Thursday, 24 August 2017

Check files for malware using VirusTotal

Recently I had a fake DHL e-mail and I was interested in the attached Word doc, I wondered what was in it, whether it really was dangerous or not. But I did not want to put myself in any danger, I definitely did not want to open the doc in Word! How could I investigate this file in safety? I saved the e-mail from Outlook as an MSG file. I scanned it using Emisoft's emergency scanner but it didn't find anything. Next I used VirusTotal and that's what I want to talk about in this article today.

VirusTotal is a website. You can upload a suspect file there. It will use many anti-malware software scanners to check for infection. It displays the results and characteristics of the file. It even shows all the different names the different anti-malware companies use for malware.


Example
Here's an example based upon that fake DHL e-mail I received in Outlook.

Open the Outlook e-mail, click File | Save As


Save

You will end up with an MSG file. The MSG file contains the e-mail message text and the attachment (in my case it was a Word doc file - will VirusTotal be clever enough to find the attachment inside the MSG file?).

Browse to https://www.virustotal.com


Click Upload and scan file

Select the MSG file

The results will be displayed...


At the top it shows you how many anti-malware engines it used and how many found something nasty inside the file. In my example above 13 out of 58 found malware in the file.

Click on Details to see more information


The above screen shot shows the Details page with the Basic Properties of the file. You can see that it has identified the Word doc and provides some characteristics. This means that VirusTotal is clever enough to read an MSG and see the embedded attachments it might have inside.

Scroll down and there's more information:


Under the OLE section I found some interesting details. The Code Page is Cyrillic. This e-mail was written in German. Why does it have a Word doc written on a PC set to use Cyrillic? It's not conclusive evidence of anything but it does raise suspicions (if we weren't already very suspicious of course!). The template it is based upon is a dotm, that means there could be macros inside - again this points toward it being a dangerous file as macros can be malware. Of course in the above you can also see that VirusTotal has listed the macros inside the file anyway, for sure this is a dangerous file that I will definitely delete.


Conclusion
VirusTotal is an excellent way to investigate possible virus/malware infected files in safety. The website is free but there are some conditions of use, please read those before using it. One thing they do is use the results from your scan in their database. This is a community approach, where they can build up a picture of threats. The best thing is that it uses so many anti-malware engines to scan for malware. You can see all the different names which could help you analyse the threat at an even deeper level. For IT professionals wishing to understand threats to better protect networks and computers, VirusTotal is an invaluable tool.

For a home user, it's also very helpful. However, I would recommend that you are always extra-cautious when handling any suspect file. Make sure you have anti-malware software installed on your computer, make sure your system updates/patches are up-to-date and the most important of all, make sure you have plenty of backups.





Wednesday, 23 August 2017

Malware Alert - Beware Fake DHL e-mails and attachments

I received this fake e-mail, it's very well done, it looks almost genuine:

>>>
From: DHL Packet <info@maedchenzentrum.at>
Subject: Information uber die Sendung Nr.04128002724453

Guten Tag!

Die Sendung soll an Ihre Adresse am 24.08.2017 zugestellt werden.Im Anhang finden Sie die erforderlichen Informationen zu dieser Lieferung.

Mit freundlichen GrĂ¼ssen

<<<



If you open an e-mail like this the first thing to do is STOP!
Do *not* open the attachment.
Do *not* click any links. First read the e-mail a few times:

  • Look at the sender e-mail address, this is the biggest giveaway that this must be a fake. It's not from a DHL address, it's from "maedchenzentrum.at" instead.
  • The attachment is a Word doc file - this is a sign of something strange because few people use Word doc files now, mostly they are docx. Also, why would DHL send a Word file at all? Usually they'd send a link or if it were a file it would be PDF (but don't open those either!)
  • Did you order anything? Are you expecting DHL to send you anything? Question it, don't just think Christmas has come early, it hasn't, it might well be the opposite.

Conclusion
Please delete such e-mails. Remember to always think before opening attachments. In this case the Word file has a trojan in it that could've done all kinds of damage if I'd opened it.

The following link is to DHL's website where they warn you against such fake e-mails:
http://www.dhl.com/en/legal/fraud_awareness.html


Saturday, 5 August 2017

Which lens is best - Panasonic 12-32 or 14-42 PZ?

Previously I wrote an article praising the Panasonic Lumix G X Vario PZ 14-42mm F3.5-5.6 ASPH Power OIS lens. I recommend it, especially for a holiday trip, as that lens is small and versatile. I've been happily using this lens for a couple of years.

Recently I received a new GX80 camera! It came with the Panasonic Lumix G Vario 12-32mm F3.5-5.6 ASPH. What to do? Will it replace my 14-42 PZ as my all-purpose lens? Maybe, in this article I'll list some of the differences, the pros and cons of each, just in case you are considering one of these lenses for your camera bag.

Panasonic give their lenses very long names. In this article I'll refer to them by the shorthand of 14-42 PZ and 12-32.

GX80 + 12-32mm lens extended


Image Quality
From my non-scientific view I feel these lenses both produce amazing photos. I don't think you could make a decision of one lens over another based on image quality. Both are superb.


Auto-focus Speed
Both lenses are fast, I don't see a difference between them.


Focal Length
With the 12-32 lens starting at 12mm (24 equiv.) means you have a wide angle lens but it isn't too wide, you don't usually see any distortion. It allows you to get more into the shot and it even works well for selfies when holding the camera out at arms length. 12mm is an advantage over 14mm, I feel those 2mm make a difference. However, at the long end the 14-42 PZ has an extra 10mm of zoom range. That does make a big difference if you want a lens that can really get in close and for portrait shots it's easier to get some background out-of-focus blur using the 14-42 PZ. Having said that, there are better lens choices for portrait photography, the Olympus 45mm F1.8, for example (my favourite lens!).

With focal length it comes down to what you use the most, the wide or more telephoto end. If you like to get close having the ability to zoom to 42mm can be handy. 32mm (64mm equiv.) can be a bit restrictive. Of course both lenses are covering the all important classic focal lengths of 35 and 50mm equivalence, that is 17mm and 25mm with these Micro Four Thirds lenses.



Minimum Focusing Distance
Both lenses have a 20cm minimum focusing distance when at their widest focal lengths. This is fine for taking flowers and the like, neither lenses are good for photographing insects though. Because of the longer zoom range of the 14-42 PZ, it is the better option for this kind of photography.

If macro or close-up photography is of interest and you are on a budget, consider the Olympus 45mm and macro converter combination. I've used this and it's excellent, you can read more about it here.


Aperture
Both have a variable aperture of F3.5 (wide) to F5.6 (telephoto). As the focal length ranges are different, when zoomed, on paper the 14-42 PZ is the better low-light performer. For example, the 12-32 at 12mm will start at F3.5. Zoom to 14mm and the aperture goes to F3.7. The 14-42 PZ starts at 14mm F3.5.

When using the 14-42 PZ, I zoomed to 32mm and the best aperture I could set was F5.5. We can say in simple terms that when zoomed, the 12-32 is one stop less efficient at light gathering.

In the real world this probably won't make a huge difference. I have found F3.5 to be good enough for most casual evening photography, especially on holiday where both these lenses would be ideal. Just keep either lens at its widest focal length.

If you really need a good low light lens, consider a prime lens such as the Panasonic 20mm F1.7. It is also small and compact.


Size
Physically both lenses are small and compact. When not in use they both fold to a pancake size. The 12-32 is very small. The 14-42 PZ is bigger in diameter. The two switches and styling of the 14-42 PZ give it a slightly bulkier appearance. But both are compact lenses, great for taking on a trip. When fitted to a camera like the GX7 or GX80, they fit nicely into a small shoulder bag or even a large winter coat pocket.


Build Quality
Both are well built. The 12-32 is all plastic. The 14-42 PZ has a metal lens mount, otherwise it is plastic too. But both are made from good quality feeling plastic. The 12-32 in particular, it feels good to the touch. I can't really fault either lens.


Looks
The 12-32 is the better looking lens. It is minimalistic, no red dot, no switches and bumps like the 14-42 PZ. Personally I prefer the neater look of the 12-32.

GX80 + 12-32 lens not extended

Handling
With the 12-32, switch on the camera and then twist the zoom ring to extend the lens before use. The 14-42 PZ is named PZ because it is a Power Zoom lens. Switch on the camera and the lens automatically extends ready for use. It is fast too. If you are used to point and shoot cameras, you'll feel right at home with the 14-42 PZ. It works well with one hand, at least I have using the GX7 and GX80 cameras. The 12-32 has an advantage though, you can extend and set it to the desired focal length before switching on the camera. It is probably down to personal preference which is better. For me, I like both methods but the powered zoom very convenient.

Both cameras come with a small manual lens cap that's easy to lose! You can buy automatic lens caps from eBay, I have one on my 14-42 PZ  and it has worked well. I believe one is also available for the 12-32 lens.


Control
This is where there is a lot of difference. The 14-42 PZ has a rocker switch for zooming. The 12-32 has a conventional zoom ring. For stills I prefer the conventional zoom as you can set that to what you want visually. But the 14-42 PZ can be good for films because you can zoom consistently with the powered zoom.

It is possible to remotely control the zoom from the Panasonic app on your phone. That might be a nice feature for a filmmaker.

The 12-32 does not have a focus ring. Instead, for manual focus, you must use the onscreen controls in the camera. It is ok but not ideal. The 14-42 PZ has a rocker switch for manual focusing, it is easier to manage. Do you focus manually often though? With a standard zoom lens probably not so much.

The zoom rocker switch on the side of the 14-42 PZ lens

Image Stabilisation (IS)
Both lenses have IS meaning that you are more likely to get shots without blur when shooting one-handed or in the evening (low light). The newer 12-32 lens has an advantage, when used with a modern Panasonic camera such as the GX80, you will get Dual-IS which means the lens IS and in-body IS work together.


Real world use
I was using the 14-42 PZ for a couple of years or more. I know that lens. The 12-32 is still new to me but so far I am impressed. I like prime lenses with their fixed focal length, the 12-32 feels similar because you set your focal length and then shoot. With the 14-42 PZ the tendency is to point it and zoom. There is no right nor wrong, both methods get the job done.

I have found the extra wide 12mm focal length handy. Out at a restaurant it was particularly useful in easily capturing everyone at the table. The F3.5 aperture was more than adequate for the job.

With the 12-32 only zooming to 32mm is a bit of a pain sometimes. I want to reach further but I just can't.


Conclusion
I think for convenience the 14-42 PZ is best, especially when the automatic lens cap is attached. The 12-32 makes photography more deliberate as you set your focal length ready to shoot. It is a more tactile experience. Having the wider field of view is also a welcome advantage for the 12-32. Standard zoom lenses are always a compromise. In this case it is down to what's important to you. There are other factors too, such as will you carry another lens with you? I have the Panasonic 35-100mm F4-5.6 lens. It is styled in a similar way to the 12-32. It is compact and great for travel. Maybe with those two in my bag I will not miss the ability to zoom to 42mm, as I can get that and more with the 35-100mm. Decisions decisions! The good thing here is that whatever you choose, you get great quality for a reasonable price.


References

David Thorpe's video for the 12-32 lens.
https://youtu.be/NROsVegOAIo

Other photography articles:
https://mgxp.blogspot.ch/search/label/photography

If you want to see some of my photos I am on Instagram here:
mgVersion1