Recently, we have been seeing a lot of the Winwebsec rogue branded as " System Tool ". Winwebsec authors have been using this brand since last year, but lately these have been seen using more aggressive campaigns. Winwebsec is installed in a variety...

A new spam campaign using UPS (United Parcel Service) as a social-engineering draw was initiated this week. The spammed message contains an attachment, detected as TrojanDownloader:Win32/Chepvil.I . The spam campaign actually started around March 16th...

Malware writers never miss the chance to take advantage of big world events, no matter how tragic. The recent Japanese nuclear incident, caused by the devastating earthquakes, is their target this time. The Microsoft Malware Protection Center has been...

Internet Explorer 9 includes a great new application reputation feature driven by SmartScreen. As described in this Building Reputation blog post by Ryan Colvin, SmartScreen uses file hashes and Authenticode signatures to identify publishers and applications...

This year's Black Hat Europe Conference 2011, with Microsoft as one of the sponsors, was held in Barcelona Spain. The first briefings were held March 17th, when speakers began to present various research papers on a lot of very interesting topics. This...

We are tracking the trails of this fake " System Defragmenter " software since its first appearance last October 2010, and have warned our customers in our earlier post about this trojan software. In this follow-up post, we give an update including...

Just over one year ago, Microsoft- with industry and academic partners- utilized a novel combination of legal and technical actions to take control of the Win32/Waledac botnet as the first action in Project MARS (Microsoft Active Response for Security...

On March 14, Adobe released a security advisory (APSA11-01) warning of 0-day attacks affecting Adobe Flash Player (versions earlier than and including 10.2.152.33). These attacks were hidden inside Microsoft Excel documents that were used as a vehicle...

On March 8th, we announced the release of our latest Malicious Software Removal Tool (MSRT), version that included detection and cleaning capabilities for a backdoor enabled worm we are calling Win32/Renocide . If you are not familiar with this threat...

This month we are releasing another instalment of our Malicious Software Removal Tool (MSRT) , which now includes Win32/Renocide detection and cleaning capabilities. Win32/Renocide is a family of worms that spread via local, removable, and network...

In a blog published in November titled “ Explore the CVE-2010-3654 matryoshka “, we discussed a 0-day Shockwave (SWF) exploit that uses JavaScript to do malicious actions. In this blog, we discuss another advanced way SWF malware is combined with JavaScript...