Malware Calendar Wallpaper for February 2011 [updated]

In January we published the first of our malware wallpaper calendars. Here's the latest wallpaper.

1280x800 | 1680x1050 | 1920x1200 | 2560x1600

Hopefully you'll find it eye-catching and it gives you the chance to see at-a-glance some of the significant malware-related events from the past.

free spyware and malware removal spyware and malware removal spyware malware remover

MSRT Tackles Fake Microsoft Security Essentials

We've seen a few rogue security programs use elements of legitimate security software in order to try to make themselves appear more authentic. It was inevitable that Microsoft Security Essentials would be the target of this kind mimicry. While some rogues have simply copied Security Essentials' name, others have gone further by imitating elements of the Security Essentials user interface. By far the most prevalent of these is Win32/FakePAV, which is this month's addition to the MSRT family list.

When FakePAV sees an attempt to run certain programs, it displays a fake Security Essentials alert dialog.

At first glance, there is very little that differentiates this from a real Security Essentials alert, beyond the bogus malware name ("Unknown Win32/Trojan"). You can close the window, but in a crude attempt to emulate the behavior of real-time malware blocking, FakePAV also terminates the program that it reports as a threat. This effectively means you can't run programs in FakePAV's kill list, including Internet Explorer and other common web browsers. This kind of technique has become extremely popular with rogues and serves the dual purpose of making the claims of infection more convincing and making the machine harder to use without registering the rogue.

Predictably, FakePAV's behavior differs greatly from Security Essentials' when you ask it to clean what it has found. FakePAV claims that it can't remove the threat and prompts you to "scan online".

It then pretends to scan the file again. Earlier variants of FakePAV would display bogus results from a list of anti-virus scanners, including legitimate ones, but invariably only five fictional scanners were reported to actually detect the threat:

• Red Cross Antivirus
• Peak Protection 2010
• Pest Detector 4.1
• Major Defense Kit
• AntiSpy Safeguard

The rogue would even go as far as to display a different GUI depending on which "scanner" you chose to install. Current variants of FakePAV don't even provide the illusion of choice. They claim that you need to install AV software and that "ThinkPoint" will be installed as soon as the machine is rebooted.

By this point the rogue has replaced explorer.exe as the machine's default shell, which means after reboot you see the rogue's "ThinkPoint" GUI instead of your desktop, taskbar and start menu. From here the experience is similar to most other rogues, with "ThinkPoint" pretending to run its own scan before reporting multiple threats that you need to buy the full version of the scanner to remove.

The affected machine is now even more difficult to use; in addition to stopping explorer.exe from running, it terminates task manager, leaving no easy way to run any other programs. If your computer has been infected by Win32/FakePAV, you can terminate it's process by following these instructions.

Win32/FakePAV has only been around since August, but it has already become prevalent through typical rogue distribution methods, including search engine optimization (SEO), malicious ads and installation by other malware such as Win32/Harnig. Several elements of the rogue's modi operandi indicate that it was produced by the same group that produced Win32/PrivacyCenter. At this stage the rogue method for making money is pretty well established; imitating Microsoft Security Essentials is an example of the kind of slow evolution we are seeing as rogue makers try to convince more people to pay in the hope that it will make their computer behave normally again.

If in doubt, you can get the real Microsoft Security Essentials from http://www.microsoft.com/security_essentials/. And remember that it’s free for genuine Windows users and offers comprehensive malware protection; it won’t upsell you.

-- Hamish O'Dea

fix my computer pc repair software fix pc errors free download

Targeted attacks against recently addressed Microsoft Office vulnerability (CVE-2010-3333/MS10-087)

Last November, Microsoft released security bulletin MS10-087, which addresses a number of critical vulnerabilities in how Microsoft Office parses various office file formats. One of them is CVE-2010-3333, "RTF Stack Buffer Overflow Vulnerability," which could lead to remote code execution via specially crafted RTF data. A few days before Christmas, we received a new sample (sha1: cc47a73118c51b0d32fd88d48863afb1af7b2578) that reliably exploits this vulnerability and is able to execute malicious shellcode which downloads other malware.

The vulnerability can be triggered by utilizing a specially crafted RTF file with a size parameter that is bigger than the expected one. The vulnerability is present in Microsoft Word. It attempts to copy RTF data to the stack memory without validating the size, which will lead to overwriting the stack. 

Figure 1.10 

After executing the code in figure 1.10, the stack memory is overwritten by first part of the shellcode. The challenge for the exploit writer here is to make sure that the shellcode gets control and is executed. In this sample, one of the return addresses was overwritten by another address, which can be found in any known DLL loaded in the memory. That address contains a single piece of code, “Jmp ESP”, that  transfer the control to the stack memory containing our first shellcode.

Let's take a look at the first shellcode: 

Figure 1.20 

The code above uses a brute-force method to find the second shellcode entry-point by searching for the string "pingping" starting from hardcoded address 0x500000. To avoid causing exceptions while parsing these memory pages, it checks if the page is accessible by calling NtAccessCheckAndAuditAlarm() via Int 2Eh - passing EAX = 2h (NtAccessCheckAndAuditAlarm system call ordinal) and passing the page address in EDX. It returns STATUS_ACCESS_VIOLATION to EAX if the page is not accessible. 

The second shellcode starts by decrypting the rest of the codes and string using a XOR operation with constant keys. It retrieves the address of the needed APIs, downloads the malware from a remote location, and then executes it. In our sample, it attempts to download a file named svchost.exe and saves it as <system folder>\a.exe (detected as Trojan:Win32/Turkojan.C). 

Microsoft detects this exploit as Exploit:Win32/CVE-2010-3333.

We recommend customers that have not yet installed the security update MS10-087 to do so at their earliest convenience.

For reference, here’s a list of some SHA1s we’ve seen related to these targeted attacks:

• 00d9af54c5465c28b8c7a917c9a1b1c797b284ab
• 24ee459425020ea61a10080f867529ea241c51dc
• 2e6abd663337c76379ae26b8aa6cf4db98137b64
• 77637eccf9011d420cccc520bcb3ed0cf907dc00
• CC47A73118C51B0D32FD88D48863AFB1AF7B2578

-- Rodel Finones

spyware malware removal spyware malware spyware adware malware

Re: What?s new in Norton 2011

Hello Tomas

�

You should be able to turn off auto renewal in mynortonaccount.. I would contact customer support if it just auto renewed if you want to use NIS 2011. NIS is more tweakable than N360 is and the newer engines come out sooner for NIS than for N360.

�

http://us.norton.com/support/contact/contact.jsp?pvid=cs

This is the link for US/Can. If you need a different location, please consult your local Symantec site for the local free chat customer support link.

spyware malware spyware adware malware spyware malware adware

Surveys and free VPNs: an odd combination

malware removal tool free spyware malware removal free malware

Can Google weed out the content farms?

how to fix error fixing runtime errors free fix registry errors

Targeted attacks against recently addressed Microsoft Office vulnerability (CVE-2010-3333/MS10-087)

Last November, Microsoft released security bulletin MS10-087, which addresses a number of critical vulnerabilities in how Microsoft Office parses various office file formats. One of them is CVE-2010-3333, "RTF Stack Buffer Overflow Vulnerability," which could lead to remote code execution via specially crafted RTF data. A few days before Christmas, we received a new sample (sha1: cc47a73118c51b0d32fd88d48863afb1af7b2578) that reliably exploits this vulnerability and is able to execute malicious shellcode which downloads other malware.

The vulnerability can be triggered by utilizing a specially crafted RTF file with a size parameter that is bigger than the expected one. The vulnerability is present in Microsoft Word. It attempts to copy RTF data to the stack memory without validating the size, which will lead to overwriting the stack. 

Figure 1.10 

After executing the code in figure 1.10, the stack memory is overwritten by first part of the shellcode. The challenge for the exploit writer here is to make sure that the shellcode gets control and is executed. In this sample, one of the return addresses was overwritten by another address, which can be found in any known DLL loaded in the memory. That address contains a single piece of code, “Jmp ESP”, that  transfer the control to the stack memory containing our first shellcode.

Let's take a look at the first shellcode: 

Figure 1.20 

The code above uses a brute-force method to find the second shellcode entry-point by searching for the string "pingping" starting from hardcoded address 0x500000. To avoid causing exceptions while parsing these memory pages, it checks if the page is accessible by calling NtAccessCheckAndAuditAlarm() via Int 2Eh - passing EAX = 2h (NtAccessCheckAndAuditAlarm system call ordinal) and passing the page address in EDX. It returns STATUS_ACCESS_VIOLATION to EAX if the page is not accessible. 

The second shellcode starts by decrypting the rest of the codes and string using a XOR operation with constant keys. It retrieves the address of the needed APIs, downloads the malware from a remote location, and then executes it. In our sample, it attempts to download a file named svchost.exe and saves it as <system folder>\a.exe (detected as Trojan:Win32/Turkojan.C). 

Microsoft detects this exploit as Exploit:Win32/CVE-2010-3333.

We recommend customers that have not yet installed the security update MS10-087 to do so at their earliest convenience.

For reference, here’s a list of some SHA1s we’ve seen related to these targeted attacks:

• 00d9af54c5465c28b8c7a917c9a1b1c797b284ab
• 24ee459425020ea61a10080f867529ea241c51dc
• 2e6abd663337c76379ae26b8aa6cf4db98137b64
• 77637eccf9011d420cccc520bcb3ed0cf907dc00
• CC47A73118C51B0D32FD88D48863AFB1AF7B2578

-- Rodel Finones

fix error software free fix runtime error fix error messages

FakeSysdef: We can defragment that for you wholesale! / Diary of a scamware

Initially it was "System Defragmenter", then "Scan Disk" and now it's called "Check Disk". While the name will most certainly change again, the main goal of Trojan:Win32/FakeSysdef will surely remain the same: to trick you into buying a piece of software that does nothing except scare you with fake warnings, critical "errors" and other "problems".

As the name suggests, this malware imitates a hard disk defragmenter. It will pretend to scan your computer for problems such as: it "checks" if your hard disk is working correctly, "defragments" it, and even checks the health status of your RAM and GPU (Graphic Processor Unit). Of course, once you start checking for problems using this 'program' it is going to ?find? a bucketful of them:

• Bad sectors
• RAM fragmentation
• Registry errors
• Very high CPU/GPU temperature
• RAM failures

Image 1 ? ?System Defragmenter? iteration of FakeSysdef

 

Apparently all those problems can be resolved by just running the "defragmentation" function on your hard drive; unfortunately that component is not "enabled" and to enable it you need to buy the full version of the product. You kind of expected that right?

If you choose not to buy the product, it will just stay in your status bar and will remind you every few minutes that your computer has problems that should be fixed.

Even though this malware is relatively new (only appeared 2 months ago) it has already passed through various iterations.

We encountered the first sample on the 6th of October 2010; it came disguised as a fake Windows update which required the user to enter his user name and password in order to apply the security patches. The author even went to the point of translating the fake update messages in French, German, Spanish, and Italian in an attempt to appear as authentic as possible when running on a computer not running an English version of Windows. Once given the information, it installed the fake defragmenter program and errors started pouring in.

At this point the installer malware came in an unprotected form: no actions were taken in order to evade antivirus detections, no code obfuscation applied to make analysis more difficult. This makes us think it was a trial run, made just to test the waters to see how it handled once in the wild.

Image 2 - "Windows Update" installer for FakeSysdef

 

We spotted a new variant on the 10th of October 2010; it had the same icon as Windows Update but no Windows Update message was shown. The malicious code was installed silently and ran in the background until the user tried launching an application at which point a "system error" occurred. The approach evolved at this point:

Image 3 - "System Error!" message displayed by FakeSysdef

 

1. Authors decided to be less obvious: since an advanced user would get suspicious if a new application started scanning for problems all of a sudden, now the malware changed so that it waits for user interaction.
2. The Defragmenter is hidden under multiple layers generated by 2 executable protectors/packers ("Stealth PE" and a custom packer encountered in other malware) to make detection and analysis more difficult. Fortunately we easily bypass this technique in our products.
3. The malware now deletes its original binary showing the intent of the authors to hide their tracks.

On the 27th of October we saw another version. It was distributed standalone and used stolen file information and the icon from the file utilman.exe, which is present in Windows XP. This seems to be a major update where they tried to improve the resistance to analysis tools and AV products:

1. The file won't run in a virtualised environment; and
2. The file is protected with a custom-made packer only which employs anti-emulation code to stop AV products from analysing the file.

On the 15th November a minor update was released. The software used the name "Scan Disk" probably due to the attention it slowly started getting. Again they invested heavily in code to fight AV detection. They reverted to the original defragmenter icon and to the original behaviour of showing the interface scanning for errors.

Image 4 - "Scan Disk" iteration of FakeSysdef

 

On 21 November a new version was released. The current move was to switch the name to "Check Disk", which has a familiar sound to the pronunciation of a legitimate Windows tool named ?chkdsk.exe? (?chkdsk.exe? is used to legitimately identify and correct various problems of the hard drives). This was a move clearly directed at fooling inexperienced users. The code was also updated to evade antivirus detection. Fortunately our products, such as Microsoft Security Essentials, can detect all these versions.

Image 5 - "Check Disk" iteration of FakeSysdef

 

We are sure we'll be seeing more changes from Trojan:Win32/Fakesysdef in the future, changes that we will closely monitor and detect to protect our users.

 

Below are example SHA1 hashes for the malware discussed in this blog:

cadacb248411c287822b2b09d6fff301a0f294a8
5a69f5fa043d2f5141226d10cb67d6d2a2d59f4a
d7195878d15c0e294101c5385b402b75885216f8

While writing this blog, a new version of the malware was encountered, ?Win HDD? with the following SHA1:

1905DE84FBA23A9152317A7F7C0BE7D1B3F07D70

 

Daniel Radu & Marian Radu
MMPC Dublin

spyware adware malware remover anti spyware free malware and spyware

TDL4 exploits Windows Task Scheduler flaw

Next tuesday will be the Microsoft patch day and Microsoft is going to release 17 updates which will address 40 flaws, fixing among all two critical vulnerabilites that allow remote code execution and four elevation of privileges vulnerabilities.

One of the elevation of privileges flaws which is going to be addressed is the one related to the last 0day exploit left still opened and used by the Stuxnet malware. The flaw has been already publically disclosed and relative proof of concept exploit has been released online in November, opening the door for malicious activities. This flaw is officially known to Microsoft since September.

It has become so trivial to exploit this flaw that the authors of the TDL rootkit started using it to avoid limited account and UAC-protected account limitations. As our readers may remember, we already talked about TDL rootkit many times here in our blog as the most advanced rootkit in the wild at the moment, and after this last update we can assume their authors are still pretty active in developing the malware.

The biggest obstacle that TDL rootkit could run into was running in a limited account or in a UAC-protected account because it didn't have the needed privileges to load its own kernel mode driver or to overwrite the MBR. In fact, the rootkit was previously able to infect Windows operating system only after the user had given administrative privileges to it (we are assuming that the user is logged in a limited account or in an account protected by UAC).

Now, by using the Windows Task Scheduler exploit the rootkit is fully able to infect the system without any visual warning that could alert the user. We have found the rootkit being dropped by exploit kits on compromised websites as well as usual vectors like cracks and warez websites.

After the dropper is executed, it tries at the beginning to load its own driver by using the old well-known AddPrintProvidor trick to avoid detection by some of classic HIPS software. If it gets back an ERROR_ACCESS_DENIED status, then the dropper assumes it has been run in a limited account and sets up all the needed stuff to exploit the Windows Task Scheduler CVE-2010-3888 vulnerability. TaskEng.exe, the Windows Task Manager Engine, will then execute the dropper again with SYSTEM privileges.

Beside that, there isn't any major change to the rootkit code itself. The TDL4 kernel mode component has been updated to version 0.03 earlier last month. This update added the filtering by the rootkit of the ATA Pass Through commands, which was one of the last available ways to bypass rootkit filtering engine in user mode - SCSI Pass Through commands were filtered by the rootkit since version 3.273 of previous TDL3 release.

Still the rootkit is able to hit x64 versions of Windows operating systems by overwriting the MBR with its own loader. As we already wrote in a previous blog post, the rootkit patches the MBR and restart the system to immediately get the control of the system startup routine. It then patches the Boot Configuration Data to disable Windows Driver Code Signing check.

To do that it sets up its own Int13h handler and intercepts the reading of the BCD data looking for the BcdLibraryBoolean_EmsEnabled element; when found it is swapped to BcdOSLoaderBoolean_WinPEMode. Windows is then booted in WinPE mode, thus the driver signing check is disabled. The rootkit is free to load its own kernel mode driver. Then the rootkit Int13h handler intercepts the /MININT string and swaps it to IN/MINT, so that Windows does not recognize the bootup parameter and resumes the normal Windows startup.

The rootkit loads at very early stage of the bootup process a fake copy of kdcom.dll which exports a patched copy of the APIs used by the Windows internal debugger - KdD0Transition, KdD3Transition, KdDebuggerInitialize0, KdDebuggerInitialize1, KdReceivePacket, KdRestore, KdSave, KdSendPacket. This prevents the operating system from starting up if it's set in debug mode.

We strongly encourage all users to run Windows Update on Tuesday and fix once and for all this vulnerability already known for three months.

spyware adware malware remover anti spyware free malware and spyware

Re: What?s new in Norton 2011

I would like to know why Norton 360 dont have some of these as nis or nav 2011.� Norton 360 is all in one.� What would be better to use. I had thought about using norton 2011 but has automatically renewed.

�

Thanks

Tomas01

remove malware what is spyware and malware malware remover

Patch Tuesday (Microsoft and Adobe) coming next week

fix runtime error free pc problem fix pc problems

Here You Have. ? An analysis

In the security and malware research space, every now and then there comes something which suddenly becomes widespread and raises eyebrows all around. The latest ?Here You have? related worm is one such incident and we thought to share with end-users our findings and also make them aware of its capabilities and technicalities. Emsisoft Anti-Malware [...]

free pc fix free pc repair pc fixer

Highly advanced worm for sabotage nuclear facilities

A few days ago, it was reported that�Stuxnet attacked Heysham Power Station, a nuclear power station in UK. One of two reactors at Heysham 1, owned by the French energy company, EDF. However, as quoted from TheRegister, an EDF spokesperson said ?I can confirm that on Heysham 1 there is no Siemens S7 equipment in [...]

anti malware remove malware what is spyware and malware

Re: Computer held hostage? Try Norton Power Eraser

I cannot uninstall or delete Mighty Magoo from my computer.� Will Norton Power Eraser resolve this problem for me?

malware removal tool free spyware malware removal free malware

Nigerian scam email claims to be from the FBI

fixing pc errors fix windows errors fix error

Re: Norton Browser Protection: Protecting you from web attacks

Has anyone had any problems from something called AV8 .� I did not download it, but there it was on the desktop.� I did not open it, but then made the mistake of clicking on uninstall.� I have yet to recover the computer.� It restarts over and over.� You can't even shut it down properly.� I am at a loss as to what to do.

fix errors on my computer windows fix errors fixing computer errors

Definition file update for Ad-Aware.

149.608 is now available, new definition file for Ad-Aware 8.2.

150.293 is now available, new definition file for Ad-Aware 9.x, 8.3.

New definitions:
====================
Win32.TrojanPWS.Rebnip


Updated definitions:
====================
BAT.Trojan.Agent
BAT.Trojan.KeyboardDisable
BAT.Trojandownloader.Agent
JS.Trojan.Agent
JS.Trojan.Runner
MSIL.Backdoor.Vkont
MSIL.Trojan.Agent
MSIL.Trojan.Inject
MSIL.TrojanDownloader.Agent
MSIL.TrojanDropper.Agent
MSIL.TrojanDropper.StubRC
MSIL.TrojanSpy.Agent
MSIL.TrojanSpy.KeyLogger
MSIL.TrojanSpy.Zbot
NSIS.Trojan.StartPage
NSIS.TrojanDownloader.Fraudload
VBS.TrojanDownloader.Fraudload
Win32.Adware.AdRotator
Win32.Adware.Admoke
Win32.Adware.Adnur
Win32.Adware.BHO
Win32.Adware.Delf
Win32.Adware.EzuLa
Win32.Adware.FLVTube
Win32.Adware.Gaba
Win32.Adware.Gamevance
Win32.Adware.Gator
Win32.Adware.SuperJuan
Win32.Adware.ZenoSearch
Win32.Adware.Zwangi
Win32.Backdoor.Agent
Win32.Backdoor.Banito
Win32.Backdoor.Bifrose
Win32.Backdoor.BlackHole
Win32.Backdoor.Bredavi
Win32.Backdoor.Bredolab
Win32.Backdoor.Cetorp
Win32.Backdoor.Cindyc
Win32.Backdoor.Delf
Win32.Backdoor.DsBot
Win32.Backdoor.Flyagent
Win32.Backdoor.Gbot
Win32.Backdoor.Gobot
Win32.Backdoor.Hackdoor
Win32.Backdoor.HttpBot
Win32.Backdoor.Hupigon
Win32.Backdoor.IRCBot
Win32.Backdoor.Inject
Win32.Backdoor.Ircnite
Win32.Backdoor.Jewdo
Win32.Backdoor.Koutodoor
Win32.Backdoor.Lolbot
Win32.Backdoor.Mesub
Win32.Backdoor.Nbdd
Win32.Backdoor.Nepoe
Win32.Backdoor.Nihem
Win32.Backdoor.Papras
Win32.Backdoor.Poison
Win32.Backdoor.PoisonIvy
Win32.Backdoor.Prorat
Win32.Backdoor.Prosti
Win32.Backdoor.Protux
Win32.Backdoor.RBot
Win32.Backdoor.RShot
Win32.Backdoor.Ripinip
Win32.Backdoor.Rukap
Win32.Backdoor.SDBot
Win32.Backdoor.Shiz
Win32.Backdoor.Smabo
Win32.Backdoor.Spammy
Win32.Backdoor.SpyNet
Win32.Backdoor.TDSS
Win32.Backdoor.Turkojan
Win32.Backdoor.Udr
Win32.Backdoor.Ulrbot
Win32.Backdoor.VB
Win32.Backdoor.VanBot
Win32.Backdoor.WinUoj
Win32.Backdoor.Wuca
Win32.Backdoor.Yobdam
Win32.Backdoor.Yoddos
Win32.Backdoor.Zzslash
Win32.Dialer.Capredeam
Win32.Dialer.Egroupdial
Win32.Dialer.Small
Win32.FraudTool.AntiMalwarePRO
Win32.FraudTool.PrivacyCenter
Win32.Hoax.ArchSMS
Win32.Hoax.Badjoke
Win32.IMFlooder.VB
Win32.IMWorm.Ckbface
Win32.IMWorm.Yahos
Win32.IRCWorm.Small
Win32.Monitor.ActiveKeyLogger
Win32.Monitor.Agent
Win32.Monitor.Ardamax
Win32.Monitor.Msndetect
Win32.Monitor.PowerSpy
Win32.Monitor.RevealerKeylogger
Win32.Monitor.SuperSpy
Win32.P2PWorm.Bacteraloh
Win32.P2PWorm.Palevo
Win32.P2PWorm.Polip
Win32.P2PWorm.VB
Win32.Rootkit.Agent
Win32.Rootkit.Goodkit
Win32.Rootkit.Qhost
Win32.Rootkit.TDSS
Win32.Rootkit.Tent
Win32.Toolbar.Agent
Win32.Trojan.Agent
Win32.Trojan.Agent2
Win32.Trojan.Antavmu
Win32.Trojan.AntiAV
Win32.Trojan.BHO
Win32.Trojan.BHOLamp
Win32.Trojan.Buzus
Win32.Trojan.Cdur
Win32.Trojan.Chifrax
Win32.Trojan.Cosmu
Win32.Trojan.Cospet
Win32.Trojan.Delf
Win32.Trojan.Dialer
Win32.Trojan.Diple
Win32.Trojan.FakeAV
Win32.Trojan.Fakedefrag
Win32.Trojan.Fraudpack
Win32.Trojan.Gabba
Win32.Trojan.Genome
Win32.Trojan.Gibi
Win32.Trojan.Hrup
Win32.Trojan.Inject
Win32.Trojan.Jorik
Win32.Trojan.KillAV
Win32.Trojan.Koblu
Win32.Trojan.Llac
Win32.Trojan.Loader
Win32.Trojan.LowZones
Win32.Trojan.Mahato
Win32.Trojan.Maudi
Win32.Trojan.Menti
Win32.Trojan.Midgare
Win32.Trojan.Miser
Win32.Trojan.Monder
Win32.Trojan.Oficla
Win32.Trojan.Oner
Win32.Trojan.PMax
Win32.Trojan.Pakes
Win32.Trojan.Pakun
Win32.Trojan.Pasta
Win32.Trojan.Pincav
Win32.Trojan.Pirminay
Win32.Trojan.Plapon
Win32.Trojan.Powp
Win32.Trojan.Qhost
Win32.Trojan.Redosdru
Win32.Trojan.Refroso
Win32.Trojan.Regrun
Win32.Trojan.Riner
Win32.Trojan.Sasfis
Win32.Trojan.Scar
Win32.Trojan.Searches
Win32.Trojan.Sefnit
Win32.Trojan.Sharer
Win32.Trojan.Shutdowner
Win32.Trojan.Siscos
Win32.Trojan.Small
Win32.Trojan.Smardf
Win32.Trojan.StartPage
Win32.Trojan.Starter
Win32.Trojan.Swisyn
Win32.Trojan.Tdss
Win32.Trojan.VB
Win32.Trojan.Vapsup
Win32.Trojan.Vbkrypt
Win32.Trojan.Vilsel
Win32.Trojan.Webprefix
Win32.Trojan.Workir
Win32.Trojan.Xih
Win32.Trojan.Zapchast
Win32.TrojanClicker.Cycler
Win32.TrojanClicker.Small
Win32.TrojanClicker.VB
Win32.TrojanClicker.VBiframe
Win32.TrojanClicker.Vesloruki
Win32.TrojanDownloader.Adload
Win32.TrojanDownloader.Agent
Win32.TrojanDownloader.Autoit
Win32.TrojanDownloader.Banload
Win32.TrojanDownloader.Cafys
Win32.TrojanDownloader.Calper
Win32.TrojanDownloader.CodecPack
Win32.TrojanDownloader.DNSKrab
Win32.TrojanDownloader.Delf
Win32.TrojanDownloader.Fosniw
Win32.TrojanDownloader.Fraudload
Win32.TrojanDownloader.Genome
Win32.TrojanDownloader.Geral
Win32.TrojanDownloader.ISTBar
Win32.TrojanDownloader.Icehart
Win32.TrojanDownloader.Keenval
Win32.TrojanDownloader.Kido
Win32.TrojanDownloader.Laconic
Win32.TrojanDownloader.Mabu
Win32.TrojanDownloader.Mufanom
Win32.TrojanDownloader.Murlo
Win32.TrojanDownloader.Myxa
Win32.TrojanDownloader.NSIS
Win32.TrojanDownloader.Nekill
Win32.TrojanDownloader.Pebox
Win32.TrojanDownloader.Pher
Win32.TrojanDownloader.Piker
Win32.TrojanDownloader.Qhost
Win32.TrojanDownloader.Small
Win32.TrojanDownloader.Suurch
Win32.TrojanDownloader.Tolsty
Win32.TrojanDownloader.VB
Win32.TrojanDownloader.Zlob
Win32.TrojanDropper.Agent
Win32.TrojanDropper.Binder
Win32.TrojanDropper.Bonys
Win32.TrojanDropper.Cadro
Win32.TrojanDropper.Chek
Win32.TrojanDropper.Clons
Win32.TrojanDropper.Drooptroop
Win32.TrojanDropper.Drostuh
Win32.TrojanDropper.Ekafod
Win32.TrojanDropper.Fraudrop
Win32.TrojanDropper.Hdrop
Win32.TrojanDropper.Javdrop
Win32.TrojanDropper.Microjoin
Win32.TrojanDropper.MuDrop
Win32.TrojanDropper.NSIS
Win32.TrojanDropper.Renum
Win32.TrojanDropper.Small
Win32.TrojanDropper.Stabs
Win32.TrojanDropper.Startpage
Win32.TrojanDropper.TDSS
Win32.TrojanDropper.Typic
Win32.TrojanDropper.VB
Win32.TrojanDropper.Vedio
Win32.TrojanPWS.Agent
Win32.TrojanPWS.Bjlog
Win32.TrojanPWS.Coced
Win32.TrojanPWS.Delf
Win32.TrojanPWS.Dybalom
Win32.TrojanPWS.Fakemsn
Win32.TrojanPWS.Frethoq
Win32.TrojanPWS.Kates
Win32.TrojanPWS.Kukudva
Win32.TrojanPWS.Kykymber
Win32.TrojanPWS.LdPinch
Win32.TrojanPWS.Lmir
Win32.TrojanPWS.Magania
Win32.TrojanPWS.Nilage
Win32.TrojanPWS.OnlineGames
Win32.TrojanPWS.QQPass
Win32.TrojanPWS.Qbot
Win32.TrojanPWS.Small
Win32.TrojanPWS.Taworm
Win32.TrojanPWS.Tibia
Win32.TrojanPWS.VB
Win32.TrojanPWS.Vkont
Win32.TrojanPWS.WOW
Win32.TrojanProxy.Agent
Win32.TrojanProxy.Glukelira
Win32.TrojanProxy.Pixoliz
Win32.TrojanRansom.Fakeinstaller
Win32.TrojanRansom.Gimemo
Win32.TrojanRansom.PinkBlocker
Win32.TrojanRansom.PornoBlocker
Win32.TrojanRansom.Rector
Win32.TrojanSpy.Agent
Win32.TrojanSpy.Amber
Win32.TrojanSpy.BZub
Win32.TrojanSpy.Banbra
Win32.TrojanSpy.Bancos
Win32.TrojanSpy.Banker
Win32.TrojanSpy.Banker2
Win32.TrojanSpy.Brospa
Win32.TrojanSpy.Delf
Win32.TrojanSpy.Dibik
Win32.TrojanSpy.Flystudio
Win32.TrojanSpy.Keylogger
Win32.TrojanSpy.MultiBanker
Win32.TrojanSpy.Spenir
Win32.TrojanSpy.SpyEyes
Win32.TrojanSpy.VB
Win32.TrojanSpy.Wemon
Win32.TrojanSpy.Zbot
Win32.TrojanSpy.carberp
Win32.Worm.Agent
Win32.Worm.Allaple
Win32.Worm.Antinny
Win32.Worm.AutoIt
Win32.Worm.Autorun
Win32.Worm.Banof
Win32.Worm.Basun
Win32.Worm.Brontok
Win32.Worm.Bybz
Win32.Worm.Carrier
Win32.Worm.Ckbface
Win32.Worm.Fujack
Win32.Worm.Iksmas
Win32.Worm.Joleee
Win32.Worm.Kido
Win32.Worm.Kolab
Win32.Worm.Kolabc
Win32.Worm.Koobface
Win32.Worm.Mabezat
Win32.Worm.Mydoom
Win32.Worm.Mytob
Win32.Worm.Padobot
Win32.Worm.Pinit
Win32.Worm.Qvod
Win32.Worm.Runouce
Win32.Worm.Sasser
Win32.Worm.Snfer
Win32.Worm.Sohanad
Win32.Worm.Trafaret
Win32.Worm.Trojandownloader
Win32.Worm.VB
Win32.Worm.Vbna
Win32.Worm.Viking
Win32.Worm.Warezov
Win32.Worm.Yahos
Win32.Worm.Zeroll


MD5 checksum for Ad-Aware core.aawdef is 0457c9fe276f217718e70f0963f91e30

anti spyware malware adware spyware malware free spyware and malware removal

Lab Matters: ROP Techniques in Exploit Kits

In this edition of the Lab Matters webcast, Kaspersky Lab's senior anti-malware researcher Kurt Baumgartner discusses the use of ROP (return-oriented programming) techniques in vulnerability exploit packs. Baumgartner talks about how exploit packs and infected web sites launch drive-by attacks and provides a glimpse at the obfuscation tricks used by cyber-criminals.

free spyware removal free spyware protection security tool malware

MSRT December: If it quacks like a bot, it's probably Qakbot.

This month, the MSRT team has added the Win32/Qakbot family of backdoors to its detections.  Qakbot is composed of several components, including a keylogger, a password stealer and a user-mode rootkit.  Qakbot is commonly distributed as the payload of what appear to be attacks, mainly targeted at enterprise installations.

 

Qakbot starts as a highly obfuscated JavaScript that downloads and runs an installer and user-mode rootkit.  At this point, Qakbot is hidden from the user while it downloads the rest of the Qakbot package.

 

Qakbot next gathers information and steals anything that it can find.  This includes login and password, banking information, user keystrokes and information about the local infection.  All of the gathered information is then encrypted into a custom log file, and uploaded to a remote server via FTP.

 

In addition to all of these capabilities, the Qakbot family also has the ability to update itself to make sure that it's running a recent version of the malware.

 

The Qakbot family has been getting a decent amount of press for its use in several high profile attacks.  We've been keeping close tabs on the malware, and we're happy to be adding it to MSRT this month.

 

You can do more to protect your Internet experience by running a full AV solution, such as Microsoft Security Essentials for real time protection. Download and install Microsoft Security Essentials from http://www.microsoft.com/security_essentials/.

 

Dan Kurc and Aaron Putnam

free computer repair pc error fix fix computer problem

The Fake Defragmenter Invasion

Since the beginning of its popularity in the end of October 2010; a rogue defragmenter still continues to haunt the users, which in the end of 2010 has reached 20 variants, and may still continue to rise. The author has never stopped producing new variants. As is typical of the rogue application, this rogue defragmenter [...]

fixing windows errors fix pc pc doctor

Internal needs on the black market

At the end of 2010 I noticed a big wave of recruitment spam for money mule work. Initially, the criminals used spam sent from hacked email accounts. I even got some messages like this from people I know personally:

Right after that, to speed-up the recruitment process, the messages came via Windows Live Messenger (aka MSN):

And of course, the criminals also used legitimate accounts that had been hacked to spread their messages. Finally, right before the end of the year I saw a big campaign on Facebook, especially targeting Spanish speaking communities.

But yesterday I was completely surprised when I found an advertising banner on a legitimate IT site leading to the same page - money mule recruitment.

All these developments make think there is a huge demand on the black market for money mule workers. The criminals seem to have enough stolen information like credit card PINs, as well as details for online banking accounts and payment systems. Their problem now is how to launder the money they have made. Our statistics confirm there is a clear growth in Trojan-Spy malware able to steal any kind of personal information. This includes well known Trojans like Zbot (Zeus) or SpyEye.

It’s worth remembering that money mule activity is considered illegal. Basically, if nobody wanted to launder their money, cybercriminals would find it much harder to make money from stolen account details. Everyone can contribute in their own way to the global security, not just AV and other Security companies.

fix computer problems computer problems fix my pc

Re: What's driving Norton Power Eraser?

Norton Power Eraser is very aggressive and needs to be used with care. If people would read before they act, they would know NPE itself says to use only as a last resort. Norton Antivirus should be the tool of choice, but it is not perfect and sometimes fails to fix�problems.�NPE runs more like a regestry checker or systym analysis than it does an anti virus.�NPE also allows the user to determine if they want to delete a suspicious file by giving a means to see the location, judge the�importance, and view the date of creation. If the suspicious file is in programs, root, or is a DLL file,�don't check the box.�If the creation date is older than the problem, don't check the box. NPE also takes a snapshot of your system (unless you say no) that allows the user to go to system restore�and undo harmful actions. When handled properly Norton Power Eraser is a great tool.�

pc error fix fix computer problem computer help

Watching history happen on social media

pc error repair pc troubleshooting

A few words about the HLux botnet

Today my colleague Jorge Mieres found some interesting information related to the new HLux botnet. This new worm is propagating via e-mail with a backboned administration through a crimeware pack called BOMBA. The scam messages come with a message to a fake eCard requiring installing Flash Player (an old scammers trick).

� After the infection, the newly installed malware downloads a malicious update which is detected by Kaspersky as Email-Worm.Win32.Hlux.c and establishes a connection with BOMBA’s server reporting statistics about the infection.

� Our statistics for Jan 5 show countries with the highest infection attempts are the U.S., Germany and the U.K. �

We’ll keep researching this issue and will keep you updated.

fix windows errors fix error fix errors on my pc

2011 Threats Predictions, Android Malware, and a Bit of D�j� Vu

McAfee Labs recently released our 2011 Threats Predictions. In this report we dust off the crystal ball, put on our battered Mr. Wizard hat, and speculate about potential threats for the coming year. The threats landscape changed considerably in 2010. We saw marked increases in malware sophistication and targeting as well as a continued increase Read more...

fix script errors fix runtime error free pc problem

Don?t Confuse ?Anonymous? With a Russian Gang

The recent WikiLeaks disclosure of more than 250,000 U.S. State Department diplomatic cables got people worked up. Running opposite much public opinion, the main WikiLeaks defender in the hacktivism field is the ?Anonymous? group. After earlier engaging in various cyberdemonstrations against copyright-protection societies, Anonymous is now fully involved in a battle against WikiLeaks’ censors and Read more...

fix pc error fix computer errors how to fix pc errors

A few words about the HLux botnet

Today my colleague Jorge Mieres found some interesting information related to the new HLux botnet. This new worm is propagating via e-mail with a backboned administration through a crimeware pack called BOMBA. The scam messages come with a message to a fake eCard requiring installing Flash Player (an old scammers trick).

� After the infection, the newly installed malware downloads a malicious update which is detected by Kaspersky as Email-Worm.Win32.Hlux.c and establishes a connection with BOMBA’s server reporting statistics about the infection.

� Our statistics for Jan 5 show countries with the highest infection attempts are the U.S., Germany and the U.K. �

We’ll keep researching this issue and will keep you updated.

fix pc errors free download pc errors how to fix runtime error

How to remove AntiMalware GO rogue anti-spyware

find and fix errors how to fix error fixing runtime errors

The little trick about the Startup menu

There are a lot of dirty tricks used by bad boys to fool users so let?s have a look on one of these.? You may have noticed the ?Startup? folder in the Start menu, it is designed to make things...

fix dll errors fix dll error how to fix dll errors

It?s NOT Koobface! New multi-platform infector

Facebook continues being a popular target for malware authors as we discover yet another family that uses this popular social network to propagate. The main component, which we detect as Trojan:Java/Boonana, is written in Java which gives it cross platform capability infecting Windows, Mac and Linux users.

Trojan:Java/Boonana is sent via a link to a video to Facebook users. By clicking on the link, the user will be prompted to run the application ?JPhotoAlbum?, which is a Java class inside a JAR file (JPhotoAlbum.jar SHA1: 159e6bc0616dec2062c92a7dd918c8179b2de640). Independent of browser or platform, by clicking to allow this application to run, the rest of the payload will be downloaded and executed on the computer.

The components that are subsequently downloaded are:

• cplibs.zip: utility to encrypt decrypt class files in Mac
• OSXDriverUpdates.tar: MacOS X component detected as Trojan:MacOS_X/Boonana (SHA1: 7f0f3ec0460c117e299960a47cac27c7a6d96b32)
• Nircmd.chm: utility to execute files from cmd line
• ofex.exe: keylogger component detected as TrojanSpy:Win32/Boonana.A
• pax_wintl: Java open source networking classes
• rawpct.jar: IRC plugin class possibly for propagating to IRC users as well
• rvwop.jar: Java class that contains Facebook propagating class detected as Worm:Java/Boonana.A
• siv.exe: Downloader component detected as TrojanDownloader:Win32/Boonana.A
• VFXdSys.exe: Downloader component detected as TrojanDownloader:Win32/Boonana.A
• VfxdsysAdm.exe: Downloader detected as TrojanDownloader:Win32/Boonana.A
• WinStart.exe: utility to start in hidden mode

 

 

It is worth noting that this threat family also contains malicious files targeting MacOS X.  Boonana updates multiple components of the Macintosh operating system to give root level privilege to the attacker. We detect these as Trojan:MacOS_X/Boonana.

We have detection for this from 1.93.1067.0 onwards.

Thanks to Andrei Saygo for his analysis of some of the threats in this family.

--Jaime Wong

free spyware and malware removal spyware and malware removal spyware malware remover

Unhappy New Year

Malware authors don’t miss any major event in their attempts to spread malware. Evidently, they see the upcoming New Year as yet another opportunity to get their creations into unsuspecting users' computers. We have already seen signs of malware misusing this happy event. In most cases, these are spammed emails that look like legitimate “Happy New Year” messages or “New Year”-themed greetings. 

Here is a recent example:

As you can see, the video can’t be played without, you guessed it, a fake version of Adobe’s Flash Player.  As you probably realized, this is just a trick to download something malicious, which in this case is a variant of the well-known password stealer Win32/Zbot (SHA1: 6C5B80A73B4B728D7DF8BFBB142E10A6A29A0950). Once executed, it will inject itself into the address space of explorer.exe in an attempt to bypass security. When it connects to the Internet, an alert similar to the one below may be triggered:

Another example of malware using the New Year is related to a blog post from earlier this week. One of the samples of Exploit:Win32/CVE-2010-3333 (00d9af54c5465c28b8c7a917c9a1b1c797b284ab) drops malware detected as TrojanDropper:Win32/Meciv.A and Backdoor:Win32/Meciv.A. To hide its malicious dropping activities, it also drops a clean DOC file with the following New Year's message:

The message is in Russian and means: "Dear colleagues and friends! Happy New Year!"

While the techniques are not new, the social engineering employed may actually dupe users into running these malicious programs, because the New Year passing is regarded as a happy event and people tend to see the good rather than the bad.

As usual, we suggest that you stay sharp and carefully check all links and e-mail messages containing greetings and holiday themed e-cards, especially those from strangers or entities you haven’t been in contact with.

Many thanks to our colleague Kai Yu from the Antispam team for providing us with the sample.

We warmly wish you a “Happy New Year!” and may it be malware-free!

 

Andrei Saygo && Patrik Vicol && Rodel Finones

 

free spyware and malware removal spyware and malware removal spyware malware remover

The Fake Defragmenter Invasion

Since the beginning of its popularity in the end of October 2010; a rogue defragmenter still continues to haunt the users, which in the end of 2010 has reached 20 variants, and may still continue to rise. The author has never stopped producing new variants. As is typical of the rogue application, this rogue defragmenter [...]

free spyware protection security tool malware malware removal software

Definition file update for Ad-Aware.

149.603 is now available, new definition file for Ad-Aware 8.2.

150.288 is now available, new definition file for Ad-Aware 9.x, 8.3.

New definitions:
====================


Updated definitions:
====================
BAT.TrojanSpy.Banker
MSIL.TrojanDropper.Agent
MSIL.TrojanDropper.StubRC
MSIL.TrojanSpy.Agent
Win32.Adware.AdRotator
Win32.Adware.Agent
Win32.Adware.BHO
Win32.Adware.EzuLa
Win32.Adware.VirtualBouncer
Win32.Adware.Zwangi
Win32.Backdoor.Agent
Win32.Backdoor.Bancodor
Win32.Backdoor.Bifrose
Win32.Backdoor.Hupigon
Win32.Backdoor.IRCBot
Win32.Backdoor.Mesub
Win32.Backdoor.Poison
Win32.Backdoor.Prorat
Win32.Backdoor.SDBot
Win32.Backdoor.Small
Win32.Backdoor.VB
Win32.Backdoor.WinUoj
Win32.Backdoor.mIRC-based
Win32.FraudTool.FakeAVG
Win32.Hoax.ArchSMS
Win32.IRCWorm.Small
Win32.Monitor.Ardamax
Win32.Monitor.KeyLogger
Win32.Monitor.Perflogger
Win32.Monitor.PowerSpy
Win32.P2PWorm.Palevo
Win32.P2PWorm.Polip
Win32.Rootkit.Agent
Win32.Rootkit.Zybr
Win32.Trojan.AddUser
Win32.Trojan.Agent
Win32.Trojan.Agent2
Win32.Trojan.Buzus
Win32.Trojan.Chifrax
Win32.Trojan.Cospet
Win32.Trojan.Dialer
Win32.Trojan.Diple
Win32.Trojan.Eyestye
Win32.Trojan.FakeAV
Win32.Trojan.Inject
Win32.Trojan.Krament
Win32.Trojan.Llac
Win32.Trojan.Mahato
Win32.Trojan.Midgare
Win32.Trojan.Pincav
Win32.Trojan.Plapon
Win32.Trojan.Powp
Win32.Trojan.Qhost
Win32.Trojan.Refroso
Win32.Trojan.Scar
Win32.Trojan.Shutdowner
Win32.Trojan.Staget
Win32.Trojan.Starter
Win32.Trojan.Swisyn
Win32.Trojan.Tdss
Win32.Trojan.VB
Win32.Trojan.Vbkrypt
Win32.Trojan.Vilsel
Win32.Trojan.Webprefix
Win32.TrojanClicker.Agent
Win32.TrojanClicker.VB
Win32.TrojanClicker.VBiframe
Win32.TrojanDownloader.Agent
Win32.TrojanDownloader.Banload
Win32.TrojanDownloader.BaoFa
Win32.TrojanDownloader.Calper
Win32.TrojanDownloader.CodecPack
Win32.TrojanDownloader.Delf
Win32.TrojanDownloader.Fraudload
Win32.TrojanDownloader.Geral
Win32.TrojanDownloader.Homa
Win32.TrojanDownloader.Nekill
Win32.TrojanDownloader.Pebox
Win32.TrojanDownloader.Small
Win32.TrojanDownloader.VB
Win32.TrojanDownloader.Zlob
Win32.TrojanDropper.Agent
Win32.TrojanDropper.Binder
Win32.TrojanDropper.Champ
Win32.TrojanDropper.Clons
Win32.TrojanDropper.Dorn
Win32.TrojanDropper.MuDrop
Win32.TrojanDropper.NSIS
Win32.TrojanDropper.Scheduler
Win32.TrojanDropper.Small
Win32.TrojanDropper.Stabs
Win32.TrojanDropper.VB
Win32.TrojanDropper.Vedio
Win32.TrojanPWS.Kykymber
Win32.TrojanPWS.Magania
Win32.TrojanPWS.Nilage
Win32.TrojanPWS.OnlineGames
Win32.TrojanPWS.Qbot
Win32.TrojanPWS.Taworm
Win32.TrojanRansom.PornoBlocker
Win32.TrojanSpy.Banker
Win32.TrojanSpy.Plankton
Win32.TrojanSpy.SpyEyes
Win32.Worm.Agent
Win32.Worm.Allaple
Win32.Worm.AutoIt
Win32.Worm.Autorun
Win32.Worm.Brontok
Win32.Worm.Bybz
Win32.Worm.Kido
Win32.Worm.Kolab
Win32.Worm.Mabezat
Win32.Worm.Mydoom
Win32.Worm.Mytob
Win32.Worm.Netsky
Win32.Worm.Sohanad
Win32.Worm.Trafaret
Win32.Worm.Trojandownloader
Win32.Worm.VB
Win32.Worm.Vbna
Win32.Worm.Yahos


MD5 checksum for Ad-Aware core.aawdef is 60b766675117efe4ab4811448abfa5f1

spyware removal malware removal tools remove spyware adware malware

Definition file update for Ad-Aware.

149.605 is now available, new definition file for Ad-Aware 8.2.

150.290 is now available, new definition file for Ad-Aware 9.x, 8.3.

New definitions:
====================
Win32.Backdoor.Dusta
Win32.FraudTool.JHCompany
Win32.FraudTool.JiniInfo
Win32.FraudTool.MegaAntivirus2012
Win32.FraudTool.PcCure
Win32.FraudTool.WindowsOptimalTool
Win32.Trojan.Maudi


Updated definitions:
====================
BAT.Trojan.Startpage
BAT.Trojandownloader.Agent
BAT.Trojandownloader.Small
JS.Trojan.Agent
MSIL.Trojan.Purswapper
MSIL.TrojanDownloader.Agent
MSIL.TrojanDropper.Agent
MSIL.TrojanDropper.Late
MSIL.TrojanDropper.StubRC
MSIL.TrojanPWS.Dybalom
MSIL.TrojanSpy.Agent
MSIL.TrojanSpy.KeyLogger
MSIL.TrojanSpy.Zbot
NSIS.Trojan.StartPage
RAR.Trojan.Qhost
VBS.Worm.Autorun
Win32.Adware.AdRotator
Win32.Adware.Adnur
Win32.Adware.Delf
Win32.Adware.EzuLa
Win32.Adware.Gaba
Win32.Adware.Gamevance
Win32.Adware.Reklosoft
Win32.Adware.Stud
Win32.Adware.Ubar
Win32.Adware.Zwangi
Win32.Backdoor.Agent
Win32.Backdoor.Bifrose
Win32.Backdoor.BlackHole
Win32.Backdoor.DsBot
Win32.Backdoor.Gbot
Win32.Backdoor.HttpBot
Win32.Backdoor.Hupigon
Win32.Backdoor.IRCBot
Win32.Backdoor.Kbot
Win32.Backdoor.Koutodoor
Win32.Backdoor.Mesub
Win32.Backdoor.Nbdd
Win32.Backdoor.Papras
Win32.Backdoor.Poison
Win32.Backdoor.Prosti
Win32.Backdoor.RBot
Win32.Backdoor.Ripinip
Win32.Backdoor.Rosex
Win32.Backdoor.SDBot
Win32.Backdoor.Shark
Win32.Backdoor.Shiz
Win32.Backdoor.Sinowal
Win32.Backdoor.Small
Win32.Backdoor.Turkojan
Win32.Backdoor.Udr
Win32.Backdoor.VB
Win32.Backdoor.VanBot
Win32.Backdoor.WinUoj
Win32.Backdoor.Yobdam
Win32.Flooder.Agent
Win32.FraudTool.AdwareRemover
Win32.FraudTool.BlueSolution
Win32.FraudTool.PrivacyCenter
Win32.Hoax.ArchSMS
Win32.Hoax.Badjoke
Win32.Hoax.Delf
Win32.IRCWorm.Small
Win32.Monitor.Ardamax
Win32.Monitor.KeyLogger
Win32.Monitor.MiniKeyLog
Win32.Monitor.PowerSpy
Win32.Monitor.SuperSpy
Win32.P2PWorm.Bacteraloh
Win32.P2PWorm.Palevo
Win32.P2PWorm.Polip
Win32.Rootkit.Agent
Win32.Rootkit.Bubnix
Win32.Rootkit.TDSS
Win32.Rootkit.Tent
Win32.Trojan.Agent
Win32.Trojan.Agent2
Win32.Trojan.Antavmu
Win32.Trojan.AntiAV
Win32.Trojan.AutoIT
Win32.Trojan.BHO
Win32.Trojan.Buzus
Win32.Trojan.Cosmu
Win32.Trojan.Cospet
Win32.Trojan.Cossta
Win32.Trojan.Ddox
Win32.Trojan.Delf
Win32.Trojan.Delfinject
Win32.Trojan.Diple
Win32.Trojan.Exedot
Win32.Trojan.FakeAV
Win32.Trojan.Fakedefrag
Win32.Trojan.FraudST
Win32.Trojan.Fraudpack
Win32.Trojan.Gabba
Win32.Trojan.Genome
Win32.Trojan.Inject
Win32.Trojan.Jkfg
Win32.Trojan.Jorik
Win32.Trojan.KillAV
Win32.Trojan.Larchik
Win32.Trojan.Llac
Win32.Trojan.Mahato
Win32.Trojan.Menti
Win32.Trojan.Mepaow
Win32.Trojan.Midgare
Win32.Trojan.Miser
Win32.Trojan.Monder
Win32.Trojan.Oficla
Win32.Trojan.Pakes
Win32.Trojan.Pasta
Win32.Trojan.Phak
Win32.Trojan.Pincav
Win32.Trojan.Pirminay
Win32.Trojan.Powp
Win32.Trojan.Qhost
Win32.Trojan.Redosdru
Win32.Trojan.Refroso
Win32.Trojan.Regrun
Win32.Trojan.Sadenav
Win32.Trojan.Sasfis
Win32.Trojan.Scar
Win32.Trojan.Searches
Win32.Trojan.Sefnit
Win32.Trojan.Siscos
Win32.Trojan.Skillis
Win32.Trojan.Small
Win32.Trojan.Smardf
Win32.Trojan.Staget
Win32.Trojan.StartPage
Win32.Trojan.Starter
Win32.Trojan.Stuh
Win32.Trojan.Swisyn
Win32.Trojan.Tdss
Win32.Trojan.VB
Win32.Trojan.Vaklik
Win32.Trojan.Vapsup
Win32.Trojan.Vbkrypt
Win32.Trojan.Vilsel
Win32.Trojan.Vkhost
Win32.Trojan.Webprefix
Win32.Trojan.Zapchast
Win32.Trojan.Zmunik
Win32.TrojanClicker.Delf
Win32.TrojanClicker.Refpron
Win32.TrojanClicker.VB
Win32.TrojanClicker.VBiframe
Win32.TrojanDownloader.Adload
Win32.TrojanDownloader.Agent
Win32.TrojanDownloader.Banload
Win32.TrojanDownloader.Boltolog
Win32.TrojanDownloader.Bulilit
Win32.TrojanDownloader.CodecPack
Win32.TrojanDownloader.Dluca
Win32.TrojanDownloader.Fosniw
Win32.TrojanDownloader.Fraudload
Win32.TrojanDownloader.Genome
Win32.TrojanDownloader.Geral
Win32.TrojanDownloader.Homa
Win32.TrojanDownloader.ISTBar
Win32.TrojanDownloader.Imgdrop
Win32.TrojanDownloader.Kido
Win32.TrojanDownloader.Lipler
Win32.TrojanDownloader.Mufanom
Win32.TrojanDownloader.Murlo
Win32.TrojanDownloader.Myxa
Win32.TrojanDownloader.NSIS
Win32.TrojanDownloader.Pebox
Win32.TrojanDownloader.Pher
Win32.TrojanDownloader.Qhost
Win32.TrojanDownloader.Small
Win32.TrojanDownloader.SpyAgent
Win32.TrojanDownloader.Trad
Win32.TrojanDownloader.VB
Win32.TrojanDropper.Agent
Win32.TrojanDropper.Binder
Win32.TrojanDropper.Cadro
Win32.TrojanDropper.Chek
Win32.TrojanDropper.Clons
Win32.TrojanDropper.Delf
Win32.TrojanDropper.EESbinder
Win32.TrojanDropper.Javdrop
Win32.TrojanDropper.MuDrop
Win32.TrojanDropper.NSIS
Win32.TrojanDropper.Renum
Win32.TrojanDropper.Scheduler
Win32.TrojanDropper.TDSS
Win32.TrojanDropper.VB
Win32.TrojanDropper.Yabinder
Win32.TrojanPWS.Agent
Win32.TrojanPWS.Bjlog
Win32.TrojanPWS.Dybalom
Win32.TrojanPWS.Frethoq
Win32.TrojanPWS.Kykymber
Win32.TrojanPWS.LdPinch
Win32.TrojanPWS.Magania
Win32.TrojanPWS.Mailpass
Win32.TrojanPWS.Nilage
Win32.TrojanPWS.OnlineGames
Win32.TrojanPWS.QQPass
Win32.TrojanPWS.QQRob
Win32.TrojanPWS.Qbot
Win32.TrojanPWS.Ruftar
Win32.TrojanPWS.Taworm
Win32.TrojanPWS.Vkont
Win32.TrojanPWS.WOW
Win32.TrojanPWS.WebMoner
Win32.TrojanProxy.Agent
Win32.TrojanProxy.Glukelira
Win32.TrojanProxy.Small
Win32.TrojanProxy.Wintu
Win32.TrojanRansom.Fakeinstaller
Win32.TrojanRansom.FullScreen
Win32.TrojanRansom.Gimemo
Win32.TrojanRansom.Hexzone
Win32.TrojanRansom.HmBlocker
Win32.TrojanRansom.PornoBlocker
Win32.TrojanRansom.PornoCodec
Win32.TrojanRansom.Rector
Win32.TrojanSpy.Ayolog
Win32.TrojanSpy.BZub
Win32.TrojanSpy.Banbra
Win32.TrojanSpy.Bancos
Win32.TrojanSpy.Banker
Win32.TrojanSpy.Brospa
Win32.TrojanSpy.Delf
Win32.TrojanSpy.IESpy
Win32.TrojanSpy.Keylogger
Win32.TrojanSpy.Mircspy
Win32.TrojanSpy.Montp
Win32.TrojanSpy.MultiBanker
Win32.TrojanSpy.Polyatroj
Win32.TrojanSpy.SpyEyes
Win32.TrojanSpy.Zbot
Win32.Worm.Agent
Win32.Worm.Allaple
Win32.Worm.AutoIt
Win32.Worm.Autorun
Win32.Worm.Brontok
Win32.Worm.Bybz
Win32.Worm.Carrier
Win32.Worm.Fujack
Win32.Worm.Hlux
Win32.Worm.Hteibook
Win32.Worm.Kido
Win32.Worm.Kolab
Win32.Worm.Koobface
Win32.Worm.Mabezat
Win32.Worm.Mydoom
Win32.Worm.Rokut
Win32.Worm.Sohanad
Win32.Worm.Trafaret
Win32.Worm.VB
Win32.Worm.Vbna
Win32.Worm.Viking
Win32.Worm.Yahos


MD5 checksum for Ad-Aware core.aawdef is 9d1d806044153778e5efcdcb7b00f098

fix runtime error fix errors on pc for free fix computer errors for free

Don't cash this cheque

fix registry error fix system errors fix errors free

Re: Faster, Safer Internet with Free Norton DNS

Thank you, it is really useful for me...

pc problem fix pc problems free computer repair

SpyEye, the infostealing trojan leader

Everyone is talking about the SpyEye Trojan, the info stealer malware that gained all the attention after the author of ZeuS left the underground market and sold ZeuS sources to the SpyEye team. We already wrote about SpyEye last year, when we focused on the threat claiming that it could potentially become one of the top password stealing threats. Now that the SpyEye authors have access to all of ZeuS source code, SpyEye is becoming the main kit available for sale in the underground with even more efficient coding with some additional ZeuS based technologies.

Let's have a closer look at the new variants of SpyEye.

The SpyEye dropper comes in a UPX packed executable. After unpacking the first layer, we are lucky as we could already get to the SpyEye code. Actually, we have some samples which make use of highly-obfuscated decryption code, used for a second stage decryption loop. This second stage decryption loop make uses of its own routine able to get function addresses by parsing library export tables. The function is using name hashes instead of plain-text names. The hash is calculated by an ROL/XOR loop.

After the second decryption loop was completed, we are up to the real SpyEye executable code. The Trojan is divided in a few parts: the main executable

itself is just a stub, it acts like a pre-loader. It then contains 5 resource files and an embedded executable - which is the real SpyEye code. The resource files are named C1, C2, C3, SC1, SC2.

C1 contains the basic settings of the Trojan, like the name of the folder that the Trojan needs to create along with the name of the two files that will be stored inside the folder and the mutex used to check if theinfection is already running in the system. The folder will have the hidden flag attribute set as well. C2 contains the real configuration file, called config.bin - we'll better explain it later in the blog post. C3 contains the config.bin password in plain text.

SC1 is instead a module that will be injected by the pre-loader inside explorer.exe process. This module is responsible of creating the folder and storing the Trojan dropper inside it, then it launches again the dropper from the new location and deletes the original dropper. SC2 is a module used by SpyEye pre-loader to get system information like the Windows build number, username account, Windows folder and a number of other data points.

SC1 module is injected inside the host process explorer.exe and does its job as showed above. The dropper now reloads from the right location and extracts the C3 resource file, reads the config.bin password and stores it as a local variable by calling SetEnvironmentVariableA API. This will help the Trojan in sharing the password between this pre-loader and the actual SpyEye code. Finally, the execution is passed to the embedded executable code.

Inside the real SpyEye code, the Trojan first check if the config.bin file has been already stored inside the hidden folder along with the dropper executable. If not, the config file is extracted from the C2 resource and is stored inside the folder. Then, the configuration file is decrypted by the Trojan. The encryption algorithm is not really complicated, and it's just a XOR-based loop starting from the end of the file till the beginning. Every byte is XOR'd with 0xC4 key and the result is being subtracted by the value of the byte that is located at the previous location. After the decryption, the config.bin file is just a password-protected zip archive. As mentioned above, the password is the string located inside the C3 resource.

Stored inside the configuration zip package are configuration files along with specifically chosen plugins. There could be some plugins able to make the infected PC act as a socks5 server, or credit card grabbers. There are other interesting information like the servers that are contacted by the Trojan and the HTML code that is being injected inside some specific HTML pages. This is already a feature implemented in ZeuS and has been copied out by the SpyEye authors.

After the configuration file has been decrypted and parsed, the embedded executable code injects all its code inside the explorer.exe process, and the pre-loader process terminates. The code is now active in memory and it is ready to be injected in every other running process except services.exe, smss.exe, csrss.exe and system processes.

In the targeted processes, the Trojan hooks following APIs:

CryptEncrypt, LdrLoadDll, NtEnumerateValueKey, NtQueryDirectoryFile, NtResumeThread, NtVdmControl, TranslateMessage, HttpAddRequestHeadersA, HttpOpenRequestA, HttpQueryInfoA, HttpSendRequestA, HttpSendRequestW, InternetCloseHandle, InternetQueryDataAvailable, InternetQueryOptionA,

InternetReadFile, InternetReadFileExA, InternetWriteFile.

Some newer variants of SpyEye implement a hooking engine protected by a number of watchdog threads, able to immediately restore all the Trojan hooks if they are being overwritten or deleted by security software.

The Trojan make uses of user mode rootkit techniques to hide both its registry key located inside HKEY_CURRENT_USER\SOFTWARE\Microsoft\Current Version\Run and the folder containing the Trojan executable along with the config.bin file. The folder is usually located on the root directory of the drive where the operating system is located.

Due to the way the Trojan is designed, it is perfectly able to steal sensitive data from every PC, no matter if it runs with administrative privileges or limited user account. Moreover, after the ZeuS authors resigned, SpyEye is soon to become the leading infostealing Trojan in the underground.

The increasing number of SpyEye infections we are detecting and cleaning on infected PCs tells us that SpyEye is very widespread and you should really pay attention to your computer security, even if using a limited account. Protect your web surfing experience with Prevx and SafeOnline.

free anti spyware malware spyware adware

Microsoft Patch Day: is that all?

Yesterday Microsoft released 17 security bulletins, finally fixing the last 0day flaw exploited by Stuxnet malware which had been left open up until now. In all, 7 out of 38 flaws fixed by Microsoft were already disclosed publicly and they allowed both remote code execution and elevation of privilege.

Microsoft patched some of their software which was vulnerable to the flaw disclosed in last August, relative to the insecure DLL loading exploit. We talked about this vulnerability in a specific blog post in August, where we already said this shouldn't be considered as a vulnerability of the operating system itself, but a coding error by the software developers.

Finally, Microsoft patched the long discussed and well known Windows Task Scheduler exploit used by Stuxnet malware to gain administrative privileges. With this update, all the 0day exploits used by Stuxnet have been definitely fixed.

The task scheduler exploit was known since September and a working proof of concept exploit had been released publicly in November, allowing malware writers to use it in their malware code, evading by limited account and UAC restrictions.

In a Microsoft blog post written on 9th December 2010, Mike Reavey from Microsoft Security Response Center wrote that the 0day exploit affecting the Windows Task Scheduler had not been used anywhere else aside by the Stuxnet malware. Contrary to this we have had reports of the infamous TDL4 rootkit exploiting the same flaw since first days of December 2010. We have covered this topic in a previous blog post. Anyway, now the exploit has been fixed and TDL4 will need to other ways to elevate its privileges when dropped on the victims PC.

With this massive security update Microsoft patched a lot of flaws that could be exploited by malware. Is that all? Actually not. This massive update still leaves open a security flaw that allows privilege escalation, the one we talked about in a blog post written here, relative to the win32k.sys stack overflow flaw.

This is bad, and it becomes even more dangerous due to the fact that the exploit code for this vulnerability has been already disclosed publicly. In fact we should expect malware starting to use it for malicious purpose very soon. Now that the Windows Task Scheduler flaw has been successfully closed, this other exploit will probably be in the spotlight for a while until Microsoft releases a patch for it.

Looking at malware like TDL4 rootkit, its development trend suggests that their authors will use this exploit very soon, giving again the rootkit the ability to automatically elevate its privileges and infect both x86 and x64 versions of Microsoft Windows operating system, again.

Prevx customers are already protected by this Windows 0day exploit, so are the users of Prevx free version. So, while waiting for the Microsoft patch, why don't you just give Prevx a try and stay protected from this exploit?

fix dll errors fix dll error how to fix dll errors

TDL4 exploits Windows Task Scheduler flaw

Next tuesday will be the Microsoft patch day and Microsoft is going to release 17 updates which will address 40 flaws, fixing among all two critical vulnerabilites that allow remote code execution and four elevation of privileges vulnerabilities.

One of the elevation of privileges flaws which is going to be addressed is the one related to the last 0day exploit left still opened and used by the Stuxnet malware. The flaw has been already publically disclosed and relative proof of concept exploit has been released online in November, opening the door for malicious activities. This flaw is officially known to Microsoft since September.

It has become so trivial to exploit this flaw that the authors of the TDL rootkit started using it to avoid limited account and UAC-protected account limitations. As our readers may remember, we already talked about TDL rootkit many times here in our blog as the most advanced rootkit in the wild at the moment, and after this last update we can assume their authors are still pretty active in developing the malware.

The biggest obstacle that TDL rootkit could run into was running in a limited account or in a UAC-protected account because it didn't have the needed privileges to load its own kernel mode driver or to overwrite the MBR. In fact, the rootkit was previously able to infect Windows operating system only after the user had given administrative privileges to it (we are assuming that the user is logged in a limited account or in an account protected by UAC).

Now, by using the Windows Task Scheduler exploit the rootkit is fully able to infect the system without any visual warning that could alert the user. We have found the rootkit being dropped by exploit kits on compromised websites as well as usual vectors like cracks and warez websites.

After the dropper is executed, it tries at the beginning to load its own driver by using the old well-known AddPrintProvidor trick to avoid detection by some of classic HIPS software. If it gets back an ERROR_ACCESS_DENIED status, then the dropper assumes it has been run in a limited account and sets up all the needed stuff to exploit the Windows Task Scheduler CVE-2010-3888 vulnerability. TaskEng.exe, the Windows Task Manager Engine, will then execute the dropper again with SYSTEM privileges.

Beside that, there isn't any major change to the rootkit code itself. The TDL4 kernel mode component has been updated to version 0.03 earlier last month. This update added the filtering by the rootkit of the ATA Pass Through commands, which was one of the last available ways to bypass rootkit filtering engine in user mode - SCSI Pass Through commands were filtered by the rootkit since version 3.273 of previous TDL3 release.

Still the rootkit is able to hit x64 versions of Windows operating systems by overwriting the MBR with its own loader. As we already wrote in a previous blog post, the rootkit patches the MBR and restart the system to immediately get the control of the system startup routine. It then patches the Boot Configuration Data to disable Windows Driver Code Signing check.

To do that it sets up its own Int13h handler and intercepts the reading of the BCD data looking for the BcdLibraryBoolean_EmsEnabled element; when found it is swapped to BcdOSLoaderBoolean_WinPEMode. Windows is then booted in WinPE mode, thus the driver signing check is disabled. The rootkit is free to load its own kernel mode driver. Then the rootkit Int13h handler intercepts the /MININT string and swaps it to IN/MINT, so that Windows does not recognize the bootup parameter and resumes the normal Windows startup.

The rootkit loads at very early stage of the bootup process a fake copy of kdcom.dll which exports a patched copy of the APIs used by the Windows internal debugger - KdD0Transition, KdD3Transition, KdDebuggerInitialize0, KdDebuggerInitialize1, KdReceivePacket, KdRestore, KdSave, KdSendPacket. This prevents the operating system from starting up if it's set in debug mode.

We strongly encourage all users to run Windows Update on Tuesday and fix once and for all this vulnerability already known for three months.

spyware search and destroy security tool virus removal adware spyware

Malware in the cloud

The use of all kind of services in a cloud basis is becoming more and more popular, enhancing productivity and reducing the needs of setting up a complex infrastructure. This approach is progressively being taken by IT industry. However, malware reacted faster in abusing this virtual infrastructure for its profit.

We have seen many examples in the past: the use of Twitter as a communication channel for a botnet, using Amazon EC2 for hosting C&Cs or abusing advertising channels for distributing malware. Today we will see, through a sample, how malware maximizes its revenues using this kind of services with a minimum impact on victim�s computer.

Our sample belongs to Trojan-Dropper.Win32.Drooptroop family, which has more than 7000 variants. The sample is detected by Kaspersky Internet Security as Trojan-Dropper.Win32.Drooptroop.jpa, and its peak of activity corresponds to 6^th of December, mostly based in the US.

It is being distributed through an email message with a link to a Rapidshare file:

hxxp://rapidshare.com/files/4XXXXXXX0/gift.exe

Taking advantage of the Christmas campaign, the name of the binary is gift.exe. As suspicious as it is, however, most filters fail in detecting this as malicious for two reasons: the binary is not in the body message and the domain of the URL is legitimate. We have detected more than 1000 infections were technique was used for distributing the sample.

This is not the only use of external infrastructure done by the sample. Once the computer is infected,Drooptroop.jpa injects code into spoolsv.exe and intercepts browser�s network functions, resulting in hijacking user�s requests.

Doing this, Drooptroop performs click fraud redirecting legitimate requests:

GET /click.php?c=eNXXXXXSA HTTP/1.1 Host: 64.111.xxx.xxx User-Agent: Mozilla/5.0 (Windows; U; Windows NT 5.1; es-ES; rv:1.9.2.3) Gecko/20100401 Firefox/3.6.3 Accept: text/html,applicationxhtml+xml,applicationxml;q=0.9,*/*;q=0.8 Accept-Language: es-es,es;q=0.8,en-us;q=0.5,en;q=0.3 Accept-Encoding: gzip,deflate Accept-Charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7 Keep-Alive: 115 Connection: keep-alive Referer: hxxp://wwwxxx.com/go/beXXXX4

This remuneration programs are abused on a regular basis by malware. Apart from that, this malware redirects the user to rogue AV sites:

It is interesting how everything is shown in the browser. All is javascript highly obfuscated simulating explorer, so further binaries are downloaded to the computer at the scaring phase.

At this point, you probably want to run Kaspersky Internet Security to clean your system.

Summing it up, the distribution was using a remote file sharing service, the malware used click fraud to monetize and the rogue AV was all happening in the browser. However this malware still needed to infect your computer, so don�t forget to protect yourself.

fix errors free free fix computer errors fix errors on my computer

FakeSysdef: We can defragment that for you wholesale! / Diary of a scamware

Initially it was "System Defragmenter", then "Scan Disk" and now it's called "Check Disk". While the name will most certainly change again, the main goal of Trojan:Win32/FakeSysdef will surely remain the same: to trick you into buying a piece of software that does nothing except scare you with fake warnings, critical "errors" and other "problems".

As the name suggests, this malware imitates a hard disk defragmenter. It will pretend to scan your computer for problems such as: it "checks" if your hard disk is working correctly, "defragments" it, and even checks the health status of your RAM and GPU (Graphic Processor Unit). Of course, once you start checking for problems using this 'program' it is going to ?find? a bucketful of them:

• Bad sectors
• RAM fragmentation
• Registry errors
• Very high CPU/GPU temperature
• RAM failures

Image 1 ? ?System Defragmenter? iteration of FakeSysdef

 

Apparently all those problems can be resolved by just running the "defragmentation" function on your hard drive; unfortunately that component is not "enabled" and to enable it you need to buy the full version of the product. You kind of expected that right?

If you choose not to buy the product, it will just stay in your status bar and will remind you every few minutes that your computer has problems that should be fixed.

Even though this malware is relatively new (only appeared 2 months ago) it has already passed through various iterations.

We encountered the first sample on the 6th of October 2010; it came disguised as a fake Windows update which required the user to enter his user name and password in order to apply the security patches. The author even went to the point of translating the fake update messages in French, German, Spanish, and Italian in an attempt to appear as authentic as possible when running on a computer not running an English version of Windows. Once given the information, it installed the fake defragmenter program and errors started pouring in.

At this point the installer malware came in an unprotected form: no actions were taken in order to evade antivirus detections, no code obfuscation applied to make analysis more difficult. This makes us think it was a trial run, made just to test the waters to see how it handled once in the wild.

Image 2 - "Windows Update" installer for FakeSysdef

 

We spotted a new variant on the 10th of October 2010; it had the same icon as Windows Update but no Windows Update message was shown. The malicious code was installed silently and ran in the background until the user tried launching an application at which point a "system error" occurred. The approach evolved at this point:

Image 3 - "System Error!" message displayed by FakeSysdef

 

1. Authors decided to be less obvious: since an advanced user would get suspicious if a new application started scanning for problems all of a sudden, now the malware changed so that it waits for user interaction.
2. The Defragmenter is hidden under multiple layers generated by 2 executable protectors/packers ("Stealth PE" and a custom packer encountered in other malware) to make detection and analysis more difficult. Fortunately we easily bypass this technique in our products.
3. The malware now deletes its original binary showing the intent of the authors to hide their tracks.

On the 27th of October we saw another version. It was distributed standalone and used stolen file information and the icon from the file utilman.exe, which is present in Windows XP. This seems to be a major update where they tried to improve the resistance to analysis tools and AV products:

1. The file won't run in a virtualised environment; and
2. The file is protected with a custom-made packer only which employs anti-emulation code to stop AV products from analysing the file.

On the 15th November a minor update was released. The software used the name "Scan Disk" probably due to the attention it slowly started getting. Again they invested heavily in code to fight AV detection. They reverted to the original defragmenter icon and to the original behaviour of showing the interface scanning for errors.

Image 4 - "Scan Disk" iteration of FakeSysdef

 

On 21 November a new version was released. The current move was to switch the name to "Check Disk", which has a familiar sound to the pronunciation of a legitimate Windows tool named ?chkdsk.exe? (?chkdsk.exe? is used to legitimately identify and correct various problems of the hard drives). This was a move clearly directed at fooling inexperienced users. The code was also updated to evade antivirus detection. Fortunately our products, such as Microsoft Security Essentials, can detect all these versions.

Image 5 - "Check Disk" iteration of FakeSysdef

 

We are sure we'll be seeing more changes from Trojan:Win32/Fakesysdef in the future, changes that we will closely monitor and detect to protect our users.

 

Below are example SHA1 hashes for the malware discussed in this blog:

cadacb248411c287822b2b09d6fff301a0f294a8
5a69f5fa043d2f5141226d10cb67d6d2a2d59f4a
d7195878d15c0e294101c5385b402b75885216f8

While writing this blog, a new version of the malware was encountered, ?Win HDD? with the following SHA1:

1905DE84FBA23A9152317A7F7C0BE7D1B3F07D70

 

Daniel Radu & Marian Radu
MMPC Dublin

free malware scan spyware adware malware remover anti spyware free