Caution: Your Computer is in a Bad Neighborhood</a>.</p>]]></content:encoded>
					
		
		
			</item>
		<item>
		<title>Phone Call from Microsoft India. Oops. NOT!</title>
		<link>https://www.startupware.com/field-reports/phone-call-from-microsoft-india-no-i-mean-microsoft-oops/</link>
		
		<dc:creator><![CDATA[Jerry Stern]]></dc:creator>
		<pubDate>Mon, 06 Oct 2014 21:49:12 +0000</pubDate>
				<category><![CDATA[Field Reports]]></category>
		<category><![CDATA[#malware]]></category>
		<category><![CDATA[Microsoft]]></category>
		<category><![CDATA[phone]]></category>
		<category><![CDATA[scams]]></category>
		<category><![CDATA[viruses]]></category>
		<category><![CDATA[Windows]]></category>
		<guid isPermaLink="false">https://www.startupware.com/?p=1243</guid>

					<description><![CDATA[<p>Apparently international phone calls now cost nothing. And labor is effectively free, too.<br />
So when Microsoft called... Well, maybe when I got the call from India that said it was from Microsoft, telling me about all the viruses in my computer, I answered the call. And wasted his time. When they call you, hang up. Don't try this stuff at home.</p>
<p>The post <a rel="nofollow" href="https://www.startupware.com/field-reports/phone-call-from-microsoft-india-no-i-mean-microsoft-oops/">Phone Call from Microsoft India. Oops. NOT!</a> appeared first on Startupware.com. Visit to read more about software design, malware, and computer security.</p>
]]></description>
										<content:encoded><![CDATA[<p>Apparently international phone calls now cost nothing. And labor is effectively free, too.<br />
So when Microsoft called&#8230; Well, maybe when I got the call from India that said it was from Microsoft, telling me about all the viruses in my computer, I answered the call. And wasted his time. When they call you, hang up. Don&#8217;t try this stuff at home.</p>
<p><iframe loading="lazy" title="Fake Cleanup Phone Call, from Microsoft...NOT." width="604" height="453" src="https://www.youtube.com/embed/TVJ0S55lPOk?feature=oembed" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture; web-share" referrerpolicy="strict-origin-when-cross-origin" allowfullscreen></iframe></p>
<p>The post <a rel="nofollow" href="https://www.startupware.com/field-reports/phone-call-from-microsoft-india-no-i-mean-microsoft-oops/">Phone Call from Microsoft India. Oops. NOT!</a> appeared first on Startupware.com. Visit to read more about software design, malware, and computer security.</p>
<p>Original article: <a href="https://www.startupware.com/field-reports/phone-call-from-microsoft-india-no-i-mean-microsoft-oops/">Phone Call from Microsoft India. Oops. NOT!</a>.</p>]]></content:encoded>
					
		
		
			</item>
		<item>
		<title>Careful again: FedEx Doesn&#8217;t Leave Your Package at the Post Office</title>
		<link>https://www.startupware.com/field-reports/careful-again-fedex-doesnt-leave-your-package-at-the-uspse/</link>
		
		<dc:creator><![CDATA[Jerry Stern]]></dc:creator>
		<pubDate>Tue, 03 Sep 2013 13:26:54 +0000</pubDate>
				<category><![CDATA[Field Reports]]></category>
		<category><![CDATA[#FedEx]]></category>
		<category><![CDATA[#malware]]></category>
		<guid isPermaLink="false">https://www.startupware.com/?p=1137</guid>

					<description><![CDATA[<p>Here&#8217;s another sample of what&#8217;s not safe to open. Again, the clues are clear, if you&#8217;re careful before you click: There are punctuation and grammar errors in the message. The link that you&#8217;ll see when floating the mouse over that &#8216;Print Label&#8217; link doesn&#8217;t match the &#8216;from&#8217; domain, and isn&#8217;t Fedex.com. European date format used &#8230; <a href="https://www.startupware.com/field-reports/careful-again-fedex-doesnt-leave-your-package-at-the-uspse/" class="more-link">Continue reading <span class="screen-reader-text">Careful again: FedEx Doesn&#8217;t Leave Your Package at the Post Office</span> <span class="meta-nav">&#8594;</span></a></p>
<p>The post <a rel="nofollow" href="https://www.startupware.com/field-reports/careful-again-fedex-doesnt-leave-your-package-at-the-uspse/">Careful again: FedEx Doesn&#8217;t Leave Your Package at the Post Office</a> appeared first on Startupware.com. Visit to read more about software design, malware, and computer security.</p>
]]></description>
										<content:encoded><![CDATA[<p>Here&#8217;s another sample of what&#8217;s not safe to open.<br />
Again, the clues are clear, if you&#8217;re careful before you click:<br />
<img loading="lazy" decoding="async" class="aligncenter size-full wp-image-1139" src="//www.startupware.com/wp-content/uploads/2013/09/Fake-Fedex.png" alt="Fake FedEx notice" width="524" height="382" srcset="https://www.startupware.com/wp-content/uploads/2013/09/Fake-Fedex.png 524w, https://www.startupware.com/wp-content/uploads/2013/09/Fake-Fedex-300x218.png 300w" sizes="auto, (max-width: 524px) 100vw, 524px" /></p>
<ul>
<li>There are punctuation and grammar errors in the message.</li>
<li>The link that you&#8217;ll see when floating the mouse over that &#8216;Print Label&#8217; link doesn&#8217;t match the &#8216;from&#8217; domain, and isn&#8217;t Fedex.com.</li>
<li>European date format used by a US-based company.</li>
<li>The logo is a bad jagged paste, and is missing the circle-R symbol for &#8216;registered trademark&#8217;.</li>
<li>FedEx has no pickup service at their competitor, the &#8220;nearest&#8221; US Post Office.</li>
</ul>
<p><span id="more-1137"></span></p>
<p>Now, that&#8217;s already enough information to make me delete the email, but I&#8217;ll look a little deeper:</p>
<p>I downloaded the &#8220;label&#8221; to look&#8211;it was &#8220;Shipping_Label_US_Westminster.zip&#8221; and it held one file, &#8220;Shipping_Label_US_Westminster.exe&#8221;.</p>
<p>The antivirus I&#8217;m running didn&#8217;t object to either file; it probably can&#8217;t detect today&#8217;s variation yet.</p>
<p>I looked inside that file with an extraction program, and found a .rsrc folder, and files .text, .rdata, .data. Inside the folder there were two .ico files, basically desktop icons.</p>
<p>That&#8217;s enough to tell me that it appears to be a script to install software. It&#8217;s clearly not a label&#8211;that would be a PDF or a JPG image.</p>
<p>IMO, the most-likely payload would be a rogue/fake security program, either scare-ware or blackmail-ware. The message itself isn&#8217;t infectious, just don&#8217;t click that link.</p>
<p><a href="https://sciencetranslations.com" target="_blank" rel="author noopener noreferrer">Jerry Stern</a> is webmaster at <a title="PC410.com" href="http://www.pc410.com" target="_blank" rel="noopener">PC410.com</a> and <a title="Startupware.com" href="//www.Startupware.com">Startupware.com</a>.</p>
<p>The post <a rel="nofollow" href="https://www.startupware.com/field-reports/careful-again-fedex-doesnt-leave-your-package-at-the-uspse/">Careful again: FedEx Doesn&#8217;t Leave Your Package at the Post Office</a> appeared first on Startupware.com. Visit to read more about software design, malware, and computer security.</p>
<p>Original article: <a href="https://www.startupware.com/field-reports/careful-again-fedex-doesnt-leave-your-package-at-the-uspse/">Careful again: FedEx Doesn&#8217;t Leave Your Package at the Post Office</a>.</p>]]></content:encoded>
					
		
		
			</item>
	</channel>
</rss>
