Security Response

90 Day Global Threats, Risks, and Vulnerabilities Timeline

Most Active New Threats

Name

Type

Protected*

Discovered

Packed.Dromedan!gen3	Trojan Virus	05/15/2012	05/15/2012
Trojan.Smoaler!gen3	Trojan	05/15/2012	05/14/2012
Packed.Generic.366	Trojan Worm	05/11/2012	05/11/2012
Trojan.Tatanarg.B	Trojan	05/10/2012	05/10/2012
Packed.Generic.364	Trojan Worm	05/10/2012	05/09/2012
Suspicious.Epi.2	Trojan Virus	05/07/2012	05/08/2012
Bloodhound.Olexe.2	Trojan Virus	05/08/2012	05/08/2012
Bloodhound.Flash.15	Trojan Virus	05/08/2012	05/08/2012
Trojan.Maljava!gen19	Trojan	05/08/2012	05/07/2012
Trojan.Maljava!gen18	Trojan	05/08/2012	05/07/2012

*For continued protection, make sure that your Symantec subscription and/or license are up to date.

Threat Spotlight: Trojan.
Zeroaccess

Trojan.Zeroaccess is a Trojan horse that uses an advanced rootkit to hide itself. It is often installed through drive-by-download attacks from sites hosting the Blackhole exploit kit. The Trojan can also create an encrypted, hidden file system, download more malware, and open a back door on the compromised computer.

The Trojan is called ZeroAccess due to a string found in the kernel driver code that is pointing to the original project folder called ZeroAccess. It is also known as max++ as it creates a new kernel device object called __max++>.

More information on Trojan.Zeroaccess is available in the threat family writeup.

Best Practices

With the rapid rise in the number of malware attacks it’s harder than ever to prevent machines from getting infected. But have you done everything you can do? Have you done the things you must do to stay protected? Following some simple best practices can make a tremendous difference in improving your protection. Symantec has assembled a set of best practices for today’s threat landscape.

Use these recommendations to know what you must, should and can do to protect your endpoints from malware.

Want to go further and really beef up protection on your endpoint machines? Symantec Endpoint Protection has a feature called Application and Device Control that gives you additional tools to protect your endpoints. Find out about Application and Device Control and download rulesets especially created by Symantec to increase your protection. Information available here.

White Paper Spotlight

With more than 800 million registered accounts, Facebook is the largest social network in use at the moment. Consequently, it is also becoming a booming attack ground for malware authors and scammers. Most of the attacks that we currently see use social engineering tricks to spread their messages to thousands of users.

This paper illustrates and discusses the most prevalent issues and threats targeting the Facebook network today, as well as providing help in choosing the right configuration settings.

Download the full Scams and Spam to Avoid on Facebook white paper.

View the full set of Symantec Security Response white papers.