Malware News

MS Antispyware 2009: new fake antispyware

MS Antispyware 2009 is a new fake security application. Do not attemp to download or install it - it is malware!

Following sites are noticed in distribution of MS Antispyware 2009:

193.142.244.217 MsAntispyware2009 [dot] com
94.247.2.84 Files.Msas2009dl [dot] com
94.247.2.88 dl.msas2009storage  [dot] com
216.195.42.227 Sales.buymsantispyware2009  [dot] com

Additional information on MS Antispyware 2009

Microsoft has released an unplanned patch for Internet Explorer

Microsoft has released an unplanned patch for Internet Explorer.

The security hole about which there is a speech, has been found out about a week ago. The vulnerability can be used by malefactors for the purpose of unapproved penetration on the remote computer and executing  of any program code on it. For the organisation of the attack  it is necessary to entice the user on the web site generated in special way. The problem relates to all versions Internet Explorer, and malefactors worldwide are already actively maintaining the vulnerability. According to some information, for today by the amount computers, cracked with use of this vulnerability, is over 2 millions. The harmful code is already atached to thousands of web pages.

Users with activated Windows Update will receive the patch automatically. Besides, “patch” for a browser can be loaded manually from Microsoft web site.

Social network Facebook under attack of a worm

Computer security experts warn about the next splash in activity of the harmful program Koobface extending through social network Facebook.

Worm Koobface has been detected for the first time even in the summer, but in the end of last week a new modification of this malware was detected. Facebook user receives a message from somebody from his contacts-list, which ostensibly suggests to look an interesting video. Behind the link, specified in the message, the potential victim receives an offer to install update for the flash player, in order to have a possibility to watch the video. If the user agrees, the malware program installs itself on his computer.

When the Koobface is installed, it starts to load trojan components amd modules to collect the private data and confidentional information. In theory, with Koobface frauds can get user’s logins and passwords and turn the infected computer into a bot.

Facebook recomends it’s users to update their antivirus software and don’t follow suspicious links.

Windefender 2009 rogue antispyware application

WinDefender 2009 is a rogue antispyware program. It only looks similar to the program intended for removal of viruses, trojans, and spyware programs, but in fact it uses a trojan for penetration on your computer itself. After infection, you start to receive pop-up messages in which it is told that the computer is infected and it is offered to download and establish WinDefender 2009 to cure the computer.

At the first start WinDefender 2009 adjusts the computer so that to be started each time when you start the computer. After the start the program carries out computer scanning, thus result always one - your computer is infected by set of trojans, spyware and advertising programs. Scaring user this way the developers are tryiing to persuade you to purchase the software.

Detailed information on Windefender 2009

Antivirus 2009: another fake antivirus application

Antivirus2009, known also as Antivirus 2009, is one of last and hot counterfeit spies that devastates Internet community. Does this sound familiar to you? Yes, Antivirus 2009 is indeed a clone of the infamous Antivirus 2008. Antivirus 2009 usually comes up after you install a video codec that come with Trojan, malware and virus. Antivirus 2009 normally generates fake and misleading system popup error messages so end-users will be tricked into purchase Antivirus 2009. Antivirus 2009 constantly creates false error messages with those to end users will be a deceit in purchase Antivirus 2009.

Detailed information on Antivirus 2009

AntiVirusTrigger: new fake antivirus

AntiVirus Trigger is a new fake antivirus software product.

AntiVirus Trigger is installed by trojans. It loads various security related messages in order to scare people and make them buy the full version of the software. Neither the full version nor the infections exist; AntiVirus Trigger is a rogue to gain money. Some of the generated infection alerts loaded by this malware might be very convincing: it may imitate computer scan and load scan results full of threats, but in fact, all this alerts are fake. Stay away from this product and remove it as soon as possible.

List of sites and ip adresses noticed in distribution of AntiVirus Trigger:

• 74.50.110.184 Systemtrigger.com
• 74.50.110.184 Virtrigger.com
• 74.50.110.184 Virtriggersupport.com
• 74.50.110.184 Virus-trigger.com
• 74.50.110.184 Virus-triggers.com
• 74.50.110.184 Virustrigger2009.com

Detailed information on AntiVirusTrigger

New rogue software: XP AntiVirus

A new rogue antispyware has been defined some days ago on the Internet, and it can really deceive you in case you are not ready to it. Antivirus XP seems to be a security software which cleans your computer of undesirable infections. However, it is not so well intended, as it can seem, because it is actually a part of rogue application, which displays fake alerts to convince you to buy the full version.

Antivirus XP works under the majority of versions of Windows, including Windows 98, Windows 2000 and Windows Vista. So, even if it has been named Antivirus XP, it does not affect only Windows XP.

These kind of malware has grown much in popularity for last several months, and is becoming more and more dangerous for each not protected user.

Detailed information on XP AntiVirus

Microsoft warns customers of a new worm

The Microsoft Corp. warns about appearance of the new harmful program maintaining vulnerability in operating systems of Windows the patch for which has been released last month. About Microsoft building all is quiet.

The worm who has received name Conficker extends mainly in corporate networks so far, also hundreds cases of infection of computers of ordinary Internet users however are already reported. Conficker uses a hole which description contains in the bulletin of safety of Microsoft MS08-067. The problem is linked by that at processing of the inquiries of the remote call of procedures generated in special way (Remote Procedure Call) in Server service of program platforms of Microsoft there is an error allowing malefactors to capture a complete control over the computer of a victim.

Harmful program Conficker opens a random port between 1024 and 10000 and works as a web server. When the worm penetrates the computer, it masks itself as a JPG-file, and then writes itself to a disk under the pretext of library DLL. It is remarkable that, having got on the computer of a victim, Conficker installs a patch for vulnerability MS08-067. However in this case the worm cares at all of the owner of the computer — simply thus Conficker closes an opening for other harmful programs which can prevent its operation. The majority of messages on infection of computers with program Conficker while arrives from territory of the United States. Besides, the worm is noticed and in a number of other countries, including in Germany, Spain, France, Italy, Japan, Brazil and China.

PRO Antispyware 2009 rogue antispyware application

Pro Antispyware 2009 is a rogue application from the same family as Antispyware Pro XP and AntiSpyware 2008 XP. Pro Antispyware 2009 is advertised through the web sites that claim to appear online malware scanners. During the advertisement, it will pretend to scan your computer and then display a warning box alerting that your computer is infected. Then it suggest you to download and install ProAntispyware 2009 in order to clean your computer.

When Pro Antispyware 2009 is installed it will be configured to automatically start when you logon to Windows. When the application is launched, it scans your system and lists a large amount of fake infections that cannot be removed unless you purchase the full version of the software. While running, the programs will also display fake pop-up and taskbar security alerts stating your computer is threatened or being attacked and that you should buy the software to protect your data. These messages are just a way that the developers try to scare user into purchasing their product. Last, but not least, Pro Antispyware 2009 will also install an adware Trojan as a browser helper object (BHO) in Microsoft Internet Explorer. This adware will display pop-ups on your computer from mxlivemedia.com when using Microsoft Internet Explorer.

Additional information on PRO Antispyware 2009