AV360 is the New Antivirus 2009 ThreatFire Research Blog

ThreatFire Blogger

Fri, 12 Dec 2008 02:16:01 GM

Our . ThreatFire. community is seeing and preventing far too many hits on this stuff today. It shamelessly re-uses the same AV2009 detection names, like Spyware.IEMonst​er , and presents a simliar 37 phony malware detections on a system. ...

QQ Password Stealing via ActiveX Office Web Component 0day ...

admin

Sat, 31 Oct 2009 11:48:39 GM

Bookmark/Search​ this post with: Delicious Digg StumbleUpon Propeller Reddit Magnoliacom Newsvine Furl Facebook Google Yahoo Technorati Icerocket.

Streamviewer.exe, Tubeviewer.exe, Tubeplayer.exe, now Onlinemovies ...

ThreatFire Blogger

hu, 09 Jul 2009 18:55:01 GM

ThreatFire Research. Blog Home ... It seems that the isp's may be acting on public information the sites were up for only a short time today, but . ThreatFire. protected the community from this prevalent malware all morning. ...

Zbot Targets Major Banks Across the World ThreatFire Research Blog

bprince

ue, 06 Oct 2009 10:11:01 GM

Early Sunday morning was the first that the . ThreatFire. community started seeing a newer variant of the banking password stealing family Zbot in fairly high prevalence, served on a system hosted in Sweden (83.140.191.170​). ...

Urlzone/Bebloh Bait and Switch

bprince

Fri, 09 Oct 2009 13:33:00 GM

The first, larger waves we saw in February targeted German users, protected within the . ThreatFire. community from the menace. As more european banks and countries were hit, we continued to monitor for more of a global presence, ...

intellectual virus scan?

ThreatFire Blogger

ue, 08 Sep 2009 23:24:00 GM

as dancho danchev chronicles the blackhat seo work of his biggest ukrainian fan club (that is sarcasm, folks) leading to delivery of a particular fakeav, the . threatfire. community is protected from fakeav polymorphic downloaders from ...

AMTSO Conference Prague

bprince

ue, 13 Oct 2009 06:01:00 GM

Yesterday's AMTSO conference brought with it formal announcements of Board positions, new tools for the AMTSO to offer testers (be sure to join the group!) and potential new efforts. There were some Board updates due to terms expiring, ...

captcha cracking koobface

ThreatFire Blogger

Wed, 16 Sep 2009 22:58:00 GM

in a post last december on the threatexpert blog, sergei proposed a method to defeat koobface -- hit 'em in the pocketbook where it hurts. the captcha cracking services that the koobface gang uses could be the weak link in its chain and ...

cutwail/pandex reader_s.exe continues to deliver spambots and mmx ...

ThreatFire Blogger

Mon, 10 Aug 2009 22:22:00 GM

this type of evasion, of course, is ineffective against a behavioral-base​d solution like . threatfire. . cutwail is succesfully prevented from running on . threatfire. community user systems on a daily basis. some of the latest cutwail/pandex ...

Torpig Botnet Academics ThreatFire Research Blog

ThreatFire Blogger

hu, 07 May 2009 03:06:01 GM

Over the past couple of years, . ThreatFire. has been preventing fairly high numbers of Torpig/Sinowal/​Anserin infections all over the world, keeping this bank account and credit card number snorting nastiness penned up. ...

koobface 0x3e8 folders and setup.exe links

ThreatFire Blogger

hu, 13 Aug 2009 17:08:00 GM

here is an abbreviated list of the more high volume koobface urls that the . threatfire. community has been protected from over the past 48 hours. see a pattern here (do not visit any of these links and download the malware served there)? ...

michael jackson x-files answer

ThreatFire Blogger

hu, 02 Jul 2009 16:01:00 GM

the . threatfire. community prevented the file in very low prevalence, so very few users are falling for this sort of shameless scam. but we remind you to always think twice before running an unknown executable or visit an untrusted site ...

out of band patch and prevalent client side exploitation

ThreatFire Blogger

ue, 28 Jul 2009 20:46:00 GM

instead, . threatfire. continues to prevent prevalent attacks from malicious pages like those currently hosted on cxim-way. cn, where javascript identifies third party plugins on the system and attacks the user's system accordingly. ...

foto049.com and banking password stealers

ThreatFire Blogger

Mon, 03 Aug 2009 16:59:00 GM

our . threatfire. community in brazil and other parts of the world has been protected from the threat since this variant first appeared on friday, and users must be wary of running unsigned (or any) executables from links that are spread ...

Facebook Password Reset Confirmation Spam -- Bredolab, Zbot ...

admin

ue, 27 Oct 2009 16:18:01 GM

Trojan and virus . research. news ... Avoid the confusion and install a behavioral based layer of protection like . ThreatFire. that reliably and effectively prevents Bredolab, Zbot, and other highly dangerous malware families. ...

PDF Reader Exploitation 2009 ThreatFire Research Blog

ThreatFire Blogger

Wed, 11 Mar 2009 19:06:01 GM

Tens of thousands of malcrafted pdf exploits have been prevented from running by . ThreatFire. on our community systems so far this year. This information is being presented to encourage our users to upgrade their pdf reader software to ...

streamviewer's .gif images embedded with encrypted malware

ThreatFire Blogger

ue, 16 Jun 2009 16:15:00 GM

it stymies automated web crawling based . research. efforts. no longer are we seeing simple xor decoding schemes with visible pe headers in downloaded image files. the encryption implemented for this attack was another previously ...

undetected autorun/injector variant on the loose

ThreatFire Blogger

ue, 02 Jun 2009 21:20:00 GM

a new variant of an autorun worm is on the loose, probably created by another childish and angry ex-lover. the little multithreaded beast injects into windows explorer, and attempts to communicate with one of several irc servers at june ...

bruce schneier on conficker

ThreatFire Blogger

Mon, 27 Apr 2009 22:02:00 GM

conficker autorun-based attacks made up a little less than 10% of the autorun-based attacks in april within the . threatfire. community. the other 90% of autorun based malware continues to thrive by abusing misunderstood autorun features, ...

LaTale Loading Problems

NinpoScythe

Fri, 06 Nov 2009 23:52:36 GM

C:\Program Files\. ThreatFire. \TFTray.exe C:\Program Files\Alwil Software\Avast4​\ashDisp.exe C:\Program Files\Common Files\Real\Upda​te_OB\realsched​.exe C:\Program Files\Zune\Zune​Launcher.exe c:\Program Files\Common Files\Symantec ...