Windows Defender – Page 3 – Computer Security Articles

Fake fax ushers in revival of a ransomware family

January 23, 2017 admin antimalware, Antimalware research for IT pros and enthusiasts, Crimace, enterprise software security, fake fax, malware research, microsoft, Microsoft Edge, MMPC, Ransom:Win32/WinPlock.B, ransomware, research, spam, Trojan, TrojanDownloader:JS/Crimace.A, Windows 10, Windows Defender, Windows Defender for Windows 10, WinPlock

“Criminal case against you” is a message that may understandably cause panic. That’s what a recent spam campaign hopes happens, increasing the likelihood of recipients opening the malicious attachment. We recently discovered a new threat that uses email messages pretending to be fax messages, but in truth deliver a ransomware downloader. The attachment used in this…

Microsoft Security

MSRT November 2016: Unwanted software has nowhere to hide in this month’s release

January 23, 2017 admin Antimalware research for IT pros and enthusiasts, browser modifier with rootkit capabilities, BrowserModifier:Win32/Soctuseer, InstallMonster, Internet Explorer Browser Extensions, Keeping browsing experience in users' hands, Microsoft browser extension policy, Microsoft Edge, Microsoft Malicious Software Removal Tool, MSRT, Objective Criteria, rootkit, Social2Search, Soctuseer, software bundlers, SoftwareBundler:Win32/InstallMonster, SoftwareBundler:Win32/Techrelinst, Techrelinst, Unwanted software, Windows Defender, Windows Defender in Windows 10

We came across a browser modifier that sports rootkit capabilities. Not only does the threat, detected as BrowserModifier:Win32/Soctuseer, cross the line that separates legitimate software from unwanted, it also takes staying under the radar to the next level. Rootkit capabilities, which make it difficult to detect and remove applications, are usually associated with malware. Yet…

Microsoft Security

MSRT October 2016 release: Adding more unwanted software detections

January 23, 2017 admin BrowserModifier:Win32/Sasquor, BrowserModifier:Win32/SupTab, Checking Windows Defender exclusions, Ghokswa, Microsoft Edge, Microsoft Malicious Software Removal Tool, MSRT, MSRT release October 2016, Objective Criteria, Sasquor, software bundler, SupTab, Suweezy, Trojan, Trojan:Win32/Ghokswa, Trojan:Win32/Suweezy, Trojan:Win32/Xadupi, Uncategorized, Unwanted software, Windows 10, Windows Defender, Xadupi

Unwanted software often piggy-backs on program downloads, delivered by software bundlers. These bundles, which you might have downloaded, can include software that you do not want, and some that are harmful. The bundled or “extra” software can perform actions on your device that run the gambit from unwanted to annoying to malicious. The threat that…

Microsoft Security

The new .LNK between spam and Locky infection

January 23, 2017 admin .LNK between spam and Locky, .Lnk embedded PowerShell command, .Lnk embedded PowerShell script, .LNK spam spreads Locky infection, Antimalware research for IT pros and enthusiasts, email spam, Locky ransomware, Nemucod and Locky, Ransom:Win32/Locky, ransomware, spammed .Lnk spreads Locky, Trojan, TrojanDownloader:PowerShell/Ploprolo.A, Windows Defender, Windows Defender ATP, Windows Defender in Windows 10

Just when it seems the Ransom:Win32/Locky activity has slowed down, our continuous monitoring of the ransomware family reveals a new workaround that the authors might be using to keep it going. The decline in Locky activity can be attributed to the slowdown of detections of Nemucod, which Locky uses to infect computers. Nemucod is a…

Microsoft Security

Beware of Hicurdismos: It’s a fake Microsoft Security Essentials installer that can lead to a support call scam

January 23, 2017 admin Antimalware research for IT pros and enthusiasts, fake BSoSD, Hicurdismos, how to spot a fake BSOD, report tech support scam, SupportScam, SupportScam:MSIL/Hicurdismos.A, tech support scam mimics BSoD, Technical support scam, Windows Defender, Windows Defender for Windows 10

Wouldn’t it be a shame if, in trying to secure your PC, you inadvertently install malware and run the risk of being scammed? We recently discovered a threat detected as SupportScam:MSIL/Hicurdismos.A that pretends to be a Microsoft Security Essentials installer. Microsoft Security Essentials is our antimalware product for Windows 7 and earlier. In Windows 10…

Microsoft Security

Double-click me not: Malicious proxy settings in OLE Embedded Script

January 23, 2017 admin Antimalware research for IT pros and enthusiasts, JavaScript, JavaScript spam attachment, JScript, JScript malware, JScript malware prevention, Macro-based malware, malware-prevention blog, mitigate OLE misuse, obfuscated JScript, OLE misuse mitigation, OLE-embedded objects, Social engineering, spam, spam email infection vector, Trojan, Trojan:JS/Certor.A, Trojan:PowerShell/Certor.A, Windows Defender

Attackers have been using social engineering to avoid the increasing costs of exploitation due to the significant hardening and exploit mitigations investments in Windows. Tricking a user into running a malicious file or malware can be cheaper for an attacker than building an exploit which works on Windows 10. In our previous blog, Where’s the…

Microsoft Security

MSRT September 2016 release feature: Prifou

January 23, 2017 admin Antimalware research for IT pros and enthusiasts, browser modifier, BrowserModifier:Win32/Prifou, Microsoft Malicious Software Removal Tool, Microsoft's objective criteria, MSRT, MSRT September 2016, NightClick, Objective Criteria, Prifou, Suweezy, Trojan:Win32/Suweezy, Trojan:Win32/Xadupi, TrojanClicker:Win32/NightClick, Unwanted software, unwanted software objective criteria, Windows Defender, Xadupi

As part of our ongoing effort to provide better malware protection, the Microsoft Malicious Software Removal Tool (MSRT) release this September includes detections for: BrowserModifier:Win32/Prifou TrojanClicker:Win32/NightClick Trojan:Win32/Suweezy Trojan:Win32/Xadupi This blog discusses BrowserModifier:Win32/Prifou (Prifou). Windows Defender detects this threat because it limits your choice and control over your browser and operating system. The unwanted behaviors are detailed…

Microsoft Security

Link (.lnk) to Ransom

January 23, 2017 admin Antimalware research for IT pros and enthusiasts, detect ransomware, macro malware, OneDrive backup, prevent ransomware, ransomware, ransomware detection, ransomware prevention, ransomware recovery, recover from ransomware attack, spam email infection vector, Windows Defender, worm, worm-like ransomware, wormable ransomware

We are alerting Windows users of a new type of ransomware that exhibits worm-like behavior. This ransom leverages removable and network drives to propagate itself and affect more users. We detect this ransomware as Ransom:Win32/ZCryptor.A. Infection vector Ransom:Win32/ZCryptor.A is distributed through the spam email infection vector. It also gets installed in your machine through…