AntivirusWorld

Better Business Bureau is warning consumers and businesses to keep their guard up and their wits about them in order to fend off a new string of phishing e-mails making the rounds this holiday season.

Lavasoft unveiled Anti-Virus Helix, a stand-alone security tool designed to address the rapidly changing malware landscape. This new product delivers comprehensive protection and high performance with low impact on system resources.

A virus that's attacking Facebook users is also infecting other social networking sites, says ScanSafe.

Koobface tricks social networkers into downloading malicious malware onto their PC. Users receive messages that look as if they're videos. Often they say something like "you look funny". When the user clicks to see the video, he is taken to a new website and asked to download special software in order to see the video.

An unpatched security vulnerability in Internet Explorer v7 is being actively exploited in-the-wild. Worryingly, the successful exploit of this vulnerability allows attackers to control the infected computer and access any personal information without the user being aware.

The vulnerability centers on Internet Explorer’s handling of specially crafted XML tags which can leave the browser susceptible to a heap spray attack. In the attacks observed by ScanSafe, successful exploit would result in the installation of a data theft Trojan with autorun worm capabilities.

The security company revealed that 12 percent of malware is spread through malicious email attachments but just 5 percent comes from bugs that exploit software vulnerabilities.

Paul Ferguson, network architect at Trend Micro said: "This illustrates that social engineering seems to be playing a larger role than we thought. The problem isn't due to software vulnerabilities in, say, the browser".

BitDefender announced that a new type of password - stealing application disguised as a Mozilla Firefox Plugin has been detected in the wild. The e-threat, Trojan.PWS.ChromeInject.A, is downloaded to a Mozilla Firefox Plugin folder and is executed each time the user opens Firefox.

Fake antivirus products dominate November’s top ten e-threats, according to BitDefender®. Variants of the FakeAntivirus Trojan filled the first three positions, totaling 37-percent of November’s top e-threats. Links to this e-threat are spread through various sources (spam, hidden redirections on shady webpages and malware already present on your computer).

When the FakeAntivirus Trojan is run from a malicious webpage, a "scan process" begins which takes about 10 seconds. During this time the "scanner" detects an enormous amount of infections - thousands of malicious files. The names of the "found" viruses are taken off lists from antivirus companies. The fake antivirus then demands money to remove the "malware" it found.

Malware detected in e-mail traffic in November

1	Win32.HLLM.MyDoom.based	13741 (15.33%)
2	Win32.Virut	13036 (14.55%)
3	Win32.HLLM.Alaxala	5705 (6.37%)
4	Trojan.MulDrop.13408	4534 (5.06%)
5	Win32.HLLM.Beagle	4426 (4.94%)
6	Trojan.MulDrop.16727	4206 (4.69%)
7	Trojan.PWS.GoldSpy.2456	4145 (4.63%)
8	Win32.HLLW.Autoruner.2640	3032 (3.38%)
9	Trojan.MulDrop.18280	2580 (2.88%)
10	Trojan.PWS.Panda.31	2228 (2.49%)
11	Trojan.DownLoad.16843	2192 (2.45%)
12	Win32.HLLM.Netsky.35328	1888 (2.11%)
13	Win32.Virut.5	1497 (1.67%)
14	Win32.HLLM.MyDoom.33	1442 (1.61%)
15	Win32.HLLM.Netsky	1361 (1.52%)
16	Trojan.PWS.GoldSpy.2454	1328 (1.48%)
17	Trojan.MulDrop.19648	1310 (1.46%)
18	Win32.HLLW.MyDoom.43010	1306 (1.46%)
19	Win32.HLLM.Mailbot	1305 (1.46%)
20	Trojan.DownLoad.3735	1212 (1.35%)

Two Top Twenties have been compiled from data provided by the Kaspersky Security Network in November 2008. The first Top Twenty is made up of those malicious programs most frequently detected on users’ computers by the 2009 antivirus products.

Position	Change in position	Name
1	3	Virus.Win32.Sality.aa
2	0	Packed.Win32.Krap.b
3	New	Trojan-Downloader.WMA.GetCodec.c
4	-1	Worm.Win32.AutoRun.dui
5	3	Trojan-Downloader.Win32.VB.eql
6	New	Worm.Win32.AutoRun.rja
7	0	Packed.Win32.Black.a
8	New	Exploit.JS.RealPlr.nn
9	New	Trojan-Downloader.JS.Tabletka.a
10	-5	Trojan-Downloader.JS.IstBar.cx
11	-1	Trojan.Win32.Agent.abt
12	New	Trojan-Downloader.Win32.Agent.anje
13	2	Virus.Win32.VB.bu
14	New	Worm.Win32.Mabezat.b
15	New	Worm.Win32.AutoRun.eee
16	0	Email-Worm.Win32.Brontok.q
17	8	Virus.Win32.Alman.b
18	-7	Worm.VBS.Autorun.r
19	New	Trojan-Downloader.JS.Iframe.yp
20	New	Trojan.Win32.Autoit.ci