DOCSLIB.ORG

Landesk Patch News Bulletin: Updated Spyware Definition Files Are Available Core 148.0018, 148.0019, 148.0020 05-MAY-2009

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Landesk Patch News Bulletin: Updated Spyware Definition Files Are Available Core 148.0018, 148.0019, 148.0020 05-MAY-2009 LANDesk Patch News Bulletin: Updated Spyware Definition Files are Available Core 148.0018, 148.0019, 148.0020 05-MAY-2009 LANDesk Security and Patch News Headlines · (May 05, 2009) Updated spyware content has been made available on the LANDesk global host servers for customers to download. This content represents the latest spyware family definitions to provide customers with security and protection from annoying and malicious spyware/malware applications New Vulnerabilities # Win32.Backdoor.InCommander # Win32.BackdoorIRC.Flood # Win32.BackdoorIRC.Floodz # Win32.BackdoorIRC.Mimic # Win32.BackdoorIRC.Shiznat # Win32.Dialer.Udis # Win32.FraudTool.AntivirusAgentPro # Win32.FraudTool.ZinapsAnti-Spyware2008 # Win32.IRCWorm.Azaco # Win32.IRCWorm.Azrael # Win32.IRCWorm.Bilay # Win32.IRCWorm.Bildan # Win32.IRCWorm.Buffy # Win32.IRCWorm.Manila # Win32.IRCWorm.Pantera # Win32.Monitor.Ardamax # Win32.SpamTool.Rlsloup Changed Vulnerabilities # WhenU.SaveNow # Win32.Adware.ABetterInternet # Win32.Adware.Adsquash # Win32.Adware.BHO # Win32.Adware.Cinmus # Win32.Adware.ClientMan # Win32.Adware.DealHelper # Win32.Adware.E404 # Win32.Adware.NaviPromo # Win32.Adware.SearchFast # Win32.Adware.Stud 1 LANDesk Patch News Bulletin: Updated Spyware Definition Files are Available Core 148.0018, 148.0019, 148.0020 05-MAY-2009 # Win32.Adware.SuperJuan # Win32.Adware.Surfaccuracy # Win32.Adware.WinAD # Win32.Adware.Virtumonde # Win32.Backdoor.Agent # Win32.Backdoor.Agobot # Win32.Backdoor.AIMVision # Win32.Backdoor.Antilam # Win32.Backdoor.Bifrose # Win32.Backdoor.BO2k # Win32.Backdoor.Cakl # Win32.Backdoor.Ceckno # Win32.Backdoor.Coldfusion2 # Win32.Backdoor.ControlTotal # Win32.Backdoor.DarkMoon # Win32.Backdoor.Delf # Win32.Backdoor.DsBot # Win32.Backdoor.DSNX # Win32.Backdoor.DSSdoor # Win32.Backdoor.DTR # Win32.Backdoor.EggDrop # Win32.Backdoor.Fasec # Win32.Backdoor.Flux # Win32.Backdoor.ForBot # Win32.Backdoor.GF # Win32.Backdoor.GGDoor # Win32.Backdoor.GirlInRed # Win32.Backdoor.Gobot # Win32.Backdoor.GWGirl # Win32.Backdoor.HacDef # Win32.Backdoor.Hackarmy # Win32.Backdoor.HttpBot # Win32.Backdoor.Hupigon # Win32.Backdoor.HVL-rat # Win32.Backdoor.IEBooot # Win32.Backdoor.IRCBot # Win32.Backdoor.IRCContact # Win32.Backdoor.Iroffer # Win32.Backdoor.Joleee # Win32.Backdoor.Lithium # Win32.Backdoor.LittleWitch # Win32.Backdoor.Mytobor # Win32.Backdoor.Nepoe 2 LANDesk Patch News Bulletin: Updated Spyware Definition Files are Available Core 148.0018, 148.0019, 148.0020 05-MAY-2009 # Win32.Backdoor.NetShadow # Win32.Backdoor.Nuclear # Win32.Backdoor.PcClient # Win32.Backdoor.Poison # Win32.Backdoor.PoisonIvy # Win32.Backdoor.PopWin # Win32.Backdoor.Prorat # Win32.Backdoor.Prosti # Win32.Backdoor.Protux # Win32.Backdoor.R3C # Win32.Backdoor.RBot # Win32.Backdoor.Reload # Win32.Backdoor.Robobot # Win32.Backdoor.Rustock # Win32.Backdoor.SDBot # Win32.Backdoor.Sequel # Win32.Backdoor.ShadowPhyre # Win32.Backdoor.Shark # Win32.Backdoor.Sinowal # Win32.Backdoor.Skubur # Win32.Backdoor.Small # Win32.Backdoor.Spyboter # Win32.Backdoor.SubSeven # Win32.Backdoor.Turkojan # Win32.Backdoor.VB # Win32.Backdoor.XRat # Win32.Backdoor.Y3KRat # Win32.BackdoorIRC.Cloner # Win32.BackdoorIRC.Microb # Win32.BackdoorIRC.Zapchast # Win32.Dialer.Agent # Win32.Dialer.ALifeDialer # Win32.Dialer.InstantAccess # Win32.EmailFlooder.Anubis # Win32.EmailFlooder.Aslike # Win32.EmailFlooder.EmailBomb # Win32.EmailFlooder.IPMail # Win32.EmailFlooder.Kubik # Win32.EmailFlooder.Liame # Win32.EmailFlooder.MailBomber # Win32.EmailFlooder.Shadow # Win32.EmailFlooder.VB # Win32.EmailFlooder.XMas 3 LANDesk Patch News Bulletin: Updated Spyware Definition Files are Available Core 148.0018, 148.0019, 148.0020 05-MAY-2009 # Win32.EmailFlooder.ZombBomber # Win32.Flooder.Delf # Win32.Flooder.GichtyChatFlood # Win32.Flooder.MobileBomb # Win32.Flooder.Piaoyes # Win32.Flooder.Sevenc # Win32.Flooder.Tfd # Win32.Flooder.UDP # Win32.Flooder.VB # Win32.FraudTool.AntiSpyware # Win32.FraudTool.AntivirusPlus # Win32.FraudTool.InternetAntivirusPro # Win32.FraudTool.PrivacyCenter # Win32.FraudTool.RealAV # Win32.FraudTool.SpyShredder # Win32.FraudTool.SpywareProtect2009 # Win32.FraudTool.SystemSecurity # Win32.FraudTool.TotalProtect2009 # Win32.FraudTool.WinSpywareProtect # Win32.FraudTool.VirusShield # Win32.FraudTool.XPPoliceAntivirus # Win32.Hoax.Renos # Win32.IMFlooder.DFMA # Win32.IMFlooder.Punter # Win32.IMFlooder.VB # Win32.IRCWorm.Acoragil # Win32.IRCWorm.Delarm # Win32.IRCWorm.Delf # Win32.IRCWorm.JeepWarz # Win32.IRCWorm.Lucky # Win32.IRCWorm.Momma # Win32.IRCWorm.Sleeper # Win32.IRCWorm.Small # Win32.IRCWorm.Supnov # Win32.IRCWorm.Whacked # Win32.Monitor.SCKeyLog # Win32.Monitor.SpyAgent # Win32.Monitor.Spytector # Win32.P2PWorm.Agent # Win32.P2PWorm.Apsiv # Win32.P2PWorm.Darby # Win32.P2PWorm.Darker # Win32.P2PWorm.Delf 4 LANDesk Patch News Bulletin: Updated Spyware Definition Files are Available Core 148.0018, 148.0019, 148.0020 05-MAY-2009 # Win32.P2PWorm.Doep # Win32.P2PWorm.Gemel # Win32.P2PWorm.Kapucen # Win32.P2PWorm.Kifie # Win32.P2PWorm.Krepper # Win32.P2PWorm.Lolol # Win32.P2PWorm.Mua # Win32.P2PWorm.Niklas # Win32.P2PWorm.PeerBot # Win32.P2PWorm.Sambud # Win32.P2PWorm.SdDrop # Win32.P2PWorm.Spear # Win32.P2PWorm.SpyBot # Win32.P2PWorm.Symop # Win32.P2PWorm.Sytro # Win32.P2PWorm.VB # Win32.Rootkit.Agent # Win32.Rootkit.Pakes # Win32.Rootkit.Podnuha # Win32.Rootkit.Small # Win32.SpamTool.Agent # Win32.SpamTool.Blen # Win32.Trojan.Agent # Win32.Trojan.Agent2 # Win32.Trojan.Akopt # Win32.Trojan.AntiAV # Win32.Trojan.AutoIT # Win32.Trojan.AVKill # Win32.Trojan.BAT # Win32.Trojan.BHO # Win32.Trojan.Buzus # Win32.Trojan.Cdur # Win32.Trojan.Chifrax # Win32.Trojan.DelAll # Win32.Trojan.Delf # Win32.Trojan.DieMast # Win32.Trojan.DNSchanger # Win32.Trojan.Downloader # Win32.Trojan.FakeAlert # Win32.Trojan.FlyStudio # Win32.Trojan.Fraudpack # Win32.Trojan.Gendal # Win32.Trojan.Genome 5 LANDesk Patch News Bulletin: Updated Spyware Definition Files are Available Core 148.0018, 148.0019, 148.0020 05-MAY-2009 # Win32.Trojan.IFramer # Win32.Trojan.Inject # Win32.Trojan.Jevafus # Win32.Trojan.KillAV # Win32.Trojan.KillDisk # Win32.Trojan.KillWin # Win32.Trojan.Midgare # Win32.Trojan.Monder # Win32.Trojan.Nabload # Win32.Trojan.Obfuscated # Win32.Trojan.Pakes # Win32.Trojan.Peed # Win32.Trojan.PopUpper # Win32.Trojan.Qhost # Win32.Trojan.Refpron # Win32.Trojan.Regrun # Win32.Trojan.Sadenav # Win32.Trojan.Scagent # Win32.Trojan.Shutdowner # Win32.Trojan.Skintrim # Win32.Trojan.Slefdel # Win32.Trojan.Small # Win32.Trojan.Spy # Win32.Trojan.StartPage # Win32.Trojan.Stuh # Win32.Trojan.Swizzor # Win32.Trojan.TDSS # Win32.Trojan.Tibs # Win32.Trojan.Vapsup # Win32.Trojan.VB # Win32.Trojan.Virtl # Win32.TrojanClicker.Agent # Win32.TrojanClicker.BHO # Win32.TrojanClicker.Delf # Win32.TrojanClicker.Small # Win32.TrojanClicker.VB # Win32.TrojanClicker.Vesloruki # Win32.TrojanDownloader.Adload # Win32.TrojanDownloader.Agent # Win32.TrojanDownloader.Bagle # Win32.TrojanDownloader.Banload # Win32.TrojanDownloader.BHO # Win32.TrojanDownloader.CcKrizCry 6 LANDesk Patch News Bulletin: Updated Spyware Definition Files are Available Core 148.0018, 148.0019, 148.0020 05-MAY-2009 # Win32.TrojanDownloader.Cn911 # Win32.TrojanDownloader.ConHook # Win32.TrojanDownloader.CWS # Win32.TrojanDownloader.Dadobra # Win32.TrojanDownloader.Delf # Win32.TrojanDownloader.Elly # Win32.TrojanDownloader.FakeAlert # Win32.TrojanDownloader.FlyStudio # Win32.TrojanDownloader.FraudLoad # Win32.TrojanDownloader.Geral # Win32.TrojanDownloader.Hilldoor # Win32.TrojanDownloader.Hmir # Win32.TrojanDownloader.Iciko # Win32.TrojanDownloader.Injecter # Win32.TrojanDownloader.Isof # Win32.TrojanDownloader.Kather # Win32.TrojanDownloader.Konix # Win32.TrojanDownloader.Losabel # Win32.TrojanDownloader.Murlo # Win32.TrojanDownloader.QQHelper # Win32.TrojanDownloader.Renos # Win32.TrojanDownloader.RtkDL # Win32.TrojanDownloader.Small # Win32.TrojanDownloader.Suurch # Win32.TrojanDownloader.VB # Win32.TrojanDownloader.Vivia # Win32.TrojanDownloader.Zdesnado # Win32.TrojanDownloader.Zlob # Win32.TrojanDropper.Agent # Win32.TrojanDropper.BHO # Win32.TrojanDropper.Delf # Win32.TrojanDropper.FakeAV # Win32.TrojanDropper.Flystud # Win32.TrojanDropper.Joiner # Win32.TrojanDropper.MSWordAgent # Win32.TrojanDropper.MuDrop # Win32.TrojanDropper.Muldrop # Win32.TrojanDropper.Neblso # Win32.TrojanDropper.Pakes # Win32.TrojanDropper.Pincher # Win32.TrojanDropper.Small # Win32.TrojanDropper.Tiny # Win32.TrojanDropper.VB 7 LANDesk Patch News Bulletin: Updated Spyware Definition Files are Available Core 148.0018, 148.0019, 148.0020 05-MAY-2009 # Win32.TrojanProxy.Agent # Win32.TrojanProxy.Dlena # Win32.TrojanProxy.Small # Win32.TrojanProxy.Wopla # Win32.TrojanPWS.Agent # Win32.TrojanPWS.Delf2 # Win32.TrojanPWS.LdPinch # Win32.TrojanPWS.Lineage # Win32.TrojanPWS.Lmir # Win32.TrojanPWS.Magania # Win32.TrojanPWS.Nilage # Win32.TrojanPWS.OnlineGames # Win32.TrojanPWS.Papras # Win32.TrojanPWS.QQPass # Win32.TrojanPWS.QQShou # Win32.TrojanPWS.Steam # Win32.TrojanPWS.Tibia # Win32.TrojanPWS.VB # Win32.TrojanPWS.WOW # Win32.TrojanSpy.Agent # Win32.TrojanSpy.Banbra # Win32.TrojanSpy.Bancos # Win32.TrojanSpy.Banker # Win32.TrojanSpy.Banker2 # Win32.TrojanSpy.BHO # Win32.TrojanSpy.BZub # Win32.TrojanSpy.Delf # Win32.TrojanSpy.Keylogger # Win32.TrojanSpy.Pophot # Win32.TrojanSpy.Small # Win32.TrojanSpy.VB # Win32.TrojanSpy.VBChuchelo # Win32.TrojanSpy.Zbot # Win32.Worm.Agent # Win32.Worm.Allaple # Win32.Worm.AllocUp # Win32.Worm.Autorun # Win32.Worm.Brontok # Win32.Worm.Dabber
Load more

Recommended publications
  • Statistical Structures: Fingerprinting Malware for Classification and Analysis
    Statistical Structures: Fingerprinting Malware for Classification and Analysis Daniel Bilar Wellesley College (Wellesley, MA) Colby College (Waterville, ME) bilar <at> alum dot dartmouth dot org Why Structural Fingerprinting? Goal: Identifying and classifying malware Problem: For any single fingerprint, balance between over-fitting (type II error) and under- fitting (type I error) hard to achieve Approach: View binaries simultaneously from different structural perspectives and perform statistical analysis on these ‘structural fingerprints’ Different Perspectives Idea: Multiple perspectives may increase likelihood of correct identification and classification Structural Description Statistical static / Perspective Fingerprint dynamic? Assembly Count different Opcode Primarily instruction instructions frequency static distribution Win 32 API Observe API calls API call vector Primarily call made dynamic System Explore graph- Graph structural Primarily Dependence modeled control and properties static Graph data dependencies Fingerprint: Opcode frequency distribution Synopsis: Statically disassemble the binary, tabulate the opcode frequencies and construct a statistical fingerprint with a subset of said opcodes. Goal: Compare opcode fingerprint across non- malicious software and malware classes for quick identification and classification purposes. Main result: ‘Rare’ opcodes explain more data variation then common ones Goodware: Opcode Distribution 1, 2 ---------.exe Procedure: -------.exe 1. Inventoried PEs (EXE, DLL, ---------.exe etc) on XP box with Advanced Disk Catalog 2. Chose random EXE samples size: 122880 with MS Excel and Index totalopcodes: 10680 3, 4 your Files compiler: MS Visual C++ 6.0 3. Ran IDA with modified class: utility (process) InstructionCounter plugin on sample PEs 0001. 002145 20.08% mov 4. Augmented IDA output files 0002. 001859 17.41% push with PEID results (compiler) 0003. 000760 7.12% call and general ‘functionality 0004.
    [Show full text]
  • Exploring Corporate Decision Makers' Attitudes Towards Active Cyber
    Protecting the Information Society: Exploring Corporate Decision Makers’ Attitudes towards Active Cyber Defence as an Online Deterrence Option by Patrick Neal A Dissertation Submitted to the College of Interdisciplinary Studies in Partial Fulfilment of the Requirements for the Degree of DOCTOR OF SOCIAL SCIENCES Royal Roads University Victoria, British Columbia, Canada Supervisor: Dr. Bernard Schissel February, 2019 Patrick Neal, 2019 COMMITTEE APPROVAL The members of Patrick Neal’s Dissertation Committee certify that they have read the dissertation titled Protecting the Information Society: Exploring Corporate Decision Makers’ Attitudes towards Active Cyber Defence as an Online Deterrence Option and recommend that it be accepted as fulfilling the dissertation requirements for the Degree of Doctor of Social Sciences: Dr. Bernard Schissel [signature on file] Dr. Joe Ilsever [signature on file] Ms. Bessie Pang [signature on file] Final approval and acceptance of this dissertation is contingent upon the candidate’s submission of the final copy of the dissertation to Royal Roads University. The dissertation supervisor confirms to have read this dissertation and recommends that it be accepted as fulfilling the dissertation requirements: Dr. Bernard Schissel[signature on file] Creative Commons Statement This work is licensed under the Creative Commons Attribution-NonCommercial- ShareAlike 2.5 Canada License. To view a copy of this license, visit http://creativecommons.org/licenses/by-nc-sa/2.5/ca/ . Some material in this work is not being made available under the terms of this licence: • Third-Party material that is being used under fair dealing or with permission. • Any photographs where individuals are easily identifiable. Contents Creative Commons Statement............................................................................................
    [Show full text]
  • GQ: Practical Containment for Measuring Modern Malware Systems
    GQ: Practical Containment for Measuring Modern Malware Systems Christian Kreibich Nicholas Weaver Chris Kanich ICSI & UC Berkeley ICSI & UC Berkeley UC San Diego [email protected] [email protected] [email protected] Weidong Cui Vern Paxson Microsoft Research ICSI & UC Berkeley [email protected] [email protected] Abstract their behavior, sometimes only for seconds at a time (e.g., to un- Measurement and analysis of modern malware systems such as bot- derstand the bootstrapping behavior of a binary, perhaps in tandem nets relies crucially on execution of specimens in a setting that en- with static analysis), but potentially also for weeks on end (e.g., to ables them to communicate with other systems across the Internet. conduct long-term botnet measurement via “infiltration” [13]). Ethical, legal, and technical constraints however demand contain- This need to execute malware samples in a laboratory setting ex- ment of resulting network activity in order to prevent the malware poses a dilemma. On the one hand, unconstrained execution of the from harming others while still ensuring that it exhibits its inher- malware under study will likely enable it to operate fully as in- ent behavior. Current best practices in this space are sorely lack- tended, including embarking on a large array of possible malicious ing: measurement researchers often treat containment superficially, activities, such as pumping out spam, contributing to denial-of- sometimes ignoring it altogether. In this paper we present GQ, service floods, conducting click fraud, or obscuring other attacks a malware execution “farm” that uses explicit containment prim- by proxying malicious traffic.
    [Show full text]
  • Classification of Malware Persistence Mechanisms Using Low-Artifact Disk
    CLASSIFICATION OF MALWARE PERSISTENCE MECHANISMS USING LOW-ARTIFACT DISK INSTRUMENTATION A Dissertation Presented by Jennifer Mankin to The Department of Electrical and Computer Engineering in partial fulfillment of the requirements for the degree of Doctor of Philosophy in Electrical and Computer Engineering in the field of Computer Engineering Northeastern University Boston, Massachusetts September 2013 Abstract The proliferation of malware in recent years has motivated the need for tools to an- alyze, classify, and understand intrusions. Current research in analyzing malware focuses either on labeling malware by its maliciousness (e.g., malicious or benign) or classifying it by the variant it belongs to. We argue that, in addition to provid- ing coarse family labels, it is useful to label malware by the capabilities they em- ploy. Capabilities can include keystroke logging, downloading a file from the internet, modifying the Master Boot Record, and trojanizing a system binary. Unfortunately, labeling malware by capability requires a descriptive, high-integrity trace of malware behavior, which is challenging given the complex stealth techniques that malware employ in order to evade analysis and detection. In this thesis, we present Dione, a flexible rule-based disk I/O monitoring and analysis infrastructure. Dione interposes between a system-under-analysis and its hard disk, intercepting disk accesses and re- constructing high-level file system and registry changes as they occur. We evaluate the accuracy and performance of Dione, and show that it can achieve 100% accuracy in reconstructing file system operations, with a performance penalty less than 2% in many cases. ii Given the trustworthy behavioral traces obtained by Dione, we convert file system- level events to high-level capabilities.
    [Show full text]
  • MODELING the PROPAGATION of WORMS in NETWORKS: a SURVEY 943 in Section 2, Which Set the Stage for Later Sections
    942 IEEE COMMUNICATIONS SURVEYS & TUTORIALS, VOL. 16, NO. 2, SECOND QUARTER 2014 Modeling the Propagation of Worms in Networks: ASurvey Yini Wang, Sheng Wen, Yang Xiang, Senior Member, IEEE, and Wanlei Zhou, Senior Member, IEEE, Abstract—There are the two common means for propagating attacks account for 1/4 of the total threats in 2009 and nearly worms: scanning vulnerable computers in the network and 1/5 of the total threats in 2010. In order to prevent worms from spreading through topological neighbors. Modeling the propa- spreading into a large scale, researchers focus on modeling gation of worms can help us understand how worms spread and devise effective defense strategies. However, most previous their propagation and then, on the basis of it, investigate the researches either focus on their proposed work or pay attention optimized countermeasures. Similar to the research of some to exploring detection and defense system. Few of them gives a nature disasters, like earthquake and tsunami, the modeling comprehensive analysis in modeling the propagation of worms can help us understand and characterize the key properties of which is helpful for developing defense mechanism against their spreading. In this field, it is mandatory to guarantee the worms’ spreading. This paper presents a survey and comparison of worms’ propagation models according to two different spread- accuracy of the modeling before the derived countermeasures ing methods of worms. We first identify worms characteristics can be considered credible. In recent years, although a variety through their spreading behavior, and then classify various of models and algorithms have been proposed for modeling target discover techniques employed by them.
    [Show full text]
  • Workaround for Welchia and Sasser Internet Worms in Kumamoto University
    Workaround for Welchia and Sasser Internet Worms in Kumamoto University Yasuo Musashi, Kenichi Sugitani,y and Ryuichi Matsuba,y Center for Multimedia and Information Technologies, Kumamoto University, Kumamoto 860-8555 Japan, E-mail: [email protected], yE-mail: [email protected], yE-mail: [email protected] Toshiyuki Moriyamaz Department of Civil Engineering, Faculty of Engineering, Sojo University, Ikeda, Kumamoto 860-0081 Japan, zE-mail: [email protected] Abstract: The syslog messages of the iplog-2.2.3 packet capture in the DNS servers in Ku- mamoto University were statistically investigated when receiving abnormal TCP packets from PC terminals infected with internet worms like W32/Welchia and/or W32/Sasser.D worms. The inter- esting results are obtained: (1) Initially, the W32/Welchia worm-infected PC terminals for learners (920 PCs) considerably accelerates the total W32/Welchia infection. (2) We can suppress quickly the W32/Sasser.D infection in our university when filtering the access between total and the PC terminal’s LAN segments. Therefore, infection of internet worm in the PC terminals for learners should be taken into consideration to suppress quickly the infection. Keywords: Welchia, Sasser, internet worm, system vulnerability, TCP port 135, TCP port 445, worm detection 1. Introduction defragmentation, TCP stream reassembling (state- less/stateful), and content matcher (detection engine). Recent internet worms (IW) are mainly categorized The other is iplog[11], a packet logger that is not so into two types, as follows: one is a mass-mailing-worm powerful as Snort but it is slim and light-weighted so (MMW) which transfers itself by attachment files of that it is useful to get an IP address of the client PC the E-mail and the other is a system-vulnerability- terminal.
    [Show full text]
  • Shoot the Messenger: IM Worms Infectionvectors.Com June 2005
    Shoot the Messenger: IM Worms infectionvectors.com June 2005 Overview Instant Messaging (IM) has rapidly gained popularity, making it an attractive medium for malware coders. However, without the universal interoperation of email, instant messaging worms have so far been much slower to propagate and gain widespread success compared to their SMTP-based cousins. As such, the amount of attention (and development) they have received from malware authors is significantly less than the mass mailer worms. Nonetheless, IM-based malware is a threat to all organizations and should be addressed by both policy and technical safeguards. IM-founded malware carries the same potential for compromising data as any other malcode (and has adopted the tactics of more successful varieties exceptionally quickly). This paper examines the development and importance of IM worms. Messaging Overview Instant messaging generically refers to real-time text communications between two or more clients (although, it is important to note many new services such as video and voice are available through these clients). Generally, messages are passed from a client to a server and vice versa. Some IM clients are capable of transmitting files between one another without a central server (once a communications channel is established) and can allow for a remarkable degree of command execution. This is represented simply below: Messaging Server Presence data transferred to clients from servers. Message/file transfer. Compatible Clients Shoot the Messenger: IM Worms 2 IM protocols range from relatively simple to quite complex and generally include some form of “presence” detection and notification (the ability to indicate whether a contact is online at any given time).
    [Show full text]
  • The Blaster Worm: Then and Now
    Worms The Blaster Worm: Then and Now The Blaster worm of 2003 infected at least 100,000 Microsoft Windows systems and cost millions in damage. In spite of cleanup efforts, an antiworm, and a removal tool from Microsoft, the worm persists. Observing the worm’s activity can provide insight into the evolution of Internet worms. MICHAEL n Wednesday, 16 July 2003, Microsoft and continued to BAILEY, EVAN Security Bulletin MS03-026 (www. infect new hosts COOKE, microsoft.com/security/incident/blast.mspx) more than a year later. By using a wide area network- FARNAM O announced a buffer overrun in the Windows monitoring technique that observes worm infection at- JAHANIAN, AND Remote Procedure Call (RPC) interface that could let tempts, we collected observations of the Blaster worm DAVID WATSON attackers execute arbitrary code. The flaw, which the during its onset in August 2003 and again in August 2004. University of Last Stage of Delirium (LSD) security group initially This let us study worm evolution and provides an excel- Michigan uncovered (http://lsd-pl.net/special.html), affected lent illustration of a worm’s four-phase life cycle, lending many Windows operating system versions, including insight into its latency, growth, decay, and persistence. JOSE NAZARIO NT 4.0, 2000, and XP. Arbor When the vulnerability was disclosed, no known How the Blaster worm attacks Networks public exploit existed, and Microsoft made a patch avail- The initial Blaster variant’s decompiled source code re- able through their Web site. The CERT Coordination veals its unique behavior (http://robertgraham.com/ Center and other security organizations issued advisories journal/030815-blaster.c).
    [Show full text]
  • Common Threats to Cyber Security Part 1 of 2
    Common Threats to Cyber Security Part 1 of 2 Table of Contents Malware .......................................................................................................................................... 2 Viruses ............................................................................................................................................. 3 Worms ............................................................................................................................................. 4 Downloaders ................................................................................................................................... 6 Attack Scripts .................................................................................................................................. 8 Botnet ........................................................................................................................................... 10 IRCBotnet Example ....................................................................................................................... 12 Trojans (Backdoor) ........................................................................................................................ 14 Denial of Service ........................................................................................................................... 18 Rootkits ......................................................................................................................................... 20 Notices .........................................................................................................................................
    [Show full text]
  • BEGIN README.TXT-- PC Media Antivirus (PCMAV)
    --BEGIN README.TXT-- PC Media Antivirus (PCMAV) 9.9.1 Copyright (c) 2006-2014 Majalah PC Media Pinpoint Publications Group ************************************************************************ MEMANFAATKAN/MENGGUNAKAN PCMAV BERARTI ANDA MENGERTI DAN SETUJU DENGAN SELURUH KETENTUAN YANG ADA DI BAGIAN "KETENTUAN PENGGUNAAN (END-USER LICENSE)" YANG TERDAPAT PADA FILE README.TXT INI. PCMAV INI DIBUAT KHUSUS DAN DIPERSEMBAHKAN BAGI "PEMBACA SETIA" PC MEDIA DAN YANG KAMI CINTAI. MAKA DARI ITU, JIKA ANDA ADALAH PENGGUNA PEMULA DAN ATAU MERASA KESULITAN MEMAHAMI ISI README.TXT INI, BAIK SEBAGIAN MAUPUN SECARA KESELURUHAN, MAKA KAMI SANGAT MENYARANKAN ANDA UNTUK BERKONSULTASI TERLEBIH DULU DENGAN REKAN ANDA YANG LEBIH BERPENGALAMAN DALAM BERKOMPUTER. ATAU DEMI KENYAMANAN ANDA, MAKA KAMI SARANKAN UNTUK TIDAK MENGGUNAKAN PCMAV SAMA SEKALI. ************************************************************************ ------------------------------ ANTIVIRUS KEBANGGAAN INDONESIA ------------------------------ Tidak ada antivirus lain yang mampu mengatasi secara tuntas virus komputer, baik lokal maupun asing, yang banyak menyebar di Indonesia sebaik dan seaman PCMAV. Umumnya antivirus yang ada hanya mampu mengenali dan menghapus file yang dideteksi bervirus. PCMAV menyempurnakannya dengan tingkat akurasi pendeteksian yang lebih tinggi, sehingga lebih handal dalam mengembalikan file, dokumen dan sistem yang menjadi sasaran serangan virus hingga pulih 100%. Dengan PCMAV, Anda akan mendapatkan antivirus yang bukan hanya sekadar mendeteksi namun daya basminya
    [Show full text]
  • Effective Malicious Features Extraction and Classification for Incident Handling Systems
    EFFECTIVE MALICIOUS FEATURES EXTRACTION AND CLASSIFICATION FOR INCIDENT HANDLING SYSTEMS CHO CHO SAN UNIVERSITY OF COMPUTER STUDIES, YANGON OCTOBER, 2019 Effective Malicious Features Extraction and Classification for Incident Handling Systems Cho Cho San University of Computer Studies, Yangon A thesis submitted to the University of Computer Studies, Yangon in partial fulfillment of the requirements for the degree of Doctor of Philosophy October, 2019 Statement of Originality I hereby certify that the work embodied in this thesis is the result of original research and has not been submitted for a higher degree to any other University or Institution. …..…………………………… .…………........………………………… Date Cho Cho San ACKNOWLEDGEMENTS First of all, I would like to thank Hist Excellency, the Minister for the Ministry of Education, for providing full facilities support during the Ph.D. course at the University of Computer Studies, Yangon. Secondly, my profound gratitude goes to Dr. Mie Mie Thet Thwin, Rector of the University of Computer Studies, Yangon, for allowing me to develop this research and giving me general guidance during the period of my study. I would like to express my greatest pleasure and the deepest appreciation to my supervisor, Dr. Mie Mie Su Thwin, Professor, the University of Computer Studies, Yangon, for her excellent guidance, caring, patient supervision, and providing me with excellent ideas throughout the study of this thesis. I would also like to extend my special appreciation to Dr. Khine Moe Nwe, Professor and Course-coordinator of the Ph.D. 9th Batch, the University of Computer Studies, Yangon, for her useful comments, advice, and insight which are invaluable through the process of researching and writing this dissertation.
    [Show full text]
  • Malware Behavior Comportamento De Programas Maliciosos
    Andr´eRicardo Abed Gr´egio Malware Behavior Comportamento de Programas Maliciosos Campinas 2012 i ii Universidade Estadual de Campinas Faculdade de Engenharia El´etrica e de Computa¸c~ao Andr´eRicardo Abed Gr´egio Malware Behavior Comportamento de Programas Maliciosos Doctorate thesis presented to the School of Electrical and Computer Engineering in partial fulfillment of the requirements for the degree of Doctor in Electrical Engineering. Concentration area: Computer Engineering. Tese de doutorado apresentada `aFaculdade de Engenharia El´etrica e de Computa¸c~ao como parte dos requisitos exigidos para a obten¸c~aodo t´ıtulo de Doutor em Engenharia El´etrica. Area´ de concentra¸c~ao: Engenharia de Computa¸c~ao. Orientador (Tutor): Prof. Dr. Mario Jino Co-orientador (Co-Tutor): Prof. Dr. Paulo Licio de Geus Este exemplar corresponde `avers~aofinal da tese defendida pelo aluno, e orientada pelo Prof. Dr. Mario Jino. Campinas 2012 iii FICHA CATALOGRÁFICA ELABORADA PELA BIBLIOTECA DA ÁREA DE ENGENHARIA E ARQUITETURA - BAE - UNICAMP Grégio, André Ricardo Abed G861c Comportamento de programas maliciosos / André Ricardo Abed Grégio. --Campinas, SP: [s.n.], 2012. Orientador: Mario Jino. Coorientador: Paulo Licio de Geus. Tese de Doutorado - Universidade Estadual de Campinas, Faculdade de Engenharia Elétrica e de Computação. 1. Redes de computadores - Medidas de segurança. 2. Tecnologia da informação - Segurança. 3. Software - Segurança. 4. Virus de computador. 5. Taxonomia. I. Jino, Mario, 1943-. II. Geus, Paulo Licio de, 1956-. III. Universidade
    [Show full text]