Microsoft Malware Protection Center

Threat Research & Response Blog

Microsoft Malware Protection Center

  • The fall of rogue antivirus software brings new methods to light

    Rogue antivirus software has been a part of the malware ecosystem for many years now – Win32/SpySheriff and Win32/FakeRean date all the way back to 2007. These rogues, and the many that have followed them throughout the years, generally mislead and scare users into paying a fee for "cleaning" false detections that the software claims to have found on the machine. They often use dozens of different brandings and name combinations in an attempt to hide, cover their tracks, and avoid...
  • FireEye and Fox-IT tool can help recover Crilock-encrypted files

    Since file-encryption ransomware Crilock (also called CryptoLocker) has reared its head, the security industry has been hard at work finding ways to mitigate and neutralize these threats. We've also been hard at work finding ways to recover from the encryption and restore affected files - such as our recommendations on using version control and recovery options in SkyDrive and Windows . This week, researchers from FireEye and Fox-IT have released a tool that may be able to recover files encrypted...
  • MSRT August - Lecpetex

    ​This month we added Win32/Lecpetex to the Microsoft Malicious Software Removal Tool (MSRT). The addition will assist with the detection and clean-up of this family following the recent Facebook take-down of the Lecpetex botnet . The graph below shows the number of unique machine encounters we have seen since February this year. The primary Lecpetex payload is a Litecoin miner that is installed to the infected system. A malicious hacker can then use the compromised PC to generate Litecoins...
  • The future of independent antimalware tests

    Our guiding vision at the Microsoft Malware Protection Center (MMPC) is to keep every customer safe from malware. Our research team and machine learning systems, as well as industry engagement teams, function around the clock in an effort to achieve this vision. As part of these efforts, we are also working with independent antimalware testing organizations towards advancing the relevance of independent testing and reporting. Our goal is to help enable independent antimalware testing organizations...
  • A particularly convincing nefarious ad

    ​As a researcher with the Microsoft Malware Protection Center (MMPC), I see a lot of digital advertising. Recently I came across a nefarious ad that is so convincing I need to warn you about it. Below is a mock-up of the ad I saw. I’ve changed the name of the company to Contoso, which is a fictitious company used by Microsoft in examples and documentation: Figure 1: The nefarious ad At first glance, the ad seems to follow all of the criteria Microsoft has for clean advertising as...
  • MSRT July 2014 - Caphaw

    This month we added Win32/Caphaw and Win32/Bepush to the Malicious Software Removal Tool (MSRT). Caphaw is a malware family that can be used by criminals to gain access to your PC - the ultimate goal is to steal your financial or banking-related information. The graph below shows the number of machine encounters we have seen since September 2013. Figure 1: Caphaw encounters Caphaw can be installed on a PC via malicious links posted on Facebook, YouTube, and Skype. It can also spread through...
  • Microsoft Digital Crimes Unit disrupts Jenxcus and Bladabindi malware families

    ​Today, following an investigation to which the Microsoft Malware Protection Center (MMPC) contributed, the Microsoft Digital Crimes Unit initiated a disruption of the Jenxcus and Bladabindi malware families. These families are believed to have been created by individuals Naser Al Mutairi, aka njQ8, and Mohamed Benabdellah, aka Houdini. These actions are the first steps to stop the people that created, distributed, and assisted the propagation of these malware families. There are more details...
  • Adware changes – One week to go

    ​A quick note to all of developers out there. You have until 1 July to let us know if you think your software shouldn’t be detected under our new adware criteria. A few months ago I announced some major changes to how we at the Microsoft Malware Protection Center assess adware in my blog Adware: A new approach . As a reminder, the updated criteria defines adware as: Programs that promote a product or service outside of their own program can interfere with your computing experience...
  • “Your fault - core dumped”- Diving into the BSOD caused by Rovnix

    Recently we have noticed some Win32/Rovnix samples (detected as TrojanDropper:Win32/Rovnix.K ) causing the BSOD on Windows 7 machines. We spent some time investigating this situation and discovered an interesting story behind the BSOD. Analyzing the crash dump We first saw TrojanDropper:Win32/Rovnix.K in October 2013. During a normal Windows Boot the malware will cause the BSOD. Figure 1: Rovix BSOD screenshot To start, let’s analyze the crash dump using windbg: kd>...
  • MSRT June 2014 – Necurs

    This month we added Win32/Necurs to the Microsoft Malicious Software Removal Tool (MSRT). In a previous blog about Necurs I outlined the family's prevalence and the techniques it uses to execute its payload. In this blog, I will discuss the Necurs rootkit components Trojan:WinNT/Necurs.A and Trojan:Win64/Necurs.A in greater depth. These Necurs rootkit components are sophisticated drivers that try to block security products during every stage of Windows startup. It’s important to note...