Security

Since yesterday, our lab has detected a flood of email messages that seem to contain a Microsoft Update, but it’s actually malware. We’ve seen around 3,000 in a few hours. The message is like the following: This email, which seems to have been sent by the Microsoft Support team, informs you that a new security update for Outlook/Outlook Express has been released. It’s a critical update, so it’s better to install it as soon as possible. ...

In recent weeks, various cybercrime attacks have disrupted the computer systems that allow nations to manage their national greenhouse-gas emissions quotas and their possession of carbon assets according to international agreements (the Kyoto Protocol and the European system). One quota is the right to emit the equivalent of one ton of carbon dioxide during a specified period. The initial attack targeted the Danish CO₂ quota register that was shut down on January 12. The Danish authorities took this decision after registry users received a fake email purporting to originate from the Danish Energy Agency and redirecting the recipients to a mirror site to steal their credentials. ...

We were made aware that phishing for Skype credentials is currently taking place. The link the phishing mails direct to are dangerous – they aren’t detected by any phishing filter of the popular browsers yet. One thing caught my attention. Modern browsers should support domain highlighting so that the real domain is visible when someone surfs the Internet. Like Internet Explorer 8 properly does: There you can clearly see that you are not on the Skype website, but on another domain. ...

MyPcSecure is a rogue anti-spyware application and a clone from the WiniGuard family — more of the same rebrand conveyor belt into early 2010 (clones coming thick and fast). It shows fake infections and pushes a paid unlock that does not protect the machine. Do not buy it; follow the Malware Removal guide for Windows.

LiveEnterpriseSuite is a clone of InternetAntivirusPRO. Actually, the only thing that the authors of this rogue have changed is the name in the GUI. LiveEnterpriseSuite will detect false infections and require a license to remove them. If your computer is infected with this malware, you should remove it soon, Click Here to learn how to remove such malwares.

With the latest release of their browser, v.4.0, Google has published a long expected feature: Browser Extensions. Now Chrome features what other browsers like Firefox, IE, Opera and so on offer for a long time already. But, being able to compete with the others better doesn’t mean that they have solved all problems. Actually, their problems just start to appear – because adding extensions in the browser is just the same as opening Pandora’s box. ...

Information leakage is a real problem. It’s especially bad for high-security organizations, like military agencies. And it’s now harder than ever, thanks to services such as Flickr, Photobucket, Facebook, Twitter and Myspace. So, we worked together with Lewis Communications to submit a Freedom Of Information Act request to Ministry of Defence in UK, asking if they’ve had problems with this. After waiting some weeks, we got a reply back, detailing that UK military personnel and Ministry of Defence staff have leaked secret information 16 times on social networking websites and Internet forums. ...

It has been a month since Sophos added detection for Troj/JSRedir-AK and figures generated today show that over 40% of all web-based detections have been from this malicious code. [Graph shows Malware hosted on websites from 2009-12-22 11:00:00 to 2010-01-21 11:00:00 (GMT-8)] Translating the numbers into a more human comprehensible form: 1 site every 15 secs was being detected as Troj/JSRedir-AK. The affected sites include well-known names, including: ...

APcSafe is another rogue anti-spyware clone of the WiniGuard family — part of the same revolving-door rebrand pattern documented in The biggest rogue family. Fake infection results and scare warnings push a paid unlock that does not protect the machine. Do not buy it. If it is installed, follow the Malware Removal guide for Windows.

PcsSecure is a cloned rogue antispyware from the WiniGuard family — another 2010 nameplate on the same scareware line that was already producing clones every couple of days in late 2009 (Like clockwork…). Do not license it. If the PC is infected, remove it with the Malware Removal guide for Windows.

Disguised IQ test combines virus, rootkit and worm — malicious code for one fatal formula BitDefender today identified a new e-threat that combines the destructive behavior of a virus with the spreading mechanisms of a worm. There are two known variants of this virus, which enters the computer as a harmless IQ test. Once executed, the worm creates between seven and eleven copies of itself (depending on the variant) in critical areas of the Windows system. ...

Desktop Security 2010 is a rogue antispyware program, designed to trick people into thinking it is a legitimate program. Desktop Security 2010 uses fake security warnings and system scans to frighten people into buying the software. If Desktop Security 2010 is installed on your PC, you should remove it immediately as it is a potentially dangerous computer infection. Computers that have been infected with Desktop Security 2010 may show the following symptoms: ...

I am a very lucky guy. In fact, I must be the luckiest person in the world since spammers like to send all kinds of lucky spam to me. These days, I get inundated with lucky spam. The last spam I had, I got offered a free gift card if I purchased some Viagra from them. Wow. On other days, asking me to lose my weight results in instant chances of winning a lottery at the same time and all of this is due to my lucky email address. ...

False images from Cosmopolitan infect computers with fake antivirus product BitDefender today warned of a new threat following the flood of interest in the result of the January 19th Massachusetts elections. The day after his winning Senate campaign, nude pictures of Cosmopolitan’s Sexiest Man of 1982 Scott Brown not only stirred women’s imaginations, but also got the interest of malware creators. The latter exploited the news to spread a fake antivirus: Trojan.FakeAV.XP. Instead of spicy pictures, the targeted user received messages of false infections on their computer and prompts to buy a fake antivirus product. ...

Some questionable sites associated with the Winigard family of rogue security products pulls it from this location, which appears to belong to a graphic designer in Canada. It’s funny and here’s waaaay too much truth there: