Spybot Search & Destroy For September 22nd

Adware
+ Win32.LinkOptimizer (2)
Keylogger
+ SCKeylogger
Malware
+ Smitfraud-C. + Winsoftware.WinAntiVirusPro2006 + VirtuMonde + AdvancedSearchBar
Spyware
+ 180Solutions.Zango
Trojan
+ Win32.Banload.BHI + Win32.Small.doi + Win32.Agent.AGF + Haxdoor-H + Zlob.iCodecPack + Nous-Tech.UDefender + Zlob.HQCodec + Zlob.XPasswordManager + Win32.Avkiller + AccountMaker + Goldun (2) + MuKill + Win32.Small.asf + Win32.Agent.rk

Total: 321626 fingerprints in 49160 rules for 2248 products.

http://www.safer-networking.org/en/home/index.html

Spoof email - Anti virus from Microsoft

I received a disturbing email this evening. It looked, at first glance, like it was from Microsoft.

It was telling me that Microsoft recommended this particular anti virus and that I was to uninstal my resident antivirus and download and install the file that I was linked to.

Well I didn't... why?

Microsoft would never ever ever tell me to uninstall my resident anti virus.

If there was a program that they were releasing or recommending then they would announce it the usual way, through the media and on the official Microsoft sites.. they certainly would not email me personally.

As it turned out, the file that I was being prompted to download was a particularly nasty trojan.

Yes you have guessed it, the email wasn't from Microsoft. The address it came from was spoofed so that it looked like it was from Microsoft.

Please take care when you are going through your emails, if you are unsure about the content of an email then go to the senders website by using the link you have in your favourites or by typing the URL into your browser address bar manually. Don't click on any links in the email.

Remember, the world won't end tomorrow if you don't download this or install that. But your computer will probably be a lot happier! :)

SpywareBlaster Updated September 14th

Updated: Septemebr 14th, 2006
New: 11 Items
Total: 6598 Items

SpywareBlaster is free and available from Javacool's SpywareBlaster page.

SpywareBlaster can:

• Prevent the installation of ActiveX-based spyware, adware, browser hijackers, dialers, and other potentially unwanted software
• Block spyware/tracking cookies in Internet Explorer and Mozilla/Firefox
• Restrict the actions of potentially unwanted sites in Internet Explorer

Please use the web update feature withinSpywareBlaster to obtain the latest definitions.
Enable all protections once downloaded.

Spyware Doctor 3.0560 0

Spyware Doctor has been updated with new spyware definitions.

Latest Database Version: 3.0560 0
Intelli-Signatures: 70,852

Spyware Doctor protects your computer in 3 ways. First, it has the On guard monitor which watches places spyware will change your computer settings. By alerting you, Spyware Doctor gives you the option to not allow unwanted programs on your computer. Second, Spyware Doctor has a feature called Immunize that completely blocks known spyware from even installing. Third, spyware Doctor has a large detection database that removes spyware that has gotten onto your computer. I have used Spyware Doctor in tests against SpyAxe and SpyFalcon. It completely removed the those two. A restart of the computer and resetting my wallpaper was the hardest part.

A free scan is available from the Spyware Doctor Homepage:
http://www.pctools.com/spyware-doctor/

New Intelli-Signatures:

3.0559 0 - Trojan.Plustlnt

3.0558 0 - Trojan.Agent.EO, Trojan.Downloader.TIBS

Extended Intelli-Signatures:

3.0560 0 - Backdoor.Beastdoor, Backdoor.Graybird.GEN, Trojan.Banker, Trojan.Popuper, Trojan.Proxy.Small.BO, Trojan.PSW.Hangame, Trojan.PWSteal.QQPass, Trojan.VisAgent

3.0559 0 - Backdoor.Graybird.GEN, CasinoClient, Common Components for Backdoors, Common Components Unrelated, CWS.XPSystem, HotBar, Known Bad Sites, QQFace, SC Keylogger, SpyHeal, Trojan.DNS Changer, Trojan.Downloader.Banload, Trojan.Downloader.Femad, Trojan.Downloader.Obscux, Trojan.Downloader.Small.AWA, Trojan.Downloader.Small.BWS, Trojan.Fald, Trojan.Goldun, Trojan.LdPinch, Trojan.Proxy.Lager.f, Trojan.Proxy.Ranky.EK, Trojan.PWSteal.Agent.C

3.0558 0 - Backdoor.Hupigon.GEN, Known Bad Sites, Maxifiles, SpySpotter, Trojan.Banbra.FB, Trojan.Bancos, Trojan.Banker, Trojan.Downloader.Agent.AEA, Trojan.Downloader.Harnig, Trojan.Dropper.Agent.HL, Trojan.Spy.Agent.EW, Trojan.Spy.Banker.AEZ, Trojan.StartPage.GEN, Trojan.StartPage.XS

Deleted:

3.0559 0 - Trojan.Spy.Agent.BY


General Information:
Updates are posted 5 times per week on average.
Updates are installed by running Spyware Doctors' Smart Update feature.

AD Aware Update to Fix False Positives

SE1R123 13.09.2006 Is Now Available, New Definition file for Ad-Aware SE

============================================
Definition file Notification - Lavasoft News
============================================
SE1R123 13.09.2006

This fixes a False Positive in Adware.AdMedia.
This fixes a False Positive in TrojanBackdoor.Serv-U.
This fixes a False Positive in BargainBuddy.
This fixes a False Positive in Win32.Trojan.Agent.
This fixes a False Positive in Win32.Trojan.Downloader.

Ad Aware SE1R123 12.09.2006

There's an update for Ad Aware today, SE1R123 12.09.2006

New Definitions:
========================
Adware.FunWeb +11
Adware.LinkOptimizer +4
Diaremover +7
Win32.Keylogger.Skin +5

Updated Definitions:
========================
ABetterInternet.Aurora +5
Admedia.AdMedia +14
Adware.AdMedia +8
Adware.Allsum +15
Adware.DesktopMedia
Adware.Dropper
Adware.Eztracks +10
Adware.Iebar +10
Adware.Look2Me +29
Adware.Maxifiles +6
Adware.NaviPromo +7
Adware.Suggestor +4
Adware.ZenoSearch +7
Ardamax Keylogger +5
Bargainbuddy +38
Lop +89
PurityScan
RXToolbar +9
Softomate Toolbar +3
TrojanBackdoor.Serv-U
Webhancer +8
Win32.Dialer.Trojan +10
Win32.Trojan.Agent +4
Win32.Trojan.DownLoader +14
Win32.Trojan.Keylogger +5
WinAntiVirusPro +12
VirusBlast +2

Ad Aware can be downloaded from the official Lavasoft Ad Aware page.

Sunbelt Counterspy Update 407

CounterSpy 1.5 latest update definition is 407

CounterSpy is able to catch more spyware than almost every other utility on the market because the CounterSpy threat database (with the signatures of every spyware and malware utility we can identify) is constantly updated. Our researchers constantly look for ways to improve our spyware searching database so that it catches all spyware that could potentially be on your system. Keyloggers, spyware cookies, remote access trojans (backdoors), and more are all identified.

http://research.sunbelt-software.com/download.cfm

CounterSpy offers a 15 day fully functional trial. So that means you can not only test how it detects spyware, but how well it removes spyware, malware, and other threats.

New Threats Added to Database

Hack v1.0 Trojan, W32.Netsky.AD@mm, Trojan.Rootserv, W32.Beagle.FG@mm, W32.Bacterra.Worm, W32.Duksten.C@mm, Trojan.FakeLogin, Backdoor.Hitcap, W32.HLLW.Daboom@mm, Backdoor.BluanWeb, BAT.Cyseq.Worm, Backdoor.Rsbot, Backdoor.Helios.B, Trojan-Downloader.Win32.Mediket.cd, Trojan.Win32.Conycspa.i, Trojan-Downloader.Win32.Zlob.jl, Trojan-Downloader.JS.Gool.a, Trojan-Spy.Win32.Banker.ek, Sosoko, Wnavy.Toolbar, Trojan-Downloader.AML, FireHole, Trojan-Clicker.Win32.Costrat.l, Trojan-Dropper.Win32.Agent.fly, BAT.Rahiworm, Dialer.Lohan, Infostealer.Wowcraft.C, Infostealer.Netsnake, Backdoor.Beasty.Cli, Trojan.Dasmin, Netspy.Trojan, Trojan.Popdis, W32.Misodene@mm, Trojan.DnD.DoS, Linux.Slapper.Worm, Dialer.NewDial, Backdoor.Sdbot.AR!dr, Trojan-Downloader.Reitrec, Dialer.Volta, Backdoor.Armageddon.20, Backdoor.Homutex, Infostealer.Svcstor, W32.Areses.H@mm, Backdoor.SMBRelay, W32.Banwarum@mm, W32.Mimail.A@mm, Adware.LoadEWXD, Trojan.Agentdoc, W32.Beagle.AR@mm, PWLsteal.Trojan, W32.Mumu.B.Worm, Backdoor.Oblivion, Backdoor.Nodelm, Trojan.Slapew.C, DonaldD.Trojan (NT), Trojan.Checkraise, W32.Swen.A@mm, W32.HLLW.Lovgate.J@mm, Trojan.Wimad, W32.Bagz.E@mm, Infostealer.Kurofoo, Backdoor.G_Door.Client, Dialer.XLite, Backdoor.Mite, W32.Mytob.QA@mm, Backdoor.Delf.E, Backdoor.Gaobot, Backdoor.IRC.Loonbot, Trojan.Ourxin, Trojan-Downloader.Centim, Trojan.Benfgame, Trojan.Logger, Dialer.SouthBeachTel, Backdoor.Ginwui.B, Dialer.Global, W32.Fili.A@mm, Backdoor.Portless, W32.Mydoom.L@mm, PHP.RSTBackdoor, Backdoor.IRC.RPCBot.C, Backdoor.Domwis, Backdoor.IRC.Flood.E, Backdoor.Graybird.N, W32.Lovgate.X@mm, Backdoor.Beasty.dr, Backdoor.DMSpammer, Backdoor.Tabdim, Backdoor.Sinups, W32.Shufa@mm, Backdoor.Roxe, Backdoor.Amitis.B, W32.Luder@mm, W32.Kwbot.F.Worm, W32.HLLW.Fizzer@mm, W32.Femot.Worm, VBS.BinHex.Trojan, Backdoor.IRC.Ratsou.B, Trojan.Maocal, Trojan.LowZones!reg, Trojan.Awax, Trojan.Delsha.B, W32.Balick.Trojan, Backdoor.Laphex.Client, Backdoor.Iroffer.1303.F, Trojan.Webus.H, Backdoor.Rustock.A, W32.HLLW.Torvel.B@mm, Dialer.Dcon, Infostealer.Wowcraft.B, Backdoor.Sdbot.F, ICQpager.Trojan, Backdoor.Ciadoor.Cli, Backdoor.Iroffer.1210, Backdoor.Lixy.B


Threats that have been updated

Alexa Toolbar, Backdoor.Ciadoor, Backdoor.Win32.IRCBot.gen, Backdoor.IRC.ZCrew, Sheldor, eXact.BargainBuddy, BookedSpace, ClearSearch, CommonName, Conducent/Timesink, Desktop Scout, AvenueMedia.InternetOptimizer, eXact.SearchBar, Hotbar, IBIS.WebSearch Toolbar, IEPlugin, EGroup.InstantAccess, IST.ISTbar, Hyperlinker/LinkMaker, Look2Me, C2.Lop, Mini Key Log, Mirar, NetVizor, NewDotNet, Claria.GAIN.OfferCompanion, Perfect Keylogger, KeenValue.PowerSearch, ClickSpring.PuritySCAN, Roimoi.Roings Search, Memory Watcher, WhenU.Save, SC-KeyLog, Backdoor.SDBot.gen, SearchIt Toolbar, SpyAgent, Trojan.StartPage, ZeroPopUpBar, XPCSpy, Xupiter, Verticity.IEDriver, Virtual Bouncer, ny Keylogger, Trojan-Downloader.Psyme, JS.Seeker, 2020Search, W32.Klez.h@MM, W32.Sobig.B@mm, W32.Sobig.F@mm, webHancer, Bridge/WinFavorites, WurldMedia, TopRebates.WebRebates, iSearch.Toolbar, ABetterInternet, 180solutions.SearchAssistant, IST.SideFind, WindUpdates, SearchMiracle.EliteBar, MediaTickets CDT, eXact.BullseyeNetwork, Zango.SearchAssistant, AproposMedia.ContextPlus, Begin2Search, MediaMotor, DialerPlatform, W32.Spybot.Worm, Backdoor.Win32.Rbot.gen, RXToolbar, Virtumonde, SpySheriff, Begin2Search.BigTrafficNet, Trojan-Downloader.Qoologic, MegaSearch, SpecificMedia.GoGoTools, Trojan.Abwiz.B, SpywareStormer, WebDir, Trojan.Lowzones, PWS-Banker, KGB Keylogger, WinFixer, WinAntiSpyware, 2Search, BigBlue.01, Starware.Toolbar, Maxifiles.Director, ErrorSafe, Wfgtech.com, SpyAxe, DollarRevenue, MalwareWipe, FakeAlert, SniperSpy, Powered Keylogger, SystemDoctor, Browsezilla, Trojan.Smitfraud, Backdoor.Win32.Iroffer.b, Backdoor.Eterok, Backdoor.Win32.Rbot.aeu, Infostealer.Banpaes, Infostealer.Bancos, Trojan Horse, Infostealer, Trojan.Emcodec.B

Spyware Doctor 3.0555 0

Spyware Doctor has been updated with new spyware definitions.

Latest Database Version: 3.0555 0
Intelli-Signatures: 70,598

Spyware Doctor protects your computer in 3 ways. First, it has the On guard monitor which watches places spyware will change your computer settings. By alerting you, Spyware Doctor gives you the option to not allow unwanted programs on your computer. Second, Spyware Doctor has a feature called Immunize that completely blocks known spyware from even installing. Third, spyware Doctor has a large detection database that removes spyware that has gotten onto your computer. I have used Spyware Doctor in tests against SpyAxe and SpyFalcon. It completely removed the those two. A restart of the computer and resetting my wallpaper was the hardest part.

A free scan is available from the Spyware Doctor Homepage:
http://www.pctools.com/spyware-doctor/

New Intelli-Signatures:
3.0553 0 - Trojan.Downloader.Delf, YOK Toolbar
3.0554 0 - Trojan.Downloader.Iciko, Trojan.Downloader.Small.DOJ
3.0555 0 - Backdoor.Rbot.BGP, zCodec

Extended Intelli-Signatures:
3.0553 0 - Adware.Roogoo, Backdoor.Optix, Common Components for Trojans, CWS, DSSAgent, Known Bad Sites, LinkOptimizer, SpyHeal, Trojan.Crypt.T, Trojan.Downloader.Small.ATL, Trojan.Proxy.SRSHost, Trojan.Qhosts, Trojan.StartPage.GEN, Trojan.Startpage.VO
3.0554 0 - Adware.Roogoo, Backdoor.Agent.ADR, Backdoor.Delf.AGQ, Backdoor.Rbot.AEU, Dollarrevenue, MediaGateway, PurityScan, SpywareQuake, Trojan.Downloader.ConHook, Trojan.Downloader.Small.ATL, Trojan.Downloader.Small.BDT, Trojan.Downloader.Small.DNQ, Trojan.Proxy.Lager.f, Trojan.PSW.QQRob.U, Trojan.SmartAllYes, Trojan.Zapchast
3.0555 0 - Backdoor.Bifrose.D, BookedSpace, CWS.XPSystem, EliteBar, Trojan.Banker, Trojan.Clicker.GEN, Trojan.DNS Changer, Trojan.Downloader.HO, Trojan.Downloader.Ruins, Trojan.Downloader.Small.CTK, Trojan.Downloader.Small.DOJ, Trojan.Downloader.Zlob.GEN, Trojan.Downloader.Zlob.PJ, Trojan.Popuper, Trojan.Proxy.Agent.GT, Trojan.PSW.Delf.HI, Trojan.PSW.QQRob.U, Trojan.PWSteal.Lmir.QU, WebSearch Toolbar

Tool Update releases:
Popup Blocker 3.6.0.2284

General Information:
Updates are posted 5 times per week on average.
Updates are installed by running Spyware Doctors' Smart Update feature.

MS Security Bulletin Advance Notification for September

Microsoft have released an advance notification for the updates that are due to be released next Tuesday.

Don't forget to prepare for the updates as I've outlined in an earlier entry - How To Prepare for Patch Tuesday.

On 12 September 2006 Microsoft is planning to release:

Security Updates

• Two Microsoft Security Bulletins affecting Microsoft Windows. The highest Maximum Severity rating for these is Important. These updates will be detectable using the Microsoft Baseline Security Analyzer. Some of these updates will require a restart.
• Two Microsoft Security Bulletins affecting Microsoft Office. The highest Maximum Severity rating for these is Critical. These updates will be detectable using the Microsoft Baseline Security Analyzer. These updates may require a restart.

Microsoft Windows Malicious Software Removal Tool

• Microsoft will release an updated version of the Microsoft Windows Malicious Software Removal Tool on Windows Update, Microsoft Update, Windows Server Update Services and the Download Center.
  Note that this tool will NOT be distributed using Software Update Services (SUS).

Non-security High Priority updates on MU, WU, WSUS and SUS

• Microsoft will release Two NON-SECURITY High-Priority Updates for Windows on Windows Update (WU) and Software Update Services (SUS).
• Microsoft will release three NON-SECURITY High-Priority Updates on Microsoft Update (MU) and Windows Server Update Services (WSUS).

Microsoft Security Bulletin Advance Notification

Spybot Search & Destroy September 8th

Spybot Search and Destroy has an update today, September 8, 2006. Spybot Search and Destroy is a free antispyware program available from Safer-Networking.org.

Spybot can clean your computer of apyware, but it also offers several ways to prevent spyware from getting onto your computer. Spybot was the first program to offer an Immunize feature. What Immunize does is to prevent some types of spyware and adware from installing by adding settings in your computer to block them from installing. With this update, there are 4483 items that the Immunize feature targets. There is also a helper added to Internet Explorer that can block unwanted cookies and other minor threats. Last, there is a feature called Tea Timer that monitors changes on your computer that spyware is likely to change. Unlike the monitor that is included in other antispyware products like Spyware Doctor or Spy Sweeper, Tea Timer looks for things that are deleted from your computer. So if malware tries to delete your anti virus program from starting when Windows starts, you will be notified and can block it.

Spybot Search and Destroy is free because it is supported by volunteers. A donation is always welcomed to help keep it free. You can donate by going to the donation page at Safernetworking.

Spyware and other threats added in this update:

Adware
++ Suggestor
Dialer
+ Dialer.GlobalAccess
Hijacker
+ Naupoint + TV Media + ISearchTech.PowerScan ++ DotComToolbar
Malware
+ Megasearch + Smitfraud-C. + SurfSideKick ++ Deskbar + Command Service
PUPS
++ Spionfrei
Security
+ Windows.Security.InternetExplorer
Spyware
+ VX2.e.Favoriteman + Hyperlinker + Targetsaver
Trojan
+ Win32.VB.xj ++ Fake.Oleext + Media Tickets ++ Instafin ++ Smitfraud-C.MailBot ++ Smitfraud-C.FakeProxyUpdate + WMF Exploit.NewYear2006 ++ qqHacker.IE-Bar ++ typereg32.IE-Bar + UpToFind.RelatedSearch + DialerPlatform + Zlob.XPasswordManager + Vcodec.Intcodec + Hupigon

Total: 315796 fingerprints in 44255 rules for 2234 products.

Ad Aware SE1R122 08.09.2006

Haven't heard from Ad Aware in awhile. Good to see they are still out there

SE1R122 08.09.2006 Is Now Available, New Definition file for Ad-Aware SE

============================================
Definition file Notification - Lavasoft News
============================================
SE1R122 08.09.2006

New Definitions:
========================
Adware.AdwarefilterToolbar
Adware.Allsum
Adware.CasClient +3
Adware.Koolbar +2
AdWare.Safety Bar
Win32.Backdoor.Hackarmy
Win32.Backdoor.Sality +5

Updated Definitions:
========================
Adware.ADHelper
Adware.DollarRevenue
Adware.Maxifiles +2
Adware.ToolbarDeepDive +19
AdwareSheriff
CnsMin +8
Purityscan +6
Softomate Toolbar +2
SystemDoctor
Win32.Backdoor.Agent
Win32.Backdoor.Dumador +3
Win32.Backdoor.RBot +4
Win32.Generic.PWS +3
win32.Trojan.Dnschanger +2
Win32.Trojan.Downloader +2
Win32.Trojan.KillAV
Win32.Trojan.mIRC +10
Win32.Trojan.Pakes +6
Win32.Trojan.Spambot +2
Win32.Trojan.Starter +2
Win32.TrojanClicker +2
Win32.TrojanDownloader.Delf
Win32.TrojanDownloader.Swizzor.bo +2
Win32.Trojandownloader.Zlob +31
WinAntiVirus Pro 2006 +4
WinFixer
WinPopup
Virtumonde +20
Virusblast

Ad Aware can be downloaded from the official Lavasoft Ad Aware page.

Bits from Bill: WinPatrol 10

Bits from Bill: WinPatrol 10

WinPatrol is a great program that watches your computer for changes. Sometimes they can be good, like when you add a new program that you want. Sometimes it can be bad, like when spyware tries to get onto your computer. With WinPatrol, you can allow or deny these new changes.

WinPatrol is one of the programs I use on my computer to keep it safe. Easy to use and it is free. Highly recommended.

More info on WinPatrol and where to download WinPatrol.