Website Ammyy Admin Spread Infectious Download

The official website of the remote desktop software Ammyy Admin has recently been hacked and has offered several days a contaminated version allowing users by a group of cyber criminals were spied upon. Ammyy Admin makes it possible to record on remote computers.

According to the developers make more than 50 million people, both business and private use of the software. It is used by companies in the Fortune 500, as well as banks. Also telephone scammers use the software. Some detect anti-virus programs Ammyy Admin whatsoever as unwanted software. According to the Slovak anti-virus company ESET is the remote desktop software especially popular in Russia.

On October 26 ESET discovered that on the website malware was offered. The free version of Ammyy Admin was replaced with an infected version. Until November 2 the infected version was offered. The installer installed the real Ammyy Admin software, as well as a file called AmmyyService.exe or AmmyySvc.exe that contained the malware. Then analyzed the malware existing software and websites visited.

If the computer had sufficient value was additional malware being installed. This malware was signed with a certificate from Comodo, which has been withdrawn. The malware spies on users, records all keystrokes, enumerate smart cards and communicates with a command & control server. It is unclear when the site was hacked and how long exactly malware is offered. ESET tried the developers of Ammyy Admin several days and warn in different ways, but received no response.

Website Headache Centers New Twitter Malware

At several websites attackers have posted malicious code that attempt to infect visitors with malware. It is the Society's website of Dutch Headache Centers and New Twitter, says security researcher Yonathan Klijnsma via Twitter.

In the case of New Twitter that Twitter has more than 10,000 followers, the added code points to the Angler-exploitkit. This exploitkit uses known vulnerabilities, including Adobe Flash Player. What malware is being spread Klijnsma do not know by exploitkit. Angler among other things used to install the Bedep Trojan on unpatched computers.

This Trojan may download additional malware onto the computer and use the system for various forms of cyber crime, such as click and advertising fraud. Klijnsma, also a researcher at the Delft security firm Fox-IT, warned in recent weeks regularly for hacked websites which malware spread. According to the researcher, there is a campaign in which criminals hack into websites and provide malicious code.

Ransomware-Maker Repents And Gives Decryption Keys Away

Last Monday, numerous computers suddenly by a new ransomware variant called Locker hit a small amount to the victims asked for decryption, but the automaker would now regret his actions and provides all the decryption keys free of charge.

In addition, the ransomware on June 2 will automatically create all encrypted files accessible. Locker really came up out of nowhere. The ransomware had for some time on computers running before it on May 25 suddenly proceeded to encrypt files.At various forums complained large numbers of users that their files were encrypted suddenly. Unlike other ransomware variants, which require hundreds of dollars, Locker asked a sum of 22 euros for decrypting the files.

On Saturday put someone who "Poka Bright Minds" calls a message on Pastebin . In it he claims to be responsible for Locker. According to him it was never intended to spread the ransomware. The online storage Mega he has now a file with bitcoin addresses and keys installed. The forum Bleeping Computer confirms that the file actually contains the keys of victims. In addition, on June 2, the automatic start decryption. How the malware spread exactly is still unknown.

File Information 

Name: database_dump.csv

Size: 127.5 MB

MD5: d4d781412e562b76fe0db0977cf6279b

SHA-1: 6ba671ce2a6c256c74d7db81186b0dbddd5e2185

SHA-256: d7fd791b86615fada64fe0290aecb70e5584b9ac570e7b55534555a3b468b33f

VirusTotal Link

Mega Link

Confiscated Domain Megaupload Points To Malware

Two domain names of Megaupload by the US government in early 2012 seized are now being used to infect users with malware and forward to Internet cams, as discovered website TorrentFreak .Megaupload was the upload and download site from Internet entrepreneur Kim Dotcom.

For alleged copyright infringement and online piracy were Dotcom and several others indicted by the US. Who Megaupload.com and Megavideo.com had received a warning that the domains were seized. It seems that the domain names have not been extended allowing another party they could register or attackers there have been accessed in a different way. Code on the website sends visitors will see through to scam sites or have ads that offer malware. Commenting Dotcom criticized the actions of the authorities. For several years, the Internet entrepreneur has a new online storage service called Mega.

FBI Warns Of Web Cams After Earthquake Nepal

The FBI has warned Internet scams who abuse people who want to donate money after the earthquake in Nepal or trying to spread malware. The death toll from the earthquake has now passed the 4,300 and the population is in need of all kinds of aid.

"After a natural disaster like a lot of people contribute to utilities and organizations. The FBI is warning the public to watch out for before it is donated," said the intelligence. This involves donation requests coming in via e-mail or websites that ask for. In the past it has often happened that after a natural disaster is fraudulent Web sites or e-mails appear that ask for donations, but the money does not allow to enter the victims of such disasters.

The FBI advises people choosing not to respond to unsolicited e-mails, including clicking on links or open attachments because they may contain malware. People are warned also for individuals occurring on social media sites or via e-mail as victims or officials and ask for a donation. Furthermore, the legitimacy of non-profit organizations should be checked on the Internet. According to the FBI, most legitimate charities websites ending in .com or .org.

Xtube Porn Spreading Malware Via Flash Attack

Visitors to the porn xtube are now warned cyber criminals have hacked the website and use it for distributing malware. Xtube 780 ranked of most visited websites in the United States and would have to deal with 25 million visitors every month.

Unlike other recent attacks are widely used in the case of infectious xtube no ads, but the attackers have malicious code placed directly on the website itself. Something which is possible only if the attackers have access to the website. The code sends users unnoticed through to another website which then tries to put through a known vulnerability in Adobe Flash Player malware on the computer.

It is a vulnerability that already has a security update has been released. Users who have the latest Flash Player version available are therefore not at risk. In case the attack was successfully placed a Trojan horse on the computer. The malware was detected at the time of the attack by 12 of the 57 scanners on VirusTotal, says anti-virus company Malwarebytes .

It is not just porn sites that are victims of these attacks. This week, the Dutch security researcher warned Yonathan Klijnsma that the website nummeriban.nl where users can convert to an IBAN account number, also malicious code was detected. The malicious code sent by visitors to a website that users via known vulnerabilities in Adobe Flash Player, Java and Adobe Reader tried to attack.