Conficker worm: mass infections

For today three updatings Conficker are found out. The first cases инфицирования computers have been fixed in November, and jump of speed of distribution of the harmful program has had on the beginning of January.

Worms of the Conficker family use critical vulnerability in server services of Windows operating systems which Microsoft has eliminated in the end of the last year. Besides, infection can occur through USB-devices — for example, flesh-drives or МР3-players. Having got on the computer of a victim, Conficker loads additional malware components and allows cybercriminals to supervise the infected computer far off.

The worm is constantly updated, loading components from changing ip-addresses that complicates its blocking. Now it infects thousand computers worldwide. According to experts, founders of Conficker-worm prepare for the organisation of large-scale attack with use of the infected computers.

The Trojan makes photos of Mac users

Recently,  users of Mac-computers were in safety concerning harmful programs, now this situation starts to change. And not in the best direction. Recently founders of harmful codes are involved more and more with Apple computers, and experts on safety even more often declare the next dangerous program.  So, the new Trojan horse working under OS X Tiger and Leopard, can steal the password, avoid definition, bring in a broad gull everything that users have typed and even to make their photo.

Read the rest of this entry »

System Security: new rogue application

System Security is new rogue software. The installer is hosted at http://webnetworksecurity.com (91.211.64.31).
view additional information on System Security

Photo frames with viruses

Samsung company has warned that compact discs with the software for some models of digital photo frames can contain the Trojan program.

Harmful program W32.Sality.AE can get into system at installation from a compact disc of application Frame Manager for operating system Windows XP. Samsung asserts that the malware doesn’t work under Windows Vista.

Developers of security software have registered for the first time W32.Sality in April of this year. In due time updated anti-virus programs easily find out this harmful application.

According to the official prevention os Samsung, compact discs with the malware may be included into the package of photo frames of the following models: SPF-75H, SPF-76H, SPF-85H, SPF-85P and SPF-105P. The manufacturer recommends to refrain from installation from a disk and to download corresponding version Frame Manager from the download center of Samsung.

Malware developers choose the target of buyers of digital photo frames not for the first time. So, in the beginning of this year company Best Buy has stopped sales of photo frameks Insignia infected with a virus.

In 2009 amount of malware will increase

Experts from PandaLabs predict further increase of amount of malware programs.

From January till August 2008 Panda Security laboratory has found out the same quantity of new kinds of malware that for previous seventeen years together taken. In 2009 this tendency, according to experts, will remain or even progress.

In forthcoming year dominating types of harmful programs, according to PandaLabs forecast, will become bank trojans and fake antiviruses. Cybercriminals will rely even more often on social networks and quite legal resources cracked through vulnerability in server platforms. Besides, experts mark, next year the technics of packing of a harmful code by means of special custom-made tools for the purpose of difficulty of its detection becomes especially popular.

Panda Security Laboratory also predicts substantial growth of quantity of the harmful software aimed at platforms of increasing popularity, such as Mac OS X, Linux or iPhone. Besides, in the conditions of financial crisis it is necessary to expect growth of popularity of false offers on the work which purpose consists in attraction of monetary actives.

For 2009 experts predict revival of classical harmful codes, such as viruses. These programs will be used not to violate correct work of systems or block access to files, but for the purpose of masking of trojans, used for theft of the bank information.

The USA are in the lead by quantity of websites with malware

Sophos company has published the total report with results of the analysis of a situation with safety in the Internet in 2008.

Today, most of sites with malicious software — 37 % — are hosted on the American servers. The second place in the rating is China with 27,7 % of potentially dangerous web pages. Russia takes 9,1 % from total of sites with malware and closes a three of the antileaders.

Further in decreasing order of number of harmful resources follow: Germany (2,3 %), South Korea (2,1 %), Ukraine (1,8 %), Great Britain (1,7 %), Turkey (1,5 %), the Czech Republic (1,3 %) and Thailand (1,2 %). The least dangerous is Singapore — 0,3 %.

Sophos company also notices that in leaving year the United States were the leader in amount of distributed spam. Today through computers located in the USA 17,5 % of all spams-letters are dispatched. Some reduction of volumes of a spam has been noted in the end of autumn in connection with closing of American hosting-provider McColo on which resources the command centres of several of the largest botnets worked. According to the research, frauds more and more often attack users of social networks, and the quantity of letters with harmful investments for a year has grown five times. At the same time in 2008 demountable carriers became one of the basic tools of distribution of malicious programs.

The computer worm entices victims with discounts at “McDonald’s” restaurants

PandaLabs warns about mass dispatch of electronic letters with the harmful program P2PShared.U, disguised under messages from a network of restaurants of a fast food “McDonalds”.

In heading of the infected letters it is said that “McDonald’s” wishes addressees of happy Christmas. The letter text looks as follows: “McDonald’s” is glad to present you the last menu with huge discounts. Simply print the coupon from this message and go to the nearest McDonald’s for FREE gifts and FANTASTIC discounts ». Messages look so as if start with domain Mcdonalds.

The users, fallen for the bait malefactors and agreed to follow to instructions in the letter, instead of the discount in McDonald’s receive harmful program P2PShared.U Having got on the computer of a victim, this worm starts to dispatch the copies on the found e-mail addresses. Besides, P2PShared.U copies itself in the folders used by file exchange programs, under the names related to security applications, multimedia tools and so on. Thus, the user, tried to download any of these applications, gets infected also.

MS Antispyware 2009: new fake antispyware

MS Antispyware 2009 is a new fake security application. Do not attemp to download or install it - it is malware!

Following sites are noticed in distribution of MS Antispyware 2009:

193.142.244.217 MsAntispyware2009 [dot] com
94.247.2.84 Files.Msas2009dl [dot] com
94.247.2.88 dl.msas2009storage  [dot] com
216.195.42.227 Sales.buymsantispyware2009  [dot] com

Additional information on MS Antispyware 2009

Social network Facebook under attack of a worm

Computer security experts warn about the next splash in activity of the harmful program Koobface extending through social network Facebook.

Worm Koobface has been detected for the first time even in the summer, but in the end of last week a new modification of this malware was detected. Facebook user receives a message from somebody from his contacts-list, which ostensibly suggests to look an interesting video. Behind the link, specified in the message, the potential victim receives an offer to install update for the flash player, in order to have a possibility to watch the video. If the user agrees, the malware program installs itself on his computer.

When the Koobface is installed, it starts to load trojan components amd modules to collect the private data and confidentional information. In theory, with Koobface frauds can get user’s logins and passwords and turn the infected computer into a bot.

Facebook recomends it’s users to update their antivirus software and don’t follow suspicious links.

Windefender 2009 rogue antispyware application

WinDefender 2009 is a rogue antispyware program. It only looks similar to the program intended for removal of viruses, trojans, and spyware programs, but in fact it uses a trojan for penetration on your computer itself. After infection, you start to receive pop-up messages in which it is told that the computer is infected and it is offered to download and establish WinDefender 2009 to cure the computer.

At the first start WinDefender 2009 adjusts the computer so that to be started each time when you start the computer. After the start the program carries out computer scanning, thus result always one - your computer is infected by set of trojans, spyware and advertising programs. Scaring user this way the developers are tryiing to persuade you to purchase the software.

Detailed information on Windefender 2009