Custom Search

New worm infects removable drives.

Yet another worm that infects removable drives was discovered.

The Win32/SillyAutorun.FTW was recently found in the wild. The worm is written with Microsoft Visual Studio and uses injection engine – worm’s code overwrites the original code in memory. When it runs on infected machine, it firstcopies itself to  %ApplicationData%\E-73473-3674-74335\msnrsmsn.exe; where %ApplicationData% is application data folder …

MSRT November ’12 – Weelsof around the world

Win32/Weelsof is part of a large malware family called ransomware, which is different from your traditional trojans and worms. Ransomware’s main goal is to financially benefit from every infected user and force them to pay.

We included Win32/Weelsof in our November release of the Malicious Software Removal Tool.

Malware entry point

The user can be …

Multi-Language Ransomware Mentions Police to Enforce Payment

When it comes to innovation, cyber-criminals have no borders, or that’s what we believe after analyzing this piece of multi-language malware detected as Trojan.Ransom.IcePol.

Incoming search terms for the article: bitdefender labs for police enforcement pay, bitdefender labs for police enforcement pay removal tool, bitdefender ransomware removal tool download, ransomware on xvideos, …

Newest Windows Version Runs Oldest Malware Still in Wildcore

Ever since the release of Windows 8, one of the key marketing points of the new OS made in Redmond was built-in safety. Given that we’re a curious bunch of people here in the Labs, we decided to take an Enterprise version of Win 8 for a spin and see for ourselves …

ZACCESS/SIREFEF Arrives with New Infection Technique

During the last weeks of July, we received reports from customers that their services.exe files were being patched by an unknown malware. The patched services.exe, detected by Trend Micro as PTCH_ZACCESS (for 32-bit version) and PTCH64_ZACCESS (for 64-bit version), was verified to be a component of the SIREFEF/ZACCESS malware family. ZACCESS (also known as ZEROACCESS) …

MSRT August ’12 – What’s the buzz with Bafruz?

For this month’s Microsoft Malicious Software Removal Tool (MSRT) release, we will include two families: Win32/Matsnu and Win32/Bafruz. Our focus for this blog will be Bafruz, which is a multi-component backdoor that creates a Peer-to-Peer (P2P) network of infected computers (using C&C, for instance), and includes a nasty list of payloads, as well as unique means …

Fake Delta Email Leads to Sirefef, Fake AV

There’s a fake Delta airlines email in circulation at the moment which comes with a zip attached, named “Ticket_Delta_Airlines_IN2139.zip”

Click to Enlarge

The text reads:

Hello, E-TICKET / EH065894335 SEAT / 77E/ZONE 2 DATE / TIME 20 JUNE, 2012, 09:55 AM ARRIVING / Virginia Beach FORM OF PAYMENT / CC TOTAL …

‘Bioskits’ Join Ranks of Stealth Malware

We have seen many discussions of the MyBios “Bioskit” discovered at the end of 2011. MyBios was the first malware to successfully infect the Award BIOS and survive the reboot. It was first discovered by a Chinese security company; many other security vendors published detailed analyses after that.

We have seen a lot of samples targeting …

‘Android/NotCompatible’ Looks Like Piece of PC Botnet

A lot of recent attacks on Android users are attributed to fake websites of popular applications such as Cut the Rope, Instagram, Angry Birds, or Grand Theft Auto III. However, the very recently discovered malware NotCompatible uses a distribution method not previously seen in the mobile world. The malware hacks into vulnerable websites to inject …

Updates on OSX/Tsunami.A, a Mac OS X Trojan

Yesterday, ESET announced the discovery of a new threat against the Apple Mac OS X platform. Today, we have found a new version of the same threat. The new version is similar to the previous version with two important differences. The first addition to this threat is that it now implements persistence on an infected …

Microsoft reissues update for Win XP/2003 for DigiNotar certificate revocation

Microsoft had to reissue an update for users of Windows XP and Windows 2003 today related to the compromise of certificate authority DigiNotar.

It was not related to further hacking though, it appears to be a quality assurance SNAFU at the software giant.

Microsoft has updated the known issues in security advisory 2607712 to …

Microsoft revokes DigiNotar certificates from Windows, Mac users still vulnerable

Microsoft has just released an update to security advisory 2607712 permanently moving all five of DigiNotar’s root certificates to the “revoked” certificate store.

How is this different than the previous update Microsoft released?

It provides protection for all supported versions of Windows (XP, 2003, Vista, 2008, 7 and 2008R2). It covers all five root certificates …

New worm targeting weak passwords on Remote Desktop connections (port 3389)

We’ve had reports of a new worm in the wild and that generates increased RDP traffic for our users on port 3389. Although the overall numbers of computers reporting detections are low in comparison to more established malware families, the traffic it generates is noticeable. The worm is detected as Worm:Win32/Morto.A and you can see …

Could hackers set fire to your Apple battery with a virus?

Could hackers set fire to your Apple battery with a virus? Some recent news stories seem to suggest that they might.

One uncompromising headline certainly implies that battery-based malware – whether inferno-related or not – is an inevitability, trumpeting proudly that “Apple laptop batteries are the new attack vector.”

That remains to be seen, as …