Malware

Microsoft Malware Protection Center: We’ve had reports of a new worm in the wild and that generates increased RDP traffic for our users on port 3389. Although the overall numbers of computers reporting detections are low in comparison to more established malware families, the traffic it generates is noticeable. The worm is detected as Worm:Win32/Morto.A and you can see a detailed description of at http://www.microsoft.com/security/portal/Threat/Encyclopedia/Entry.aspx?Name=Worm%3aWin32%2fMorto.A. Morto attempts to compromise Remote Desktop connections in order to penetrate remote systems, by exploiting weak administrator passwords. Once a new system is compromised, it connects to a remote server in order to download additional information and update its components. It also terminates processes for locally running security applications in order to ensure its activity continues uninterrupted. Affected users should note that a reboot may be required in order to complete the cleaning process. ...

H-Online: Security specialist Sophos reports that it has discovered new spam email messages that claim to be an advisory related to an update to the open source Firefox web browser. The fake advisory asks users to update their Firefox installations, “for security reasons”, and includes a download link to the supposed update. According to Graham Cluley of Sophos, the download leads to an executable file that bundles an installer for the Windows version of Firefox 5.0.1 and a password-stealing trojan (Troj/PWS-BSF). As noted by Cluley, users should always exercise caution when clicking on links in emails. ...

This is an article posted in Google Online Security Blog, it’s about unusual traffics being sent from infected computers during search or web surfing, if you think this story applies to you too, try to clean your computers from malwares by following my manual here in my website: Malware Removal (Cross-posted from the Official Google Blog) The Internet brings remarkable benefits to society. Unfortunately, some people use it for harm and their own gain at the expense of others. We believe in the power of the web and information, and we work every day to detect potential abuse of our services and ward off attacks. ...

Sophos Labs: Repeat after me: It’s “Facebook”, not “FaceBook”. Learn that lesson and it can be one of the tricks you can use to protect yourself against a spammed-out malware campaign, which tries to trick you into believing that Facebook support has changed your password. Computer users are receiving emails claiming that the popular social network has automatically changed their password to secure their account. Here’s a typical message: ...

SophosLabs: Are you in the habit of having complete strangers email you naked pictures of themselves? That’s the only reason I can think of that you can legitimately explain why your computer has been infected by the latest malware attack that has been spammed out around the world. Users are seeing messages in their inbox, which attempt to trick recipients into opening the attached file with the promise of a nude photo. ...

SophosLabs: Criminals and scammers on Facebook aren’t resting on their laurels… in fact, they are branching out and using multiple techniques all rolled into one scam. Tonight’s blockbuster spam is taking on several guises. One version is a likejacking attack that spams your wall with the message “Dad walks in on daughter… EMBARRASING!!!” and “This really has to be an awkward moment.” They seem to be quickly rotating through a long list of Google (goo.gl) short URLs to evade detection. ...

Avira TechBlog: The malware authors every now and then send us virus researchers some messages. For example in the compiled binary itself, or as debug output. Now we found a Zbot Trojan variant which tries to evade detection by carrying a digital certificate and therewith looking more legitimate. And this certificate is registered to “DetectMe! 🙂 ”, also adding random data behind the certificate. We see hints like these regularly – malware authors proposing names for their malicious creations or suggesting a place where a signature based detection would be suitable. Of course, such hints are ignored by us for detection but make us smile for a short time. ...

Prevx Blog: In the last couple years there have been three major players who dominated the scene in the field of the kernel mode rootkit development. They are Rustock rootkit – with its latest build discovered in the wild in 2008 – MBR rootkit – firstly discovered in January 2007 – and TDL rootkit, which can be considered the most advanced kernel mode rootkit to date, able to infect both x86 and x64 versions of Windows operating system. ...

Avira TechBlog: SpyEye is a malware family which we are monitoring for some time. Today we are analyzing a sample which is detected as TR/Spy.SpyEye.flh by Avira. The Trojan is able to inject code in running processes and can perform the following functions: Capture network traffic Send and receive network packets in order to bypass application firewalls Hide and prevent access to the startup registry entry Hide and prevent access to the binary code Hide the own process on injected processes Steal information from Internet Explorer and Mozilla Firefox A detailed analysis of this malware by Liviu Serban, Virus Researcher at Avira. ...

Symantec: Only a few days ago, Japan experienced one of the worst earthquakes in its history. The earthquake registered 8.9 on the Richter scale and triggered an enormous tsunami. The heart-wrenching images on television have left the world shaken. It was the worst earthquake and tsunami in the past century and at least 50 countries have since received related tsunami warnings. As the death and injury tolls continue to rise, one must not forget those who awake to exploit such delicate situations—spammers continue to maintain the guise of charitable institutions and governmental organizations! Don’t be surprised to suddenly see an email message in your inbox marked as URGENT and pleading with you for “monitory help” [sic] or a phishing mail urging you to donate to the rehabilitation of those affected by the quake and tsunami. Use prudence in finding out the genuine intent of email senders before you reach out or respond. ...

BetaNews.com: Android handsets infected with malware are getting a cleaning job from Google. On March 2nd, Google removed 21 apps from the Android Marketplace that contained malicious code (the number of infected apps is now 58). Now Google is “remotely removing the malicious applications from affected devices” and “pushing an Android Market security update to all affected devices that undoes the exploits to prevent the attacker(s) from accessing any more information from affected devices,” according to a blog post by Rich Cannings, Android security lead. ...

Over the past few decades, computer security has become an important concern among users. Security vendors have faced tremendous challenges dealing with complex security threats with IT experts placing more effort on educating people. Nevertheless, there are many computer security myths that exist today and surprisingly, many people still believe them. In this blog post, we’ll reveal a few of the most common malware myths and the misconceptions that can put you at risk. ...

To help secure your computer against malware: If your computer is already infected or you are in doubt, first look at the Malware Removal Guide. Build up your malware defenses Install antivirus and antispyware programs from a trusted source Never download anything in response to a warning from a program you didn’t install or don’t recognize that claims to protect your PC or offers to remove viruses. It is highly likely to do the opposite. Get reputable anti-malware programs from a vendor you trust. I recommend Avira. It’s highly recommended that you create another layer of protection beyond Avira. This second layer could be composed with Malwarebytes’ Anti-Malware, Hitman Pro or any other on-demand antimalware software. Use a safe browser with good extensions I recommend Google Chrome with uBlock and WOT. Update software regularly Cybercriminals are endlessly inventive in their efforts to exploit vulnerabilities in software, and many software companies work tirelessly to combat these threats. That is why you should: ...

If after following this guide you failed disinfecting your computer, or you cannot follow this guide yourself, I will be available to help you. The most important thing in fighting malwares is: Do NOT Panic. Do NOT Hurry. Do NOT ignore any step in removal guide unless I tell you. This manual for removing malwares can be used for either minor or major malware infection. Download and Burn Avira Rescue System to a blank Disc, Boot your computer using that and let it scan and remove malwares detected. Restart your computer into safe-mode with networking. (How to use Safe Mode?) Clean temporary files using TFC. [Let it reboot your computer, come back to Safe Mode With Networking] Download HitmanPro to your desktop, run it in force breach mode and click next to scan your computer, let it remove the malwares it find, if it ask you for license active the 30 Days trial version. after removal, restart your computer. [Try it in Safe Mode With Networking] Download, install and update Malwarebytes Antimalware, let it scan your computer and remove everything it find [Try in Safe Mode With Networking]. Download and run avast! Browser Cleanup to cleanup and reset your browsers. Download and install HostsMan. after install run it, click on “update Hosts”, choose “MVPS Hosts” (and you may choose “Peter Lowe’s AdServers List” for blocking Ads) and in below options choose “Overwrite Current” hosts. this step would immunize your Hosts File and would prevent any internet traffic to malware sites/domains and also would fix Windows Hosts File if it has been HiJacked by malwares. Disable System Restore and then re-enable it again. If you have windows installation disc, insert it into drive, open Run command from start menu (In windows vista/7, open start menu and type ‘Run’ and then press enter) and type ‘sfc /scannow’. this will check windows for mission or corrupted files and will restore them from disc. sometimes during getting infection or malware removal some files might get corrupted or being deleted which this action will solve it. Make sure your windows and all installed programs are fully updated and there are no insecure program: Check for Update. also you may do some additional scans too, here is some of them: ...

Symantec Connect: WikiLeaks.org is in the news after their recent publications linked to leaked government documents. Spammers are now leveraging the current level of interest with social engineering techniques to infect users’ computers. Symantec is observing a wave of spam spoofing WikiLeaks to lure users into becoming infected with a new threat. The spam email has subject line “IRAN Nuclear BOMB!” and spoofed headers. The “From” header purports to originate from WikiLeaks.org, although this is not in fact the case, and the message body contains a URL. This URL downloads and runs WikiLeaks.jar which has a downloader ‘WikiLeaks.class’ file. The downloader pulls the threat from http://ugo.file[removed].com/226.exe. Symantec detects this threat as W32.Spyrat. ...