Security Ticker

Tuesday, June 06, 2006

Ewido Antimalware Update 1909

Current database: #1909
Date of Update: June 6th, 2006
Known threats in database: 344,975

Ewido Antimalware scans your computer to clean any spyware that may have gotten on your computer. Ewido also has active protection to prevent spyware from getting on to your computer.

•Hijackers and Spyware
-Secure surfing in the Internet without fear of annoying changes of the start page of your browser, tracking cookies and advertising bars.
•Worms
-Nobody should receive e-mails in your name with malicious files in the appendix anymore.
•Dialers
-Security against all kinds of dialers. No fear when receiving the next phone bill.
•Trojans and Keyloggers
-No chance for thieves to steal your bank data and personal sensitive information by tapped Internet connections, remote controlled webcams or secret keyboard recordings.

Product Info & Download: Ewido Antimalware

Monday, June 05, 2006

SpySweeper Update

Spyware definition: version 692

Updated June 5th, 2006
Protection against 139,646 spyware traces.

Spy Sweeper protects your computer in two ways. First, it uses what is called shields to monitor places on your computer that spyware will likely change. By alerting you, you can prevent spyware from even getting on your computer. The second way is the large threat database. With this update, there are 139,646 known spyware threats that Spy Sweeper detects and removes, should anything undesirable get onto your computer.

Spy Sweeper available from http://www.webroot.com/consumer/products/spysweeper/

Winpatrol v10 Released

The newest version of Winpatrol has just been released, but only for PLUS subscribers at the moment.
As Bill has stated in his blog, Bits from Bill;

The final release of WinPatrol 10 will soon be available for all users but this version is an exclusive for PLUS members only. If it wasn’t for all our PLUS members, WinPatrol wouldn’t be available and our free version wouldn’t be possible.

So what's new? Here is what the blurb has to say and a screen shot taken from my very own version of Winpatrol.

Major WinPatrol 10 Innovations
Hidden Files
Scotty can now be set to monitor Hidden files in critical system areas. A new list of Hidden Files is available to help you clean up your machine. Almost all new infiltrations and/or root kits will attempt hiding their files but Scotty can detect them in real-time before any serious danger can be done. While many hidden files are normal system files, the introduction of new hidden files should be questioned. Now it can be. The ability to delete hidden files will allow proper system cleanup.
Right-click on the hidden file to view or delete.

Date/Time First Detected
Ever wonder when a new file was first introduced to your system?
WinPatrol 10 detects and records the introduction of new program files and malware infiltrations. This new feature will allow you to detect files which have all infiltrated your system at the same time. Even if they have random file names or file names matching legitimate files you can sort files by Date Detected and Kill them all at once.

New and Improved
Optimized for Multiple Protection
WinPatrol PLUS 10 has been optimized to work even better with other security programs. No one program can protect you and we recommend you don't rely on any single source of protection. WinPatrol PLUS 10 works even better while running other popular security and AntiSpyware programs.

PLUS Info one click away
By popular request we've made PLUS Info available on our main program lists. Just right click on a program title and the popup menu will let you connect to our online database.

I am a proud owner of the PLUS version of Winpatrol and have upgraded to version 10. Apart from what is mentioned above, there are some lovely new icons on the tabs. Ok so icons won't save you from nasties but they are pretty and I like pretty.

Sunday, June 04, 2006

Trust Cleaner - Rogue Anti Spyware Application

Reported today in Bleeping Computer's Security Blog is an excellent write up on the newest rogue application on the block.

What is it and what does it do?

Trust Cleaner is very similar to others of it's ilk, like Spyware Quake and SpyFalcon, in as much as it uses trojans to generate fake warnings telling you that you are infected with all sorts of nasty stuff and goading you into buying the product as it is the only way to rescue and restore your computer.
You may sit there thinking... Oh yeah, like I'm going to fall for that one!! Maybe you won't but I've come across many people who have been driven to distraction with these warnings and nags and have ended up purchasing the fake product.
This one takes things one step further though... not only does it scare you to death with it's 'You are Infected' warnings, but it will install a toolbar and basically hijack your searches and plague you with pop up ads. The final nasty is that it will change your home page to one that looks and feels like the Google search engine, but if you check the address in your address bar you will see that you aren't on www.google.com but actually C:\Windows\local.html

The Security Blog at BleepingComputer has some nice screen shots that will show you exactly what you are up against.

If you are unlucky enough to be infected with this nasty bit of coding then there is a self help removal guide here; Trust Cleaner Removal Guide

Happy Surfing

Ewido Antimalware Update 1907

Current database: #1907
Date of Update: June 4th, 2006
Known threats in database: 343,860

Ewido Antimalware scans your computer to clean any spyware that may have gotten on your computer. Ewido also has active protection to prevent spyware from getting on to your computer.

•Hijackers and Spyware
-Secure surfing in the Internet without fear of annoying changes of the start page of your browser, tracking cookies and advertising bars.
•Worms
-Nobody should receive e-mails in your name with malicious files in the appendix anymore.
•Dialers
-Security against all kinds of dialers. No fear when receiving the next phone bill.
•Trojans and Keyloggers
-No chance for thieves to steal your bank data and personal sensitive information by tapped Internet connections, remote controlled webcams or secret keyboard recordings.

Product Info & Download: Ewido Antimalware

Saturday, June 03, 2006

Ransomware Cracked

Now that is a turn up for the books... but this time it is to our advantage.

BBC Technology news are reporting that the code that will unlock the data stolen by the The Archiveus virus has been discovered.

Archiveus was discovered on 6 May but it took the rest of the month for the first victim, Rochdale nurse Helen Barrow, to emerge.
Ms Barrow is thought to have fallen victim when she responded to an on-screen message warning her that her computer had contracted another unnamed virus. The virus asks those it infects to buy drugs on one of three websites to get their files back.
"When I realised what had happened, I just felt sick to the core," said Ms Barrow about the incident.
The Archiveus virus is only the latest in a series of malicious programs used by extortionists to extract cash from victims. Archiveus seems to use some parts of another ransoming virus called Cryzip that was circulating in March 2006.

Incidently.. if you have fallen victim to this pest then the unlock code is; mf2lro8sw03ufvnsq034jfowr18f3cszc20vmw

Firefox Updated to 1.5.0.4

For everyone that use Firefox, there is an update available. From the Firefox update page:

Firefox 1.5.0.4 is a security update that is part of our ongoing program to provide a safe Internet experience for our customers. We recommend that all users upgrade to this latest version.
* Improvements to product stability
* Several security fixes

Release Date: June 1, 2006

If you are using one of the newer version of Firefox, then you may have already gotten a notice about the update. You can always click help at the top of any page and then click "check for updates" to see if there is an update.

Mozilla Firefox is an alternative web browser that can be used instead of Internet Explorer. Download link is here

Sunbelt CounterSpy Update 350

CounterSpy 1.5 latest update definition is 350

CounterSpy is able to catch more spyware than almost every other utility on the market because the CounterSpy threat database (with the signatures of every spyware and malware utility we can identify) is constantly updated. Our researchers constantly look for ways to improve our spyware searching database so that it catches all spyware that could potentially be on your system. Keyloggers, spyware cookies, remote access trojans (backdoors), and more are all identified.

Friday, June 02, 2006

Spyware Doctor Update to 3.0483

Spyware Doctor has been updated with new spyware definitions.

Latest Database Version: 3.0483 0
Intelli-Signatures: 62,396

Spyware Doctor protects your computer in 3 ways. First, it has the On guard monitor which watches places spyware will change your computer settings. By alerting you, Spyware Doctor gives you the option to not allow unwanted programs on your computer. Second, Spyware Doctor has a feature called Immunize that completely blocks known spyware from even installing. Third, spyware Doctor has a large detection database that removes spyware that has gotten onto your computer. I have used Spyware Doctor in tests against SpyAxe and SpyFalcon. It completely removed the those two. A restart of the computer and resetting my wallpaper was the hardest part.

A free scan is available from the Spyware Doctor Homepage:
http://www.pctools.com/spyware-doctor/

New Intelli-Signatures:
3.0481 1 - Backdoor.Delf.QI, Backdoor.Snowdoor, SystemDoctor, Trojan.Banker.CV, Trojan.Bankos.HA, Trojan.Downloader.Agent.FN, Trojan.Downloader.Tiny.AM, Trojan.Naebi.214, Trojan.PWS.Agent.AA, Trojan.PWSteal.Lmir.QU, Trojan.Spy.Agent.JL, Trojan.StartPage.CO, Trojan.Startpage.TM, WinAntiSpyware, Worm.Kwbot.H
3.0482 0 - Trojan.Agent.QT, Trojan.Banker.U, Trojan.Spy.Goldun.IK, Ultimate Defender
3.0483 0 - IntraKey, Trojan.Agent.AIV, Trojan.BeastPWS.C, Trojan.PWS.Hukle, Trojan.Spy.Ransom.A, XTS Keylogger

Extended Intelli-Signatures:
3.0481 1 - 180search Assistant, Alexa, Backdoor.Agent.PX, Backdoor.Bifrose.R, Backdoor.G_Door.B, Backdoor.Hackdoor, Backdoor.Rbot.Gen, Backdoor.Robobot, Bargain Buddy, BullsEye Network, Common Components for SBSoft, Dialer.AY, Dialer.U, Fastfind, HotBar, I-Search Desktop Search Toolbar, MediaTickets, Network Monitor, Pru-tect, Rogue Anti-Spyware Products, RXToolbar, SpyAxe, Trojan.Bancos, Trojan.Banker, Trojan.Downloader.CashDeluxe, Trojan.Downloader.Obscux, Trojan.Downloader.Small.AWA, Trojan.Downloader.Small.BUY, Trojan.Downloader.Small.CAM, Trojan.Downloader.Tiny.BA, Trojan.Dropper.Agent.HL, Trojan.Dropper.Small.AEK, Trojan.Goldun, Trojan.Mailbot, Trojan.Proxy.Ranky, Trojan.PWS.Tanspy, Trojan.PWSteal.Lineage, Virtumonde, VX2.Look2Me, WebDialer, WebRebates, Worm.Feebs
3.0482 0 - Adware.Advertmen, Backdoor.Agent.PX, Backdoor.Agent.ZB, Backdoor.Rbot, BookedSpace, ClkOptimizer, CWS, CWS.XPSystem, IEFeats, PSGuard Desktop Hijacker, PurityScan, SexCam, SpyFalcon, Trojan.Agent.FG, Trojan.Downloader.Delf.VT, Trojan.Downloader.Harnig, Trojan.Downloader.Small.AWA, Trojan.Downloader.Small.CSN, Trojan.Proxy.Lager.f, Trojan.Proxy.Xorpix, Trojan.WinShow, Virtumonde, Worm.Bobax, Yazzle Sudoku
3.0483 0 - ActMon Keylogger, Adware.Advertmen, BookedSpace, CasinoClient, CnsMin, CWS.XPSystem, Deskwizz, Diablo Keylogger, Dialer.AY, Dialer.Coder, EliteBar, FavoriteMan, ISTbar, Known Bad Sites, Perfect Keylogger, SahAgent, TargetSavers, Transponder.BI, Trojan.AVKillers, Trojan.Clicker.Small.HW, Trojan.Dluca, Trojan.Downloader.Agent.AEF, Trojan.Downloader.Delf.VT, Trojan.Downloader.Small.APT, Trojan.Downloader.Small.ATL, Trojan.Downloader.VB.MZ, Trojan.Downloader.Zlob.GEN, Trojan.Dropper.Small.AEK, Trojan.PWS.Tanspy, Trojan.StartPage.ADH, Trojan.StartPage.GEN, Virtumonde, WebDialer

General Information:
Updates are posted 5 times per week on average.
Updates are installed by running Spyware Doctors' Smart Update feature.

Spy Sweeper, Ewido Antimalware, and Spybot S & D Updated

There are new spyware, trojan, adware, and malware updates for 3 security programs today. Keeping your antispyware programs up to date will help keep you safe from spyware. Using old updates may not clean or remove these threats. Be sure to stay up to date to stay clean!

Ewido Antimalware has an update today.

Current database: #1905
Date of Update: June 2nd, 2006
Known threats in database: 342,473

Ewido Antimalware scans your computer to clean any spyware that may have gotten on your computer. Ewido also has active protection to prevent spyware from getting on to your computer.

•Hijackers and Spyware
-Secure surfing in the Internet without fear of annoying changes of the start page of your browser, tracking cookies and advertising bars.
•Worms
-Nobody should receive e-mails in your name with malicious files in the appendix anymore.
•Dialers
-Security against all kinds of dialers. No fear when receiving the next phone bill.
•Trojans and Keyloggers
-No chance for thieves to steal your bank data and personal sensitive information by tapped Internet connections, remote controlled webcams or secret keyboard recordings.

Product Info & Download: Ewido Antimalware

Webroot's Spy Sweeper has been updated.

Spyware definition: version 691

Updated June 2nd, 2006
Protection against 139,628 spyware traces.

Spy Sweeper protects your computer in two ways. First, it uses what is called shields to monitor places on your computer that spyware will likely change. By alerting you, you can prevent spyware from even getting on your computer. The second way is the large threat database. With this update, there are 139,628 known spyware threats that Spy Sweeper detects and removes, should anything undesirable get onto your computer.

Spy Sweeper available from http://www.webroot.com/consumer/products/spysweeper/

Spybot Search and Destroy Update

Spybot Search and Destroy has an update today, May 2nd,2006. Spybot Search and Destroy is a free antispyware program available from Safer-Networking.org.

Spybot can clean your computer of apyware, but it also offers several ways to prevent spyware from getting onto your computer. Spybot was the first program to offer an Immunize feature. What Immunize does is to prevent some types of spyware and adware from installing by adding settings in your computer to block them from installing. With this update, there are 4483 items that the Immunize feature targets. There is also a helper added to Internet Explorer that can block unwanted cookies and other minor threats. Last, there is a feature called Tea Timer that monitors changes on your computer that spyware is likely to change. Unlike the monitor that is included in other antispyware products like Spyware Doctor or Spy Sweeper, Tea Timer looks for things that are deleted from your computer. So if malware tries to delete your anti virus program from starting when Windows starts, you will be notified and can block it.

Spybot Search and Destroy is free because it is supported by volunteers. A donation is always welcomed to help keep it free. You can donate by going to the donation page at Safernetworking.

Spyware and other threats added in this update:

Dialer
+ CasinoPalazzo + Carima Enterprises
Hijacker
++ Dr.PMon + CoolWWWSearch.Feat2Installer + CoolWWWSearch.Service + CoolWWWSearch.Feat2DLL
Keylogger
+ DiabloKeys + ABC-Keylogger + ActMon-Pro + Elite Keylogger + Fearless KeySpy + Ghostlogger + Goldeneye + Iopus + Keyboard Spectator + SC Keylog + Elitec + Stealth Keylogger + Tiny + Wincontrol
Malware
+ Smitfraud-C.AntiFirewall (250) + CallingHome.biz + Smitfraud-C. + AIMaster + ErrorSafe + Winsoftware.WinAntiVirusPro2006 ++ Winsoftware.WinAntiSpyware2006 ++ Winsoftware.WinFixer2006 + PestTrap
PUPS
+ SunStarCasino.Kasinos
Spyware
+ I Spy Now
Trojan
+ Nugache.A@mm (4) ++ Downloader.Delf + GrayPigeon + Bancos + TrojDloader-NC + Prorat ++ SpywareDisinfector + Zlob.Downloader ++ SpyFalcon.FakeAlert
Total: 327888 fingerprints in 42461 rules for 2004 products.

Sunbelt CounterSpy Update 348

CounterSpy 1.5 latest update definition is 348

CounterSpy is able to catch more spyware than almost every other utility on the market because the CounterSpy threat database (with the signatures of every spyware and malware utility we can identify) is constantly updated. Our researchers constantly look for ways to improve our spyware searching database so that it catches all spyware that could potentially be on your system. Keyloggers, spyware cookies, remote access trojans (backdoors), and more are all identified.

http://research.sunbelt-software.com/download.cfm

CounterSpy offers a 15 day fully functional trial. So that means you can not only test how it detects spyware, but how well it removes spyware, malware, and other threats.

New Threats Added to Database

Trojan-Dropper.Win32.Agent.hl, Trojan-Downloader.Win32.Small.ajc, 180solutions.Zango.CommonElements, Trojan-Clicker.Win32.Delf.fj, Trojan.Win32.Crypt, ojan.Simtest, Trojan.Svchostsys, Trojan-Dropper.Win32.Agent.amn, Trojan-PSW.Win32.Sinowal, Trojan.Aepif, Trojan-Downloader.JS.Agent.af, Exploit.Gossip-Stars, Trojan.Sharp.Q, Trojan.IEMax, Backdoor.Win32.Agobot.aig, Trojan-Spy.Win32.Agent.mn, Exploit.Vxgame, Zlob.pt, Trojan-Downloader.Win32.Small.ctp, Trojan-Dropper.Win32.VB.kk, Backdoor.Win32.Small.crd, SpyCleaner, Downloader.BA, Downloader.BB, Banker.TZ, Downloader.BC, Downloader.BD, PWS.VIP, Downloader.BE, Trojan-Spy.Win32.Agent.kf, Trojan-Downloader.Fald, Fearmusk.A, BeastPWS-C,

Threats that have been updated

BookedSpace, 3721.com Chinese Keywords, Claria.Gator.eWallet, AvenueMedia.InternetOptimizer, E2Give, IST.SlotchBar, Hotbar, IBIS.WebSearch Toolbar, IST.ISTbar, Look2Me, C2.Lop, IST.PowerScan, Radlight, WhenU.Save, Stop Popup Ads Now, WhenU.WeatherCast, webHancer, MyWebSearch Toolbar, WhenU.ClockSync, ABetterInternet, DealHelper, 180solutions.SearchAssistant, WhenU.WhenUSearch, Zango.SearchAssistant, Looking-For.Home Search Assistant, Krepper, CallingHome.biz, MediaMotor, DialerPlatform, NetPumper, Netwebsearch Toolbar, Virtumonde, BetterInternet.Transponder.Ceres, CoolWebSearch.MWSearch, SurfSideKick, PC-Watch, Secret Explorer v6.0, Radar Spy 1.0, Trojan.SvcProc, The PC Detective, Trojan.Vxgame, Java ByteVerify, ABetterInternet.Aurora, ABetterInternet.DrPMon, Trojan-Downloader.Small, ABetterInternet.Poller, Dialer.Maxd, New Dial, ConsumerAlertSystem.CASClient, Topnetsearch, SurfAccuracy, Trojan-Downloader.Qoologic, WindUpdates.MediaGateway, WatchDog, Zenotecnico, MindSoft Secret Agent, SSA-KeyLogger, Zango.Muncher, ICanNews.CasClient, PWS-Banker, Remote Performance Observer ver. 2.7, SafeSurfing,
Starware.Toolbar, WebNexus, Dimpy.Win32VBsy, Chode.GM, DollarRevenue, Exploit.WMF, UserTracker, DesktopScam, FakeAlert, SupremeToolbar, EliteMediaGroup, Goldun.Fam, TagASaurus, Trojan-Downloader.Win32.Small.awa, PartyPoker, Exploit.CHM, Haxdoor.Fam, Exploit.CreateTextRange, Trojan-Downloader.Agent.Afl, FullContext.EQAdvice, Media-Codec, WhenU.VVSN, Virtumonde.BC, Trojan-Clicker.Win32.VB.ij, Trojan-Spy.Win32.VB.eh, Yazzle.SnowBallWars, Proxy-Lager, Trojan-Downloader.Win32.Small.csn, SpamTool.Win32.Agent.h, Trojan-Downloader.Harnig, Related Search, Trojan-Proxy.Win32.Xorpix.Fam, Ultimate Defender, Trojan.Win32.Agent.qt, Trojan-Proxy.Win32.Small.em, Trojan-Proxy.Win32.Agent.ke, Renchneg.B.DLL

Thursday, June 01, 2006

Virus for Star Office

Experts at SophosLabs™, Sophos's global network of virus, spyware and spam analysis centers, have announced the discovery of the first malware for StarOffice.

The virus, which has been dubbed Stardust, is the first example of malware written in the StarOffice macro language. Macro viruses have most frequently troubled users of Microsoft Office since the discovery of the Concept virus in 1995 which infected Microsoft Word files, but have rarely been seen for non-Microsoft applications.

"The Stardust virus doesn't appear to work very well, and as such poses as close-to-zero threat to computer users as is imaginable," said Graham Cluley, senior technology consultant for Sophos. "It appears that someone attempted to write this virus purely to prove that such a thing was possible, rather than with any serious motive."

Sophos experts report that an image which the virus attempts to download contains a photograph of a porn star, with the message "Vxers love you!!"

"Clearly whoever wrote this virus is an ardent fan of the Czech porn actress, Silvia Saint," continued Cluley. "The word 'Vxers' is a frequently used phrase in the computer underground for those who are interested in writing and distributing viruses. Miss Saint, however, is probably not similarly attracted to people who sit in their back bedrooms writing malicious computer code."

Source ¦ Sophos