Symantec Finds Yet Another Excel Trojan Variant
526426
It may be a single malicious user with an axe to grind, and that user may be targeting a very small group of people who just happen to use Microsoft Excel. But whoever it is continues to make security firms like Symantec nervous, as yet another Excel-based document with a malformed image string, dubbed Trojan.Mdropper.Y, has turned up.
624271
New variant offers holiday greetings before infecting your PC with a virus.
741740
A new variant of the MyDoom virus is designed to launch a denial-of-service attack against antivirus software maker Symantec, according to security firm Sophos.
692830
A new worm is making the rounds, attacking some business computers through a known -- and already patched -- flaw in a popular antivirus software suite from security firm Symantec.
758294
Two new versions of a computer virus that affects mobile phones were discovered Monday with new features that allow them to spread more quickly between vulnerable devices, according to antivirus company F-Secure.
71569
(InfoWorld) - Microsoft's Office software is under attack again, this time with anÂ unpatched flaw in the Windows 2000 version of Office 2000 being usedÂ by hackersÂ to run unauthorized software on a victim's computer. Microsoft confirmed on Tuesday that the bug exists, but it would not say when it plans to fix the problem. The critical vulnerability wasÂ first reported by SymantecÂ to users of its DeepSight threat notification service. Attackers are exploiting the flaw by sending malicious Word documents to victims, Symantec said. When these documents are opened, Word is tricked into installing malicious software on the PC. Symantec is calling this malware Trojan.MDropper. Trojan.MDropper installs malicious software on the computer, which in turn installs another Trojan horse program "which turns out to be new variant of Backdoor.Femo," Symantec said in an Web posting. Symantec testers had not been able to exploit the problem on more up-to-date versions of Office or Windows. On Tuesday Microsoft said that the bug was confined to Microsoft Word 2000. Microsoft is investigating the issue and may issue a patch once that investigation is completed, according to the company's public relations agency. Microsoft has spent a lot of timeÂ investigating and patching Office applications this year. Over the past few months there have been several reports concerning very targeted attacks, similar to this latest Office issue. Microsoft's last few security updatesÂ have been filled with patches for Office flaws, many of which had already been used in attacks.
176456
Users of Nokia&#39;s 7610 smart phone and other phones running Symbian&#39;s Series 60 software should be aware of a new Trojan program on the Internet.
409051
'Lacks seriousness and sincerity' We were skeptical on Monday when Symantec said it would atone for a bug that crippled the PCs of tens of thousands Chinese users by giving them free software. "Cockroach in your salad, sir? Have some free salad," was how we put it.â¦
389890
An Australian software developer has been left fuming after the latest virus definition update from McAfee caused his package to be wrongly identified as a Trojan horse programme.
753042
(InfoWorld) - The notorious Mpack hacker toolkit is installing malware that carries out its chores -- including spewing spam -- from within the Windows kernel, making it extremely difficult for security software to detect it, Symantec said Thursday. The Trojan horse that Symantec has dubbed "Srizbi" is being dropped onto some PCs by the multi-exploit Mpack, a ready-to-use attack application that until recently has been selling for around $1,000. Responsibility for a large-scale attack launched from thousands of hijacked Web sites last month was pinned on Mpack, as was a follow-up campaign waged from compromised Internet porn sites. Although Mpack can force-feed any malicious code to a commandeered PC, Symantec researchers said Srizbi stands out. Rather than follow the current practice of hiding only some activities with rootkit-cloaking technologies, Srizbi goes completely undercover. The new Trojan, said Symantec, works without any user-mode payload and does everything from kernel mode, including its main task: sending spam. "When Trojans go to spam, they go out to user land," said Dave Cole, director of Symantec's security response team, referring to malware writers injecting their code into visible Windows processes to carry out spam-sending tasks. "Srizbi, though, is basically using kernel libraries [to send spam]," said Cole. "It's calling the kernel libraries it needs." A blog entry by Kaoru Hayashi, a senior security response engineer at Symantec, spelled out the technical details. "Srizbi seems to move a step forward by working totally in kernel mode without the need to inject anything into user mode," wrote Hayashi. "To manipulate the network connection directly in kernel mode, it attaches NDIS and TCP/IP drivers and gets all the Ndis* and Zw* functions that it needs. This technique also allows the Trojan to bypass firewall and sniffer tools, and to hide all its network activities." Translation: Only advanced security tools will detect Srizbi. It's also the first full-kernel malware spotted in the wild. "It's evolutionary, not revolutionary, but it's indicative of what we see in the threat landscape," Cole said. "And if your security software is relying only on [Windows'] APIs to detect malware, you won't be protected. You need something that uses modern, anti-rootkit techniques." Cole added other information to the Srizbi story, in particular his suspicion that its author is probably the same hacker who created Rustock, a dangerous polymorphic Trojan from 2006 that also relied on rootkit technology to avoid detection. "It appears to be from the same author," said Cole. "He's been quiet for a while, and everyone has been waiting for Rustock 2.0. Some thought he'd maybe went away, but [Srizbi] uses some of the same components as Rustock." Cole expects Srizbi to follow a similar trajectory. "The pattern with Rustock seemed to be to get something out there that might be sloppy at first, but to evolve it over time. It's reasonable to believe that [Srizbi] will do the same." According to Symantec's research, the new Trojan is sloppy. "Users may be able to detect the presence of this malicious code via a registry key that happens to not be hidden by the rootkit component," said an alert to Symantec's DeepSight customers. The registry key to look for, said Symantec, is: HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Services\\RcpApi\\"MachineNum" = "[six random digits-six random digits-two random digits]" In other Mpack-related news, a third Symantec security researcher said today that he's spotted the toolkit selling for as little as $150, an 85 percent reduction from its previous $1,000 price tag. "Considering the toolkit is written in a script language, it is easy to redistribute and modify," said Eric Chien, a Symantec security response engineer. "The sellers likely didn't even need to buy it themselves, but rather probably found some of the multiple Web sites that did not employ standard Web site protections, allowing them to download the whole kit for free. "Talk about clearance sales." Mpack's wider "distribution" spells trouble not only for the hacker -- suspected to be Russian -- who created the multiple-strike attack kit, but for users, too. "Its usage is likely to grow," said Chien. "In addition, without a single author controlling the distribution of the toolkit, we also expect to see forks of the source code with additional exploits, bug fixes, and other feature enhancements."
316753
Trojan hides under patch update Do not be tempted into opening an email with the subject line: "Microsoft Security Bulletin MS07-0065" because it is no such thing.â¦
482465
A flashier offshoot of the Trojan horse that affects Symbian-based cell phones has been discovered.
225170
Spreadsheet-focused attack affects several versions of company's Office software, including one for Macs.
644007
Latest variant poses a risk to home and small office users.
93420
A new Trojan horse program that attacks and removes troublesome advertising software, known as "adware," is circulating on the Internet, according to antivirus company Symantec Corp.
509953
During a weeklong period in mid-November, security experts with Symantec observed roughly 65,000 new applications being downloaded onto the computers of customers participating in a new research project -- based on their analysis of the software, as many as 60 percent of the programs were malicious.The involved timeframe represented a relative high point for the percentage of unknown applications being downloaded by Symantec's project participants, and the basis for the company's assessment of the programs as malicious was predicated largely on the programs' use of obfuscated naming conventions.However, the numbers point to a disturbing trend that the researchers say may force the security company to change its fundamental approach for warding off threats -- that being that the number of malicious applications coming to life on the Web appears to be outpacing the volume of legitimate programs.With malware authors using fuzzing tools to find holes in popular applications such as Web browsers, and testing their work against commercial anti-virus (AV) products to ensure that the attacks evade detection by the tools, leading researchers at Symantec admit that defending against threats using traditional methods has become something of a losing battle."The reality is that most new malware is going undetected by commercial security products, and not just Symantec's, but we have to recognize that like all other AV products we are probably missing a sizeable amount of this malware," said Carey Nachenberg, a member of the company's Security Response team who also wears the title of Symantec Fellow."Eventually we write [virus] signatures and get those out to customers, but it appears that a sizeable proportion of this malware never gets detected," he said. "Instead of distributing one copy of each malware program to thousands of people, they're producing a copy for as few as two or three people and then re-writing it; so, if we get one version we can remove it from a few computers, but not all the variants. The problem with this is that there is the potential over time for almost everyone to have some form of infestation, maybe in only a few years time."The trend toward malware authors using small runs of attacks to evade detection and hook as many victims as possible, known as server-side polymorphism, is forcing Symantec to reassess how it goes about protecting its users.Since it can't hope to keep up with every flavor of threat that is being created, traditional countermeasures such as the use of malware signatures or behavioral heuristics will need to be augmented with new tactics, Nachenberg said.One such alternative is the use of the same distributed data collection capabilities that Symantec is using to track the proliferation of malware. By creating a system of file and Web site reputation by studying applications usage patterns among its customers, the researcher said, Symantec hopes to use a community approach to help people determine which programs they decide to use, or avoid.Much as many people turn to the reviews section on Amazon.com or the buyer feedback system on eBay to get a real-world take on products before they decide to buy, Nachenberg contends that by watching how people are using various applications the security vendor can use a process of elimination for weeding out malware from legitimate software.If only a few people among the millions of Symantec customers who could contribute usage data to such a program were utilizing some application in question, it would be prudent to recommend that people avoid the program until its nature has been better determined, he said.Using opt-out tools that provide anonymous feedback on applications that were built into Symantec's existing Norton AntiVirus and Internet Security 2008 products, the company is already gathering the type of data necessary to create such a system of recommendation."Right now this is just a long-term research project, but we hope that as we get more users involved in the system, we can truly get a better idea of what is on people's computers so that we can identify malicious software based on the demographics of who is using it, versus what it does," Nachenberg said. "We're hoping to get more clarity through the large base of users we have; by collecting this data we should be able to get the most comprehensive view of the usage patterns to derive reputation information for everything they use."Faced with questions over potential privacy issues driven by Symantec's ability to watch just who is using what applications and how, the researcher reiterated that users must be made aware of the data collection, allowed to opt-out, and guaranteed that all the information aggregation is done in an anonymous fashion.By offering users the ability to decide whether or not to use an application based on demographics, versus simply blocking programs based on its own observations, the company will also give people more freedom to determine what tools they feel are appropriate to use, he said."If we know that only five people are using a program, given the tens of millions of users we ultimately hope to have in the system, we can be totally objective and recommend that people wait until it is scrutinized further before using it," the researcher said. "We will need to have some manual process for white-listing programs as well, but we think that using this approach we can deliver a reasonable amount of quality with a low false positive rate."If the volume of new malware strains arriving on the Web continues to outpace the proliferation of legitimate programs, Nachenberg said that AV vendors including Symantec may need to move to a white-listing approach in general, and focus more attention on identifying good applications instead of trying to chase down all the bad."If there is less software to analyze that is good, it makes more sense to spend our time scanning for good programs and simply telling our users to avoid everything else," he said. "We're considering models where we can produce the world's largest up-to-date white list of software, but it's not something we can put together in a year; maybe in two-to-three years time."
347752
ANTI-VIRUS firm F-Secure has found a new variant of the âSkullsâ Trojan horse that attacks mobile phones with the Symbian operating system and is warning phone owners not to