In a recent blog, I mentioned that Office documents were a great place to hide malware in order to maximize its chances of distribution. This time I want to draw attention to the fact that the Windows Registry is also another handy reference tool for some Trojans, too.

A Trojan will usually drop another copy of itself or a components as part of the installation process to try and throw users off track. So, typically a Trojan would run and as part of its installation process, it would drop a copy of itself using another filename in, say, the Windows System folder and modify the registry to run itself at every restart of the computer.

The goal of any effective profit-making malware is to get installed and run undetected for as long as possible to try and maximize the profit-making window. Many angles of attack and stealth have been explored by malware authors over the years. Some are high tech, as we see with rootkits. Some are low tech, such as in...

There is a relatively new annoyance called "spim" that seems to be popping up on our screens more frequently. Spim is the equivalent of spam (unsolicited email, usually selling snake oil) that is delivered over instant messaging clients. After recently receiving more spim, which was advertising what I believed to be a spyware product, it occurred to me that the best tricks are still the oldest ones. With the recent attention that spyware applications are receiving, it is easy to overlook some of the simpler, more direct methods of spying. Spyware applications are not the only way people can catch their spouses cheating (!). The spim message I received was advertising a “catch your spouse cheating service”. No download necessary, no application to install, no hidden software on your spouse’s computer.

The service is based strictly on social engineering. It is a “very straightforward service”, as it is explained on their Web site. For a fee of only...

Well, once again we find ourselves faced with the monthly ritual known as "Microsoft Patch Day”. This time around the ordeal is relatively minor, with only three new items in the bucket. Two of these items could potentially result in attacker-supplied code being run on a target system, but both are reliant on other limiting factors, which greatly reduce the global stress level associated with Patch Tuesday. All items, of course, are still worthy of close inspection by any admin to see if they apply to the machines and networks that they are responsible for.

The first issue we’ll address in this blog is the PGM overflow vulnerability (MS06-052, CVE-2006-3442, BID 19922). This is the most severe of the issues presented this month because it allows an attacker to execute arbitrary code remotely on the affected system. So then, what’s the good news? Well, the affected code is in MSMQ3.0...

Symantec uses the term “security risks” to refer to programs such as adware, spyware, and other potentially unwanted programs. Our hands-on analysis of these programs results in risk designations of high, medium, or low. These risk ratings are calculated across four different categories:
• Performance impact: The measure of the effect that a particular program has on a system’s stability and speed.
• Ease of removal: The measure of the difficulty of removing the program from a system.
• Privacy: The type of information that is being captured and whether or not it is personally identifiable.
• Stealth: Measuring to what extent programs may install without the user noticing and/or try to remain hidden to evade detection and removal.

Unlike malicious code threats, which are automatically removed, a security risk program may be acceptable to one enterprise or home user and not acceptable to another. Classifying security risks helps guide...