Google: Virustotal Not Intended To Compare Anti-Virus

VirusTotal is a popular service from Google that charge suspicious files can be scanned by dozens of virus, but to keep health service and to prevent abuse have now announced new rules and users are reminded of their responsibilities.

According to Google VirusTotal is a nice collaboration between anti-virus companies and users. Users upload suspicious files, which are then shared with the anti-virus companies. "It's an ecosystem where everyone contributes, everyone benefits, and we work together to improve safety on the Internet," said Bernardo Quintero.

Rules

To ensure that the ecosystem is in good working there new rules announced. So all anti-virus companies are obliged to integrate their detection scanner in the public interface of VirusTotal. New scanners wishing to apply must first be able to present a certification or independent reviews of security testers, with the best practices of the Anti-Malware Testing Standards Organization (AMTSO) followed by VirusTotal.

Additionally VirusTotal users must follow the requirements and best practices, let Google know. "It's frustrating to see abuse and is detrimental to our community," said Quintero. He points out that VirusTotal is not substitute for a virus. In addition, the service must also not be used to compare virus scanners with each other. "Virus scanners are complex programs on additional detection properties which may not operate within the scanning area of ​​VirusTotal. Therefore, the scanning results from VirusTotal are not designed to compare the effectiveness of anti-virus products," Quintero says.

Creator Of 'Hacking Tools' Denounces False Alarms By Anti-Virus

The creator of several popular tools for recovering passwords and product keys for Windows and Office criticizes the fact that there are still virus scanners are regarded as malware programs. It is NirSoft, provider of various "recovery tools.

It occurs regularly warn that anti-virus programs for software NirSoft. Developer Nir Sofer says to understand this, because attackers are able to use software. It is important that we explain in the case of a warning that the software itself is not malicious, but can be used by others and if a warning appears. Many Internet users check files on the VirusTotal website, with about 50 different virus scanners assess the uploaded file. However, in making this assessment lacks the explanation, allowing users to mistakenly believe that the tools of NirSoft are malignant, said Sofer.

Therefore, he has research carried out into the scanners on VirusTotal and how to deal with several of its programs. Twelve products thereby not provide an alarm once, which Panda Security is the main supplier. In the event a virus strikes or alarm gets the product flaws. There is counted down in this case of 100. However, if the virus indicates that it is a 'hack tool' or 'password viewer', points are added together again. Eventually put three products a negative score down, namely Antiy (-6.5) TheHacker (-230.5) and Bkav which opens for all reports on -1280.5. Most virus hit about 10 times alarm and thus setting a score of 80 or higher down.

Researchers Found 30 000 Infected Apps On Google Play

Researchers at Indiana University have developed a scanner that allows them to rapidly scan hundreds of thousands of Android apps, which ultimately resulted in 30 000 infected apps on the official Google Play store. MassVet (pdf) as the scanner is called, can determine within seconds whether an app is benign or malignant, without knowing how the malware looks or behaves.

Instead of analyzing the app MassVet compares it with apps that already exist in the relevant store. Most Android malware is in fact repackaged apps. When cybercriminals repacking apps add malicious components increasing. Therefore differs repackaged app of the original. The malicious components in applications can also be found who seem to have nothing to do with each other.

The researchers decided to test the scanner with 1.2 million apps from 33 different app markets. MassVet proved apps within 10 seconds, assess and outperformed 54 virus scanners on VirusTotal. Of the 1.2 million-controlled apps were found to be more than 127 000 malignant and 34 000 were missed by most malware scanners on VirusTotal. Some of the malware specimens were installed millions of times. It also found that 5000 malicious apps each had more than 10,000 installations.
Google Play

Also analyzed MassVet 400 000 apps on Google Play, of which 30 000 were found to be malignant. This equates to an infected rate of 7.6%. According to the researchers this different from earlier figures of Google. According to Google, was found on Android Users who only install apps from Google Play at less than 0.15% of the devices a "potentially malicious application" (PHA).

However, users of China's market places that are most likely to Android malware. In the market places of Anzhi, Yidong, yy138 and Anfen was 39%, 36%, 28% and 23% of all available apps malware. On the fifth of infected stores SlideMe comes back, 21% of the malware apps proved to be. The overview is also given to the store by Opera. This was 7.8% of the apps labeled as malicious.

Kaspersky: Angry Ex-Employees Behind Bogus

Yesterday Reuters with a story that Russian anti-virus firm Kaspersky Lab competitors like AVG, Avast and Microsoft did years sabotaged, but according to founder Eugene Kaspersky and the anti-virus company is a nonsense story from angry ex-employees.

The story would have provided the anti-virus company legitimate files from malicious code. These files are then uploaded to the VirusTotal website and shared with other anti-virus companies. VirusTotal is a website where Internet files can be scanned dozens of virus scanners. Uploaded files are shared with participating anti-virus companies. By uploading the files sabotaged legitimate files the virus of anti-virus companies would therefore be regarded as malware.

Kaspersky Lab that the statements are unfounded and untrue and made ​​by angry ex-employees. The anti-virus company shares data correctly with other parties. "Although the security market is very competitive, is the exchange of threat data is an important component of the security of the entire IT ecosystem and we work hard to ensure that this exchange does not jeopardize or sabotaged."

Experiment

Well carried out the anti-virus company in 2009 and 2010, two experiments in which clean files to VirusTotal were sent and Kaspersky Lab files considered intentional malware. A few months later found several other scanners on VirusTotal that the files were infected, even though that was not the case. Kaspersky Lab made ​​the investigation public . In their own words to indicate that the problems with the testing of malware.

Ex-employees

On his own blog is Eugene Kaspersky also on the story and denounces in particular the use of anonymous sources. "Angry ex-employees often say nasty things about their former employer, but in this case the lies are simply ridiculous." According to Kaspersky, the resources possible to convince the journalist of Reuters know, but the story is ultimately published without any evidence. "I therefore ask myself what these ex-workers' media tell us about the next time and who believe their bullshit then."

In the blog posting Kaspersky also discusses the problem with false positives. In 2012 and 2013 had anti-virus companies many problems with false positives. An attacker provided legitimate software from malicious code and spread it. Both Kaspersky Lab and other antivirus companies were targeted. There was then a meeting behind closed doors, where there is information about the attacks was exchanged. This also was the suggestion suggested that another anti-virus company possible was behind the attacks. Symantec confirms the story and says that Kaspersky Lab, in any case, none of the suspects.

Google And Anti-Virus Companies Warn Of uTorrent

Both Google and several anti-virus companies warn users that the popular program uTorrent is harmful.Through the software, users can exchange all types of files. UTorrent is free to use and generates revenue through advertising and bundled software.

Globally, it would be used by more than 100 million people. Several anti-virus companies but now warn of the software because the Open Candy-adware is bundled with uTorrent. Altogether now give seven different virus scanners, including ESET, Symantec and G Data, a warning, let VirusTotal see. According to TorrentFreak , it is unprecedented that so many different anti-virus companies stumble uTorrent.

Google

Google also shows users have come to warn the torrent software. Who uTorrent via download Google Chrome gets a message that the software is potentially harmful and therefore blocked. Users must then indicate themselves that they want to maintain the software to complete the download.

In addition, Chrome also allows for different websites uTorrent see a warning that the website "malicious programs".Recently, Google had already announced that it tougher against unwanted software will occur and that Chrome users will be more likely to see warnings. The warning for uTorrent is part of this, let a spokesperson.

Voicemail Leads To Malware Attack Via OneDrive

A group of attackers used voicemail messages in combination with malware hosted at onedrive to attack organizations, as several security companies warn. The attack on the organizations begins with targeted phishing mails which contain a self-extracting archive file as an attachment. The attachment occurs when voice mail.

If a user opens the attachment is there as a distraction play a .wav file that looks like a real voice. In the background, however connection with OneDrive made the cloud service from Microsoft. The ultimate malware is then downloaded. Sergey Lozhkin of the Russian anti-virus firm Kaspersky Lab wonders whether this method will be applied by more cyber criminals.

"It is possible because it provides an easy way for attackers to hide malicious behavior. Detecting malicious traffic in legitimate cloud services is much more complex because it involves legitimate services to be blocked," said Lozhkin.Security company Palo Alto Networks has more details about the malware used, which was detected at the time of discovery by 3 of the 54 scanners on VirusTotal.

Free Sandboxes For Malware Analysis Compared

On the Internet are several free tools available that makes it possible to analyze malware. Tools, for example, can be very useful in security incidents, according to the Belgian security analyst Koen van Impe. Companies can find through the analysis of malware for example, other infections on their network and thus take measures to protect systems.

Van Impe decided to various free solutions to look for analyzing malware, namely VirusTotal , Anubis , VxStream and Malwr , then to compare them. Thus, among other things, examined what file formats the solutions can go, including Office, PDF, Android, Windows and PDF, or hashes are displayed, an API is available and whether there are network activities are displayed.

Users are warned by Van Impe that public sandboxes public. "You have to realize that everything you share or upload these sandboxes is accessible to everyone, including the bad guys." In some cases, according to the analyst wise malware specimens that are used for a specific environment not upload to a public service, because otherwise you can let the attackers know that their operation has been detected.

Popular Torrent SubTorrents Spreading Malware

On a torrent in particular in Spain and South America is very popular, researchers have found malicious code that attempts to infect visitors with malware. It is the website SubTorrents.com . Was seen many ads on the website first thought that it was possible to "malvertising," where visitors are attacked through malicious advertisements.

However, further investigation revealed that the site itself was hacked, said Jerome Segura anti-virus company Malwarebytes. The malicious code on the website tries to use vulnerabilities in Adobe Flash Player, Microsoft Silverlight and Oracle Java.These are known vulnerabilities. Users whose software is up to date are therefore at no risk. In case the attack is successful, a Trojan horse installed, which is recognized by 6 of the 56 scanners on VirusTotal.

"The downloading illegal torrents is a dangerous thing. Besides fake files that time and also waste bandwidth users need a way through a forest of misleading advertisements and pop-ups jobs," says Segura. "They might save a few dollars on the latest movie, but possibly risking much more like a nasty malware infection."

VirusTotal: "Knock Knock Searching With Google For Mac Malware"

A program for Mac OS X that shows what programs and scripts are automatically started is now able to quickly malware via VirusTotal tracks, the online anti-virus service from Google. Knock Knock for OS X is similar to Microsoft's Autoruns for Windows and provides a detailed overview of what all is happening on the operating system.

VirusTotal is a website where users can upload files in order to submit it by 50 different virus scanning. Early this year, Microsoft decided to VirusTotal with Autoruns integrate , allowing Windows users now easily able to detect malware. Patrick Wardle, developer of Knock Knock, has now followed that example and VirusTotal added to his application.

"This tool is very useful for quickly finding malware on Mac OS X systems, and integration with VirusTotal give further momentum to our efforts to protect Mac OS X users," says Emiliano Martinez VirusTotal, which since 2012 part of Google.Last year VirusTotal decided already to the analysis of OS X and iOS malware improve and the corresponding upload tool .

Xtube Porn Spreading Malware Via Flash Attack

Visitors to the porn xtube are now warned cyber criminals have hacked the website and use it for distributing malware. Xtube 780 ranked of most visited websites in the United States and would have to deal with 25 million visitors every month.

Unlike other recent attacks are widely used in the case of infectious xtube no ads, but the attackers have malicious code placed directly on the website itself. Something which is possible only if the attackers have access to the website. The code sends users unnoticed through to another website which then tries to put through a known vulnerability in Adobe Flash Player malware on the computer.

It is a vulnerability that already has a security update has been released. Users who have the latest Flash Player version available are therefore not at risk. In case the attack was successfully placed a Trojan horse on the computer. The malware was detected at the time of the attack by 12 of the 57 scanners on VirusTotal, says anti-virus company Malwarebytes .

It is not just porn sites that are victims of these attacks. This week, the Dutch security researcher warned Yonathan Klijnsma that the website nummeriban.nl where users can convert to an IBAN account number, also malicious code was detected. The malicious code sent by visitors to a website that users via known vulnerabilities in Adobe Flash Player, Java and Adobe Reader tried to attack.

Virus Scanners Microsoft Remove Superfish-Adware

Microsoft released an update for the virus Security Essentials and Windows Defender that addresses the Super Fish-adware on Lenovo laptops as well as the self-signed certificate that the adware used will be deleted. Also the free Microsoft Safety Scanner is able to detect and remove Superfish.This was discovered by Filippo Valsorda of the CloudFlare Security Team.

Meanwhile, Microsoft has also the definition put the Super Fish-adware line, where the threat as a Trojan horse is described.In addition to Microsoft also have several other providers of anti-virus solutions now released an update to detect and remove Superfish. A survey on VirusTotal shows that Superfish yesterday by 17 of the 55 virus was detected. Earlier in the day there were still six .

Besides the anti-virus companies warn the American and Dutch government for Superfish. The Computer Emergency Readiness Team (US-CERT) that part of the US Department of Homeland Security has issued this warning off. Consumers get it advised to remove the adware and the certificate installed. The Dutch government through veiliginternetten.nl published, an initiative of Economic Affairs, the National Cyber ​​Security Center and the ECP, a short article about Superfish.

Expert Wants End to Pre-Installed 'Crapware'

Computer manufacturers must stop before installing all kinds of software on new PCs, also known as 'crapware'. "Companies like Apple, who sell their products on their own merits, saddling their customers with this adware mess," said security analyst Ken Westin at Computerworld . Following the Super Fish-scandal in the Chinese computer manufacturer Lenovo.

Practice to install software in advance, as tryouts, and other programs for which the manufacturers get paid by the software developer, will place many years. In 2011, Microsoft even came with an initiative to rid computers of crapware. Computers with no trialware (tryouts) was present and there were no programs were loaded during startup called "Signature PCs". It was also for these PCs required to provide a clean desktop without gadgets, icons and unnecessary taskbar icons.

According Westin is important that consumers, manufacturers can trust. The analyst makes the blog know his employer Tripwire that mobile phone manufacturers and laptops itself a disservice by using this kind of dated ad strategies. Meanwhile, consider multiple virus Superfish as a Trojan horse. Six of the 57 scanners on VirusTotal store in detecting adware alarm.

Virustotal: "Easily Detect Malware With Free Microsoft Sysinternal Tool Process Explorer"

Microsoft has been offering the free program Process Explorer, but recently it cooperates with VirusTotal Google, allowing users to easily check their computer for malware. Process Explorer shows an overview of services, programs, and files that are running on the computer. Through the integration with VirusTotal hashes may be checked at VirusTotal.

VirusTotal is an online virus scanner that scans files by 57 virus scanners. By the online virus scan service via Process Explorer to call can be clearly or suspicious files on your computer are active. Microsoft security architect Roger Grimes late InfoWorld know how suspicious files then disable via Process Explorer. Then he removes the computer the file in question manually.

Grimes warns Windows users that deleting files is at your own risk. It can namely that a virus file wrongly regarded as malware or that the file in question is a driver or other important program component. Some malware can not be closed by Process Explorer. For this, use Grimes Autoruns , another free program from Microsoft, which prevents the infected file the next time Windows starts loading.

The security architect stressed that this detection is not perfect. Some malware to evade detection, although that is special, says Grimes. "In the future, do virus writers struggled to avoid Process Explorer and Autoruns, but this is currently not the case. This method is therefore one of the best protection methods that you can use."

VirusTotal: "Google Picks Up False Positives By Virus Scanners To"

Virus scanners consider wrongly clean files as infected, the so-called false positives are a big problem for both anti-virus companies, software developers and end users, but the online virus scanner Google wants to change this. A new project was launched called "trusted source", with major software developers such as Microsoft share their software catalog.

VirusTotal, an online virus scanner from Google, will mark these files then separately as a trusted source. If a virus they erroneously regarded as malware, VirusTotal warns on anti-virus company, so that false positives can be resolved. In addition, files are scattered among anti-virus vendors also get the trusted source listing, so as to ignore erroneous warnings, which should prevent a snowball effect of false detections.

Since the project began a week ago has VirusTotal collaborated with Microsoft and the results look promising. More than 6,000 false positives were eliminated because. The developers of VirusTotal hope to expand their collection of reliable software. Large software companies are therefore called to share this information. Well VirusTotal lets you know that the project is not open to "potentially unwanted applications" (PUPs) and adware developers.

Chanitor Trojan: "Maleficent Microsoft Volume Licensing Spreading Malware"

Several companies have recently received an email from the Microsoft Volume Licensing Service Center (VLSC) comes appeared and attempts to spread via a clever trick JavaScript malware. Through the VLSC companies to manage their Microsoft licenses. The message that goes around is very similar to the emails that sends Microsoft normally on the VLSC and a personalized salutation. According to the e-mail recipients may register via the attached link for the VLSC.

The link actually points to a hacked WordPress server. Using JavaScript, however, the real-VLSC Microsoft Web site shown where users can log in. However, there is simultaneously a zip file provided that the hacked WordPress server originates.This seems like the file from the Microsoft Web sites originates, although the hacked WordPress server is listed at the download location.

Offered zip file contains another .scr file is a Trojan horse. This "Chanitor Trojan" then connects to the Tor network. According to Cisco, the malware at the time was that the e-mails were detected around 9 out of 57 virus scanners on VirusTotal.

Hashesh:

1b147fc9d5342ca0fa59207d366ec4fb  (VLSC Microsoft.zip)

6266dc7f68e98b3a52908a7e2b5fe4eb (Volume_Licensing_Service_Center_details_7834892334.scr)

Microsoft Startup Manager Autoruns Integrates With VirusTotal Google

There is a new version of the popular and convenient Autoruns tool from Microsoft appeared which now has a link to VirusTotal. VirusTotal is an online virus scanner from Google that allows files checked by fifty different virus scanners.

Autoruns was originally developed by Sysinternals that some time ago was acquired by Microsoft. The tool provides detailed information about files, programs and processes that start when loading Windows, as well as what happens if Windows applications such as Internet Explorer, Explorer, and media players are launched. Through the integration with VirusTotal can be displayed directly on the detected virus scanners find some processes and files.

VirusTotal - "Online Virus Scanner Google Focuses On Java malware"

VirusTotal, an online virus scanner from Google last month quietly several improvements made ​​so researchers are better able to analyze Java malware. Via VirusTotal users can upload files and then to scan dozens of virus scanners.

In early December an update was rolled out to provide more information about suspicious Mac files and iOS apps. Silently was also improved the analysis of JAR files and Java .class files. The online virus scanner scanned the contents of these files already, but now also provides additional information, such as the used Java packages, the manifesto of the JAR-beam striking strings, file type distribution and timestamp metadata for files in the JAR file.

According to Emiliano Martinez VirusTotal is a lot of malware nowadays spread via exploits kits, of which a large portion of malicious JAR files uses to attack unpatched Java vulnerabilities. By expanding the virus Martinez hopes that researchers better this kind of threats can detect and analyze.

Dridex Malware - "Christmas Offers Conatins Macro Malware"

Christmas Offers.Docx

Spammers have Christmas as a chance to send e-mails that seem to contain a Christmas special initially look, however truly unfold malware. The e-mails going around currently feature a Word document referred to as "Christmas Offerings" hooked up. Once opened, attempt the macros within the document to transfer a malicious executable file.

The authors have created several macros in fact

Because of the protection risks interference Microsoft office standard macros and users also get to check a security warning that the macros are disabled. within the same warning might opt for, however, users need to to show the content of the document. The user selects this, then the Dridex Trojan is downloaded to the pc. this can be a Trojan specifically designed to steal cash from on-line bank accounts, according to anti-virus company Malwarebytes.

VBA code

Virustotal Report:- Christmas Offers.Doc

Virustotal Analysis Report of Christmas Offers.Docx

MD5: 9d0b2db07a5c5a903e0d599c8fcc63ca

Virustotal Report of Downloaded Exe:

Virustotal Analysis Report of Dowloaded Exe

MD5: 09e21abb85829788cab67d112d1b7c95

Macro Example:

Destover malware signed with Sony certificate

It has been discovered a new variant of the dangerous malware attackers against Sony Pictures Entertainment have deployed and those with a digital certificate of the company is signed, so let researchers know. It is the "Destover" malware, which also last year against South Korean banks and television companies was used. On infected computers malware steals data and then removes all files, making the machines currently unusable.

During the attack on Sony, the attackers have the private keys captured and published that the company used to provide files of a digital certificate. However, they can also be used to sign malware, and then be used in further attacks, let anti-virus firm Kaspersky Lab know. They discovered Destover variant was signed on 5 December. Because Sony certificates are trusted by security makes this attack effectively. The digital certificate has been revoked, let certificate authority DigiCert via Twitter know.

Security Researcher Colin Keigher leave via Twitter that this is a "joke" among security researchers. A researcher who requested anonymity had found the certificate and discovered that it was the password file. Then this investigator signed the Destover malware with the Sony certificate and uploaded it to VirusTotal, which eventually landed at Kaspersky Lab.

SONY - Malware Analysis

The malware was used recently against Sony is the same " destructive "malware that the FBI this week warned. Reported that the Japanese anti-virus company Trend Micro that a copy of the malware got hold. The main part of the malware is a collection of user names and passwords to be logged on shared network drives.

Once active users remove the malware files and files connected network drives and stops the Microsoft Exchange Information Store service. Then the malware two hour idle and then restart the system. Another part of the malware puts a .bmp file on the computer that contains the message "Hacked by #GOP". This is the same image that would have appeared on the computers from Sony. Trend Micro therefore proposes that the malware that was used against Sony.

Here is Deep Analysis of Destructive Malware By Some Security Research Companies:

Trend Mirco
Kaspersky
Symantec
BlueCoat

VirusTotal Link:
https://www.virustotal.com/en/file/4d4b17ddbcf4ce397f76cf0a2e230c9d513b23065f746a5ee2de74f447be39b9/analysis/1417763962/