webrootcomsafee.us

Virus writers are evolving the use of encryption and other techniques to hide malicious code from detection software. They have direct access to the operating system documentation (for Windows, Mac, etc.); the same documentation used by developers. They have traditionally made sure they're malicious code evades detection by signature based antivirus detection. This fact and economics means the number of crackers and malicious attacks will continue to increase.In spite of this, researchers have been baffled as to how the Flame Malware has been devised to avoid detection for two years (not matching the available antivirus signatures) with the ability to infect fully patched Windows 7 machines… Security Researchers have identified 'Windows Update' as the mechanism Flame uses to infiltrate and compromise networks.Network InfectionCrackers exploited a flaw in the Microsoft Terminal Services licensing certificate authority, which allowed them to generate a new certificate that was "signed" by Microsoft. This particular kind of certificate (valid from February 2010 and February 2012) gave crackers a clear avenue into most computers running Windows.This sophistication in malware creation has never been seen before. Many security experts are just amazed, calling it "the Holy Grail of malware writers" and "the nightmare scenario". Antivirus Researchers (such as) Symantec and Kaspersky said that Flame didn't actually compromise anything in 'Windows Update' and it did not compromise the service or servers.Computer to Computer InfectionFlame conducted an imitative deception operation of Windows Update (a military grade attack). Using this process it was able to make all other computers on the network believe, that it's the Windows Update server. It Then collected the NetBIOS information (which identifies each computer) and used that info to send Windows Update requests through Internet Explorer. Flame makes itself a Web Proxy Auto-Discovery Protocol (WPAD), and sends configuration files to all of the requesting PC's.Configuration files sent from computer to computer through the WPAD directs the compromised machine to redirect all traffic through the infected machine. When Flame detects a URL request matching the Windows Update URL, it transmits a new downloader (disguised as an update from Microsoft) to infiltrate the machine disguised as a '.cab' file. Once the update is executed, it downloads a copy of Flame from the infected machine to the clean machine.Microsoft (upon detection) has blocked three certificates that were used by attackers, preventing additional spoofing of Windows Update (as long as there are no more rogue certificates in the wild). They have also implemented prevention procedures to stop others from creating new code signing certificates.Attack Vectors and InstructionsFlamer spreads from computer to computer, however; It doesn't do that automatically, instead it waits for the attacker to send instructions. Here are the additional methods that Flamer uses to spread:- It uses captured credentials from administrators - spreads through network shares.- It uses (CVE-2010-2729), spreading through a Microsoft Windows Print Spooler Service Remote Code Execution Vulnerability, which was previously used by Stuxnet.- It uses removable media - spreading through a specially crafted autorun file.- It uses removable drives - spreading through a special directory that hides the files. It can execute automatically while viewing the USB drive, if combined with the (CVE-2010-2568), the Microsoft Windows Shortcut 'LNK/PIF' Files Automatic File Execution VulnerabilityThe Last vector has not been seen before (using junction points exclusively). A junction point is actually an alias to a directory, which has some special attributes. The interesting thing is that Flamer uses junction points, and makes them hide its files and enable auto-execution.Flamer creates a directory and places three files there -' ', '' and '' the configuration file in the '' file causing this directory to work as a junction point. However, Flamer uses a special trick, to make the junction point lead to a file instead of a directory. So this directory leads to a file named ''. That means that this folder won't be accessible by the user, and the files inside will be hidden.Flamer uses (CVE-2010-2568) Microsoft Windows Shortcut 'LNK/PIF' Files Automatic File Execution Vulnerability to be executed. Then the '' file will be used and automatically parsed, and by using the "shortcut" vulnerability, it will execute the Flamer (). Additionally, Flamer might change it's names to , , , or probably any other name.In ConclusionFlamer uses new techniques to get executed and hide itself. Moreover, it exploits the old techniques too. It is incredibly large, and it will probably show us some more techniques as new versions continue to morph. BitDefender, Kaspersky, Norton and some of the other antivirus companies have released a free tool which removes the scariest cyber espionage tool ever. Please use one of the automatic removal tools listed below to eradicate this weapon.

Most of the users going online today are very casual about the internet security and they know minimum about online threats. Whenever, they face issues with their PC they consider it any minor and temporary PC problem and simply ignore them. It happens because users don't really understand that the problem is actually caused by a malware that may be a virus, Trojan or others. Those who can understand the symptoms and types of malware don't really wait till the system crashes down rather they seek the right kind of support and repairs so the threats could be prevented within time. The users who know about malware and other online threats can take recourse to updated antivirus programs in a bid to prevent such threats. What is malware? Malware is in fact a malicious software that is programmed to hack your PC and steal or destroy important data and information. The malware is a broader term that refers to every type of malicious software which is designed and created with the intention of damaging PCs and stealing important data and information. It targets the PCs connected to the internet and sometimes make the users suffer financially as well. Some of the categories of malware include viruses, Trojan horses, worms, spyware and rootkits. This article lets you know about various types malware that can infect your PC. In this article you will know about the mode of infection and features of these online threats. Viruses Viruses are the most frequent type of malware that we know. Some viruses that have made huge impact in the past include ILOVEYOU bug, the Melissa, and the Chernobyl virus. Due to these viruses, companies have suffered huge losses amounting in millions of dollars. While active during their peak, these viruses impacted thousands of PCs and crippled the entire email server of many companies. At one point of time, the companies like Intel and Microsoft had to shut down their emailing servers because of the fast increasing impact of these viruses. The viruses that have appeared in the past had a feature of stealing the contacts from the address book of the infected PC and sending them to many PCs either via the MS Outlook or other email accounts. The virus sends the email with an attachment containing an alluring note to befool users. It is very difficult to remove malware from the system as it gets glued to almost every removable hardware component that is attached to the infected PC or device. The features and mode of infiltration of these computer viruses are very similar to computer worms as both infect the files on the system and gradually make the system slow to an extent that it becomes unusable. To fix the PC you first need to remove these files as they get infected with the virus. Worms Computer worms can be termed as the self-replicating malware. It is widespread and available everywhere on the web. If you are thinking that they are not a major threat to the PC and you can easily get rid of computer worms then you are totally mistaken as worms are stubborn and it is not easy to remove them. One remarkable thing about the worms is their ability to go undetected even after staying for months in your PC. Gradually they begin deleting your files, slowing down your programs and creating ways for other malware to get into the system. Certain worms can also create backdoors for hackers. Worms often attach themselves with files and attachments and infect PCs through mass mailing. So be cautious about these highly dangerous computer worms and always keep your PC protected with an updated antivirus program. Trojan Horses This is one of the most dangerous types of malware. Trojan plays trick to befool the users. They exist in the PC in the guise of some genuine program or file that makes it very difficult for the users to detect the infection. Trojan mostly exists as a document, genuine photo or application to avoid detection. The moment you click on either of it, the malware gets executed and starts harming your PC and programs. Although, it doesn't replicate itself but is capable of inserting many worms and viruses that make irreparable damage to the PC. Some other types of malware include spyware and rootkits. Spyware infects the target PC via ads, message pop ups and browser redirection. They divert you to a malicious web page or website and thus insert the infection into your PC. The best way of preventing these threats is to install an updated antivirus program on your PC. Moreover, be always alert and cautious while you are clicking on an email or attachment coming from a strange source.