Windows malware

We’ve noticed an increase in the prevalence of Y!/MSN-aware worms. These rely on various social engineering tricks to lure the user into a malicious website.

A very nice description of a Trojan which in an attempt to keep other “competitors” out, installs an antivirus which it uses to keep the system clean. Unsurprisingly, the antivirus which the Trojan installs is KAV

This latest half-yearly report covers the most significant changes in malicious code evolution over the last six months and included a number of predictions as to how the situation may develop based on the statistics we have today.

Slander and plagiarism

Why viruses aren’t elks

No justification for writing malware

Over the weekend we saw the first malware to exploit MS06-040 – Backdoor.Win32.IRCBot.st.

Unlocking Pandora’s box with malware search engines

Yesterday evening we started receiving messages from users in Russia who’d been infected by the latest version of GpCode, a cyber blackmail virus.

We have just received a new version of the StarOffice malware we wrote about last week.

The good news is that we’ve sorted the GpCode encryption algorithm, and added a decryption routine to the latest antivirus database updates.

Two hours ago we started receiving multiple emails from users with encrypted documents. Virus.Win32.GpCode.ae is responsible for this outbreak – this is a new variant of something we’ve reported on before.

Malware seeded on ICQ makes use of FPU instructions to avoid detection.

Almost a year ago we wrote about Tenga, a classic file infector with worm and trojan-downloader functionality. Recently we added detection for something similar: Virus.Win32.Virut.4960.

A new piece of ransomware, called Ransom.a by most AV vendors, has been spotted in the wild. Evidence received so far suggests that this Trojan can be found on P2P networks.