Posted on behalf of Jo Hurcombe and Manoj Venugopalan, Malware Analysts, Symantec Hosted Services

As many of us already heard the great news about Bredolab Malware that been shut down by Dutch authorities.

“On October 25th 2010, the High Tech Crime Team of the Dutch National Crime Squad took down a very large botnet, containing at least 30 million infected computer systems worldwide since July 2009. These computers were infected with the malicious Bredolab trojan, through infected websites. Through these botnets, cybercriminals can spread large amounts of other viruses and create new botnets.

In close cooperation with a Dutch hosting provider, The Dutch Forensic Institute (NFI), the internet security company Fox-IT and GOVCERT, the computer emergency response team of the Dutch government, shut down 143 computer servers today”

But MessageLabs Intelligence is still seeing different Bredolab runs (distributing...

On behalf of Dan Bleaken, Senior Malware Data Analyst, Symantec Hosted Services

Recently it has been widely reported that global spam volumes have decreased, especially on Sunday 3rd October 2010, when spam levels dropped to their lowest for some time.  This week spam volumes seem to be creeping back to normal levels.  At Symantec Hosted Services we have a wealth of data on spam traffic, and crucially what contribution to global spam each of the major botnets makes.  This blog will take a close look at botnet spam, what factors influence botnet output, and will try to explain some of the changes that occurred around the 3rd October. 

The big picture

Nobody can be certain what the true volume of spam in circulation is, but some organisations, like Symantec, have a particularly high exposure to global email traffic.  Symantec analyse email traffic that is seen in their global infrastructure and apply reasonable...

Posted on behalf of Mathew Nisbet, Malware Data Analyst

Today there has been a lot of traffic on Twitter related to a very recently discovered Javascript exploit. It took advantage of the way Twitter handled Javascript in updates. Most of the exploits seen used the "onmouseover" trigger, which meant that all a user had to do was move the mouse over a tweet and the code would run. Most would just repost the same thing to your own wall, some would repost and redirect the user to another site. There were some examples of users being redirected towards porn sites. The fact it only needed a cursor to move over it is why it spread so very rapidly all over the world, before people knew what was happening.

More info and screenshots can be found in this F-Secure blog:
http://www.f-secure.com/weblog/archives/00002034.html

Users of the MessageLabs Hosted Web...

By Tony Millington, Malware Operations Engineer, Symantec Hosted Services

On September 9, 2010 at 15:20 (GMT) MessageLabs Intelligence identified and began blocking a new virus attack using old mass-mailer techniques. Using Skeptic’s patented heuristics, Symantec Hosted Services customers, using MessageLabs Hosted Email AntiVirus, were fully protected from this threat from the outset. As a hosted solution in the cloud, the mass mailer worm was detected using Skeptic’s unique predictive heuristics and it was blocked before it reached clients’ networks – this means that there was no need for customers to update patches or virus definitions.  The heuristic rule that triggered the detection of this virus by Skeptic was actually added in 2008.

At its peak Symantec Hosted Services were blocking over 2,000 malicious emails per a minute. The last copy was blocked on September 10, 2010 at 08:33 GMT, during which time 106,390 copies were...