Windows Defender – Page 4 – Computer Security Articles

Malicious macro using a sneaky new trick

January 23, 2017 admin antimalware, Antimalware research for IT pros and enthusiasts, Donoff, guidance, Locky, macro, Macro-based malware, malware, malware research, office, ransomware, Social engineering, VBA, VBAscript, Windows 10, Windows Defender, Word

We recently came across a file (ORDER-549-6303896-2172940.docm, SHA1: 952d788f0759835553708dbe323fd08b5a33ec66) containing a VBA project that scripts a malicious macro (SHA1: 73c4c3869304a10ec598a50791b7de1e7da58f36). We added it under the detection TrojanDownloader:O97M/Donoff – a large family of Office-targeting macro-based malware that has been active for several years (see our blog category on macro-based malware for more blogs). However, there wasn’t…

Microsoft Security

The 5Ws and 1H of Ransomware

January 23, 2017 admin detect ransomware, Microsoft ransomware FAQs, ransomware, ransomware detection, ransomware FAQ, ransomware infographic, ransomware prevention, ransomware recovery, Windows Defender, Windows Defender blogs for home users and small businesses

For the past three months, we have seen ransomware hop its way across globe. Majority of the ransomware incidents are found in the United States, then Italy, and Canada. The prevalence of large-scale ransomware incidents led the United States and Canadian governments to issue a joint statement about ransomware. Due to the global ransomware incidents, the…

Microsoft Security

Limited Periodic Scanning in Windows 10 to Provide Additional Malware Protection

January 23, 2017 admin antivirus scanning, AV scan, cybersecurity, Limited Periodic Scanning, Microsoft Safety Scanner, Microsoft security, Microsoft software security, MSRT, Windows 10, Windows Defender

Every month, Microsoft’s Malicious Software Removal Tool (MSRT) scans more than 500 million Windows devices for malware and malicious software. This tool aids in the detection and removal of malware from 1 to 2 million machines each time, even on those devices running antivirus software. Meanwhile, many Windows customers continue to use the Microsoft Safety…

Microsoft Security

Digging deep for PLATINUM

January 23, 2017 admin Activity groups, Advanced persistent threats, advanced threat, enterprise software security, guidance, hunters, malware, malware research, Microsoft Security Essentials, MMPC, phishing, research, Uncategorized, Windows 10, Windows Defender, Windows Defender ATP, Windows Defender for Windows 10

This blog introduces our latest report from the Windows Defender Advanced Threat Hunting team. You can read the full report at: PLATINUM: Targeted attacks in South and Southeast Asia There is no shortage of headlines about cybercriminals launching large-scale attacks against organizations. For us, the activity groups that pose the most danger are the ones…

Microsoft Security

Gamarue, Nemucod, and JavaScript

January 23, 2017 admin Code obfuscation, Crowti, fareit, Gamarue, JavaScript, maps, Nemucod, ransomware, spam, Tescrypt, Windows Defender, Windows Defender for Windows 10

JavaScript is now being used largely to download malware because it’s easy to obfuscate the code and it has a small size. Most recently, one of the most predominant JavaScript malware that has been spreading other malware is Nemucod. This JavaScript trojan downloads additional malware (such as Win32/Tescrypt and Win32/Crowti – two pervasive ransomware trojans…

Microsoft Security

Large Kovter digitally-signed malvertising campaign and MSRT cleanup release

January 23, 2017 admin Kovter, Locky, Macro-based malware, Malvertising campaign, maps, MSRT, ransomware, Trojan, Windows Defender, Windows Defender for Windows 10

Kovter is a malware family that is well known for being tricky to detect and remove because of its file-less design after infection. Users from United States are nearly exclusively being targeted, and infected PCs are used to perform click-fraud and install additional malware on your machine. Starting April 21, 2016, we observed a large…

Microsoft Security

JavaScript-toting spam emails: What should you know and how to avoid them?

January 23, 2017 admin AppLocker Group Policy, backdoor, JavaScript spam attachment, JS/Locky, JS/Nemucod, JS/Swabfex, Locky, Nemucod, Rensomware payload, sample JavaScript email attachments, sample JavaScript spam, spam, spam email vector, Swabfex, Tecrypt, Trojan, Windows Defender

We have recently observed that spam campaigns are now using JavaScript attachments aside from Office files. The purpose of the code is straightforward. It downloads and runs other malware. Some of the JavaScript downloaders that we’ve seen are: TrojanDownloader:JS/Swabfex TrojanDownloader:JS/Nemucod TrojanDownloader:JS/Locky The same JavaScript downloaders are also responsible for spreading the following ransomware: Ransom:Win32/Tescrypt Ransom:Win32/Locky…

Microsoft Security

A brief discourse on ‘Changing browsing experience’

January 23, 2017 admin browser modifier, browser modifier policy, browser modifier policy update, browsing experience, microsoft, Objective Criteria, Parental Control programs, Unwanted software, VPN, Windows Defender

In response to questions we’ve received from the software distribution and monetization industry, and following our blog announcing our browser modifier policy update, we’d like to provide some details on what we refer to in our policy as “changing browsing experience”. For us, “changing browsing experience” means behaviors that modify the content of webpages. We…