text:
Malware RSS Feed
Microsoft Security Updates October 2014
This morning was possibly one of the most information rich in the history of Microsoft's patch Tuesdays. Last month, we pointed out the Aurora Panda/DeputyDog actor was losing an IE 0day being patched, and that seemed unusual. This month, several vulnerabilities abused with 0day exploits by known APT actors are being patched and the actors are being publicly noted. So today Microsoft pushes out eight security bulletins MS14-056 through MS14-063, including three rated critical.
The most interesting of today's vulnerabilities are two that are enabled by Windows functionality, but are useful for spearphishing targets with Office-type data file attachments - an Excel file, PowerPoint Show, Word document, and so on. The first of the two remind us of the Duqu attacks. MS14-058 patches yet another kernel level font handling flaw CVE-2014-4148, the same kind of issue seen in the Duqu spearphish exploits. This one is rated critical by Microsoft. No one particular actor has been associated with this attack or exploit just yet.
The Windows OLE vulnerability patched with MS14-060 is surprisingly rated "Important" by Microsoft. The APT known as the "Sandworm team" deployed CVE-2014-4114 in incidents against targets alongside other known exploits. The group was known for deploying new variants of the BlackEnergy bot in cyber-espionage campaigns, hitting geopolitical and military targets. In one incident, the team sent spearphish as a PowerPoint slide deck containing the 0day OLE exploit to Ukrainian government and US academic organizations. When opened, the slides dropped newer variants of BlackEnergy to the victim systems. These newer variants of BlackEnergy maintain functionality dedicated to cyber espionage tasks.The most interesting characteristics of these BlackEnergy trojans are the custom plugins or modules, but that's for a different blog post.
Another group known as Hurricane Panda attempted to exploit CVE-2014-4113 in targeted environments. This escalation of privilege issue can present a real problem in situations where an attacker has gotten in to a network and is attempting to burrow in further. This bug also exists in Windows kernel code, and is patched by the same MS14-058 bulletin mentioned above.
The Internet Explorer update addresses fourteen vulnerabilities, rated critical for IE6 through IE11. They do not affect Server Core installations.
More can be read about October 2014 Microsoft Security Bulletins here.
Tic Tac Toe with a twist
Attempts by cybercriminals to disguise malware as useful applications are common to the point of being commonplace. However, the developers of Gomal, a new mobile Trojan, not only achieved a new level of camouflage by adding Tic Tac Toe game to their malicious program, but also implemented interesting techniques which are new to this kind of malware.
It all started with a Tic Tac Toe game being sent to us for analysis. At first glance, the app looked quite harmless:
However, the list of permissions requested by the game made us wonder. Why would it need to access the Internet, the user's contacts and the SMS archive or to be able to process calls and record sound? We analyzed the 'game' and it turned out to be a piece of multi-purpose spyware. The malicious app is now detected by Kaspersky Lab products as Trojan-Spy.AndroidOS.Gomal.a.
A thorough analysis of the malicious program showed that the game code accounts for less than 30% of the executable file's size. The rest is functionality for spying on the user and stealing personal data.
Game code is marked in green, malicious functionality – in red
What does this functionality include? First and foremost, the malware has sound recording functions, which are now standard for mobile spyware:
It also has SMS-stealing functionality:
In addition, the Trojan collects information about the device and sends all the data collected to its masters' server. But Trojan-Spy.AndroidOS.Gomal.a has something really curious up its sleeve – a package of interesting libraries distributed with it.
The package includes an exploit used to obtain root privileges on the Android device. The extended privileges give the app access to various services provided by Linux (the operating system on which Android is based), including the ability to read process memory and /maps.
After obtaining root access, the Trojan gets down to work. For example, it steals emails from Good for Enterprise, if the app is installed on the smartphone. The application is positioned as a secure email client for corporate use, so the theft of data from it can mean serious problems for the company where the owner of the device works. In order to attack Good for Enterprise, the Trojan uses the console to get the ID of the relevant process (ps command) and reads virtual file /proc/ /maps. The file contains information about memory blocks allocated to the application.
After getting the list of memory blocks, the malware finds the block [heap] containing the application's string data and creates its dump using one more library from its package. Next, the dump file created is searched for signatures characteristic of emails and the messages found are sent to the cybercriminals' server.
Gomal also steals data from logcat – the logging service built into Android that is used for application debugging. Developers very often have their applications outputting critically important data to Logcat even after the apps have been released. This enables the Trojan to steal even more confidential data from other programs.
As a result, the seemingly harmless game of Tic Tac Toe gives cybercriminals access to an enormous amount of the user's personal data and corporate data belonging to his employer. The techniques used by Gomal were originally implemented in Windows Trojans, but now, as we can see, they have moved on to Android malware. And, most dangerously, the principles upon which this technique is based can be used to steal data from applications other than Good for Enterprise – it is likely that a range of mobile malware designed to attack popular email clients, messengers and other programs will appear in the near future.To reduce the risk of infection by mobile malware we recommend that users:
- Do not activate the "Install applications from third-party sources" option
- Only install applications from official channels (Google Play, Amazon Store, etc.)
- When installing new apps, carefully study which rights they request
- If the requested rights do not correspond with the app's intended functions, do not install the app
- Use protection software
Tyupkin: Manipulating ATM Machines with Malware
Earlier this year, at the request of a financial institution, Kaspersky Lab's Global Research and Analysis Team performed a forensics investigation into a cyber-criminal attack targeting multiple ATMs in Eastern Europe.
During the course of this investigation, we discovered a piece of malware that allowed attackers to empty the ATM cash cassettes via direct manipulation.
At the time of the investigation, the malware was active on more than 50 ATMs at banking institutions in Eastern Europe. Based on submissions to VirusTotal, we believe that the malware has spread to several other countries, including the U.S., India and China.
Due to the nature of the devices where this malware is run, we do not have KSN data to determine the extent of the infections. However, based on statistics culled from VirusTotal, we have seen malware submissions from the following countries:
This new malware, detected by Kaspersky Lab as Backdoor.MSIL.Tyupkin, affects ATMs from a major ATM manufacturer running Microsoft Windows 32-bit.
The malware uses several sneaky techniques to avoid detection. First of all, it is only active at a specific time at night. It also uses a key based on a random seed for every session. Without this key, nobody can interact with the infected ATM.
When the key is entered correctly, the malware displays information on how much money is available in every cassette and allows an attacker with physical access to the ATM to withdraw 40 notes from the selected cassette.
Most of the analyzed samples were compiled around March 2014. However this malware has evolved over time. In its last variant (version .d) the malware implements anti debug and anti emulation techniques, and also disables McAfee Solidcore from the infected system.Analysis
According to footage from security cameras at the location of the infected ATMs, the attackers were able to manipulate the device and install the malware via a bootable CD.
The attackers copied the following files into the ATM:C:\Windows\system32\ulssm.exe
%ALLUSERSPROFILE%\Start Menu\Programs\Startup\AptraDebug.lnk
After some checks of the environment, the malware removes the .lnk file and create a key in the registry:[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"AptraDebug" = "C:\Windows\system32\ulssm.exe"
The malware is then able to interact with ATM through the standard library MSXFS.dll – Extension for Financial Services (XFS).
The malware runs in an infinite loop waiting for user input. In order to make it more difficult to detect, Tyupkin accepts (by default) commands only on Sunday and Monday nights.
It accepts the following commands:
- XXXXXX – Shows the main window.
- XXXXXX – Self deletes with a batch file.
- XXXXXX – Increases the malware activity period.
- XXXXXX – Hides the main window.
After every command the operator must press "Enter" on the ATM's pin pad.
Tyupkin also uses session keys to prevent interaction with random users. After entering the "Show the main window" command, the malware shows the message "ENTER SESSION KEY TO PROCEED!" using a random seed for each session.
The malicious operator must know the algorithm to generate a session key based on the seed shown. Only when this key is successfully entered that it is possible to interact with the infected ATM.
After that, the malware shows the following message:CASH OPERATION PERMITTED.
When the operator chooses the cassette number, the ATM dispenses 40 banknotes from it.
When the session key entered is incorrect, the malware disables the local network and shows the message:DISABLING LOCAL AREA NETWORK...
It is not clear why the malware disables the local network. This is likely done to to delay or disrupt remote investigations.
Video with a demonstration in a real ATM is available in the following link: http://youtu.be/QZvdPM_h2o8Conclusion
Over the last few years, we have observed a major uptick in ATM attacks using skimming devices and malicious software. Following major reports of skimmers hijacking financial data at banks around the world, we have seen a global law enforcement crackdown that led to arrests and prosecution of cyber-criminals.
The successful use of skimmers to secretly swipe credit and debit card data when customers slip their cards into ATMs at banks or gas stations is well known and has led to a greater awareness for the public to be on the lookout – and take precautions – when using public ATMs.
Now we are seeing the natural evolution of this threat with cyber-criminals moving up the chain and targeting financial institutions directly. This is done by infecting ATMs directly or direct APT-style attacks against the bank. The Tyupkin malware is one such example of attackers moving up the chain and finding weaknesses in the ATM infrastructure.
The fact that many ATMs run on operating systems with known security weaknesses and the absence of security solutions is another problem that needs to be addressed urgently.
Our recommendations for the banks is to review the physical security of their ATMs and consider investing in quality security solutions.Mitigation recommendations
We recommend that financial institutions and businesses that operate ATMs on premises consider the following mitigation guidance:
- Review the physical security of their ATMs and consider investing in quality security solutions.
- Change default upper pool lock and keys in all ATMs. Avoid using default master keys provided by the manufacturer.
- Install and make sure that ATM security alarm works. It was observed that the cyber-criminals behind Tyupkin infected only those ATMs that had no security alarm installed.
- For the instructions on how to verify that your ATMs are not currently infected in one step, please contact us at firstname.lastname@example.com. For the full scan of the ATM's system and deleting the backdoor, please use free Kaspersky Virus Removal Tool (you may download it here).
- Ensure the ATM is in an open, well-lit environment that is monitored by visible security cameras. The ATM should be securely fixed to the floor with an anti-lasso device that will deter criminals.
- Regularly check the ATM for signs of attached third-party devices (skimmers).
- Be on the lookout for social engineering attacks by criminals who may be masquerading as inspectors or security alarms, security cameras or other devices on premises.
- Treat intruder alarms seriously and act accordingly by notifying law enforcement authorities of any potential breach.
- Consider filling the ATM with just enough cash for a single day of activity.
- For more advices both for merchants and users please visit http://www.link.co.uk/AboutLINK/site-owners/Pages/Security-for-ATMs.aspx
Mobile Cyber-threats: A Joint Study by Kaspersky Lab and INTERPOL
Cyber-threats, including those targeting mobile devices, are directly linked to cybercrime. In most developed countries, creating and distributing malicious software is a criminal offence. Although such criminal acts are perpetrated in virtual environments, their victims lose real assets, such as personal data and money.
Combating cybercrime is particularly difficult because cybercriminals do not need to cross the borders of other countries to commit crimes in those territories. At the same time, enforcement authorities in these same countries have to overcome numerous barriers in order to administer justice. Therefore, international cooperation between information security experts and law enforcement authorities is required to effectively combat crime in the virtual world. Kaspersky Lab is an international company that brings together IT security experts from all over the world and seeks to provide detailed and highly qualified technical consultations to assist local law-enforcement agencies investigating cybercrime.
To cooperate as effectively as possible against international cybercrime, Kaspersky Lab and the International Criminal Police Organization (INTERPOL) have established a partnership, under which Kaspersky Lab experts will share their expertise in cyber-threat analysis with INTERPOL officers.
This "Mobile cyber-threats" report has been prepared by Kaspersky Lab and INTERPOL within that partnership framework. It aims to evaluate how widespread mobile threats are, and to alert the international IT security and law enforcement community to the problem of crime in the area of mobile communications.Introduction: The Mobile Leader and Target no. 1
Smartphones and tablets have long been established as popular personal electronics devices. A joint Kaspersky Lab and B2B International survey conducted in the spring of 2014 found that 77% of the Internet users surveyed use several devices to access the World Wide Web; alongside traditional computers, they typically use smartphones and tablets. So what types of smartphones and tablets are used?
According to IDC's Q2 2014 report, the sales of such devices have, for the first time ever, passed the mark of 300,000,000 devices sold per quarter. This is an important milestone in the market that has been growing for several years.
According to the same IDC report, the distribution of operating systems for mobile devices looks like this:
Figure 1. Distribution of mobile operating systems in Q2 2014, according to IDC. Source: IDC
As the diagram shows, nearly 85% of the mobile device market was occupied by Android in Q2 2014. These numbers are an acknowledgement of Android's undisputed leadership among mobile environments. This operating system is free for device manufacturers and can be easily modified to match various business needs, which has helped it achieve popularity among smartphone and tablet developers as well as consumers across the world. This also means that Android-based devices inevitably attract the attention of cybercriminals who are creating and distributing malicious programs.
Kaspersky Lab experts estimate that 98.05% of all existing mobile malware targets the users of Android devices. So, how much is "all existing malware"? Kaspersky Lab experts report that in the first half of 2014 alone, 175,442 new unique Android malicious programs were detected. That is 18.3% (or 32,231 malicious programs) more than in the entire year of 2013.
For these and other reasons, it is safe to say that that vast majority of mobile cyber-threats are targeting Android.
Figure 2. The distribution of Kaspersky Lab products' malware detections in 2013 between different mobile environments
It is easy to understand why cybercriminals create so many malicious programs targeting Android devices: these days, smartphones are increasingly often used as a tool to pay online for merchandise and services.
Apps can be installed through Google Play as well as third parties such as Amazon App store. Third party apps pose a security threat to users who enable the installation of apps from unverified sources. These unverified packages may carry malware that would be installed on a device without the user's permission or knowledge.
Another danger is the possibility of an attacker gaining access to personal data such as the user's cloud storage accounts and associated email identifiers. This information can be used to access personal content that is stored in cloud base storage without the user's knowledge or permission.
Smartphones can also be regarded as a kind of mobile sensor, since they routinely collect a multitude of personal information about their owners. In other words, mobile devices users are a very valuable target for cybercriminals.
Figure 3. The scheme of actors involved in cybercrime. Source: INTERPOL
Information is the new currency and this has led to a drastic change in the structure of organized criminal groups, which now support a larger group of actors. The bottom to top approach leaves us with three basic categories (1) The Infectors, (2) The Analysts, and (3) The Investors. The Infectors' role is to mass-propagate and exploit devices as well as pick up data from the devices with very little discrimination about the type of data collected - the more the better. The Analysts' job revolves around studying and processing the data that was collected, monetizing it by offering it on underground markets, blackmailing individuals or using the information to invest into markets that would eventually allow the criminals to profit from illegally obtained information or insider trading. The Investors are responsible for funding and providing financial support to the pyramid –obviously they then receive the majority of the profits made over time.
This model has overtaken the lone hacker scenario, which is now merely a media misconception. When it comes to mobile devices, it has been underlined that they can be a greater source of personal or business information than desktop computers. That, coupled with the fact that these devices are often less secure, has caused Infectors to refocus their efforts onto the mobile device sector.
Of course these and other factors have an effect on how often smartphone and tablet users encounter dangerous software while accessing the Internet from their mobile devices.
How much risk is there in being an active Android user, and how can users reduce that risk? Details on this are provided in this report.Methodology
This study focused on the 12 -period of 1 August 2013 through 31 July 2014. This study period was chosen based on Kaspersky Lab data. Kaspersky Lab began to collect statistics on attacks against Android users in May 2012. During the more than two years that followed, it was the above mentioned time frame that showed that the number of Android threats, the number of attacks and the number of attacked users grew particularly sharply.
Figure 4. Detections by Kaspersky Lab's security products of cyber-attacks on Android devices throughout the entire history of observations. All data sourced from Kaspersky Security Network, unless stated otherwise
Naturally, this dramatic increase partly comes from the increasing numbers of users who purchased Kaspersky Lab's mobile security products. However, this is not the sole, nor even the main factor, behind this growth.
Apart from changes in the numbers of launched attacks and attacked users, this study will also focus on the geographic distribution of attacks and users. Additionally, a list of the most widespread malicious programs for Android will be analyzed.
Data used in this research was sourced from the cloud-based Kaspersky Security Network (KSN), which includes more than 5,000,000 users of Android-based smartphones and tablets protected by Kaspersky Lab products. This research analyzes threat data collected from these devices.The Main Findings
- Over a 12 month period, Kaspersky Lab security products reported 3,408,112 malware detections on the devices of 1,023,202 users.
- Over the 10 month period from August 2013 through March 2014, the number of attacks per month was up nearly tenfold, from 69,000 in August 2013 to 644,000 in March 2014.
- The number of users attacked also increased rapidly, from 35,000 in August 2013 to 242,000 in March.
- 59.06% of malware detections related to programs capable of stealing users' money
- About 500,000 users have encountered mobile malware designed to steal money at least once.
- Russia, India, Kazakhstan, Vietnam, Ukraine and Germany are the countries with the largest numbers of attacks reported.
- Trojans designed to send SMSs were the most widespread malicious programs in the reporting period. They accounted for 57.08% of all detections.
- The number of modifications for mobile banking Trojans increased 14 times over 12 months, from a few hundred to more than 5000.
There are those who believe that Android is a secure platform. When confronted with the fact that new Android malware emerges every day, these people often say that those malicious programs are in fact very rare and pose only a limited threat to the owners of Android devices. For a long time, these views have been justified. If we look at the historical course of the number of existing Android threats (see Figure 4), we will indeed see that before the summer of 2013 the numbers of attacks and attacked users were well below 100,000 a month. That looked very modest as compared to PC attack numbers.
However, this situation changed dramatically during the period analyzed in this paper. In the 12 months from August 2013 through July 2014, over 1,020,000 Android users across the globe encountered more than 3,400,000 attacks. That was six times more than the number of attacks in the whole of the previous 1.5 years when records were kept.
Over the reporting period, the number of attacks showed a dramatic growth, increasing nearly 10 times from 69,000 in August 2013 to 644,000 in March 2014. Then there was a sudden fall in activity, down to 216,000 incidents in June.
Figure 5. Number of Kaspersky Lab Android product detections of malware targeting Android devices. August 2013 through July 2014
At the end of the Holiday season, there was no decrease in the activity, despite expectations. Instead, there was a further dramatic spike. The decline only began in April.The geographic distribution of attacks and attacked users
More than half (52%) of attacks during the study period were reported in Russia. This is primarily due to the fact that Russian residents form a particularly large proportion of the users who agreed to have their statistics sent to Kaspersky Security Network.
Figure 6. Top 15 countries with highest numbers of users attacked between April 2013 and July 2014
Another contributing factor is the wide popularity of various mobile payment services in Russia. These allow users to pay for goods or services by sending premium SMSs. This encourages cybercriminals to create and distribute Android malware exploiting these services.
However, it may be misleading to think that the malware industry is well-developed in Russia and comparatively calm in the rest of the world. Russian-speaking cybercriminals are definitely interested in foreign markets. Two banking Trojans, Faketoken and Svpeng, are vivid examples of such attempts at globalization. These two were created to launch attacks on the clients of foreign banks, and only a few versions target Russian users.Part 2: The 'Star' Performers
As predicted, the number of attacks increased over time, more malware modifications were detected.
Figure 7. Number of modifications of Android malicious applications, as detected by Kaspersky Lab in August 2013 – July 2014
This number rose by a factor of nearly 3.4 over the year, from 120,500 malware modifications in August 2013 to 410,800 in July 2014.
For the study period the top 10 most widespread malware are mostly malicious programs from the Trojan-SMS type – these accounted for 57.08% of all attacks. Following that, RiskTool programs, accounting for 12.52% detections. These are nominally legitimate programs that can also be used for malicious purposes, such as sending SMS with a visual notification of the user, transmitting geo-data etc. Aggressive advertising software (adware) came in third (7.37%.)
Figure 8. Distribution of attacks by malware types: Top 10 most active malware types. August 2013 – July 2014
These overall statistics are affected by the large number of Russian users and the popularity of SMS payments in Russia. To eliminate any possible "Russian" bias, we also looked at the cyber-threat landscape described without data collected from users in Russia.
Figure 9. Distribution of attacks by malware types, excluding data from Russian users. August 2013 – July 2014
As can be seen in the diagram, the numbers have changed. However, the overall situation remains broadly similar: Trojan SMS is still the most widespread type of malware. Below is a graph showing the Top 10 countries with the largest numbers of reported attacks involving Trojan SMS malware:
Figure 10. Top 10 countries with the largest numbers of reported attacks involving Trojan-SMS malware. August 2013 – July 2014
Attacks involving Trojan-SMS malware are most frequent in Russia. Residents of Kazakhstan, Ukraine, the UK, Spain, Vietnam, Malaysia, Germany, India, France and other countries also encounter attacks involving this type of malware.
Malware created with the sole aim of stealing money from victims (i.e. Trojan-SMS and Trojan-Banker malware types) accounted for 59.06% of attacks and was reported on the devices of 49.28% of users during the study period. In absolute numbers that represents half a million users who agreed to have their statistics on detected threats sent to KSN.
It is hardly surprising that cybercriminals actively use financial Trojans. As reported in a B2B International report , 53% of polled smartphone and tablet users say they use the devices to pay online. In other words, theoretically cybercriminals can potentially make money on every second user of a mobile device. Statistics show that approximately every second user is indeed attacked by cybercriminals.Legitimate surveillance
Approximately 2.72% of all detections, or 92,600 detections, involved "Monitor" class programs. In Kaspersky Lab's classification, this stands for conditionally legitimate applications designed to conduct surveillance over smartphone users. These applications can track the user's location, read his/her messages, and access other personal information. The manufacturers of such software advertise it as a useful tool to help look after children and the elderly, but Kaspersky Lab classifies it as insecure. A total of 41,400 users encountered such applications in the 12-month period. On average, each of these users encountered such programs twice.
Interestingly, the geographical distribution of these programs is noticeably different from the overall global distribution of malware detections.
Figure 11. The geographical distribution of detected "legitimate" spyware in the "Monitor" class. August 2013 – July 2014
India is in first position with 19.73% of all detections. Russia is in second place with 14.72% of all detections (even though it is the leader of the general threat ranking). Users in the USA also quite often encounter these applications (7.59% detections); followed by the UK (6.8%) and Germany (4.56%). Kaspersky Lab experts have no reason to assume all these detection cases are attempts to secretly install these programs on a device protected by a Kaspersky Lab product. However, this scenario is possible, so Kaspersky Lab security products detect Monitor-class programs as potentially dangerous.Part 3: Trojan-SMS and the 'Legitimate' Business of Affiliate Programs
During the reporting period, 452 different modifications of 62 different Trojans capable of using SMS messaging were detected.
Figure 12: Distribution of attacks involving the most widespread SMS Trojans during the period from August 2013 to July 2014
Malware from the Agent family had the largest proportion of detection (28.57%), followed by FakeInst (22.4%) in second place and Stealer (21.59%) in third.
According to Kaspersky Lab experts, affiliate programs are one of the most common ways of delivering malicious code.
A typical setup for a malicious affiliate program is as follows: a group of cybercriminals creates an affiliate website and invite Internet users to become their accomplices and make money by distributing a malicious program. A unique modification of the malware and a landing page from which it will be downloaded to victims' devices is created for each user who agrees to take part. After that, participants of the affiliate program buy Internet traffic from third parties or bring in users by redirecting requests from compromised websites, displaying banners on popular Web resources or creating their own sites and promoting them using search-engine optimization. The objective is to have as many Android users as possible visit the page hosting the malicious application. After each successful installation, the newly-infected device starts sending SMS messages to premium numbers, making money for the cybercriminals. Part of that money is paid to the affiliate partners. Criminal groups that sell Web traffic usually resort to various social engineering techniques, attracting users with pornography, free games, etc..
According to Kaspersky Lab experts, about 38% of users who end up on these landing pages will download malicious apps from them. About 5% of users go on to install these applications. Cybercriminals can earn millions of dollars in net profits from this activity.
During the study period, Kaspersky Lab experts observed at least four large active affiliate programs, accounting for about one quarter of all attacks recorded over that time. All of these affiliate programs were primarily active in Russia and countries of the former Soviet Union, but each program used a different family of SMS Trojans.
Figure 13: Activity of four affiliate programs distributing Android malware from August 2013 to July 2014
In the beginning of the period under consideration, there were three 'leaders' in this market: Fakeinst.am, Opfake.bo and Opfake.a, of which Opfake.bo was the most active and successful. However, the situation changed radically in October 2013 with the appearance of a new player – Stealer.a. It was different from competing malware in that it had more extensive functionality and spread very actively. By November 2013 it was the most frequently detected affiliate program and remained at the top throughout the rest of the research period.2014: bad news for malicious affiliate programs
The abovementioned attacks conducted using SMS Trojans were different from typical malicious campaigns targeting PCs in one important respect. Legitimate legal entities, mostly registered in Russia, were involved in distributing Android Trojans and profited from the consequences of infecting smartphones. The business model of affiliate programs that distribute applications and premium content is not illegal, but there is indirect evidence that the companies behind some of the affiliate programs described above worked with cybercriminals as well as those who distribute legitimate content and apps.
This situation continued for a long time, because neither the heavy penalties issued by mobile-phone operators for mounting fraud campaigns nor criminal liability for distributing malware managed to stop cybercriminals or the organizations that worked with them. However, everything changed in early 2014: shortly before changes in legislation aiming, among other things, to curtail SMS fraud came into effect, mobile-phone operators adopted an Advice of Charge (AoC) mechanism. Every time a customer (or an SMS Trojan) attempts to send a message to a premium number, the operator notifies the customer how much the service will cost and requests additional confirmation from the user.
Early in the year the mechanism was applied to selected types of premium SMS services and as of May 1, 2014 a new law made it obligatory for mobile-phone operators to notify their customers of any attempts to start any mobile subscription. This coincided with a radical fall in the number of attacks involving SMS Trojans.
The major surge in the number of attacks, particularly those involving Stealer.a, could have been an attempt to make as much money as possible before AoC was universally adopted. Kaspersky Lab experts observed that in spring 2014 the three affiliate programs which distributed Fakeinst.am, Opfake.bo and Opfake.a stopped active operation. Kaspersky Lab experts have no reason to believe that the three affiliate programs have run out of steam completely, but they lack their earlier vigor and the reduced number of attacks involving SMS Trojans is a good, albeit indirect, indication of this.
The most active program of the four – the one distributing Stealer.a – has also lost a lot of ground in terms of the number of attacks, but users often still come across versions of this malicious app.
Curiously, although all these affiliate programs were set up and maintained by Russian-speaking cybercriminals and their scams mostly targeted users from Russia and the former Soviet Union, parts of Europe saw fewer attacks involving SMS Trojans in spring, too.
Figure 14: Changes in the number of attacks involving Trojan-SMS in European countries where Kaspersky Lab products detected this type of malware from April to June 2014
The diagram above shows data about attacks involving Trojan-SMS in the European countries in the Top 10 for attacks using Trojan-SMS. The diagram shows that four of the five countries which ranked among those attacked most often have seen the number of attacks fall.
Towards the end of the period there was also a slight growth in the number of attacks in Germany by Agent.ao malware, which was distributed by an affiliate program primarily targeting that country. All other affiliate programs which had been active in Europe and Asia were noticeably less active.
Figure 15: Attacks involving Agent family Trojans from August 2013 to July 2014
In other words, the number of attacks was falling almost everywhere in the post-Soviet space, in Europe and in Asia.
This may be due to two reasons. First, cybercriminals wind down their activity during the vacation season, which begins in spring. Additionally, the Russian legislative developments described above may also have contributed to the decline. Kaspersky Lab experts have frequently observed that Russian-speaking developers of Android malware have global ambitions and adapt their malware, including Trojan-SMS, to attack markets where languages other than Russian are spoken. However, the number of detections recorded outside the post-Soviet space has always been significantly smaller than in Russia and its neighbors – in other words, it is unlikely that most distant targets brought much money to the owners of affiliate programs based in Russia. So when the main 'players' in a Russian segment of Android malware wound down their activity, this naturally resulted in the closure of their foreign 'projects'.
Admittedly, Kaspersky Lab experts do not have the solid evidence needed to confirm this theory, though if it is it would be an example of how anti-fraud measures in one country can have a beneficial effect – albeit a small one – elsewhere in the world.Mobile banking Trojans: dangerous trends
A total of 67,500 attacks involving Trojan-Banker malware against 37.7 thousand users were recorded in the analysis period. Trojan-Banker is a type of malware designed to steal online banking credentials. The total number of banking Trojans targeting mobile devices grew from 423 in August of 2013 to 5,967 in July 2014. That is a more than 14-fold increase!
Figure 16: Changes in the number of attacks and users attacked by Trojan-Banker malware from August 2013 to July 2014
However, even though there were more malware variants, the decline in the use of Trojan-SMS malware also affected Trojan-Bankers. This was primarily because one of the banking Trojans was distributed using the same affiliate networks as Trojan-SMS malware.
Figure 17: Geographical distribution of users affected by Trojan-Banker on Android from August 2013 to July 2014
The overall downward trend was sparked by the Faketoken Trojan-Banker, which could steal one-time passwords sent to confirm bank transactions and operated in conjunction with 'desktop' banking Trojans.
Figure 18: Attacks involving Faketoken, compared to all attacks involving mobile banking Trojans from August 2013 to July 2014
As the diagram above shows, from August to March Faketoken was virtually the only widespread mobile banking Trojan. However Faketoken was distributed by one of the affiliate networks that wound down in April 2014 and from that time it too began to dwindle. Subsequently the overall number of mobile banker detections remained at a higher level than Faketoken and showed a small increase in overall attack numbers.
This rising trend was led by two other programs targeting online banking users – Svpeng and Marcher.
Figure 19: Changes in the number of attacks involving Marcher and Svpeng banking Trojans from March to July 2014
As the diagram shows, the number of attacks involving Svpeng fell from late May to late June; however, in June Kaspersky Lab experts discovered a new Svpeng variant. Previously it was a mostly 'Russian-speaking' and exclusively 'banking' Trojan, but in its new variant Svpeng acquired ransomware Trojan functionality. It displayed messages saying the phone was blocked and demanding several hundred dollars to unblock it. Analysis of the content used by the malware has demonstrated that US users were its main targets.
As for Marcher, at first glance it seems to be just one more 'Russian' banking Trojan – 98.84% of users affected by it live in Russia. However, when Kaspersky Lab experts analyzed the Trojan's code they found that the objectives pursued by the Trojan are not quite so obvious.
After infecting a device, the malware tracks the launch of just two apps. If the user starts Google Play, Marcher displays a false window requesting credit card data.
Initially, Marcher was only able to attack Google Play users, but in March 2014 Kaspersky Lab experts discovered a variant that targeted the mobile client of a large German bank's online banking system. If the user launches the bank's mobile banking client, another fake window displays fields for user credentials for the online banking system.
Although so far users of Kaspersky Lab mobile products in Germany have not encountered this threat, this situation may change in the future. Kaspersky Lab experts will track the evolution of this and other dangerous Android threats.Other Threats: Bitcoin Miners and Ransomware Bitcoin Mining Malware on Mobile – notable mention
In April 2014, Google Play removed a new category of malware applications that were directly aiming at mining crypto-currencies. "BadLepricon" malware, one of the first to be detected was masquerading as a fully operational live wallpaper application. Infected mobile devices were overheating once the hidden process of crypto-mining currencies was triggered. Even though the processing power of a single mobile device was quite minimal and not really an effective miner, it is estimated that a massive infection of devices could contribute to big profits for the actors managing the malware.
There have been further reports and detections from the Anti-Virus community, some of which indicated that similar malware applications were released on the Google Play market and had over one million downloads, raising serious questions on the profitability of that model. Even though the malware does not target personal information, this type of malware still falls in the category of unauthorized access to a personal device, which makes it illegal to use an individual's machine without the owner's prior consent. It is expected that further variants of crypto-mining malware will emerge in the coming months, possibly focusing on mining altcoins or the family of clonecoins, which are easier to mine than bitcoins at this stage.Crypto-ransomware finds its way to Android
Crypto-ransomware refers to a class of malware that infects a machine then encrypts targeted files with specific extensions and demands payment before providing the key to decrypt the files. Crypto-ransomware found its way to Android OS in 2014 after gaining a reputation as a growing problem for Internet security companies and law enforcement in general.
Simplelocker A, a piece of crypto-ransomware tailored for Android, was the focus of research by INTERPOL. This variant uses AES-256 to encrypt the data within specific file extensions hosted on the SD card of a mobile device, making it impossible to access the files. More interestingly, the malware itself communicates with its C&C servers by routing to an onion on the Tor Network for further anonymity. Simplelocker.A has been mainly targeting Russian speaking countries. However, security experts believe that it is only a proof of concept with a far more developed, mature and complicated version expected to surface soon in Google Play.Conclusions and Recommendations
The data analyzed in this study shows that mobile cybercrime is an extremely widespread phenomenon across the globe. It's important to remember that the study only reflects data on users protected against mobile malware and can only give a general idea of the extent to which different threats are widespread and dangerous.
One thing that is certain is that the number of threats is growing and the damage that can be caused by them, potentially, runs to millions of dollars.
Another conclusion is that the cybercriminals involved in distributing malware which targets mobile device users commit their crimes outside the borders of the countries where they live.
It is obvious that the problem needs to be addressed by IT security experts and law enforcement agencies in the countries where the perpetrators presumably reside, not only in those countries where their crimes are perpetrated. Security solutions can simply block the threats on user devices, but the criminals will simply find other victims who are not so well protected. The only thing that can stop them is the involvement of law enforcement organizations.
To avoid falling victim to cybercriminals involved in distributing mobile malware, Kaspersky Lab and INTERPOL experts recommend the following security measures:For individual users:
- Protect your Android devices with secure passwords to prevent attackers from accessing personal data by stealing your device and brute-forcing the password.
- Unblocking the option that enables apps from third-party sources to be installed on the device is not a good idea. As a rule, Google Play, which is the main distribution channel for Android apps, carefully verifies the software it distributes. Even if you need to use a third-party application for some reason, be sure to block this option again after installing the app.
- Antivirus software developers often create applications designed to test devices for unclosed vulnerabilities. Such applications are regularly updated to include data on newly-discovered vulnerabilities. We recommend using these apps once in a while.
- Use a security solution on your device and make sure it scans files as they are downloaded and protects the device from other types of Internet attacks. Although Android malware has not so far been as widespread as malicious software targeting PCs, this thought is unlikely to comfort you if you fall victim to mobile malware.
- When conducting banking transactions, be sure to use two-factor authentication. Ideally, temporary codes used to access your bank account should be sent to a different phone from the one from which you connect to online banking. Using simple devices with no smartphone features for this purpose is recommended, since this minimizes the chances of these devices being infected with a banking Trojan. And, generally, it is a good idea to use two-factor authentication wherever possible.
- You should use encryption if you have any valuable information (financial, personal or work-related) on your device. Then, even if your device is stolen, the attackers won't be able to access your data.
- If you believe that you may have fallen victim to or witnessed a cybercrime, do not hesitate to contact law enforcement as soon as possible. In most countries, creating and distributing malware or stealing personal information is a crime that is investigated by dedicated law enforcement agencies.
- The Bring Your Own Device approach, which allows employees to use their personal devices for work, can expose your company to virtually all 'consumer' IT security risks: sensitive corporate data stored on an employee's personal phone could be a valuable find for cybercriminals. A security solution with Mobile Device Management capabilities, including encryption and remotely wiping data from smartphones, will help you to keep your sensitive business-related information secure.
- If your employees are not aware of simple IT security rules, this is likely to cause security incidents. This is why, in an environment where nearly all the employees have Internet-enabled devices, training people to handle their mobile devices appropriately will be a worthwhile investment.
- Be sure to contact law enforcement and expert organizations in the event of an IT security incident. Many companies keep information about incidents secret for fear of reputational losses and do not initiate investigations into cybercriminal activities. However, a cybercriminal who escapes prosecution is free to come back and cause even greater damage in future.
- There are many highly-qualified experts in digital forensics and malware analysis, whose participation in cybercrime investigations could speed up the process of collecting evidence and searching for suspects and make it more effective.
- Today, cybercriminals launch attacks against people in other countries without fear, taking advantage of the many jurisdictional issues that beset international multi-jurisdictional investigations. The more effectively cyber police forces of different countries work together, the harder it will be for cybercriminals to avoid liability.
This document presents an analysis of the cyber-threat landscape as it relates to Android-based mobile platforms. It is based on information about instances of Kaspersky Lab security products detecting applications considered insecure or malicious due to their functionality. To avoid possible misinterpretation of the facts presented in this document, Kaspersky Lab would like to highlight a number of issues related to the way this report was prepared.
1. Terminology
The report uses several terms describing how a security product interacts with malicious software. The term "Attack" is among those used most frequently. In Kaspersky Lab's terminology, an attack is an instance of a security product detecting any software considered malicious on the protected device, regardless of whether an attempt to execute malicious code was detected. The term "User" denotes exclusively the owner of the device protected by Kaspersky Lab's product.
2. Dataset and its geographical distribution
All calculations and conclusions made in this study rely on data from Kaspersky Lab's mobile customer community, which exceeds 5 million users in over 200 countries and territories. It should be emphasized that the number of Kaspersky Lab's product users varies from country to country, so the results of this study may not fully reflect the situation existing in some countries. However, many years' experience of monitoring the statistics collected by Kaspersky Security Network (KSN) shows that in most cases KSN data is about 95% accurate concerning the prevalence of specific cyber-threats or cyber-threat classes, and concerning on the percentage distribution of consumers using devices running different operating systems. It also correlates very well with data received from other sources, namely from companies which specialize in collecting and analyzing statistical data.
Responsible distribution of information
This study can be freely shared or distributed. Kaspersky Lab requests that those who find the information presented in this document interesting and useful make allowances for the abovementioned issues related to the ways in which KSN statistics are collected when preparing public materials in which this information is to be used.
Virus Bulletin 2014: new times, same challenges
During the last week of September the antimalware industry got together in one of the oldest and most legendary information security conferences in the world, the 24th Virus Bulletin International Conference (VB2014), held in the beautiful Seattle, USA. Kaspersky Lab was there to present and share a wide range of ongoing research topics with the security community.
In the first day of the conference we were shown over and over how the Linux operating it's not so malware free any more. Dismantling the myth, we had several talks on the topic, amongst them "Ebury and CDorked. Full disclosure" and "Linux-based Apache malware infections: biting the hand that serves us all" brought attention to non-traditional malware, and how the Apache web server is caught in the middle of this *nix world, becoming an efficient platform for attacking and infecting unsuspecting clients.
My colleague Santiago Pontiroli presented about the current "bitcoin bonanza" and how cybercrime is quickly targeting cryptocurrencies and their users. While sharing some of the most interesting malware samples that target bitcoin and other alternative currencies, the audience got an overview of the benefits that digital currencies offer to Latin American countries and the reasons behind criminals' activity.
The icing on the first day's cake was the presentation shared by Patrick Wardle who covered "Methods of malware persistence on Mac OS X", again showing us that not everything in the malware ecosystem is about Microsoft.
With so many good talks to attend in the second day, sometimes making the right decision was rather difficult. A very interesting presentation by Jérôme Segura, regarding Technical Support Scams, demonstrated in detail how to build a honeypot to catch these scammers while emphasizing the importance of user awareness and education.
I presented a one year research about the attacks against "boletos", an old and very popular payment system from Brazil based in printed documents and a barcode, showing how local bad guys have adapted their trojans to change them, redirecting payments to their accounts, and stealing millions of dollars in the process.
It was the turn for my colleague David Jacoby to present an extremely funny (yet informative) presentation on how he hacked his own home, exploiting different vulnerabilities on networked devices such as Smart TVs, printers, NAS, etc. Interactively demonstrating how exposing these devices to attacks would mean compromising an entire home network, all the presentation was displayed with funny GIFs and (interestingly enough) the slides were hand crafted with MS Paint.
Security Researchers from Microsoft gave us a run down on .NET malware analysis with their last minute paper ".NET malware dynamic instrumentation for automated and manual analysis". As malware developers are increasingly relying on high level programming languages for their malicious creations, tools like the one presented in this talk will become essential for malware analysts looking to become proficient in .NET malicious applications study.
And the last Kaspersky presentation was from Vicente Diaz on "OPSEC for security researchers". Working as a security researcher nowadays is not an easy task, especially now that we no longer deal only with technical aspects. The global picture of the security landscape these days features new actors including governments, big companies, criminal gangs and intelligence services. That puts researchers in some tricky situations.
The closing panel was funny and informative, with David Jacoby bringing awareness to the community on how disclosure of important vulnerabilities (like Heartbleed, and now the infamous Shellshock) should be handled, and what roles do vendors play in this scenario. After the keynote address by Katie Moussouris of HackerOne on "Bounties and standards and vuln disclosure, oh my!", the final panel left us with a cohesive feeling for the conference, bringing into the spotlight what the industry as a whole should be facing in terms of vulnerabilities disclosure and the same challenges we had to protect connected devices, the Internet of Things, crypto currencies and payment systems.
Times change but the same challenges remain, one thing is clear, we are still here to protect the user and fight against cybercrime.
OPSec for security researchers
Being a security researcher nowadays is no easy task, especially as we are no longer dealing with purely technical matters. Today's global security landscape includes several new actors including governments, big companies, criminal gangs and intelligence services. This puts researchers in a difficult situation.
According to one of many definitions of OPSec:
"Operational security identifies critical information to determine if friendly actions can be observed by adversaryintelligence systems"
We are hearing reports of researchers facing threats from criminal gangs, or being approached by state intelligence services. Others have found themselves under surveillance or had their devices compromised when on the road.
How can we minimize these risks? What can we do to avoid leaking information that could put us in an uncomfortable situation in the future?
Sometimes we are the public faces of a research project, but at other times we don't want to be in a visible position.
The golden rule in Operational Security is using silence as a defensive discipline. If you don't really need to say something, then keep quiet. When you need to communicate with someone, do it in a secure way that doesn't compromise the content of your message and, if possible, doesn't generate metadata around it.
This is an incredibly difficult objective to accomplish: it's a natural instinct to want to impress others and on many occasions we will face adversaries who are well trained in obtaining the information that they want. We all like to tell interesting stories.
The second golden rule is that OPSec does not work retrospectively, so we should very careful about what we are doing now if we don't want it to come back and bite us in the future.
In terms of OPSec, every security analyst should aspire to being just another guy in the line. If we attract too much attention to ourselves, surveillance could easily escalate beyond electronic means – and that is basically game over. In today's world of massive surveillance, standing out will alert the attention of anyone who can access the relevant data. And in today's world of information leakage and "big internet companies", it´s difficult to know exactly who has access to which data:
(example of data leaked from an aggregator and published as a service)
There are some interesting examples of how anomalies have been detected from metadata and then successfully used in investigations (http://en.wikipedia.org/wiki/Abu_Omar_case). And then there is the routine application of this in mass surveillance and data mining.So what can we do?
The first rule of implementing OPSec is don´t try to accomplish more than you can. The fact is bad OPSec might be worse than no OPSec at all.
The main feature needed for effective OPSEC is not technical, but psychological: be meticulous, and maintain a healthy level of paranoia.
However electronic surveillance is obviously much more common and every bit of information will be there forever. Let´s look at our minimum toolset to avoid leaking information and thin about some basic tips.Encryption
Obviously we should use as much encryption as possible. But remember that there is an inherent weakness. Once your keys are compromised, all the info that was encrypted in the past is compromised with them. As time passes, the likelihood of your keys being compromised will grow. So it's much better to use IM with OTP.
Today's big question: what is happening with TrueCrypt, the most popular encryption software?
According to the Audit project, there is no obvious flaw or backdoor. However a couple of months ago we saw this:
There are still many open questions, but you can find a trusted TrueCrypt repository at: https://github.com/AuditProject/truecrypt-verified-mirrorEmail
Email simply leaves too much metadata, even when the message is encrypted with PGP (by the way, use keys bigger than 2048). IM with OTP is better.
External providers cannot be trusted.IM
Pidgin and Adium seem to be ok. But remember not to log your chats and don't overlook the non-technical factor: you don´t know who is on the other side of the conversation (even when you have verified the key).TOR
I'd definitely recommend using an anonymizing network to shake off most of the groups that could track you. However it cannot be considered truly "secure" in the sense that most of output nodes are controlled by people that can correlate their logs with the source of the connection. We saw an example of this in the Harvard bomb:
Also TOR has been the target of many attack attempts, like this recent one:
So don´t blindly trust TOR for anything very sensitive, but use it for your daily activities. Never reveal your true IP.Telephone
A total nightmare in terms of OPSec. The simple recommendation is to get rid of it! But this won't happen.
At least don´t do anything sensitive with it, instead use burner phones, and don´t use them at home or work.Conclusions
Perfect OPSec is almost impossible. However implementing basic OPSec practices should become second nature for every researcher. Once you internalize the need to apply OPSec you will be more careful and hopefully, avoid rookie mistakes like talking too much and bragging about your research.
The most important things, beyond any tool, are being meticulous, applying the right level of OPSec according to your situation and understanding what you can actually hope to achieve.
This is just a brief introduction to a complex topic, but we hope it could be a useful eye-opener, especially for our fellow security researchers.


text:
|23 Mar 2011
Windows 7 Home Premium 64 bit, Professional 32 & 64 bit
Task Scheduler Refresh
When watching the task scheduler before, during and after a task has run, at no point does it automatically refresh to change the status to running or finished plus it doesn't automatically change the "next run time" coloumn. All of this used to happen in XP.
I know that there is a refresh button but is there any way to get it to do it automatically?
|My System Specs
|24 Mar 2011
Windows 8.1 Pro RTM x64
I've had a look, and I don't think that there is a way to do this. At least, if there is, I'm not aware of it. Sorry.
|My System Specs
|Thread Tools
|Similar help and support threads for2: Task Scheduler Refresh
|Task Scheduler - Create Task to Display a Message Reminder
|simple task scheduler question: changing a task name
|Performance & Maintenance
|Can't create a task in task scheduler, account unknown.
|General Discussion
|Need help creating a task scheduler task to move files over a network.
|General Discussion
|Task scheduler unable to load task status/active tasks at startup.
|Performance & Maintenance
|Refresh not happening in task scheduler dropdown.
|General Discussion
|Task Scheduler failing to start task with merged network locations
|General Discussion
|Our Sites
|Site Links
|About Us
|Find Us
Windows 7 Forums is an independent web site and has not been authorized, sponsored, or otherwise approved by Microsoft Corporation. "Windows 7" and related materials are trademarks of Microsoft Corp.
© Designer Media Ltd
All times are GMT -5. The time now is 12:57 PM.

subset: commoncrawl


text:
A Turlock man is facing a lengthy prison term for his role in an Illinois home invasion, in which his partner was shot and killed by the homeowner.
The man accused of slitting his ex-girlfriend's throat at Turlock's Donnelly Park has been sentenced to eight years and eight months in prison for the attack.
Armed robberies, assaults, burglaries and clandestine drug labs are among the specific types of Turlock crimes that have been solved in arrests made possible because of the confidential Crime Stoppers tip hotline.
A tip that a Turlock home was being used to cultivate marijuana led to the confiscation of hundreds of plants and the arrest of one person.
A suspected drunken driver tried to avoid arrest by outrunning Turlock police officers in his vehicle and later on foot after he crashed.
Three teenagers were robbed at gunpoint Sunday night while parked outside a Turlock fast food restaurant.
Five friends leaving a Turlock bar were assaulted by a group of men Sunday night, leaving one with two stab wounds and another knocked unconscious.
A crash in Delhi that left one dead may have been the result of a drunken driver, the California Highway Patrol reported.
After helping a stranded motorist change a flat tire, a Turlock man decided to rob the motorist of his cell phone, the Turlock Police Department reported.
Ceres police were inundated with calls Thursday from throughout the nation to check on the welfare of a dog whose life appeared threatened on a Ceres man's Facebook page that went viral.
A 50-year-old woman had her life saved by a group of park-goers who subdued her ex-boyfriend after he slit her throat at Turlock's Donnelly Park Monday night.
Friends and family of Brandon Pacheco joined together Saturday to express their frustration with the status of the case involving the 25-year-old's death last week.
A Turlock man was sentenced to a prison term Thursday for his role in a crash that claimed the lives of three men. However, a plea deal will limit his incarceration to the county jail.
The family of the Turlock man shot and killed while allegedly trespassing, disputes the claims he confronted the homeowner and wants to see an arrest made in the fatal encounter.
The decision on whether or not Michael Hoyt will face another trial in the fatal beating of a Denair man after a traffic incident will soon be in the hands of a judge.
A Grinch has stolen the Christmas cheer from a Turlock child with special needs by stealing the boy's beloved decorations.
The Turlock Police Department is investigating a woman's report that she was sexually assaulted by two men she met outside a Lander Avenue business.
A 23-year-old man is facing domestic abuse charges after allegedly putting a knife to the throat of woman.
A woman and two men were cited by the Turlock Police Department after they were caught trying to skip out on their bill after eating at a Turlock restaurant.
A dispute between two men led to the arrest of one after he threatened to use a Taser on the other.
A man was beaten and robbed by a couple while visiting a friend at a Turlock motel.
A woman suspected of shoplifting from a Turlock department store was found in possession of narcotics and counterfeit money.
An armed suspect robbed a Quik Stop in Turlock, pointing his firearm at both a customer and the store's clerk, the Turlock Police Department reported.
The Turlock Police Department is investigating a shooting that left one man with a bullet wound to his leg and three suspects on the run.
For the second time in three weeks the Turlock Police Department is investigating a kidnapping and sexual assault that reportedly began at a Turlock park.
Two Delhi men arrested as part of a federal investigation into methamphetamine trafficking to Hawaii are now prison bound.
A Turlock man is facing robbery charges after using a pellet gun to steal a bicycle from an 18-year-old woman.
A Turlock man was hospitalized with injuries he sustained in a crash in an attempt to avoid arrest for stalking his ex-girlfriend.
Page 1 of 1


text:
Error message when you upgrade the Microsoft Management Console (MMC) to the MMC 3.0 format in IIS 5.1: "MMC has detected an error in a snap-in"
Article ID: 915519 - View products that this article applies to.
Consider the following scenario:
You receive this error message when you click the Meta Data tab under Analysis Manager in MMC 3.0. Additionally, the content in the right pane does not update as expected.
MMC has detected an error in a snap-in. It is recommended that you shut down and restart MMC.
This is a known problem with the Analysis Manager MMC snap-in. However, this problem is not known to cause any additional problems. If you click the following option in the error message, the Analysis Manager MMC snap-in continues to run:
Continue running and always ignore errors with this snap-in, regardless of user or session.
Microsoft has confirmed that this is a problem in the Microsoft products that are listed in the "Applies to" section.
Article ID: 915519 - Last Review: December 3, 2007 - Revision: 2.3


text:
That's putting it mildly.
Best Answer
only if you pay attention to them. They want attention so I don't give it to them
Best Answer
Not at all...most children are Narcissist....until the reach puberty...then they realize there's an opposite sex and the hormones kick in....
Best Answer
Are narcissists a pain in the Arse? Everyone I have ever been with turned out to be....
Best Answer
They're entertaining especially when you wind them up!
Best Answer
of course not we're just self righteous we know all of our flaws because we're in touch with ourselves and need not bother with anyone else except those we select for use
Best Answer
Related Questions
Are narcissists good a portraying different facades to people? Do their true colours eventually show?With exception of maybe two of his exes, I think a lot of people don't know he's verbally and emotionally abusive. He has a tonne of friends and business associates. Everyone...Lifesacake 26-30, F 4 Answers 0 Jul 25 in Dating & Relationships
BournUltimatum 22-25, M 5 Answers 1 Aug 23, 2012 in Parenting & Family
What would a few words be of your painting be*** is what i meant.OceanicDebris 31-35, F 10 Answers 1 Dec 20, 2009
pedrohedgerow 51-55, M 17 Answers 5 Feb 22, 2013 in Community
Nimbus007 46-50, M 17 Answers 1 Mar 21, 2010
jonnyboy55 46-50, M 7 Answers 3 Sep 22, 2011
Painted a pic for someone a while back. havent spoke in 5 months. is it ok to mail him the painting? I just wanna move oNRF25 26-30, F 5 Answers 1 Mar 5, 2012
What is your most favourite painting in your house? If not a painting, a portrait then? Is your choice one of your child's or grandkids? Cause that is fine too! Tell me, please. Details if you wish....PoetryNEmotion 51-55, F 8 Answers 4 Jun 1, 2012
My kitchen is painted a very light yellow, what colour should i paint the cabinets. the floor is dark wood.?butterfliesforever 41-45, F 12 Answers 1 Sep 11, 2009


text:
Hello everyone.
I have been thinking about a better solution for our current situation at our secondary school and thought i would ask you guys for your tips and experience.
Currently we have around 70 Staff Laptops of mixed brands that all run XP professional.
They are all added to the school domain for use within schools so staff can access SIMS and there network shares.
For home use however all Laptops have a second local account called home where they can just log on and do local work.
Ideally I would like to offer the option of just logging on with the same user account whether at school or at home. (can this be done on a domain without being connected to domain) And also it would be so helpful to everyone if work stored in their network shared directories could be accesseed at home too with an internet connection.
What would be the easiest, safest and most cost effective way of doing this?
Thank you for you help :)


text:
The exploration of sound is a natural part of Danish pianist Nikolaj Hess' music. Since graduating from the Rhythmic Conservatory in Copenhagen, he has worked in a wide range of contexts and played with artists as varied as trumpeter Wynton Marsalis and singer Sissel Vera Pettersen. With Pettersen he made an enchanting duo album, By This River (Music For Dreams, 2006).
Hess is also part of a musical dynasty, which includes his brothers, the saxophonist Emil Hess and the drummer Mikkel Hess. Together they have become an institution in Danish jazz comparable to the famous Heath Brothers in the US. ...read more
Any kind of duet, whether jazz, classical or rock, presents its own particular set of challenges. It's paramount that the playrs involved come equipped with some kind of simpatico, or build it up quickly. Tenor player Marc Mommaas and pianist Nikolaj Hess tackle this task on Balance. Funny Bones Jones begins slowly, then opens up into an up-tempo tableau of melodic and harmonic exploration. Hess uses Mommaas' shriek-punctuated flights of fancy as a springboard for his own clever melodic left hand riffs and abrupt, hard bop-flavored chords. Mommaas races along with a comparatively light tone on these ...read more


text:
My Profile
Steven Maravelias
Member since Feb 2012
Flag This ProfileFlag as Inappropriate
Reviewed Slow Cooker Melt-In-Your-Mouth Short Ribs
Feb 14, 2012 in Food Network Community Toolbox on FoodNetwork.com
"I tried braising the meat first. Roll it in the dry rub first, a little cooking oil and about 3 minutes a side to brown first before slow cooking. It cuts down on the fat content others complain about. I would recommend this step to cut down the fatty oil or buy the higher grade lean meat cut. Still a great recipe."""


text:
Erin Sagin Posts from the Internet Marketing Blog
How to Write Ad Copy for PPC: 5 Tips for Better Ad Writing
Writing ad copy for PPC can be a tough feat. The good news is, you don't have to be a super-creative copywriter to whip up competitive ad text. In fact, following a pragmatic approach can be advantageous.Here are a few simple steps that will help you to assess the competitive landscape and write ad copy that will stand out against your competitors', regardless of your ad rank.
Do Some Competitive ResearchDo some research to hunt down your real competitors. With paid search, it's easy to put up your blinders and forget who you're really up against. Don't take the easy route and assume that your competitors are parallel companies within your space. With PPC, you may actually be facing a whole new crew of competitors.Take a high-end shoe designer like Christian Louboutin. The typical... > Read more
How to Set Up an AdWords Account
Think you're ready to take the plunge and start a Google AdWords account? If the next three statements describe you, than you have my blessing!You have a website that is relevant, easy to navigate, and fairly well built out.Your AdWords account will help you to bring qualified searchers to your landing pages.
Once they've made it to your site, it's your job to convince them to convert. To achieve this, you must create landing pages that will compel visitors to take action. If your landing pages are cluttered, lack relevant information or do not facilitate a conversion, you're throwing money into a black hole and your paid search efforts will be in vain. If you know that your landing pages need a little TLC, check out these tips. (Bonus points if you have mobile optimized land... > Read more
AdWords Review Extensions: Add Positive Reviews & Testimonials to Your AdWords Ads
If you've had an eye on the AdWords Blog lately, you may have noticed that Google is on a roll when it comes to new features, particularly in the form of ad extensions—for example, see the new image extensions and enhanced, extra-large Google sitelinks.In the past, these "bells and whistles" were often utilized by only the savviest PPC experts.
Nowadays, ad extensions are a fundamental aspect of paid search accounts. If you're not using them, hop on the bandwagon before you're left in its dust. Not only do ad extensions require minimal setup time, they are also displayed at no additional cost—a win-win for most advertisers.Google's latest brainchild is Review Extensions. As you can see in the example below, these extensions give you the opportunity to share positive reviews... > Read more
Enhanced Campaigns FAQ: Top 5 Frequently Asked Questions on Enhanced Campaigns
As the deadline to migrate to Enhanced Campaigns looms ahead (it's in 12 days!), advertisers are becoming increasingly anxious about how these new features will impact their paid search accounts. Here are the answers to some of my clients' top five most frequently asked questions about Enhanced Campaigns:Q: How do I determine my bid modifier for mobile?A: If you've advertised on mobile devices in the past, take some time to segment your performance by device and assess your mobile success.
Consider how you are performing at your current CPCs and set your bid modifiers accordingly. If you are new to the mobile space, Google recommends using this formula to calculate an appropriate bid adjustment: 100% x ((value per mobile click/value per desktop click) – 1)). Regardless of which metho... > Read more
Top 4 Google AdWords Features I'll Be Exploring This Summer
Last month, our team had the opportunity to visit Google's NYC office for the Google Engage Catalyst conference.The event was directed toward agencies and, to be perfectly honest, I expected to get an earful of Google's typical agenda pushing. Pleasantly to my surprise, Google delivered on their promise to show us "what's new and exciting in online marketing.
"Here are the top four Google and AdWords features I'll have my eye on this summer:Similar AudiencesCheck out this new twist on Remarketing, one of the most popular Display Network strategies. Similar Audiences allows you to display your ads to users whose browsing behaviors are similar to those of people on your current remarketing lists. I think this is a genius idea, considering that it will give you exposure to a new, q... > Read more
Google AdWords Ad Extensions Cheat Sheet
If you're looking to boost your paid search performance without working late in the office all summer or increasing your budget, try utilizing Ad Extensions. Not only do they require minimal set-up time, they are displayed at no additional cost.It can be tough to decide which extensions to focus on, so I've created a cheat sheet to help you decide which ones will work best for you:Sitelink ExtensionsWhat are they? As you can see above, Sitelink Extensions allow you to promote additional landing pages below your standard ad text.
Applying a few more lines to your ad gives you more real estate on the SERP, helping your ad to stand out against your competition. Sitelinks also give the searcher an opportunity to go to a more specific page on your site. For example, in the ad above, t... > Read more
Five Reasons to Bid on Branded Terms in PPC
Anyone who manages a PPC account is perpetually on the lookout for a "secret weapon" to boost their performance. As a Customer Success Rep at WordStream, I have consulted for (what feels like) almost every type of account imaginable. Usually, my suggestions differ based on each individual client, but there is one foolproof recommendation that benefits just about everyone: bid on your branded terms.
OK, I know it sounds crazy. You're probably thinking, why bother spending money on branded terms that are already triggering organic listings? (That's what eBay recently decided, but we're not sure their SEM managers are quite up to snuff...) Or you may be worried that paid search ads will cannibalize your organic traffic. However, Google has conducted studies that show this isn�... > Read more
AdWords Geo Targeting Demystified – Advanced Location Options
I can't tell you how frequently I receive frustrated emails from clients who encounter surprises in their geo reports. Why is Google showing their ads to people in India if their geo targeting is set to New Jersey? Geo targeting seems like one of the easiest decisions you can make when setting up an AdWords campaign, but it's not as straightforward as it may seem.
Let's say I run a website that sells baked goods within Maryland. By default, my geo-targeted ads would be eligible to show to searchers who:Are physically located in Maryland: This one is pretty straightforward. As long as the searcher's IP address is located within my target region, Google can show my ads.Are located outside of my target area, but are looking for products in my area: This searcher could be in Boston, but... > Read more
Help, My Search Query Report Has Bieber Fever! Plus 5 Tips for Setting Negatives
Imagine you're managing a campaign for a product that sends videos over optical fiber. Would you think to set "Justin Bieber" as a negative keyword? I know I wouldn't. As it turns out, this is one of the best moves my client, Rolands, has made.Rolands oversees paid search for AD Net, a Taiwanese manufacturer of Formosa cables.
A few weeks ago, as he was mining his search query data, he noticed that his ads were showing to searchers looking for videos of Justin Bieber—not exactly his target audience!He quickly realized that Google considered "Bieber" to be a misspelling of "fiber," which is one of the most prominent keywords in his account. There were so many variations of Bieber queries that Rolands found himself "cleaning Biebers for the next few weeks."If you�... > Read more


text:
Bridge closed in Pike County
Updated On: Dec 22 2013 08:18:54 AM CST
Pike County officials closed the bridge over the railroad on Guy Barkdull Road indefinitely because of deterioration, they announced Saturday.
County Road Manager Mike Duncan told The Enterprise-Journal that the span was the last timber bridge in Pike County that crosses the railroad track.
Copyright 2013 by WAPT.com All rights reserved. This material may not be published, broadcast, rewritten or redistributed.


text:
Your live fish may not match the image shown due to natural variations in each species. Each companion animal is different in shape, color, and personality.
The graceful Radiata Lionfish is a hardy species with fan-like fins and black, red and white body pattern. This species is not a very active swimmer and generally drifts in the tank, ignoring most tank mates, including other lionfish. Avoid the addition of smaller tank mates and fin nipping fish that may pick on the lionfish. Due to the venomous nature of the dorsal spines on the lionfish, exercise caution when working in the tank.
Adapts to captivity easily when provided with adequate hiding spots such as crevices and caves. Plenty of swimming room is needed as is subdued lighting as this species is more active at night than during the day.
Radiata Lionfish - Special Care Info
As with all Lionfish, the spines located across its dorsal, pectoral, and anal fins are venomous. The likelihood of a sting is a very uncommon event, but should not be taken lightly. Although the venom is stronger than a bee sting, every person reacts differently to the venom. It is highly recommended to get medical treatment.
Internet Price: $56.99 Today's Price: $42.74 (Save 25%)
Temperament: Semi-aggressive; venomous
Reef Safe: With Caution
Family: Scorpaenidae
Native To: Sri Lanka, Tahiti
Diet: Carnivore
Adult Size: Up to 10"
Water Current: Low
Temperature: 72 - 78°F
Water Parameters: sg 1.023-1.025; pH 8.1-8.4; dKH 8-12
Care Level: Moderate
Tank Size: 30+ gallons
Scientific Name: Pterois radiata
Environment: Marine
Usually Leaves Warehouse the Next Business Day | More Shipping Info
3"-5" Length
|Store Prices Vary
$28.49 to $82.49
$27.74 to $61.49
$0.89 to $4.47
$15.74 to $41.99
$23.24 to $35.61
$14.24 to $17.61
$11.24 to $17.24
Free Shipping Exclusion:
This product qualifies for the Live Fish & Rock Free Shipping offer on orders of $175 or more. This product is not available for any other Free or Reduced Shipping promotions.If we need to contact you for any reason about your order, shipping of your package may be affected. Once your order is placed, you will receive a confirmation email with your order summary. Orders are subject to verification of payment information by phone or email.


text:
Please find past GCIV annual reports linked below.
The mission of GCIV is to create valuable international experiences and opportunities for the people of Georgia and emerging leaders around the world. Our vision is that every Georgian has the opportunity to be globally engaged.
Email address:
Copyright © 2010 GCIV All rights reserved.
Site by Cordelia Blake Web Design
100 Edgewood Avenue, Suite 1560 * Atlanta, GA 30303
Phone: 404-832-5560 * Fax: 404-832-5568


text:
A few days ago we presented the Y-3 Fall 2014 Hayex Low and now we take a look at the high version in a "Zebra" colorway. Created as a collaboration between famed Japanese designer Yohji Yamamoto and German athletic giant adidas, the label's latest offering shows the duo's willingness to experiment in terms of both silhouette and colorway. Inspiration from different footwear ranges can be seen throughout, form the hiking-inspired laces to the running-inspired sole. Look for the sneakers in the coming months at select retailers and the official Y-3 online store.
Get Updates Daily.
Follow our Twitter feed
We'll update you as we publish on our site. You'll get an update instantly!Follow @highsnobiety
Get Updates on Facebook
We'll bring our best stories and photos direct into your newsfeed.
Follow us on Instagram


text:
1493 County Road 106,
Carbondale, CO, 81623-0816
Carbondale, CO, 81623-0816
Tel: (970)963-2562
Colorado Rocky Mountain School is an exceptional institution with a life-changing program.
Colorado Rocky Mountain School cultivate a learning enviornment in which students discover their potential to excels as individuals, contribute to their communities, and participate thoughtfully in the world we share.
Since CRMS's founding more than fifty years ago, we've believed that a school should enrich and engage the mind, body, and soul of its students.
Their individual potentials become illuminated in a community that truly embraces them and their contributions.
Everything that a student does—in the classroom, in the active curriculum, within and beyond the CRMS community—is designed toward the development of a complex, nuanced person, because at CRMS we value each student's individual potentials, and embrace the comtributions they can make to our school.
A CRMS student graduates with the skills, knowledge, and confidence to succeed in college, and to lead a fulfilling life.
CRMS's distillation of academic, active, and community influences is unique among independent boarding schools.
School Overview
|School Membership(s)School Assoc.
|National Association of Independent Schools (NAIS)
Association of Colorado Independent Schools (ACIS)
|Religious Affiliation
|Grades Offered
|Grades 9 - 12
|Year Founded
Student Body
|Total Students
|148 students
|Student Body Type
|% Students of Color
State avg.: 21%
|Students by Grade
Academics and Faculty
|Total Classroom Teachers
|38 teachers
|Student : Teacher Ratio
National avg.: 13:1
|% Faculty w/Advanced Degree
|Average Class Size
|13 students
|Number of AP Courses
|4 courses
|List of Courses Offered
|Link to List of Courses
|Advanced Courses
|AP American History, AP American Literature, AP Calculus, AP Environmental Science,
|Average ACT score
|Matriculation DataMatric. Data
|Link to Matriculation Data
|Classroom Dress Code
Finances and Admission
|Admission Deadline
|Feb. 15 / rolling
|Yearly Tuition Cost
|Tuition Notes
|Day student tuition is $27,000
|% on Financial Aid
|Average Financial Aid Grant
|Admissions Director
|Molly Dorais
|Admissions Associate
|Tracy Wilson
|Total Sports Offered
|13 sports
|Alpine Skiing, Cross Country, Cycling, Freestyle Skiing, Kayaking, Mountain Biking, Mountaineering, Nordic Skiing, Rock Climbing, Ski Jumping, Snowboarding, Soccer, TennisAlpine Skiing, Cross Country,
Cycling, Freestyle Skiing,
Kayaking, Mountain Biking,
Mountaineering, Nordic Skiing,
Rock Climbing, Ski Jumping,
Snowboarding, Soccer,
|Total ExtracurricularsTotal Extra-curric.
|14 extracurriculars
|Bike Shop, Blacksmithing, Ceramics, Cooking, Drama Set Design, Face AIDS, Gardening, Glassblowing, Operation Smile, Peer Tutoring, Photography, Random Acts of Kindness, Student Council, Yearbook Bike Shop, Blacksmithing, Ceramics, Cooking, Face AIDS, Gardening, Glassblowing, Peer Tutoring, Photography, Yearbook, Drama Set Design,
Operation Smile,
Random Acts of Kindness,
Student Council,
School Notes:
- 100% college acceptance
- 75% of students accepted to their first choice college
- 4:1 Student-Faculty ration
- 13: Average class size
Nearby Schools:
All Schools | High Schools | Elementary Schools | Preschools | Public Schools
Show me:
- School Location Miles Students Grades
CarbondaleMt. Sopris Montessori School
879 Euclid Avenue
Carbondale, CO, 81623
(970)963-3506Montessori School0.9 mi | 7 students | Gr. PK-K
CarbondaleWaldorf School On The Roaring Fork
16543 Highway 82
Carbondale, CO, 81623
(970)963-1960Special Program Emphasis4.9 mi | 142 students | Gr. PK-8
BasaltAlpine Christian Academy
20449 Highway 82
Basalt, CO, 81621
(970)927-9106(Christian)8.3 mi | 51 students | Gr. PK-12
Glenwood SpringsColumbine Christian School
2314 Blake Ave
Glenwood Springs, CO, 81601
(970)945-7630(Seventh-Day Adventist)9.8 mi | 15 students | Gr. KG-8
Glenwood SpringsSt. Stephen's Catholic School
414 Hyland Park Drive
Glenwood Springs, CO, 81601
(970)945-7746(Roman Catholic)10.2 mi | 104 students | Gr. PK-8
School Reviews
Area Statistics
Recent Articles
Updated November 30, 2014
Don't assume you cannot afford private school. Don't assume that you make too much money to be eligible for financial aid. Ask. Always ask.
The Cristo Rey Network of schools currently comprises some 26 schools in 17 states and the District of Columbia. Truth is they are just getting started.
What do you do when you are dissatisfied with your local public schools? Homeschool your children? Send them to private school? Let's look at your options.
More ArticlesElementary Issues, Opinion, Why Private School, Paying For It, High School Issues


text:
Unsweetened Shredded Coconut
I bought a bag when I was doing Southbeach to make these cream cheese PB balls rolled in it. Is it allowed during Induction?
I don't recall that it is, but someone with the book may need to refresh my memory.
I just finished a bag yesterday (makes a nice chewey fat bomb), but I am not going to buy any more for a while. I may add some back, along with coconut flour, when I am a bit further along. On the other hand, CO is now a vital part of my everyday diet.
It doesnot specifically mention coconut but the idea is no nuts on induction. Read up in other places as well and that seems to be the consensus.
thread whether or not you were following induction, because of the coconut (and
a few other things). Atkins induction and South Beach induction use different foods
but I'm not familiar enough with SB to just tell you straight out what the differences
|All times are GMT -7. The time now is 05:51 AM.


text:
Course Directory
Golf Links & Resources
About Us
Customer Support
Like Us On Facebook
Follow Us On Twitter
Follow Us on Google+
US/CAN Billing Zip/Postal Code:
Sign In
Sign up for our
Email Club
Other Communities
United States
AK - Anchorage
AL - Birmingham
AL - Montgomery
AL - RTJ Trail
AR - Fayetteville
AR - Little Rock
AR - S. Arkansas
AZ - Casa Grande
AZ - Mesa
AZ - Phoenix Metro
AZ - Scottsdale
AZ - Tucson
AZ - Yuma
CA - Central Valley
CA - El Centro
CA - Fresno
CA - Inland Empire
CA - Los Angeles
CA - Monterey
CA - Napa/Sonoma
CA - Oakland/East Bay
CA - Orange County
CA - Palm Springs
CA - Reno Lake Tahoe
CA - Sacramento
CA - San Diego
CA - San Diego East County
CA - San Diego North County
CA - San Francisco Bay Area
CA - San Jose/South Bay
CA - Santa Barbara
CA - Temecula
CO - Colorado Springs
CO - Denver
CO - Grand Junction
CO - Mountain
CO - Pueblo
CT - Hartford/Central
CT - New Haven/Southern
DC - Washington DC
DE - Wilmington
FL - Daytona/Space Coast
FL - Jacksonville
FL - Lakeland/Sebring
FL - Miami/South Florida
FL - Naples
FL - Ocala
FL - Orlando
FL - Panama City/Pensacola
FL - Sarasota
FL - Tampa Bay / Saint Petersburg
FL - West Palm Beach
GA - Athens/Gainesville
GA - Atlanta
GA - Augusta
GA - Coastal Georgia
GA - Macon/Columbus
GA - Macon - Mid GA
GA - NE GA Mountains
GA - Valdosta
HI - Big Island
HI - Kauai
HI - Maui
HI - Oahu
IA - Des Moines
IA - Omaha NE
ID - Coeur D'Alene / Northern Idaho
ID - Spokane
IL - Central Illinois
IL - Chicago West
IL - Chicago North
IL - Chicago South
IL - Northwest Indiana
IL - Peoria/Bloomington
IL - Quad Cities
IL - Rockford
IL - St Louis (Metro East)
IN - Bloomington
IN - Fort Wayne
IN - Indianapolis
IN - Lafayette
IN - Northwest
IN - Southern
IN - Terre Haute
KS - Kansas City
KS - Wichita
KY - Eastern
KY - Lake Cumberland
KY - Lexington
KY - Louisville
KY - Western
LA - Baton Rouge
LA - Lafayette
LA - New Orleans
LA - Shreveport Golf
MA - Boston
MA - Cape Cod
MA - New England
MA - Springfield
MD - Baltimore
MD - Metro DC
MD - Ocean City
ME - Portland
MI - Detroit Northeast
MI - Detroit Southeast
MI - Detroit Northwest
MI - Detroit Southwest
MI - Grand Rapids-Kalamazoo
MI - Lansing
MI - Northern Michigan
MN - Minneapolis
MO - Branson
MO - Kansas City
MO - Lake of the Ozarks
MO - Springfield
MO - St. Louis
MS - Mississippi
MT - Billings
MT - Western Montana
NC - Asheville
NC - Charlotte
NC - Coastal
NC - Greensboro
NC - Raleigh-Durham
NC - Village of Pinehurst
ND - Fargo/Bismarck
NE - Omaha / Lincoln
NJ - Atlantic City
NJ - Crystal Springs
NJ - North New Jersey
NJ - South New Jersey
NM - Albuquerque
NM - North/South New Mexico
NV - Las Vegas
NV - Laughlin
NV - Mesquite
NV - Reno / Lake Tahoe
NY - Albany/Schenectady
NY - Buffalo
NY - Hudson Valley
NY - Long Island
NY - New York Metro
NY - Rochester
NY - Western NY
OH - Akron-Canton
OH - Cincinnati
OH - Cleveland
OH - Columbus
OH - Dayton
OH - Toledo
OH - Youngstown
OK - Oklahoma City
OK - Tulsa
OR - Bend/Central Oregon
OR - Eugene
OR - Oregon Coast
OR - Portland
OR - Salem
OR - Southern Oregon
PA - Lehigh Valley
PA - Philadelphia
PA - Pittsburgh
PA - Pocono Mountains
PA - South Central
PR - Puerto Rico
SC - Charleston
SC - Columbia
SC - Greenville
SC - Hilton Head
SC - Myrtle Beach
SD - Sioux Falls
TN - Chattanooga
TN - Knoxville
TN - Memphis
TN - Nashville
TX - Amarillo/Lubbock
TX - Dallas
TX - Fort Worth
TX - Houston
TX - NE/SE Austin
TX - NW/SW Austin
TX - San Antonio
UT - Salt Lake City
UT - St. George
VA - Richmond
VA - Washington/VA
WA - Bellingham
WA - Seattle Metro
WA - Spokane / Eastern Washington
WA - Southwest Washington
WA - Tacoma / Olympia
WA - Wenatchee / Central Washington
WA - Yakima / Tri-Cities
WI - Green Bay/North WI
WI - Lake Geneva
WI - Madison/Dells
WI - Milwaukee
WV - Washington DC/WV
WY - Casper
AB - Alberta
BC - British Columbia
ON - Barrie/North
ON - Burlington
ON - Collingwood
ON - Hamilton
ON - Indoor Golf Ontario
ON - Kitchener/West
ON - London
ON - Muskoka
ON - Niagara
ON - Northern Ontario
ON - Ottawa/Outaouais
ON - Peterborough/East
ON - Toronto/GTA
PEI - Prince Edward Island
QC - Montreal
BER - Bermuda
MEX - Mexico
MEX - Cancun region
MEX - Cozumel region
MEX - Los Cabos
MEX - Puerto Vallarta
IRL - Ireland
IRL - West/Northwest Ireland
IRL - East Ireland
IRL - Southwest Ireland
United Kingdom
ENG - England
IRL - Northern Ireland
SCT - Scotland
SCT - Highlands/Islands
SCT - Fife & Tay Coasts
SCT - West Coast
SCT - Edinburgh & East Lothian
WLS - Wales
Course Directory
Golf Links & Resources
GolfNow Mobile
GolfNow Rewards
The Daily Tee
Go. Play.
Course Directory
Florida Golf Courses
New Port Richey Golf Courses
/ River Ridge Golf Club
River Ridge Golf Club
11022 Tee Time Cir
New Port Richey, FL 34654-6229
Course Website
Driving Directions
View Tee Times
River Ridge Golf Course is a captivating 18 hole signature course. The club is situated in an environmentally protected area. Golfers may see deer, wild turkey, rare birds and an island green. Most ponds are home to native alligators.
Course Information for
River Ridge Golf Club
Course Information
Course Information
Facility Information:
18 hole regulation length course
1 golf course(s)
River Ridge Golf Club
18 hole regulation length course
Daily Fee golf course
Designed by Ron Garl
68 par, 4,615 yards
62.5 rating, 100 slope
Just Golf facility
Green Fees:
View Tee Times
* includes golf
where available
Paul Kobel, General Manager/Head Golf Pro/Superintendent
Putting Green
Chipping Area
Practice Bunker
Food & Beverage Available
Rental Clubs
Indoor Practice Facility
Walking Allowed
Softspike Facility
PGA Facility
Full Forecast
New Port Richey, FL
Current Conditions
High: 69° F
Low: 56° F
Four Day Forecast
PM T-Storms
Scattered T-Storms
10 Day Forecast
Hourly Details
River Ridge Golf Club
good coursr for the money
have played this course a few times always a good time
November 17, 2014
Playing conditions
This was my first time playing this course. The Tee boxes were in terrible shape. The fairways were not good on the majority of the holes with lots of weeds. The 17th hole was in terrible condition and from 100 yards out from the green it was nothing but dirt with no grass. For what I paid it was a round of golf and I can't complain about price. It has potential and needs some TLC.
October 27, 2014
$13 for 18 and a cart is way too much!
I wouldn't go again if it was free! I am from out of town on vacation. The greens were plugged with sand? That is for winter time and this is Florida, why??? The fairways were in terrible condition the greens were worse. There are many other courses nearby, go to one of them instead..this was the worst course I golfed at in over 10 years!
September 22, 2014
River Ridge
Excellent for the price. Its a short neighborhood course backed up and cut through a large nature area, we see wildlife every trip. Staff was courteous and professional, decent pro shop. Course was in decent shape and greens were in good condition. Cant beat the price for an afternoon and a way to work on the iron game.
September 14, 2014
Very short course and in complete and utter disrepair. The greens were the highlight of the course and they were horrible. Fairways were mostly weed and sand. If I hadn't paid $8 to play, I would be really upset. I guess you get what you pay for.
August 4, 2014
very disappointed
Took my wife, and we were not happy after discovering course was in bad shape. If it was kept up would be nice. Most likely won't play again.
July 22, 2014
To start they were emptying there septic tank so you could barely breath on hole 1 and the "putting green". Secondly there are large patches of sand with zero grass growing in them on every green and the are ignorant enough to even place the hole location in some of these patches on some hole. If you can finally get thru the grassless fairways and reach the green you will discover that on top of the poor green conditions the grass that is there is like putting on short rough. On top of all this the employees where off putting and just ignorant to the players needs. I can promise you that there is no way I play a worse course for as long as I live. I have contacted the BBB and hope changes will be made or they will close shortly for golfs sake
June 21, 2014
Great Value and Challenging Course
The staff is very friendly making you feel welcome. Golf course is challenging for any level player. The value was unbelievable $10 for 18 holes with cart! Was obvious they have been working hard at getting course /greens in good shape had few bad spots but really nice on the good areas. Restaurant staff was excellent and food very good. Great beer & liquor prices and very clean. I will definitely go back, we played 18 holes in 2hr 50min! Lot of wildlife to see.
June 13, 2014
NOTE: While every effort has been made to assure accuracy, we advise you to check all information with the golf course before booking your tee-time or driving to the course.
Global Links
Sign up for our email Club
Golf Links & Resources
Customer Support
Website Feedback
GolfNow Resources
Course Directory
Affiliate Program
Book by Phone: 800-752-9020
About Us
Company Information
Privacy Policy
Terms of Use
Contact Us
GolfNow News
GolfNow Solutions
About GolfNow Solutions
Course Technology
Online Tee Times Distribution
Support for Golf Operators
BRS Golf (U.K.)
2014 GolfNow.com
Site Map