On March 9, Microsoft started investigating reports of targeted attacks using a previously undisclosed vulnerability (CVE-2010-0806) affecting Internet Explorer 6 and 7 (Internet Explorer 8, Windows 7, and Windows Server 2008 R2 are not susceptible)....

Today we are going to take a closer look at bots and botnets. On the black market, selling bots and botnets is quite profitable, which makes creating them a popular activity for criminals. It helps that bot sources and creation kits are available on the...

Recently, following an investigation to which various members of the MMPC contributed, Microsoft’s Digital Crimes Unit initiated a takedown of the Waledac botnet in an action known as Operation b49 , an ongoing operation to disrupt the botnet for the...

PWS:Win32/Zbot a.k.a Zeus/WSNPoem is a password-stealing trojan that monitors for visits to certain Web sites. It allows limited backdoor access and control and may terminate certain security-related processes. In our collection, although we have some...

Back in August 2009 we added a rogue called Win32/FakeRean to the list of families removed by MSRT. At the time, I wrote about how it used several different names, like Home Antivirus 2010 and PC Antispyware 2010, which all looked pretty much the same...

Greetings purveyors of the Internet! Welcome to another thrilling installment of "MSRT: Miami", aka "What's new in MSRT this month?"! It's Win32/Helpud . What, anti-climactic? Perhaps. However that doesn't take away from the importance of this addition...

While recently analyzing a malicious PDF file, I noticed a vulnerability exploited by the sample which I've never encountered before. After a bit of research I came to the conclusion that this specific sample exploited CVE-2010-0188 . This is a fresh...

In January this year, the MMPC added Win32/Rimecud to MSRT's removal capability. Win32/Rimecud to MSRT's removal capability. As previously discussed by Marian , this worm propagates mainly via removable devices, IM, and P2P channels; and utilizes backdoor...

By now you have likely seen multiple reports of Operation b49 which has targeted the Win32/Waledac botnet’s command and control infrastructure. As I mentioned in my last blog there is still more work that needs to be done in terms of cleaning up infected...