The days leading up to major religious holidays are when you should be more careful with the contents of your inbox.One malicious spam run recently spotted by McAfee consists of a cute image of bunnies, chicks and colored eggs, complete with the offer to download the animated greeting by clicking on the offered link:The subject [...]
Archive | Malware
“Worm.Ckbface.adj” spreading via Yahoo Messenger
Posted on 12 April 2011.
A “Worm.Ckbface.adj” is spreading via Yahoo Instant Messenger ,that tricks people into downloading what they think is a pictures from a friend but is instead malware that installs a backdoor on Windows systems and spreads to a victim’s IM contacts. The worm arrives via a message from a contact with the word “picture” or “pictures” [...]
Posted in Malware, Quick HealComments Off
Update on LizaMoon mass-injection and Q&A
Posted on 01 April 2011.
The LizaMoon mass-injection campaign is still ongoing and more than 500,000 URLs have a script link to lizamoon.com according to Google Search results. We have also been able to identify several other URLs that are injected in the exact same way, so the attack is even bigger than we originally thought. All in all, a [...]
Posted in MalwareComments Off
Spotify application serves malicious ads
Posted on 26 March 2011.
Today it was reported that Spotify, the popular streaming music service, displayed malicious ads to users of their Free version. The ads lead to websites that used the Blackhole Exploit Kit to infect users with the Windows Recovery fake AV application. Our Advanced Classification Engine has full coverage for the Blackhole kit and protected users [...]
Posted in MalwareComments Off
Rustock – 7 days later
Posted on 24 March 2011.
RIP Rustock botnet! Today marks exactly one week since Rustock, one of the largest spam generator botnets, was taken down by the Microsoft digital crime unit and US federal law enforcement agents. Rustock had more than 250,000 bots approximately, and until last Wednesday was one of the biggest known bot networks. The bot's author was implementing certain [...]
WoW Factor or Back Into Matrix
Posted on 16 February 2011.
Online gaming password stealers form a large malware category. Moreover, it is growing: there is strong demand in the virtual experience, there is supply, there are online auction sites where such experience is sold to those who are ready to pay for it. That is, there are mechanisms for converting the virtual experience into the [...]
Posted in MalwareComments Off
The Nduja Job: Into The World Of XSS Worms
Posted on 31 January 2011.
In this blog i talk about the history of XSS worms, how they evolved to spread through multiple webmail providers and the client-server model involved in a XSS botnet. More here: http://www.avertlabs.com/research/blog/index.php/2007/07/19/the-nduja-job-into-the-world-of-xss-worms/ View full post on News from the Lab
Posted in MalwareComments Off
ClubHack 2007: Analysis of Adversarial Code – The Role of Malware Kits
Posted on 31 January 2011.
Just came back from Pune after Presenting at ClubHack 2007. It was such a great initiative to promote security awareness in India. I talked about the recent trend in the emergence of kits like MPack and how attackers are exploiting them to install various Malware. You can find my slides below: View full post on [...]
Worm-Able PDF Clarification
Posted on 14 November 2010.
I have received several email questions and explanation requests regarding my blog post “Are PDFs Worm-Able” and the proof of concept video within the post. Instead of repeating a post I wrote over on my company’s blog I figured I would just link to it from here: Implications of Recent PDF /Launch Hacks. In the [...]
Posted in Malware8 Comments
How to Remove Internet Security Suite Rogue
Posted on 14 November 2010.
Internet Security Suite is a rogue security product that pretends to find malicious code on a victim’s machine in order to frighten him or her into purchasing this useless application. It’s the latest rogue of the FakeVimes family. Both the downloader and module are detected as FraudTool.Win32.FakeVimes!VB (v). This replaces SmartEngine.FakeVimes as the latest member [...]
Posted in MalwareComments Off
Another PDF Launch Action Oddity
Posted on 13 November 2010.
It has been a few months since I posted anything here but tonight as I was fiddling around with the Launch action within a PDF file I discovered another oddity that I thought would make an interesting blog posting. As we are all probably aware of the Launch action within the PDF specification allows for [...]
Posted in MalwareComments Off
New Feed Alliance Created
Posted on 13 November 2010.
Hi Guys, i want to announce that our new malware feeds alliance was lunched. http://c300g.net. we are open for feeds exchange for the solely purpose of research. we already have 8 different vendors which we all ready exchanging data with, we also work with 6 different sensors deployed around several different geographical hosting services. we [...]
Posted in MalwareComments Off
UPS Spam Mail
Posted on 13 November 2010.
Emsisoft Labs are always on the lookout for something out of the ordinary happening, and we recently came across a circulation of spam portraying as fake FedEx Emails. Emsisoft Anti-Malware will detect and remove the same as Trojan-Dropper.Win32.Oficla (alias Sasfis). The email comes with subjects like “ID N4815147” or “FedEx Item Status N5561690” and does [...]
Windows “DbgHelp.dll” Export name stack overflow vulnerability
Posted on 11 November 2010.
The malwares in wild are exploiting this vulnerability. This vulnerabilty allows remote code to be executed while a debugger loads a specially crafted executable using Microsoft’s Dbghelp.dll(ver 5.x). When I was trying to load the malware that uses this trick it made olly debugger to exit. The below link has some interesting stuff about this [...]
Posted in MalwareComments Off
SecurityEssentials 2011
Posted on 09 November 2010.
SecurityEssentials2011 is a rogue security product that pretends to find malicious code on a victim’s machine in order to frighten him or her into purchasing this useless application. VIPRE detects it as Trojan.Win32.Generic!SB.0 Security Essentials 2011 splash screen (Click on graphic to enlarge) Security Essentials 2011 graphic interface (Click on graphic to enlarge) Security Essentials [...]
Posted in MalwareComments Off
System Tool 2011
Posted on 06 November 2010.
System Tool 2011 is a rogue security product that pretends to find malicious code on a victim’s machine in order to frighten him or her into purchasing a useless application. It’s a clone of the 2008 Security Tool rogue. System Tool 2011 warning screen. (Click on graphic to enlarge) System Tool 2011 graphic interface [...]
Posted in MalwareComments Off
Antivirus8
Posted on 28 October 2010.
Antivirus8 is a rogue security product in the Antivirus XP 2010 family that pretends to find malicious code on a victim’s machine in order to frighten him or her into purchasing this useless application. VIPRE detects it as Antivirus8.FakeXPA. The Antivirus8 graphic interface: (Click on graphic to enlarge) Antivirus8 fake scan: (Click on graphic to [...]
Posted in MalwareComments Off
Antivirus Solution 2010
Posted on 28 October 2010.
Antivirus Solution 2010 is the latest rogue security product the UnVirex family. It pretends to find malicious code on a victim’s machine in order to frighten him or her into purchasing this useless application. Threat name: AntivirusSolution2010 The primary downloader and all dropped files are detected by VIPRE as LooksLike.Win32.Malware!D (v). Antivirus Solution 2010 install [...]
Posted in MalwareComments Off
Smart Engine
Posted on 27 October 2010.
SmartEngine is a rogue security product that pretends to find malicious code on a victim’s machine in order to frighten him or her into purchasing this useless application. This is the replacement for the SmartSecurity.FakeVimes. The SmartEngine bogus warning screen: (Click on graphic to enlarge) The warning screen claims that there is a “hidden connection.” [...]
Posted in MalwareComments Off
Beware Fake Microsoft Security Essentials (PC World)
Posted on 24 October 2010.
PC World – Microsoft Security Essentials is fake. Well, it is and it isn’t. Microsoft Security Essentials is a free antimalware protection program from Microsoft, but a new malware threat identified by security software vendor F-Secure is also masquerading as Microsoft Security Essentials. You want to avoid that one. View full post on Yahoo! News: [...]
Posted in Antivirus, Internet Security, Malware, SecurityComments Off
Facebook tackles latest privacy slip with encryption
Posted on 23 October 2010.
Facebook Thursday announced that it will start encrypting User IDs before they are transmitted to third-party Web sites. View full post on Computerworld Security News
Posted in Antivirus, Internet Security, Malware, SecurityComments Off
Beware Fake Microsoft Security Essentials
Posted on 23 October 2010.
Microsoft Security Essentials is fake. Well, it is and it isn’t. Microsoft Security Essentials is a free antimalware protection program from Microsoft, but a new malware threat identified by security software vendor F-Secure is also masquerading as Microsoft Security Essentials. You want to avoid that one. View full post on Network World on Security
Posted in Antivirus, Internet Security, Malware, SecurityComments Off
Google: Wi-Fi Sniffing Collected Whole E-Mails, URLs, Passwords
Posted on 23 October 2010.
Google on Friday said that it collected entire e-mails, URLs, and passwords when its Street View cars accidentally sniffed unencrypted Wi-Fi networks. View full post on PCMag.com Security Coverage
Posted in Antivirus, Internet Security, Malware, SecurityComments Off
Cyber Security Awarenes Month – Day 23 – The Importance of compliance, (Sat, Oct 23rd)
Posted on 23 October 2010.
We need to comply with .. is a phrase that will send quivers of fear, loathing, despair, or joy through many a security person’s body. Fear, because you have been through it before and know what is around the corner. Despair and loathing, because you are told to to the basic minimum to comply rather [...]
Posted in Antivirus, Internet Security, Malware, SecurityComments Off
