Adware Virus Turns Out Trick-Through Certificates

An adware family that has been active for several years used a new trick to disable virus scanners and other security software on computers, so it is regarded as a trojan. Once the active adware start a variety of tasks that show advertisements on the computer.

In addition, all shortcuts to be adjusted at the desktop, taskbar and Start menu. What is new is that the adware 13 certificates of anti-virus companies such as Avast, AVG, BitDefender, McAfee, and Malwarebytes, now classifies as 'not trusted'.Therefore applications such certificates can not be started. Because of this method, anti-malware Malwarebytes company decided to brand the adware henceforth as a trojan.

Test: How Safe Are Scanners Anyway?

Virus scanners should work against all kinds of malware and other threats, providing protection, but what is it really the security situation of this kind of security suites? That question decided the German test lab AV-Test to answer by looking at both business and consumer products.

Security software should not only be able to detect threats, but also the software required to take security measures in order not to be attacked or make it more difficult for an attacker. Various techniques are available, such as ASLR (Address Space Layout Randomization) and DEP (Data Execution Prevention). Anti-virus companies have to add this technology to their own software.

Of the 21 tested products for consumers were found six full DEP and ASLR use, namely Avira, BullGuard, ESET, Kaspersky, McAfee and Symantec. Quick Heal, Norman and K7 do so at less than 30% of stocks. Corporate products outperformed, whereby three of 10 scored the maximum 100%, namely two products and one of Kaspersky from Symantec. 8 products were thereby above 90%. Only Bitdefender (79.7%) and Seqrite (29.8%) scored lower.

Certifications

Looked or all files of the security suites can be digitally signed and whether there was a valid digital certificate used for the second part of the test. Ant-virus companies require other software developers to sign their files digitally, which helps in the detection of malware, says AV-Test. In addition, a virus must be able to monitor their own authenticity and integrity, which help digital signatures with valid certificates and hash values.

Among business products showed that possessed 50% of unsigned files. In consumer products it was 60%. According to AV-Test, the results show that some anti-virus companies to be still awake. On the other hand, there are also companies that have taken steps since last year, the last test. "But many have done absolutely nothing," said the German test lab.

USB Worms Most Active Malware In European Union

Worms that spread via USB drives and shared network drives and folders were in the second half of last year, the most active malware in the European Union, so says Microsoft. Just over 10% of all malware observed in this period by the software giant had come from three worm families. Malware that spreads through exploit kits, which use is made ​​of unpatched vulnerabilities, was much less common.

Is looked specifically at the EU countries shows that Finland, Denmark and Sweden to do with the least infections had. In Bulgaria, Italy, Romania and France, most infections were found. Netherlands also doing very well in the reviews of Microsoft and reached the lowest level in four years. According to Microsoft's Tim Rains is a lot of malware to avoid operating in the EU by keeping computers up-to-date and use security software.

Malwarebytes Provides Software Pirates Free Year License

To accommodate Internet using a pirated version of the anti-virus security software company Malwarebytes an " amnesty program started. " According to the virus fighter can prevent users from being tricked into buying a counterfeit version of Malwarebytes.

Also, it may be that there is a problem with the key being used. Therefore, users can now specify in the paid version of the software, how they obtained the product and then generate a new license for Anti-Malware Pro or Premium. In addition, users of 12 months may make free Malwarebytes Anti-Malware Premium use. Some users, however, not to speak of the action and want their money back, because software pirates in this way with a free version "rewarded".

In a statement sets Marcin Kleczynski, CEO and founder of Malwarebytes, that in the beginning in the development of anti-virus software unsafe algorithm was selected to generate the license keys. As a result, it was and is the generation of an illegal license key very simple. The problem with illegal license keys is that they sometimes "collide" with legal license keys, Kleczynski notes. Meanwhile, there is a new licensing system used will be rolled out in phases.

"The only problem is that we have millions of users where we sold keys to, or where a reseller has sold keys, or we have issued keys without placing them in. It's a mess, and as a consumer you have the right to to be angry, " writes Kleczynski on the private forum. Therefore, the virus fighter first see which keys are active and by whom they are used. In the case of software pirates, they will be able to use free of Malwarebytes at most one year. The CEO noted that he would like all keys would want to process manually and verify, but that millions of license keys is impossible.

New Variant of Emotet Malware - "Microsoft Warns of Malware That Steals Passwords"

Microsoft warned their users about malware that steals passwords for various programs and login details for online banking. The Emotet malware is distributed via a spam campaign that is aimed primarily at German Internet users, although 2.3% of the infections was observed in the Netherlands. The email contains a link to a zip file with a known deposit of the bank.

In reality, the zip file contains an .exe file that malware. Once active Emotet tries to steal login details for several German banks. In addition, the passwords for Eudora, Google Desktop, Google Talk, IncrediMail, Mozilla Thunderbird, MSN or Windows Live Messenger, Netscape 6 and Netscape 7, Outlook 2000, Outlook 2002 and Outlook Express, Windows Mail and Windows Live Mail and Yahoo! Messenger sent back to the attackers.

The linked website can download a .zip file that contains an executable file with a long file name to hide its .exe extension such as:

• de_0000239029_rechnung_scan_hp_28_0000000904_page_2_10_01_05_id_00291002098.exe
• E-Card_zu_Weichnachten_scan_foto_2834792347_12_2014_21093812_000129_001_004_002910.exe
• Informationen_Kontobewegung_dezember_2014_de_20_8139_237_90109238_000129_000028_05.exe

According to the software giant let the malware show that it is important to keep security software up-to-date. To share in the event Microsoft's security software is used, users taking the advice to data with the Microsoft Active Protection Service Community (MAPS).

Malware Traffic Analysis