Kaspersky Wins Test Malware Removal

Anti-virus software must be able to not only detect malware, including the removal of an infection is part of a good working virus scanner. The Austrian test lab AV-Comparatives therefore decided to test 16 security packages to consumers on malware removal.

In total, were used for the test 35 different malware instances that had to remove the packages. These criteria include being sought for leave of executable files, MBR or registry changes, custom host files and programs that were disabled by the malware and after disinfection is still not working, like Windows Task Manager and the Windows Registry Editor.

The packages were evaluated for the simplicity with which the malware was removed, like removing normal mode, safe mode, using a rescue disk or calling the help desk to remedy the infection. Eventually, the virus could score up to 100 points. Kaspersky Lab sets with 93 points, the highest score down just before Avast (89) and Bitdefender (89). Sophos (72) and Threat Track Viper (65) put the lowest score down. Microsoft Windows Defender ends up with 80 points in the middle.

Ransomware-Maker: The Victims Have Paid More Attention

A new ransomware variant that has been in development since early this year has a real roadmap for victims to explain the situation they find themselves in, where users also clear that the infection is their own fault. The ransomware was discovered by the Dutch security researcher Yonathan Klijnsma , who works at the Delft Fox-IT.

CryptoApp, as is called ransomware encrypts files with 162 different file extensions, like .docx, .avi and .xslx. Remarkably, according Klijnsma that files from QuickBooks accounting software is encrypted. Once active on a computer, the ransomware is looking not only at local disks for files to encrypt, but also relied network drives. As with other ransomware variants must then be paid an amount to decrypt the files.

It is in this case to an amount of 1 bitcoin, what with the current exchange rate 231 euros. On the website of the ransomware is user-maker explained their situation. As the author states that victims have been infected because they have not been paying attention. Also, the computer of the user according to the ransomware maker poorly protected and the files can be recovered only by paying. Thereby paying victims are advised to turn off their virus scanner.

The tool for decrypting the files can namely be considered as malware and removed by the virus. In that case, users will lose all their files, according to the warning. According Klijnsma the ransomware is not widespread and probably still in development. The website of the ransomware-maker, which was hosted on the Tor network, early August is gone. It may be that the author, the project has stopped or a new location sought to continue its operation, with the old website was a test setup, the researcher says.

Crypto Locker Infected 200 Computers From VU University

The Crypto Locker ransomware has 200 computers of the VU University Amsterdam (VU) infected as a spokeswoman for the university. "The Crypto Locker Virus haunts on our network," said Aukje Scoop. Twitter posted Rickey Gevers a screenshot of the warning was distributed among staff and students. The damage was due to a good backup strategy, however, are minimal. The malware spreads via email attachments and encrypt files on computers for ransom. To put the impact of ransomware to counteract the VU network decided this weekend to "read-only".

Scans performed at the IT department were discovered last week several infected workstations. Once there was an infection detected, the computer and the corresponding account temporarily blocked. The malware was removed and a backup of the evening returned it, then the computer and the account were released. Because the VU backing up the harm or risk of data loss are minimal. There were no students or employees have come forward that have been lost by the ransomware files.

Last weekend decided the technical department to put the network on read-only, so that the virus could not do his job. "The IT department had more clout to clean everything," Scoop notes. At the VU is a lot of work with group drives, where students store their documents. "Now it's wait and see how it is spread. The virus mutates continuously. Our IT department is aware that it can emerge in other places." At 200 computers Crypto Locker was eventually found.

Emails

"The complicated is that the virus ever mutates. In the beginning was warned mails from unknown senders or stranger left. But it now seems also that it can attach to emails from colleagues. Why is continuously scanned . It is therefore not sufficient to keep only foreign mails outside, because it seems to be mutated itself. "

It is currently unclear whether the students or employees who were initially opened the infected emails. When the first infections through Crypto Locker emerged the university decided to warn in different ways for the ransomware. "It is very much shut out by the security systems. In an organization such as a university, it is impossible to rule out anything. So there is a balance to be searched."

Virus Scanner

The network has now picked up again in read-only. In addition, the university is also looking forward a new type of virus that may in addition have to go, but the details are not yet known. According Spoon would not get the first time that make VU ransomware. A few months ago would have been some isolated cases. "But when that had no effect and that was resolved pretty quickly."

Factories Target Online Banking Malware

Trojans designed to steal money from online bank accounts are also used at industrial plants and factories, so has had a security researcher know. Kyle Wilhoit anti-virus firm Trend Micro discovered thirteen different types of malware that occurred as software in SCADA (supervisory control and data acquisition) environments used. It involves, for example, Siemens WinCC, GE Cimplicity, Advantech and other human machine interface (HMI) products.

Although attacks on industrial environments often with attacks by countries are linked, it would be here involve ordinary cybercriminals. "It's an interesting trend, traditional banking Trojans and no targeted attacks," Wilhoit as late versus Dark Reading know. According to the researcher criminals focus their sights on SCADA / ICS systems because they are unsafe.

Many HMI machines run on Windows and would not use a virus scanner or are not equipped with the latest signatures. Most malware Wilhoit encountered no problems would be detected by an up-to-date virus scanner. While targeted attacks are still at risk managers should also take into account normal "crimeware", as the consequences can be just as bad. HMI systems are very susceptible to interference. Infection by a banking Trojan can also just as easily get the system down.

Wilhoit saw in October for the first peak in the attacks, but does not know what the occasion is. The criminals behind the malware use spear phishing mails and drive-by downloads to infect computers. Fake websites are used on that instance, resemble those of Siemens and supposedly download a WinCC update, while it is actually malware. Wilhoit 32 recently discovered malware instances that occurred as WinCC software. Next week, the researcher during a conference SCADA give more details about his research.