Windows SMB2 exploit now public; Expect in-the-wild attacks soon

September 29th, 2009 Posted by Ryan Naraine @ 3:09 amCategories:Anti Virus, Arbitrary Code Execution, Botnets, Browsers, Complex Attacks, Data theft, Denial of Service (DoS), Malware, Metasploit, Microsoft, Passwords, Spam and Phishing, Spyware and Adware, Vulnerability research, Windows VistaTags:Vulnerability, Microsoft Windows Vista, Microsoft Corp., Exploit, Attack, Microsoft Windows, Operating Systems, Security, Software, Ryan NaraineFully functional [...]

Tropical Storm Leads to FAKEAV

Cybercriminals leveraged on the tropical storm, Ondoy (International name: Ketsana) that hit the Philippines and killed around 140 people. Senior Threat Analyst Joseph Pacamara found several malicious sites that appeared each time the users search the strings, “manila flood,” “Ondoy Typhoon,” and “Philippines Flood,” among others. The said sites emerged as one of the [...]

Microsoft Security Essentials Launches Tuesday

If you can’t wait to get your hands on Microsoft’s upcoming free antivirus app, and you missed the limited public beta period, you won’t have to wait any longer. Microsoft has confirmed that its Security Essentials antivirus software will be publicly available September 29.

Read entire article

Fake Windows Live Malware Spreads via Email

Trend Micro threat analysts recently snagged an email pushing a bogus Windows Live Messenger residing in http://{BLOCKED}s-live-msn.serveftp.com/Windows_Live_9.0_beta.exe (detected as WORM_VB.PAB). The .EXE file is, of course, not the “real” Windows Live Messenger but a bot that reports to an IRC-based C&C with the following details about the infected system:

Server: {BLOCKED}s.rvsanmiguel.com Server IP: {BLOCKED}.{BLOCKED}.110.141 Port: [...]

Several Compromised Thai Sites Serve Malware

Trend Micro researchers discovered another wave of mass compromised websites involving several Thai government agencies’ sites. One of the compromised sites, the Thai Police site, was injected with malicious codes to redirect users to several malicious sites. One of the landing pages, http://{BLOCKED}t.ru/ip/bchqu1.exe served a downloader detected by Trend Micro as TROJ_DLOADER.DNG. This Trojan downloader [...]