Microsoft issues patch to fix IE

Microsoft has issued a security patch to fix a critical vulnerability in its Internet Explorer browser it said has attacked over 2m Windows users. The flaw is believed to have already infected as many as 10,000 websites. The "zero day" exploit let criminals take over victims' computers by steering them to infected websites. Microsoft's Christopher Budd said the software giant "encourages all IE customers to test and deploy this update as soon as possible". He also said the threat lead Microsoft to mobilize security engineering teams worldwide to deliver a software cure "in the unprecedented time of eight days". The company's security response team said the patch consists of more than 300 distinct updates for more than half-a-dozen versions of IE in around 50 languages. "Even with that, the release Emergency Response process isn't over," said Security Response Alliance director Mike Reavey. "There is additional support to customers and additional refinement of our product development efforts." Microsoft stressed that the flaw was proven to exist only in IE 7 on all applicable versions of Windows, but that IE 6 and the "beta" release of IE 8 were "potentially vulnerable". Users who have automatic updates turned on will receive the patch over the next 24 hours while others can access it via a download. "Wildfire" The AZN Trojan has been making the rounds since the beginning of December but became public knowledge in the last week . Unlike other exploits, users only have to visit a malicious site with Trojans or other malware in order to become contaminated. Once an infected web page is opened, malicious downloaders are installed on the computer designed to record keystrokes and steal passwords, credit card details and other financial information. The sites affected are mostly Chinese and have been serving up programmes to steal passwords for computer games which can then be sold for cash on the black market. Internet Explorer is the world's most widely used web browser with nearly three quarters of the market share. Microsoft estimated that one in every 500 Windows users had been exposed to sites that try to exploit the flaw and the number of victims was increasing at a rate of 50% daily. Researchers at the software security firm Trend Micro said attacks were spreading "like wildfire". "This vulnerability is being actively exploited by cyber-criminals and getting worse every day," said the company's advanced threat researcher Paul Ferguson. Microsoft labelled the bug as "critical," the most serious threat ranking in its four-step scouring programme.

Koobface virus hits Facebook

A worm responsible for sending Facebook users malicious code appears to be limited in nature, although the social engineering attack may be used again, say experts. Facebook representative Barry Schnitt said the worm isn't new; it dates back to August, although the variant that first appeared on Wednesday targets only Facebook users. Craig Schmugar, threat researcher for McAfee Avert Labs, confirmed this in a call with CNET News and said that, in general, Koobface strikes only social-networking sites. After receiving a message in their Facebook in-box announcing, "You look funny in this new video" or something similar, recipients are then invited to click on a provided link. Once on the video site, a message says an update of Flash is needed before the video can be displayed. The viewer is prompted to open a file called flash_player.exe.

Schmugar said the prompt for a new player should be a warning. "The messages you tend to get from these sites don't look quite right." For instance, IE will tell you where the update is coming from, and usually it's not an Adobe site. If the viewer approves the Flash installation, Koobface attempts to download a program called tinyproxy.exe. This loads a proxy server called Security Accounts Manager (SamSs) the next time the computer boots up. Koobface then listens to traffic on TCP port 9090 and proxies all outgoing HTTP traffic. For example, a search performed on Google, Yahoo, MSN, or Live.com may be hijacked to other, lesser-known search sites.

Facebook's Schnitt said, "Only a very small percentage of Facebook users have been affected and we're working quickly to update our security systems to minimize any further impact, including resetting passwords on infected accounts, removing the spam messages, and coordinating with third parties to remove redirects to malicious content elsewhere on the Web."

Worm uses familiar brands to lure people

On Tuesday security vendor WebSense issued an alert warning that holiday coupon e-mails from familiar companies may be malicious code in disguise, in this case a mass-mailing e-mail worm. The warning cites one spoofed McDonald's e-mail that claims to present their latest discount menu, and asks the recipient to print out the attached coupon. A similar mailing pretending to be from Coca-Cola asks recipients to print out details about their new online game, and also offers recipients a chance to win Coca-Cola drinks for life. Websense says the attached zip file contains files named either coupon.exe or promotion.exe, both of which contain dropper files for remote access Trojan horses.

On Wednesday, McAfee identified a third holiday-themed e-mail using the Hallmark brand. McAfee has named the malware used as W32/Xirtem@MM and says this particular worm carries a built-in SMTP engine that mass-mails copies of itself to e-mail addresses harvested from an infected machine. In all cases the e-mail appears to be legitimate, using images taken from the McDonald's, Coca-Cola, and Hallmark sites. To avoid compromise, antivirus experts recommend not opening e-mail attachments as well as keeping your desktop's antivirus protection up-to-date.

Free : Spybot - Search & Destroy

From Patrick M. Kolla: Spybot - Search & Destroy can detect and remove a multitude of adware files and modules from your computer. Spybot also can clean program and Web-usage tracks from your system, which is especially useful if you share your computer. Modules chosen for removal can be sent directly to the included file shredder, ensuring complete elimination from your system. For advanced users, it allows you to fix Registry inconsistencies related to adware and to malicious program installations. The handy online-update feature ensures that Spybot always has the most current and complete listings of adware, dialers, and other uninvited system residents. Version 1.6 features improved speed for on-demand scans, support for a dozen different browsers, and easier on-access use. Download : http://www.zdnetasia.com/downloads/pc/swinfo/0,39043052,39174487s,00.htm

Its Free : Ad-Aware 2008

From Lavasoft: With the ability to scan your RAM, Registry, hard drives, and external storage devices for known data-mining, advertising, and tracking components, Ad-Aware 2008 can clean your system easily, allowing you to maintain a higher degree of privacy while you surf the Web. Ad-Aware 2008 includes an improved threat detection, enhanced rootkit removal system, faster updates, Lavasoft ThreatWork to submit suspicious files for analysis, and is now compatible with 32-bit and 64-bit Windows Vista. Version 7.1.0.11 may include unspecified updates, enhancements, or bug fixes. Download : http://www.zdnetasia.com/downloads/pc/swinfo/0,39043052,39247373s,00.htm

EAV Antivirus Suite Free Edition

From EAV Software: EAV Antivirus Suite can detect and eliminate spyware, Trojans, key loggers, adware programs, browser hijackers, cookies, spy bots, trackware, and other malware, even new and unknown ones, on your PC. EAV Antivirus Suite will scan all running processes, local files in real time automatically once you run the software. Once spyware or other malware appears, even if it hides in other programs, EAV Antivirus Suite will display a signal for warning and will eliminate it consequently. Meanwhile, this software will clear all spyware-system-linked files as well as relative registry files. EAV Antivirus Suite can recover all damages with Internet Explorer caused by JavaScript and ActiveX viruses. And it can also help you to fulfill anti-hacker Windows settings. Version 5.92 adds the latest virus-definition updates. Download : http://www.zdnetasia.com/downloads/pc/swinfo/0,39043052,39114179s,00.htm

Free to try : Folder Crypt

From LittleLite Software: With Folder Crypt you can password protect any Windows file or folder using low level encryption and standard algorithms, such as DES, Rijndael and Blowfish with keys up to 2048 bits. The program performs a true bit per bit encryption of your data. Original files and folders may be shredded. The encryption process is not reversible. Easy to use with its improved shell integration. Full international characters support. Version 3.1.4586 enhances compatibility with 64-bit systems, includes new archiving algorithm, better memory handling, and removes 2GB limit. Download : http://www.zdnetasia.com/downloads/pc/swinfo/0,39043052,39232916s,00.htm

Lenovo ThinkPads to get text-message kill switch

Lenovo is to build a new security feature into some of its upcoming ThinkPad notebooks, allowing users to remotely lock their machines' functionality by sending an SMS. Lenovo said that there will be no extra cost for laptops using its Constant Secure Remote Disable feature, and the feature will be supported anywhere that GSM communications and text messaging are supported by local cellular networks. This kind of cellular-based remote-kill functionality is fairly widespread in the corporate mobile-phone market and is common in military and secure voice-communications systems, but is only now becoming feasible in the laptop world, through the embedding of cellular connectivity into notebooks. In October, security company McAfee and communications firm Alcatel-Lucent announced they were working together on a similar mobile-security package that would use embedded cellular capabilities to protect notebook computers.

Gmail 'vulnerability' turns out to be phishing scam

Reports that a purported Gmail vulnerability was being used by unauthorized third parties to hijack domains turned out to be nothing more than a phishing scam, Google announced Tuesday. The alleged vulnerability reportedly allowed an attacker to set up filters on users' e-mail accounts without their knowledge, according to a proof of concept posted during the weekend on the blog Geek Condition. In the post, Geek Condition's "Brandon" wrote that the vulnerability had caused some people to lose their domain names registered through GoDaddy.com. However, after consulting with those who claimed to be affected by the so-called vulnerability, Google determined that they were victims of a phishing scam, Google information security engineer Chris Evans explained in a blog post: Attackers sent customized e-mail encouraging Web domain owners to visit fraudulent Web sites such as "google-hosts.com" that they set up purely to harvest usernames and passwords. These fake sites had no affiliation with Google, and the ones we've seen are now offline. Once attackers gained the user credentials, they were free to modify the affected accounts as they desired. A Google representative informed ZDNet Asia's sister site CNET News.com Monday that the company was trying contact "Brandon" to get more information on his claim, but there was no word whether that blogger helped Google arrive at its conclusion. As of this writing, the blog had not been updated to mention Google's finding. While this security breach was apparently unrelated to Gmail's operation, Google reminded users to enter Gmail sign-in credentials only at Web addresses starting with "https://www.google.com/accounts", and not to ignore warnings their browsers may raise regarding certificates.

Websense: Google's Orkut being used to spread Trojans

Someone is using Orkut to spread Trojan links in a message disguised as an official e-mail from the Google-owned social network, according to an alert from security firm Websense released Tuesday. The message, written in Portuguese to appeal to Orkut's many Brazilian members, looks like it is sent from an Orkut member who is looking for love, Websense said. "The message contains several links that appear to lead to the official Orkut Web site. Clicking on a link actually leads to a malicious executable file, which is a Trojan Downloader named 'imagem.exe,'" the Websense alert explained. "The malicious file opens the legitimate Orkut network login page, and in the background downloads a password stealing Trojan named 'msn.exe'." The Trojans are hosted on a compromised labor union Web site from southern Brazil, according to Websense. A Google spokesman said the company was investigating the matter. This article first appeared as a blog post on CNET News.com.