Security Response

While investigating the worm W32.Waledac recently, we got a shock (and a few laughs) from what popped up on ours screens (yes, unfortunately this is what passes for kicks in the virus lab during the holiday season):

(to see how we received this – skip to “Arnold Surprise” below)

First, I’ll tell you a little bit about the worm. W32.Waledac is a worm that sends emails containing a link to an apparent Christmas e-card that you have received. However, when the link for the e-card in the email is visited, you receive a copy of the worm instead of a greeting card. The file name used by the worm is ecard.exe and the links are all Christmas related, such as:

hxxp://[...

After the shutdown of McColo, which was aiding the distribution of about half of all spam on the internet globally, spam volumes dropped. However, since mid-November, spam volumes have been slowly inching their way back up as old botnets are being brought back online and potential new botnets are being created.

At this point, spam volumes have slowly crept back up to 80 percent of their pre-McColo shutdown levels (when reviewing daily averages):

The types of spam being seen in new attacks are similar to what was being sent around the Internet prior to the shutdown. The spam messages can be categorized into the following groups:

• Replica watches
• Generic pharmacy
• Erectile dysfunction drugs
• Weight loss
• Software

The spam is...

Like so many forms of donations today, contributions to cancer research and treatment can be made online. Unfortunately, any online business or charity can be prone to phishing attacks against unsuspecting users. We have come across messages posing as though they have been sent from a legitimate cancer institute, but with spoofed URLs inside. These spoofed URLs redirect users to fake websites where online donations can be made. When a user enters their email address and password for making payments, an error is shown and they are redirected to the legitimate site. This is common behavior seen with such attacks. The actual intention of these phishing websites is to harvest email addresses and steal confidential information.

Simple preventive measures such as manually typing legitimate URLs directly in the browser can...

    从12月9日IE漏洞发布至今，赛门铁克密切监测可能针对此漏洞的计算机威胁，并陆续发布漏洞分析和IE zero-day漏洞警示， 帮助用户了解此漏洞的潜在威胁，提高防范意识。与此同时，赛门铁克迅速更新病毒特征库。针对此漏洞的 Bloodhound.Exploit.219 和 IPS 特征 23241 - HTTP MSIE Malformed XML BO 能够使用户计算机得到有效的安全防范。截至目前，根据赛门铁克的监测，针对此漏洞的攻击十分活跃，并已迅速跃居病毒攻击排行的前列。其中，中国用户受攻击数量居全球之首，美国，韩国和中国香港地区次之。

    亚洲是受此次漏洞影响的“重灾区”，因为目前利用比较广泛的针对该漏洞的SQL注入式攻击主要针对亚洲地区的用户。该攻击将计算机重新定向到含有恶意代码的网站，并自动下载 ...