Malware

Targeted e-mails distribute malware in PayChoice breach

Pay­roll pro­ces­sor PayChoice said Thurs­day it is inves­ti­ga­ting a breach in which cus­to­mers recei­ved tar­ge­ted e-mails pur­por­ting to be from the com­pany but were desig­ned to trick peo­ple into down­loa­ding malware.

Wor­kers recei­ved e-mails last week that direc­ted them to down­load a brow­ser plug-in or visit a Web site so they could con­ti­nue acces­sing the Onlineemployer.com PayChoice por­tal. Mal­ware in the down­load and on the Web site tur­ned out to exploit holes in Inter­net Explo­rer, Adobe Flash, and Adobe Rea­der, PayChoice said.

Read the rest of the article here: http://news.cnet.com/8301-27080_3-10365830–245.html?tag=newsEditorsPicksArea.0

Clampi Virus targets online banking

In the modern world, most peo­ple never see their bank (with the excep­tion of ATM with­dra­wals).  We use bill pay, direct depo­sit and bank debit cards.  This is the exact beha­vior that the Clampi virus is living on.

Clampi is a very stealthy virus, just biding it’s time on a com­pro­mi­sed machine and watching for con­nec­tions to online finan­cial web­si­tes.  So many so that the Lon­don Times Online reports:

The tro­jan has a list of more than 4,500 finance-related web­si­tes that it moni­tors, inc­lu­ding Bri­tish high street banks. Secu­rity experts war­ned that it was one of the stealthiest and most per­va­sive threats to com­pu­ters using the Mic­ro­soft Win­dows ope­ra­ting systems.

The virus appears to be gea­red with more of the busi­ness users ins­tead of the nor­mal home user (though it does infect home users).  If the virus does end on a work com­pu­ter, it will attempt to cap­ture login cre­den­tials admi­nis­tra­tors and spread itself through the net­work.  As it spreads, it con­ti­nually moni­tors for login infor­ma­tion to the watch list of finan­cial web­si­tes.  If this virus does infect the finance group of a com­pany, it will attempt to send wire trans­fers from that account.  You can ask Slack Auto Parts.  It has been repor­ted that they lost $75,000 July 3–7, says owner Henry Slack. Clampi-infected com­pu­ters sent nine pay­ments to six dif­fe­rent mules � and fai­led to trans­fer an addi­tio­nal $69,000 in eight other attempts.

A word of war­ning, if your com­pu­ter is desig­na­ted for finan­cial usage, please do not surf the inter­net or use social media sites to mini­mize the risk of infections.

Since this virus has been out for a while, all the major anti­vi­rus ven­dors have upda­ted defi­ni­tion files that inc­lude the scan for this par­ti­cu­lar virus.  Make sure your sys­tem is always upda­ted and scan­ned on a regu­lar basis.  If you would like to run a quick check, using a dif­fe­rent ven­dor, I recom­mend these online scanners:

Trend­Micro: http://housecall65.trendmicro.com/
Syman­tec: http://security.symantec.com/sscv6/WelcomePage.asp
McA­fee: http://home.mcafee.com/downloads/freescan.aspx?cid=60447
Panda: http://www.pandasecurity.com/activescan/index/

Go Figure, Dirty sites are dirty…

Syman­tec, the makers of a very widely used array of inter­net secu­rity pro­grams, has com­pi­led a list of the 100 “dir­tiest” sites.

These sta­tis­tics are deter­mi­ned by a com­bi­na­tion of Symantec’s own craw­ler and input from their “Nor­ton Com­mu­nity Watch” mem­bers.  Below are some direct quo­tes from Symantec:

• Ave­rage num­ber of threats per site on the Dir­tiest Web­si­tes list is roughly 18,000, com­pa­red to 23 threats per site for all sites rated by Nor­ton Safe Web
• 40 of the Top 100 Dir­tiest Sites have more than 20,000 threats per site
• 48% of the Top 100 Dir­tiest Web sites fea­ture adult content
• 3/4 of the Top 100 Dir­tiest Web sites have dis­tri­bu­ted mal­ware for more than 6 months
• Viru­ses are the most com­mon threat repre­sen­ted on the Dir­tiest list, follo­wed by Secu­rity Risks and Brow­ser Exploits

For many years, inter­net users have always know that “adult” sites tend to be the big­gest con­tri­bu­tors to popup ads.  Now they appear to be a clea­ring house for other irri­tants.  With the amount of traf­fic that does tend to go to those sites, no judg­ment here by the way,  they have the per­fect vehicle.

Here is a par­tial list of the sites that made the top 100.  Please avoid them if pos­si­ble, or use extreme care if you have to go to them:

• 17ebook.com (view report)
• aladel.net (view report)
• bpwhamburgorchardpark.org (view report)
• clicnews.com (view report)
• dfwdiesel.net (view report)
• divineenterprises.net (view report)
• fantasticfilms.ru (view report)
• gardensrestaurantandcatering.com (view report)
• ginedis.com (view report)
• gncr.org (view report)
• hdvideoforums.org (view report)
• hihanin.com (view report)
• kingfamilyphotoalbum.com (view report)
• likaraoke.com (view report)
• mactep.org (view report)

• magic4you.nu (view report)
• marbling.pe.kr (view report)
• nacjalneg.info (view report)
• pronline.ru (view report)
• purplehoodie.com (view report)
• qsng.cn (view report)
• seksburada.net (view report)
• sportsmansclub.net (view report)
• stock888.cn (view report)
• tathli.com (view report)
• teamclouds.com (view report)
• texaswhitetailfever.com (view report)
• wadefamilytree.org (view report)
• xnescat.info (view report)
• yt118.com (view report)

Trend Micro Reports that malicious twitter posts get more personal

Read more: http://blog.trendmicro.com/malicious-twitter-posts-get-more-personal/#ixzz0MeDdg1TV

As always, please be care­ful when clic­king links

Koobface malware attack on Twitter

Twit­ter has pos­ted a war­ning con­cer­ning koob­face infec­tions.  If their sys­tem detects your PC sen­ding out these bogus tweets they will sus­pend your account.

Accor­ding to wiki­pe­dia Koob­face is:

Koob­face, an ana­gram of Face­book (“face” and “book” change order and “koob” is “book” in reverse), is a com­pu­ter worm that tar­gets the users of the social net­wor­king web­si­tes Face­book, MyS­pace ^[1], hi5, Bebo, Friends­ter and Twit­ter^[2]. Koob­face ulti­ma­tely attempts, upon suc­cess­ful infec­tion, to gather sen­si­tive infor­ma­tion from the vic­tims such as cre­dit card numbers.

Koob­face spreads by deli­ve­ring Face­book mes­sa­ges to peo­ple that are ‘friends’ of someone on Face­book whose com­pu­ter has already been infec­ted. The mes­sa­ges con­tain inno­cuous sub­ject hea­ders such as “Paris Hil­ton Tos­ses Dwarf On The Street”, “LOL”, and “My friend catched [sic] you on hid­den cam”. Upon receipt, the mes­sage directs the reci­pients to a third-party web­site unaf­fi­lia­ted with Face­book where they are promp­ted to down­load what is pur­por­ted to be an update of the Adobe Flash pla­yer. If they down­load and exe­cute the file, they will infect their com­pu­ter with Koob­face. Koob­face then com­man­deers their sur­fing acti­vi­ties and directs users to con­ta­mi­na­ted web­si­tes when they attempt to access search engi­nes like Goo­gle, Yahoo, and Bing.

Please remem­ber to keep your Anti Virus soft­ware updated.

Malware Definitions

I found this link and thought you might enjoy these definitions:

Defi­ni­tions of Malware

When is an antivirus really a virus?

Today I recei­ved a call from one of my exter­nal users that was una­ble to access any web­si­tes because some new anti­vi­rus was saying he was unpro­tec­ted and every web­site had mali­cious code.

Since I know that we have McA­fee 8.5 deplo­yed to our users, I knew that this was not a McA­fee issue.  As we dis­cus­sed it a little further he was men­tio­ning that the Anti­vi­rus wan­ted him to purchase the software.

This isn’t the first I have heard of this.  There is a soft­ware com­pany Inno­va­gest 2000 that is pro­du­cing this soft­ware.  They adver­tise it as an antispy­ware appli­ca­tion, but it is the spy­ware.  On some less then savory web­si­tes you will get a pop up that says that your com­pu­ter maybe infec­ted and they offer a free scan.

The fear of being infec­ted moti­va­tes a lot of peo­ple to run this free scan.  Unk­nown to them this appli­ca­tion ins­talls under­neath and now you are stuck.  On that note, I do recom­mend only doing the online scans from repu­ta­ble sites.  I per­so­nally recom­mend the follo­wing: Syman­tec, Panda, and McA­fee.

This appli­ca­tion is extre­mely hard to get rid of.  It rere­gis­ters and ins­talls if it is not com­ple­tely unins­ta­lled correctly.

I hate pro­grams like this.  But it is a fact of life out there.  The modern day snake-oil salesman.

While the pro­gram is run­ning you will see the follo­wing unde­si­ra­ble behavior:

• A “Win­dows Secu­rity Cen­ter” sta­ting that you should purchase Per­so­nal Antivirus.
• Nume­rous alerts sta­ting that your com­pu­ter is under attack or that you have mal­ware run­ning on your com­pu­ter. If you click on these alerts, Per­so­nal Anti­vi­rus will be ins­ta­lled, or you will be brought to the purchase page for the program.
• Your Inter­net Explo­rer brow­ser will be hijac­ked to show secu­rity war­nings when brow­sing the web that stop you from reaching your desi­red page.

As I men­tio­ned before this bug­ger is very hard to get rid off.  But not impos­si­ble.  I found these ins­truc­tions at BleepingComputer.com.

Read more…

MSN Bot Plays on Controversy over Michael Jackson’s Death

Follo­wing the sud­den and shoc­king death of The King of Pop, Senior Threat Researcher Lou­cif Kha­rouni reports that a slew of mali­cious links rela­ted to Michael Jackson’s last moments in the hos­pi­tal before his death are now being pro­li­fe­ra­ted in the wild via the ins­tant mes­sa­ging (IM) appli­ca­tion, MSN.

When reci­pients of such mes­sa­ges click on any of these links, they are then promp­ted to save a file named PIC-IMG029-www.hi5.com.exe (with the MD5 check­sum of 031429fc14151f94c8651a3fb110c19b), ins­tead of being led to an image site or gallery. Ini­tial analy­sis shows that the said file is a variant of the SDBOT family.

Read more: http://blog.trendmicro.com/#ixzz0JjYk7SNq&C

How To Avoid Viruses

Com­pu­ter viru­ses are very dan­ge­rous, espe­cially in the modern day when the inter­net is relied on for so many things. Viru­ses, adware and spy­ware can slow down com­pu­ters and in some cases even stop them from wor­king alto­gether, which can be disas­trous for busi­ness. There are various com­mon sense ways that such viru­ses can be avoi­ded howe­ver, and the­re­fore how com­pu­ter secu­rity can be improved.

One of the easiest ways to avoid com­pu­ter viru­ses is to avoid links to web­si­tes that have not being searched for by the user them­sel­ves –in other words, do not click on pop-ups. Pop-ups can be dif­fi­cult to con­trol, because on some web­si­tes a great num­ber can appear on the screen. They are also often very temp­ting to click on, espe­cially for chil­dren who are unli­kely to know bet­ter. Chil­dren must the­re­fore be edu­ca­ted about igno­ring such things, which are likely to bring viru­ses into the computer’s sys­tem. The easiest way to avoid pop-ups is simply to close them as soon as they appear.

Com­pu­ter secu­rity can also be com­pro­mi­sed if users input data into web­si­tes that are not secure. It is very easy, on such web­si­tes, for hac­kers to find out bank details or con­tact infor­ma­tion, espe­cially if the web­site in ques­tion is one where goods can be purcha­sed. To avoid such things as cre­dit card fraud, is it advi­sa­ble to look for the colou­red strip at the top of the screen, which can be found where the domain address is typed. If the line is green, the website’s secu­rity cer­ti­fi­cate is up to date and all infor­ma­tion input­ted into the site will be secure. If the line is red, howe­ver, there is likely to be a pro­blem with the secu­rity cer­ti­fi­cate, and users should avoid put­ting any infor­ma­tion into the site.

Another way, which is most often used in busi­nes­ses, is to down­load anti-virus soft­ware in order to ensure com­pu­ter and inter­net secu­rity. These pro­grams are ins­ta­lled onto the com­pu­ter, and will then set up a fire­wall that will stop unwan­ted pro­grams or viru­ses from affec­ting the computer.

Article Source: http://www.ArticleStreet.com/

Malware Alert — Yellowsn0w

Atten­tion iPhone Users

ZDNet News is repor­ting the follo­wing Alert for iPhone Users:

Researchers from Malware-database.net are repor­ting on a newly dis­co­ve­red mal­ware posing as a bogus iPhone unloc­ker, pro­mi­sing a wor­king Firm­ware 2.2.1 yellowsn0w exploit as a social engi­nee­ring tactic.

If you have an iPhone and are loo­king to unlock your device, please be aware of  this alert.  If you find a site that offers this file, please leave the site imme­dia­tely and per­form a virus scan.  The last known address of the site yellowsn0w221.wordpress.com (now down) was full of viru­ses gea­red to turn your PC into a spambot.

Thanks to Dev-Team Blog for the information.