We have been seeing a recent wave of Trojan.Shylock variants with a lot of additional functionality than the older versions we have been used to.

Initially, many of these variants are detected generically as Backdoor.Trojan or Trojan Horse, but our new Shylock heuristic signatures (Trojan.Shylock!gen6 and Trojan.Shylock!gen7) should be changing this to a more accurate naming convention, and should be picking up a much wider spread of these threats.

Additionally we are hearing about some behavior that we have not been able to reproduce. Reports are saying that legitimate documents are getting hidden and then shortcuts with the same name of the document are being added in their place. These shortcuts actually launch a thumbs.db(x) file which is the Shylock Trojan, and they are meant to trick the user into running the threat. This is common behavior of for threats, as noted in this blog article from May 2012,...

Reference: http://www.symantec.com/business/support/index?page=content&id=TECH205767

Symantec will post update to the AV Engine in Multiple Daily Virus Definitions on Tuesday May 21st 2013.

Beginning with the Virus Definitions that include the update AV Engine version 20131.1, additional files will be added. That update is expected to post in MDD1 on Wednesday May 21st.

Symantec Endpoint Protection 12.1+ and Norton AntiVirus/Norton Internet Security 2011+ customers will see 4 new index files.  Symantec Endpoint Protection 11+ and Norton AntiVirus/Norton Internet Security 2007+ products will see 8 additional index files.

As a result of the additional files, the size of each dated definition folder will increase. Note the size increase noted below will be the size that is added to the dated definition folders as they exist...

Symantec Messaging Gateway 10.5 Pre-release Evaluation

On June 25th, 2013 Symantec will be launching the pre-release evaluation of Symantec Messaging Gateway 10.5. This new version of Symantec Messaging Gateway plans to introduce new features including.

• Remove Zero Day Malware and Targeted Attacks from Office and PDF attachments with new “Disarm” technology.
• Block more Spam and Malware with Expanded Threat URL Reputation
• Simplify management with LDAP Authenticated Administration
• Enhanced management of Unscannable Messages
• Communicate securely with trusted partners using enforced inbound TLS encryption
• Increase security with TLS encrypted delivery to Symantec DLP
• Control Spam attacks and message volume from inside the your environment with Outbound Sender Throttling Capability
• Deploy using new Hyper-V support

The Symantec ...

Over the last year, the threat landscape has radically changed as cyber criminals diligently find new ways to attack encrypted data through various channels.  The annual Symantec Internet Security Threat Report (ISTR) revealed that Web-based attacks increased 30% in 2012. Surprisingly though, is that a majority of those attacks targeted small business with less than 2,500 employees, proving that no matter what size your business is, it’s vulnerable to potential attacks. Other results from the ISTR indicated a rise in targeted attacks, sub-standard website security increases risk, mobile malware is a growing concern, and that new tactics, like ransomware, will continue to evolve. To read more about the ISTR findings and learn how to better protect your small business from malicious attacks, follow this link: http://bit.ly/14QmmJ6