Antimalware research for IT pros and enthusiasts – Page 4

Our commitment to our customers’ security

January 23, 2017 admin Advanced persistent threats, Antimalware research for IT pros and enthusiasts, Coordinated Malware Eradication, CVE-2016-7855, Elevation of privileges, Exploits, Microsoft Edge, Microsoft Edge on Windows 10, Microsoft Threat Intelligence, Microsoft's post-breach detection approach, post-breach, STRONTIUM APT, Terry Myerson's blog, Windows 10, Windows Defender ATP, Windows Defender ATP detects STRONTIUM

This guest blog post is by Terry Myerson / Executive Vice President, Windows and Devices Group Windows is the only platform with a customer commitment to investigate reported security issues and proactively update impacted devices as soon as possible. And we take this responsibility very seriously. Recently, the activity group that Microsoft Threat Intelligence calls STRONTIUM…

Microsoft Security

MSRT November 2016: Unwanted software has nowhere to hide in this month’s release

January 23, 2017 admin Antimalware research for IT pros and enthusiasts, browser modifier with rootkit capabilities, BrowserModifier:Win32/Soctuseer, InstallMonster, Internet Explorer Browser Extensions, Keeping browsing experience in users' hands, Microsoft browser extension policy, Microsoft Edge, Microsoft Malicious Software Removal Tool, MSRT, Objective Criteria, rootkit, Social2Search, Soctuseer, software bundlers, SoftwareBundler:Win32/InstallMonster, SoftwareBundler:Win32/Techrelinst, Techrelinst, Unwanted software, Windows Defender, Windows Defender in Windows 10

We came across a browser modifier that sports rootkit capabilities. Not only does the threat, detected as BrowserModifier:Win32/Soctuseer, cross the line that separates legitimate software from unwanted, it also takes staying under the radar to the next level. Rootkit capabilities, which make it difficult to detect and remove applications, are usually associated with malware. Yet…

Microsoft Security

The new .LNK between spam and Locky infection

January 23, 2017 admin .LNK between spam and Locky, .Lnk embedded PowerShell command, .Lnk embedded PowerShell script, .LNK spam spreads Locky infection, Antimalware research for IT pros and enthusiasts, email spam, Locky ransomware, Nemucod and Locky, Ransom:Win32/Locky, ransomware, spammed .Lnk spreads Locky, Trojan, TrojanDownloader:PowerShell/Ploprolo.A, Windows Defender, Windows Defender ATP, Windows Defender in Windows 10

Just when it seems the Ransom:Win32/Locky activity has slowed down, our continuous monitoring of the ransomware family reveals a new workaround that the authors might be using to keep it going. The decline in Locky activity can be attributed to the slowdown of detections of Nemucod, which Locky uses to infect computers. Nemucod is a…

Microsoft Security

Beware of Hicurdismos: It’s a fake Microsoft Security Essentials installer that can lead to a support call scam

January 23, 2017 admin Antimalware research for IT pros and enthusiasts, fake BSoSD, Hicurdismos, how to spot a fake BSOD, report tech support scam, SupportScam, SupportScam:MSIL/Hicurdismos.A, tech support scam mimics BSoD, Technical support scam, Windows Defender, Windows Defender for Windows 10

Wouldn’t it be a shame if, in trying to secure your PC, you inadvertently install malware and run the risk of being scammed? We recently discovered a threat detected as SupportScam:MSIL/Hicurdismos.A that pretends to be a Microsoft Security Essentials installer. Microsoft Security Essentials is our antimalware product for Windows 7 and earlier. In Windows 10…

Microsoft Security

Double-click me not: Malicious proxy settings in OLE Embedded Script

January 23, 2017 admin Antimalware research for IT pros and enthusiasts, JavaScript, JavaScript spam attachment, JScript, JScript malware, JScript malware prevention, Macro-based malware, malware-prevention blog, mitigate OLE misuse, obfuscated JScript, OLE misuse mitigation, OLE-embedded objects, Social engineering, spam, spam email infection vector, Trojan, Trojan:JS/Certor.A, Trojan:PowerShell/Certor.A, Windows Defender

Attackers have been using social engineering to avoid the increasing costs of exploitation due to the significant hardening and exploit mitigations investments in Windows. Tricking a user into running a malicious file or malware can be cheaper for an attacker than building an exploit which works on Windows 10. In our previous blog, Where’s the…

Microsoft Security

MSRT September 2016 release feature: Prifou

January 23, 2017 admin Antimalware research for IT pros and enthusiasts, browser modifier, BrowserModifier:Win32/Prifou, Microsoft Malicious Software Removal Tool, Microsoft's objective criteria, MSRT, MSRT September 2016, NightClick, Objective Criteria, Prifou, Suweezy, Trojan:Win32/Suweezy, Trojan:Win32/Xadupi, TrojanClicker:Win32/NightClick, Unwanted software, unwanted software objective criteria, Windows Defender, Xadupi

As part of our ongoing effort to provide better malware protection, the Microsoft Malicious Software Removal Tool (MSRT) release this September includes detections for: BrowserModifier:Win32/Prifou TrojanClicker:Win32/NightClick Trojan:Win32/Suweezy Trojan:Win32/Xadupi This blog discusses BrowserModifier:Win32/Prifou (Prifou). Windows Defender detects this threat because it limits your choice and control over your browser and operating system. The unwanted behaviors are detailed…

Microsoft Security

Kovter becomes almost file-less, creates a new file type, and gets some new certificates

January 23, 2017 admin Antimalware research for IT pros and enthusiasts, Kovter, malvertising, Trojan

Trojan:Win32/Kovter is a well-known click-fraud malware which is challenging to detect and remove because of its file-less persistence on infected PCs. In this blog, we will share some technical details about the latest changes we have seen in Kovter’s persistence method and some updates on their latest malvertising campaigns. New persistence method Since June 2016,…

Microsoft Security

Nemucod dot dot..WSF

January 23, 2017 admin Antimalware research for IT pros and enthusiasts, JavaScript, JavaScript spam attachment, JS attachment, Nemucod, Nemucod infection chain, Nemucod mitigation, Social engineering, spam, Trojan, Windows Scripting File, WSF

The latest Nemucod campaign shows the malware distributing a spam email attachment with a .wsf extension, specifically ..wsf (with a double dot) extension. It is a variation of what has been observed since last year (2015) – the TrojanDownloader:JS/Nemucod malware downloader using JScript. It still spreads through spam email attachment, typically inside a .zip file,…