Wiz's Computer and Website Security Blog

For a couple of days I have been seeing a new round of nasty Trojan attachments in emails posing as FedEx invoices. This scam is not new. It has been ongoing for months now. The payload, in an attached zipfile, has been either the Bredolab or Zeus Trojan in the recent past. The Bredolab makes a PC a member of a spam and DDoS Botnet. The Zeus (Zbot) plants and info stealing keylogger on your system, then protects it wilh a rootkit. The Zeus monitors logins to a long list of popular banks, payment processors and online game sites, then captures the key strokes as you log in, and soon, most of your money is gone to Russia.

Although the scam is not new, the method of delivering the convincing con has changed. This week has seen the arrival of the con being embedded in an inline image, in the .jpg format. The message I am looking at right now has the following text embedded as its content:

"Dear,
Unfortunately we failed to deliver the postal package you sent on the 27th of July in time because the recipient's address is erroneous. Please print out the invoice copy attached and collect the package at our office."

The message then screws its own pooch by displaying this odd text: "'Spiderman' climbs again in Sydney ." However, I'm sure that will disappear, as spam filters around the world tune in to that phrase.

The attachment, which claims to be a FedEx document (invoice) is inside a .zip file and is in fact a very dangerous Trojan. If you open the zip file and launch the embedded executable, your PC will become a zombie member of a spam and attack Botnet, and or will have the Zeus Trojan installed, to steal your logins and money.

If you may have already fallen for this scam, please scan your computer with the Trend Micro online Housecall malware scanner. Then, if at all possible, update your existing anti-virus program and scan with it. If your anti-virus is old and the subscription is expired, download a free, fully functional trial of Trend Micro Internet Security. Install it, update it, then scan the entire computer.

Further, I recommend downloading and installing/scanning with Malwarebytes Anti-malware (MBAM). Both of these security applications will detect the threats contained in the fake FedEx scams attachments and will halt their hidden processes and delete their files. You will have to restart the PC and scan again and may have to disable System Restore. Many types of malware hide as backups in the hidden system restore folder and are restored after you clean the machine, then reboot. Turning off System Restore kills the malware backups. Don't forget to turn it back on after cleaning has completed!

If the malware prevents you from updating, or installing, or running a real security program, go to Bleeping Computers malware removal forum, sign up for an account, read the instructions, then open a new topic requesting personal help. A trained, volunteer malware removal expert will assist you as soon as he or she is able to. They will recommend free tools you can use to restore your PC to normal working condition. Read every word carefully and only do what you are asked to do.

Malwarebytes also has an expert malware removal assistance forum. Their forums are meant for people attempting to use MBAM to remove malware.

Both of the aforementioned programs will protect you from getting infected in the first place! Trend Micro Internet Security not only has regularly updated onboard malware definitions and behavioral analysis engines, but also consults a definitions server referred to as a "Cloud Server." As new releases of malware are captured (by security company honeypots), they are rapidly examined and new definitions are published to the Cloud servers, before they are pushed to client computers. Further, the destination websites are instantly blocked by the "Trend Micro Smart Protection Network." All subscribers to Trend Micro security programs are instantly protected from visiting those hostile websites and servers. You can learn more, download and purchase a subscription here.

Malwarebytes Anti-Malware is free to use in purely manual mode, but this won't protect you against reinfection. You can get realtime protection and automatic updating and scanning by paying $24.95 US dollars or equivalent in your currency, for a lifetime license. Read the details and download or purchase a license for MBAM here.

Posted by Wiz at 12:58 AM | Permalink

Get Norton 360 Version 4.0 - All-In-One Security. If you have a non-current version of a Symantec security program and wish to renew your definition updates subscription, or upgrade to a new version at a discount, go to the Norton Product Upgrades & Renewals page.

back to top ^

This is the latest entry in my weekly series about classifications of spam, according to my custom filter rules used by MailWasher Pro. The categories are shown on the "Statistics" page > "Junk Mail," as a pie chart, based on my custom filters and blacklist. The amount of email flagged as spam is shown on the "Summary" page of Statistics. These reports can help you adjust the order of your own spam filters.

MailWasher Pro is a POP3 and IMAP email spam screener that checks email before it is downloaded to your desktop email client. It can be set to delete recognized spam either manually or automatically when a user-defined filter, or the built-in learning filter, or a blacklist entry, or known spam source is matched, or an attached virus is detected.

My incoming spam levels have increased 6% this week, to 54% of all my incoming email. I saw a few new courier infected attachment exploits this week. All the the rest of the spam was typical junkmail for counterfeit Chinese watches, fake Cialis and Viagra, illicit prescription drugs, male enhancement scams, pirated software, and fake diploma scams.

The classifications of spam in my analysis (below) can help you adjust your email filters according to what is most common, on a weekly basis. If you are using my custom MailWasher Pro filters, keep the filters for the highest percentage categories of spam near the top of the filters list, to minimize the impact on your CPU when analyzing incoming messages for spam content.

Since virtually all spam is now sent from and hosted on hijacked PCs that are zombie members of various spam Botnets and all email sender addresses are forged, there is no point in complaining to the listed From or Reply To address. These accounts are inserted by the same script that composes the spam on the compromised PCs. These are innocent spam victims themselves, whose harvested names are reused in forged From addresses.

Sometimes, your own email address is forged as the sender, as well as being the recipient. The practice of forging the recipient's own email address in the From field is known as a "Joe Job." Fortunately, MailWasher Pro has a custom filter option that overrides the "Friends" list (a Whitelist of approved senders), allowing user created spam filters to read the content and flag or auto delete spam that's using one's own accounts as the forged sender.

You can take preventative measures to secure your computers from becoming members of Botnets, by installing Trend Micro Internet Security and MalwareBytes Anti-Malware (see pages for details).

See my extended comments for this week's breakdown of spam by category, for August 23 - 29, 2010, and the latest additions to my custom MailWasher Pro filters and Blacklist.

This article has extended content.
Continue reading "My Spam analysis & filter updates for the week of Aug 23 - 29, 2010" »

Posted by Wiz at 11:16 PM | Permalink

Get Norton 360 Version 4.0 - All-In-One Security. If you have a non-current version of a Symantec security program and wish to renew your definition updates subscription, or upgrade to a new version at a discount, go to the Norton Product Upgrades & Renewals page.

back to top ^

In early July, 2010, Firetrust, the makers of the famous anti-spam program: MailWasher Pro, released a brand new version. The new MailWasher 2010 was several years in the making and touts a new user interface, new spam weighting system and a brand new spam filter format.

Previously, MailWasher spam filters were in a plain text file, aptly named "filters.txt" - with each filter on a long separate line, ending with a line feed, but no blank lines between them. Some filters have many individual rules and trying to read and debug them is a challenge. The new version uses a well formed XML format, with indented sections and rules. This is a visually pleasing layout that is easy to read and edit, rule by rule. However, because each rule and condition is on a separate line, the file size is much larger than the old flat text file filters.

As many of you know, I write and publish spam filters for use in MailWasher Pro. I have been writing and updating these filters for years. But, with the release of the new MailWasher 2010, a lot of work was needed to convert the old filter format into the new one. The good news is that as of today, August 22, 2010, I completed the conversion and placed the new "Filters.xml" online. You can view and download them from my aforementioned Custom Filters page

If you already know where to save downloaded filters you don't need this article. Otherwise, you need this information to learn where to save updated filters. Where you save your filters file depends on both your operating system and the version of MailWasher Pro you have installed. Some, like me, use both the old and new versions simultaneously. I continue using the previous version 6.5.4, because it contains direct reporting of spam to SpamCop, for reporting members. And, the previous version has full-featured Mail Statistics and Spam Categories charts. I use the statistics and percentages reports in my weekly spam analysis articles, published on this blog, every Sunday (see my Spam and Email categories). These features are going to be added to the new version 2010 of MailWasher, at which time I and others will stop using the previous version.

If you are here out of curiosity, you can learn more about MailWasher Pro, or try it, or buy it here.

Let's move on with the locations of your spam filters, for various operating systems and versions of MailWasher Pro...

This article has extended content.
Continue reading "Where to save my updated MailWasher Pro spam filters" »

Posted by Wiz at 1:38 PM | Permalink

Get Norton 360 Version 4.0 - All-In-One Security. If you have a non-current version of a Symantec security program and wish to renew your definition updates subscription, or upgrade to a new version at a discount, go to the Norton Product Upgrades & Renewals page.

back to top ^

This is the latest entry in my weekly series about classifications of spam, according to my custom filter rules used by MailWasher Pro. The categories are shown on the "Statistics" page > "Junk Mail," as a pie chart, based on my custom filters and blacklist. The amount of email flagged as spam is shown on the "Summary" page of Statistics. These reports can help you adjust the order of your own spam filters.

MailWasher Pro is a POP3 and IMAP email spam screener that checks email before it is downloaded to your desktop email client. It can be set to delete recognized spam either manually or automatically when a user-defined filter, or the built-in learning filter, or a blacklist entry, or known spam source is matched, or an attached virus is detected.

My incoming spam levels have decreased 8% this week, to 48% of all my incoming email. This represents a 12% decline over two weeks. I saw 2 new DHL infected attachment exploits this week. All the the rest of the spam was typical junkmail for counterfeit Chinese watches, fake Cialis and Viagra, illicit prescription drugs, male enhancement scams, pirated software, and a few Nigerian lottery and 419 scams.

The classifications of spam in my analysis (below) can help you adjust your email filters according to what is most common, on a weekly basis. If you are using my custom MailWasher Pro filters, keep the filters for the highest percentage categories of spam near the top of the filters list, to minimize the impact on your CPU when analyzing incoming messages for spam content.

Since virtually all spam is now sent from and hosted on hijacked PCs that are zombie members of various spam Botnets and all email sender addresses are forged, there is no point in complaining to the listed From or Reply To address. These accounts are inserted by the same script that composes the spam on the compromised PCs. These are innocent spam victims themselves, whose harvested names are reused in forged From addresses.

Sometimes, your own email address is forged as the sender, as well as being the recipient. The practice of forging the recipient's own email address in the From field is known as a "Joe Job." Fortunately, MailWasher Pro has a custom filter option that overrides the "Friends" list (a Whitelist of approved senders), allowing user created spam filters to read the content and flag or auto delete spam that's using one's own accounts as the forged sender.

You can take preventative measures to secure your computers from becoming members of Botnets, by installing Trend Micro Internet Security and MalwareBytes Anti-Malware (see pages for details).

See my extended comments for this week's breakdown of spam by category, for August 16 - 22, 2010, and the latest additions to my custom MailWasher Pro filters and Blacklist.

This article has extended content.
Continue reading "My Spam analysis & filter updates for the week of Aug 16 - 22, 2010" »

Posted by Wiz at 12:52 PM | Permalink

Get Norton 360 Version 4.0 - All-In-One Security. If you have a non-current version of a Symantec security program and wish to renew your definition updates subscription, or upgrade to a new version at a discount, go to the Norton Product Upgrades & Renewals page.

back to top ^

On Thursday, August 19, 2010, Adobe released critical "out of cycle" security updates, 9.3.4 and 8.2.4, for its commercial Acrobat PDF encoder and free Adobe PDF Reader programs. Today's updates fix at least two critical vulnerabilities that are being exploited in the wild. Exploitation of these vulnerabilities could cause the application to crash and could potentially allow an attacker to take control of the affected system.

Updates are available for Windows, Mac and UNIX versions of these Adobe programs. Windows users may receive automatic updates notices, or may be auto-updated, depending on how you have set your updater preferences (Edit > Preferences > Updater). You can also check manually, buy going to the Help menu item, then down to "Check for updates." An updater window will open separately, download the new version upon receiving your permission. It will close Reader or Acrobat, then install then new version. If you were working on any PDF documents, save them and exit the application during the update phase. It may take some time to complete (I don't know why, it just does!).

The official Common Vulnerabilities and Exposures code for today's update is: CVE-2010-2862, which was discussed and demonstrated at the Black Hat USA 2010 security conference on Wednesday, July 28, 2010. The actual vulnerability is described as: "Integer overflow in CoolType.dll in Adobe Reader 8.2.3 and 9.3.3, and Acrobat 9.3.3, allows remote attackers to execute arbitrary code via a TrueType font with a large maxCompositePoints value in a Maximum Profile (maxp) table."

Further details are: "Network exploitable; Victim must voluntarily interact with attack mechanism" - which they are tricked into doing.

Vulnerability details were provided and/or discovered by: Charlie Miller, Independent Security Evaluators, and Tavis Ormandy, Google Security Team.

All of this follows on the heels of another out-of-cycle critical update in Adobe's Flash Player, on August 11. It appears that Adobe Acrobat and Reader bundle a version of Flash inside the program, and that version was exploitable, via authplay.dll. The new updates to Reader and Acrobat supply the latest, patched version of Flash, bundled inside those programs.

Posted by Wiz at 4:30 PM | Permalink

Get Norton 360 Version 4.0 - All-In-One Security. If you have a non-current version of a Symantec security program and wish to renew your definition updates subscription, or upgrade to a new version at a discount, go to the Norton Product Upgrades & Renewals page.

back to top ^

This is the latest entry in my weekly series about classifications of spam, according to my custom filter rules used by MailWasher Pro. The categories are shown on the "Statistics" page > "Junk Mail," as a pie chart, based on my custom filters and blacklist. The amount of email flagged as spam is shown on the "Summary" page of Statistics. These reports can help you adjust the order of your own spam filters.

MailWasher Pro is a POP3 and IMAP email spam screener that checks email before it is downloaded to your desktop email client. It can be set to delete recognized spam either manually or automatically when a user-defined filter, or the built-in learning filter, or a blacklist entry, or known spam source is matched, or an attached virus is detected.

There was news today on the anti-spam front. It was just reported that the #2 spammer in the world, Leo Kuvayev, is sitting in jail, awaiting trial in Russia, on charges of molesting over 50 young girls he lured away from Russian orphanages. Kuvayev is responsible for operating bogus online pharmacies, porn sites, including child porn, pirated OEM software and related affiliate programs for these illegal activities. His organization is called BadCow and his partner in crime is running it in his absence. Many of the spam messages we receive on a daily basis are sent by Botnets under his control, or operated by his associates. The spammers themselves are affiliates of BadCow. When spam recipients are foolish enough to purchase a spamvertised item, the affiliate spammers earn a commission and Leo Kuvayev lines his pockets even more.

My incoming spam levels have decreased 4% this week, to 56% of all my incoming email. I didn't see any new types of spam this week. All the the spam that botnets are sending out this week is typical junkmail for counterfeit Chinese watches, fake Viagra, illicit prescription drugs - sans the prescription, male enhancement scams, pirated software, fake diplomas and Nigerian lottery and 419 scams. Many of the pirated software domains this week are hosted in the Ukraine. Most Russian sender spam was for counterfeit watches.

The classifications of spam in my analysis (below) can help you adjust your email filters according to what is most common, on a weekly basis. If you are using my custom MailWasher Pro filters, keep the filters for the highest percentage categories of spam near the top of the filters list, to minimize the impact on your CPU when analyzing incoming messages for spam content.

My blacklisted senders list was fairly effective this week, auto-deleting ~5.5% of all incoming spam. 57 of this week's spam messages also included my own account names in the From and Subject and most were selling fake Viagra or male enhancement junk. This illegal spam practice is known as a "Joe Job" and it is used to slip spam past our own filters. Joe Jobs depend on people white-listing their own accounts and domains. Fortunately, MailWasher custom filters allow you to override the friends list, so you can easily detect and delete Joe Job spam, if you are using MailWasher Pro as your spam filter.

Since virtually all spam is now sent from and hosted on hijacked PCs that are zombie members of various spam Botnets and all email sender addresses are forged, there is no point in complaining to the listed From or Reply To address. These accounts are inserted by the same script that composes the spam on the compromised PCs. These are innocent spam victims themselves, whose harvested names are reused in forged From addresses. This practice is known as a "Joe Job." Fortunately, MailWasher Pro has a custom filter option that overrides the "Friends" list (a Whitelist of approved senders), allowing user created spam filters to read the content and flag or auto delete spam that's using one's own accounts as the forged sender.

You can take preventative measures to secure your computers from becoming members of Botnets, by installing Trend Micro Internet Security and MalwareBytes Anti-Malware (see pages for details).

See my extended comments for this week's breakdown of spam by category, for August 9 - 15, 2010, and the latest additions to my custom MailWasher Pro filters and Blacklist.

This article has extended content.
Continue reading "My Spam analysis for the week of August 9 - 15, 2010" »

Posted by Wiz at 3:06 PM | Permalink

Get Norton 360 Version 4.0 - All-In-One Security. If you have a non-current version of a Symantec security program and wish to renew your definition updates subscription, or upgrade to a new version at a discount, go to the Norton Product Upgrades & Renewals page.

back to top ^

Spybot Search & Destroy is a free (for personal non-business use) anti-spyware/spyware removal program used by millions of people around the World, to protect their computers from spyware, adware, Trojans and other types of malware. Spybot updates for malware detections are released every Wednesday and this week's updates were released on schedule. If you are using Spybot S&D to protect your computer you should check for updates every Wednesday afternoon and apply all that are available.

Malware writers are constantly modifying their programs to evade detection, so anti-malware vendors have to issue regular updates to keep up with the bad guys. New definitions and false positive fixes for Spybot Search and Destroy are usually released every Wednesday. This week's updates were released on schedule, as listed below. These detections include new or modified fake (rogue) security programs (fraudulent anti virus/spyware; scareware) (Malware), Trojan downloaders, password stealers, rootkits, DDoS attack bots and spam bots. It is imperative to keep your security tools updated and scan frequently for malware threats.

Note: one + sign before a detection indicates an update to an existing malware family for which previous definitions have been released. Two ++ signs indicate a completely new detection of a new or rewritten malware type.

An anti-spyware program that is updated once a week cannot protect you from malware threats created or modified and released in the last 24 - 48 hours. If you want realtime protection against the most current spyware, keyloggers, rootkits, rogue anti-virus and security programs, Trojans and other forms of malware, with very frequent automatic updates, scheduled malware scans and the blocking of known-hostile IP addresses, you should try Malwarebytes Anti-Malware.

Definition updates made on 08/11/2010

Malware (Fake anti-virus, etc)
+ ErrorSafe
+ Fraud.Antivirus
+ Fraud.InternetSecurity2010
+ Fraud.Sysguard
+ Win32.FraudLoad.edt

Trojan (Bots, Trojan downloaders, rootkits)
+ Virtumonde
+ Virtumonde.dll
+ Virtumonde.prx
+ Virtumonde.sdn
+ Win32.Agent.fbx
+ Win32.Agent.sc
+ Win32.Bifrost.gen
+ Win32.FraudLoad.ss
+ Win32.Muollo
+ Win32.OnLineGames.noa
++ Win32.OnLineGames.tojy
++ Win32.OnLineGames.tolh
++ Win32.OnLineGames.tolu
++ Win32.OnLineGames.tomw
++ Win32.OnLineGames.tonk
++ Win32.OnLineGames.tooc
++ Win32.OnLineGames.toqk
++ Win32.OnLineGames.tote
++ Win32.OnLineGames.totl
++ Win32.OnLineGames.totv
++ Win32.OnLineGames.tozi
++ Win32.OnLineGames.tpct
++ Win32.OnLineGames.tpei
+ Win32.ZBot

Total: 3090503 fingerprints in 1057887 rules for 5711 products.

False Positives Reported This Past Week

There were 2 false positives reported this week.

1: A file named ww1138.exe - an update for win3.1x calculator, was detected as Win32.Monderb.aqpu. This has been fixed with the current updates.

2: A confirmed false positive was fixed today for "Win32.Wemon.sh" - [SBI $1ACF3A39] Settings (Registry change, fixed) - HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\

Aways make sure you are using the current version of Spybot S&D, before updating definitions or scanning. Older versions tend to give false positives, or fail to adequately remove detected malware.

This article has extended content.
Continue reading "Spybot Search & Destroy updates for August 11, 2010" »

Posted by Wiz at 3:10 PM | Permalink

Get Norton 360 Version 4.0 - All-In-One Security. If you have a non-current version of a Symantec security program and wish to renew your definition updates subscription, or upgrade to a new version at a discount, go to the Norton Product Upgrades & Renewals page.

back to top ^

August 11, 2010

Adobe Releases Security Update for Flash Player: Adobe has released Flash Player 10.1.82.76 to address multiple vulnerabilities. See Go here for the details.

See what version of Flash you have installed for each browser brand, here. If you use the current version of Firefox it will tell you to update Flash, when a new version has been released. Internet Explorer users still need to go to Adobe and update the ActiveX version manually.

Due to exploits in the wild, you are strongly advised to update your Flash players now! Adobe recommends users of Adobe AIR 2.0.2.12610 and earlier versions update to Adobe AIR 2.0.3, by downloading it from the Adobe AIR Download Center.

Note, that previously, one could navigate to C:\Windows\System32\Macromed\Flash and use the FlashUtil(version#).exe application to run a manual update. Those files no longer work that way. Now, the FlashUtil apps uninstall Flash, rather than update it. You can download the new Flash installers, named: install_flash_player_ax.exe, for Internet Explorer based browsers, and install_flash_player.exe, for Mozilla based browsers (non-ActiveX), from the Adobe Flash Download Center. Administrator privileges are required to install or update Flash via these installer files. Use "Run As" (Administrator & password) if necessary.

A word of warning!
As you browse the Internet, or read emails about watching movies online, always beware of any links that take you to a page that tells you to update your Flash Player, but the link does not go to www.adobe.com, or http://www.adobe.com/go/getflash/ . Cyber criminals are famous for creating fake Flash and YouTube players, with a spinning circle in a black player screen, telling you that your Flash Player needs updating and click there. If you hover your mouse over those links you may or may not see that they never leave that website. The files you are about to downland and run from these fake web pages are Trojan Horse programs designed to make your PC a member of a Botnet, or install rogue security scanners, or a login stealing Trojan, like the Zeus/Zbot Trojan.

If you are tricked into clicking on a fake media player and a download dialog appears, dismiss it immediately, then close your browser. Use your anti-virus scanner to see if malware was downloaded into the browser's cache and remove it, or clear the cache. Always update your anti-malware definitions before scanning for new threats.

Posted by Wiz at 1:43 PM | Permalink

Get Norton 360 Version 4.0 - All-In-One Security. If you have a non-current version of a Symantec security program and wish to renew your definition updates subscription, or upgrade to a new version at a discount, go to the Norton Product Upgrades & Renewals page.

back to top ^