Captain's Blog

interesting Gartner malware quote

This is an interesting Gartner malware quote I came across, 75% is a very large number obviously so if this estimate is even close to the actual number the number is pretty large

By the end of 2007, 75 percent of enterprises will be infected with undetected, financially motivated, targeted malware that evaded their traditional perimeter and host defenses.

Posted By: Ken McGee, VP & Gartner Fellow

Microsoft Recommends Shavlik

Its pretty well known that we have been working on patch management for a long time, creating MBSA and now providing Shavlik NetChk Limted, which is directly recommended by Microsoft.  We are focused helping assure our customer's and the industry in general are getting strong security support. Our on going relationship with Microsoft is key to this.

Here are some related links:

Microsoft

Legacy Product Support: For customers using legacy products not supported by MBSA 2.0.1, Microsoft Update, and WSUS, Shavlik Technologies provides a free MBSA 2.0.1 companion tool called Shavlik NetChk Limited.

Users who have the following products in their environment can use Shavlik NetChk Limited to augment MBSA 2.0.1 results for comprehensive security update detection.

•	Office 2000
•	ISA Server 2000
•	FrontPage Server Extensions 2000/2002
•	Visual Studio .Net 2002/2003
•	SQL Server 7.0/2000
•	Other products not included in Microsoft Update's supported product list

WindowsITPro

"Shavlik Technologies was an easy choice for Microsoft to go to for providing continuity in supporting [complete security scanning] for customers who are using some of the older products," said Stephen Toulouse, Group Program Manager at Microsoft. "Shavlik has an intimate knowledge of security detection requirements since they helped develop the first version of MBSA for Microsoft."

Redmond Mag

ENT

Shavlik's NetChk Protect Limited searches for critical  security patches and spyware. However, the free version does not install patches  or remove spyware, according to the product's Quick Start Guide posted on  Shavlik's Web site. 

Get this free product, without any registration or timeous here.

Spyware updates

 

Shavlik Technologies released new data files for the NetChk Spyware and NetChk Protect application yesterday.  Details are below:

 

- Jason Miller

 

*****************************************************

 

Version 5.6/5.8.1

XML Date: 04/12/2007

XML Version: 1.0.2.1513

XML Object Count: 103,818

 

Version 5.5

XML Date: 04/12/2007

XML Version: 1.0.2.1514

XML Object Count: 103,456

 

 

Added IEBAR

-Category: NonBizWare

-Details: The IEBAR program is a toolbar for Internet Browsers.

-Comments: Initial addition to the database; please run Shavlik NetChk Spyware or Shavlik NetChk Protect for more details.

-Risk/Severity: Moderate

 

Updated NewFrn

 -Signature may have shown present with no results even if not present

Updated Opera

 -Signature may have shown present with no results even if not present

Updated iTunes

 -After remediation, the music folder for iTunes may have made this signature present

New Spyware from Shavlik data team

Shavlik Technologies released new data files for the NetChk Spyware and NetChk Protect application today.  Details are below:

 

- Jason Miller

 

*****************************************************

 

 

Version 5.6/5.8.1

XML Date: 03/29/2007

XML Version: 1.0.2.1506

XML Object Count: 103,731

 

Version 5.5

XML Date: 03/29/2007

XML Version: 1.0.2.1507

XML Object Count: 103,370

 

 

Added Aware.Cinmus

-Category: Adware

-Details: Adware.Cinmus is an Adware program that will display pop up advertisements from a Chinese web server. This program can be installed without user consent or knowledge.

-Comments: Initial addition to the database; please run Shavlik NetChk Spyware or Shavlik NetChk Protect for more details.

-Risk/Severity: Moderate

 

Added CNNIC

-Category: Malware

-Details: The CNNIC program is an Internet search hijacking program. This program will also hijack 404 pages to a controlling web server in

China

. In addition, this program can be installed without user consent or knowledge.

-Comments: Initial addition to the database; please run Shavlik NetChk Spyware or Shavlik NetChk Protect for more details.

-Risk/Severity: Moderate

 

Added DeskAdTop

-Category: Malware

-Details: The DeskAdTop program displays pop-up advertisements. This program can be installed without user consent or knowledge.

-Comments: Initial addition to the database; please run Shavlik NetChk Spyware or Shavlik NetChk Protect for more details.

-Risk/Severity: Moderate

 

Added Win32/Delf.bgb

-Category: Malware

-Details: The Win32/Delf.bgb program is a Trojan downloader that can install potentially unwanted software without user consent or knowledge.

-Comments: Initial addition to the database; please run Shavlik NetChk Spyware or Shavlik NetChk Protect for more details.

-Risk/Severity: Critical

  

Added Win32.SillyDl.CKP

-Category: Malware

-Details: The Win32.SillyDL.CKP program is a Trojan downloader. This program has the ability to install other programs without user consent or knowledge.

-Comments: Initial addition to the database; please run Shavlik NetChk Spyware or Shavlik NetChk Protect for more details.

-Risk/Severity: Critical

 

Added new version of Baidu

-Category: Malware

-Details: The Bauidu program is a Chinese language based search toolbar. This program will hijack search terms, search queries and 404 page results. In addition, this program has been found to be installed without user consent or knowledge.

-Comments: New version of HotBar added to the database.

-Risk/Severity: Moderate

 

Updated iTunes

- Added detection logic for Start Menu folders and Desktop links for iTunes (French OS)

New Spyware from Shavlik data team

Shavlik Technologies released new data files for the NetChk Spyware and NetChk Protect application today.  Details are below:

 

- Jason Miller

 

*****************************************************

 

Version 5.6/5.8.1

XML Date: 03/15/2007

XML Version: 1.0.2.1490

XML Object Count: 103,575

 

Version 5.5

XML Date: 03/15/2007

XML Version: 1.0.2.1492

XML Object Count: 103,218

 

 

Added iTunes

-Category: NonBizWare

-Details: iTunes is a popular multimedia application. This program could be considered NonBizWare in some business environments.

-Comments: Initial addition to the database; please run Shavlik NetChk Spyware or Shavlik NetChk Protect for more details.

-Risk/Severity: Low

 

Added Trojan.Spambox.BXC

-Category: Malware

-Details: Spambot.BXC will turn the infected system into a spambot.

-Comments: Initial addition to the database; please run Shavlik NetChk Spyware or Shavlik NetChk Protect for more details.

-Risk/Severity: Critical

 

Added new version of HotBar

-Category: Adware

-Details: Hotbar collects and stores aggregated information about the web pages users view and the queries users enter in search engines while using the software. HotBar uses this information to determine which ads and buttons to display on the HotBar toolbar and which ads to show in a browser.

-Comments: New version of HotBar added to the database.

-Risk/Severity: Important

 

Updated Zango

-Comments: Signature updated to remove false positives with HotBar

new spyware sigs

 

Shavlik Technologies released new data files for the NetChk Spyware and NetChk Protect application today.  Details are below:

 

- Jason Miller

 

*****************************************************

Version 5.6/5.8.1

XML Date: 03/01/2007

XML Version: 1.0.2.1483

XML Object Count: 102,842

 

Version 5.5

XML Date: 03/01/2007

XML Version: 1.0.2.1485

XML Object Count: 102,485

 

 

Added Ultimate Cleaner

-Category: Adware

-Details: Ultimate Cleaner claims to be a system cleaning tool. This program can potentially falsely report results in attempt to social engineer users in to purchasing the full program.

-Comments: Initial addition to the database; please run Shavlik NetChk Spyware or Shavlik NetChk Protect for more details.

-Risk/Severity: Important

 

Added Google Updater

-Category: NonBizWare

-Details: Google Updater is a service that provides update notifications for Google products. This product could be considered Nonbizware in some business environments. If any Google application remains on the target system, it is strongly advised you leave this product installed.

-Comments: Initial addition to the database; please run Shavlik NetChk Spyware or Shavlik NetChk Protect for more details.

-Risk/Severity: Low

 

Added new version of Google Toolbar

-Category: NonBizWare

-Details: Google Toolbar embeds Google search engine functions in IE.

-Comments: New version of Google Toolbar added to the database.

-Risk/Severity: Low

 

Added new version of Google Desktop

-Category: NonBizWare

-Details: Searches mail, picture, RSS feeds and other information based on user specified phrases and keywords and displays results in a desktop applet.

-Comments: New version of Google Desktop added to the database.

-Risk/Severity: Low

 

Updated Google Desktop

-Comments: Signature updated to remove false positives if Google Talk is installed

-Comments: Signature updated to prevent breaking of Google Gadgets if signature is removed

New Spyware from Shavlik data team

Shavlik Technologies released new data files for the NetChk Spyware and NetChk Protect application today.  Details are below:

 

- Jason Miller

 

*****************************************************

 

Version 5.6/5.8.1

XML Date: 02/22/2007

XML Version: 1.0.2.1481

XML Object Count: 102,796

 

Version 5.5

XML Date: 02/22/2007

XML Version: 1.0.2.1482

XML Object Count: 102,439

 

 

Added Adware.Agent.bc

-Category: Adware

-Details: This Adware.Agent.bc program is an adware program that will periodically display advertisements.

-Comments: Initial addition to the database; please run Shavlik NetChk Spyware or Shavlik NetChk Protect for more details.

-Risk/Severity: Moderate

 

Added Downloader.Adload.ji

-Category: Malware

-Details: The Downloader.Adload.ji program is a Trojan downloader program. This program will download and install applications without user consent or knowledge.

-Comments: Initial addition to the database; please run Shavlik NetChk Spyware or Shavlik NetChk Protect for more details.

-Risk/Severity: Critical

 

Added Trojan.CallSolutions

-Category: Malware

-Details: The Trojan.CallSolutions program is Trojan downloader that has the ability to install software without user consent or knowledge. In addition, this program is typically installed silently without user consent or knowledge.

-Comments: Initial addition to the database; please run Shavlik NetChk Spyware or Shavlik NetChk Protect for more details.

-Risk/Severity: Critical

 

Added new version of SpyMarshal

-Category: NonBizWare

-Details: SpyMarshal is a fake Anti-Spyware program. This program will falsely report Spyware infection in an attempt to get users to purchase the full version of the application. SpyMarshal is a variant of the Spy Sheriff program.

-Comments: New version of SpyMarshal added to the database.

-Risk/Severity: Moderate

 

Added new version of Video ActiveX Object (1)

-Category: NonBizWare

-Details: Video ActiveX Object is a dubious video codec.

-Comments: New version of Video ActiveX Object added to the database.

-Risk/Severity: Moderate

 

Added new version of Video ActiveX Object (2)

-Category: NonBizWare

-Details: Video ActiveX Object is a dubious video codec.

-Comments: New version of Video ActiveX Object added to the database.

-Risk/Severity: Moderate

 

Added new version of Jakposh

-Category: Malware

-Details: The Jakposh program will hijack Internet searches. When an Internet search is performed, the Jackposh program will embed it's own links in the web page. The injected links are pulled from http://glotka.com . Certain versions of this program will also present pop up advertisements.

-Comments: New version of Jakposh added to the database.

-Risk/Severity: Moderate

 

new spyware sigs

 

Shavlik Technologies released new data files for the NetChk Spyware and NetChk Protect application today.  Details are below:

 

- Jason Miller

 

*****************************************************

 

Version 5.6/5.8.1

XML Date: 02/15/2007

XML Version: 1.0.2.1479

XML Object Count: 102,614

 

Version 5.5

XML Date: 02/15/2007

XML Version: 1.0.2.1480

XML Object Count: 102,257

 

 

Added Baidu

-Category: Malware

-Details: The Bauidu program is a Chinese language based search toolbar. This program will hijack search terms, search queries and 404 page results. In addition, this program has been found to be installed without user consent or knowledge.

-Comments: Initial addition to the database; please run Shavlik NetChk Spyware or Shavlik NetChk Protect for more details.

-Risk/Severity: Moderate

 

Added DriveCleaner

-Category: NonBizWare

-Details: Drive Cleaner adds unnecessary processes that download additional software to your system. They also connect with ad sites for possible user tracking.

-Comments: Initial addition to the database; please run Shavlik NetChk Spyware or Shavlik NetChk Protect for more details.

-Risk/Severity: Moderate

 

Added new version of Trojan_VXGame

-Category: Malware

-Details: Trojan_VXGame is a program that can download other unwanted programs. Newer versions of this program install Rootkits.

-Comments: New version of Trojan_VXGame added to the database.

-Risk/Severity: Moderate

 

Updated Brave Sentry

-Comments: Updated current signature to fix problem with detected processes not being removed.

 

Updated PC Spy Keylogger

-Comments: Updated current signature to remove false positive detection in jmail registry keys.

 

New Spyware from Shavlik data team

Shavlik Technologies released new data files for the NetChk Spyware and NetChk Protect application this evening.  Details are below:

 

- Jason Miller

 

*****************************************************

 

Version 5.6/5.8.1

XML Date: 02/01/2007

XML Version: 1.0.2.1473

XML Object Count: 102,346

 

Version 5.5

XML Date: 02/01/2007

XML Version: 1.0.2.1474

XML Object Count: 101,989

 

 

Added Trojan.Downloader.Tiny

-Category: Malware

-Details: The Trojan.Downloader.Tiny program is a Trojan downloader that can be installed without user consent or knowledge.

-Comments: Initial addition to the database; please run Shavlik NetChk Spyware or Shavlik NetChk Protect for more details.

-Risk/Severity: Critical

 

Added Trojan-Proxy.Pasksa.A

-Category: Malware

-Details: The Trojan-Proxy.Pasksa.A program is a Trojan downloader. This program can be installed without user consent or knowledge.

-Comments: Initial addition to the database; please run Shavlik NetChk Spyware or Shavlik NetChk Protect for more details.

-Risk/Severity: Critical

 

Added Dimpy.Win32VBsy

-Category: Malware

-Details: The Dimpy.Win32VBsy program is a Trojan downloader. This program can be installed without user consent or knowledge. This program will modify that target system hosts file to redirect AV updates in attempt to disable detection of this signature.

-Comments: Initial addition to the database; please run Shavlik NetChk Spyware or Shavlik NetChk Protect for more details.

-Risk/Severity: Critical

 

Added new version of Brave Sentry

-Category: NonBizWare

-Details: SpyGuard claims to be an anti-spyware tool, and is often bundled with unwanted adware. Brave Sentry is a rebranded version of Spy Sheriff.

-Comments: New version of Brave Sentry added to the database.

-Risk/Severity: Moderate

 

Added new version of Trojan_VXGame

-Category: Malware

-Details: Trojan_VXGame is a program that can download other unwanted programs. Newer versions of this program install Rootkits.

-Comments: New version of Trojan_VXGame added to the database.

-Risk/Severity: Moderate

 

Updated VSToolbar

-Comments: Updated current signature to fix problem with detected executable not being removed

new spyware sigs

Shavlik Technologies released new data files for the NetChk Spyware and NetChk Protect application this evening.  Details are below:

- Jason Miller

*****************************************************

 

Version 5.6/5.8.1

XML Date: 02/01/2007

XML Version: 1.0.2.1473

XML Object Count: 102,346

 

Version 5.5

XML Date: 02/01/2007

XML Version: 1.0.2.1474

XML Object Count: 101,989

 

 

Added Superutilbar

-Category: NonBizWare

-Details: The Superutilbar is a Chinese language based search toolbar. This program has been found to be installed without user consent or knowledge.

-Comments: Initial addition to the database; please run Shavlik NetChk Spyware or Shavlik NetChk Protect for more details.

-Risk/Severity: Moderate

 

Added Troj.QQHelper

-Category: Malware

-Details: The Troj.QQHelper program has been found to be installed without user consent or knowledge. This program is a Trojan downloader that has the ability to download and install programs without user consent.

-Comments: Initial addition to the database; please run Shavlik NetChk Spyware or Shavlik NetChk Protect for more details.

-Risk/Severity: Critical

 

Added Danmec

-Category: Spyware

-Details: The Danmec program is a Trojan that attempts to steal system information. This program will also redirect certain Internet sites to the local host in attempt to break Antivirus and Windows patch updates.

-Comments: Initial addition to the database; please run Shavlik NetChk Spyware or Shavlik NetChk Protect for more details.

-Risk/Severity: Critical

 

Added new version of Trojan_VXGame

-Category: Malware

-Details: Trojan_VXGame is a program that can download other unwanted programs. Newer versions of this program install Rootkits.

-Comments: New version of Trojan_VXGame added to the database.

-Risk/Severity: Moderate

 

Updated Troj.QQSpy-Gen

-Comments: Updated current signature to remove a false positive detection of Internet Explorer as a Spyware process.

 

Updated Virtumod

-Comments: Updated current signature to prevent showing true when no items detected.

 

Updated DropSpam

-Comments: Updated current signature to remove multiple false positive during detection.