Trojan that captures SMS, making two-factor authentication dangerous

New Trojan for Android mobile operating system does two-factor authentication is practically useless and even dangerous.

The main feature of the malware identified Dr. Web as Android.Pincer.2.origin, is that it intercepts all SMS-message arriving on the infected device and sends them to the attacker.

The specialists of Dr. Web found the Trojans, note that he is disguised as a security certificate. It helps cybercriminals to convince potential victims that it simply must be installed.

Infecting a system, the malware displays the following message: "Certificate installed successfully and your device is protected now." ("The certificate has been successfully installed. Your device is protected"). At that collects all the information about the infected device, in particular, the serial number, IMEI, model, data on the operator and the operating system, the phone number. After completing the data collection, the malware attempts to send them to a remote server.

Dr. Web has found a new Trojan for Mac

If on your Mac began appearing advertising images on sites where they usually do not appear, there is a risk that the computer was infected Trojan.Yontoo.1. The program has been identified by the Russian company Dr. Web. The experts did not provide data on the number of infected computers.

While Dr. Web is the only company, which reported on the existence of the virus, so that the threat is likely not too common. However, its identification eloquently shows that contemporary Mac users are increasingly becoming the target of hackers.

Trojan.Yontoo.1 works simply. Users are invited to the program installer as a plugin for the browser. This usually happens when a person comes to specific Web sites that should show trailers for films. The installer may appear directly in the media player or in an accelerator downloads. The program asks the user if he wants to carry out installation Free Twit Tube. After that, the Trojan is downloaded from the network and is installed as a plugin on all browsers, including Safari, Firefox and Chrome.

Trojan cryptologist attacked Spain and France

The company Dr Web captures ongoing at the moment of the mass distribution of foreign users Trojan cryptographer Trojan.ArchiveLock. Modifications of the program, dubbed Trojan.ArchiveLock.20, infecting more and more computers in France and Spain.

In August last year, the company Dr Web reported the Trojan cryptographer Trojan.ArchiveLock. This malware uses file encryption standard archiver WinRAR. In order to spread malicious threats to use brute force to access the victim's computer via RDP. Once connected to the attacked workstation cybercriminals launch her Trojan. Obtaining control, Trojan.ArchiveLock.20 locates in one of the system folders application coder.

Trojan.ArchiveLock.20 then creates a list of files to be encrypted, and then empties the Recycle Bin, and removes stored on your computer data backups. Using a console application WinRAR coder puts user files to a predefined list in the password-protected archive, and the source data is destroyed using a special tool - recover deleted files then becomes impossible.

Android.SmsSend Trojan spreads through advertising platform Airpush

The company Dr Web today warned about the intense spread Trojans Android.SmsSend by advertising platform Airpush, which is used by many developers to make money on the applications they create. Demonstrated the system messages may confuse users and lead to malicious software downloads.

Virus lab experts Dr Web periodically recorded complaints from users on false positives from Dr.Web for Android applications against GooglePlay_install.apk, which detected the Trojan Android.SmsSend.315.origin. After studying the problem of virus experts have confirmed the validity of the detection of the program, which is in fact a fake installer and charge for access to the free applications, sending premium SMS to a short number. However, the treatment of such complaints are still coming. Spent on this investigation had revealed one of the sources of the spread of Trojan: it was advertising system Airpush.

As you know, many games and applications for Android are free, but in order to recoup their development in time and money, developers often use a special system that plugs directly into the target program and show users different advertisements. These systems, in particular, is a popular advertising platform Airpush. A typical algorithm of its work is to demonstrate the application of advertising in a specially designated place, but some version of this module can also display different dialog boxes when working with the program, and without it directly run. In this case, the contents of the advertisements themselves can be absolutely anything, what and exploited, so decided to distribute the Trojan Android.SmsSend.315.origin.

Trojan.Hosts infects about 8,000 new computers every day

The company Dr Web today informed the members about the intense hackers hacking Web sites to download to your computer malware family Trojan.Hosts. The magnitude of this threat in early 2013, took almost an epidemic. Peak spread Trojans Trojan.Hosts was in January and the middle of February, when daily on users' computers fixed order 9500 cases of infection. In March Trojan.Hosts infect computers around 8000 per day.

To hack websites cybercriminals use protocol FTP, connecting to resources using previously stolen usernames and passwords. Then, on the hacked site to load the command interpreter (shell) which varies with the file. Htacess, and the site has not hosted malicious script.

As a result, when entering the infected site visitor, it prints a web page that contains links to a variety of malicious applications. In particular, so recently begun to be widely distributed family of Trojans Trojan.Hosts.

Dr. Web: New Windows Trojan-blocker

Experts have found a new sample of the Trojan family - Trojan.Winlock, which found signs of a backdoor

Researchers antivirus company "Dr. Web" reported the discovery of new malware samples per family Trojan.Winlock, specializing in locking the operating system Windows. The virus, called Trojan.Winlock.7372, differs from its predecessors because it does not contain any images or texts, and be uploaded from the Internet, serving as a backdoor.

According to experts, the new malware is an atypical representative Trojan.Winlock, because it contains the usual components of such viruses. When you lock the operating system loads the virus all the necessary elements of the Internet, and when locking the screen displayed by normal web-page.

After activation of the infected computer Trojan.Winlock.7372 puts itself into a branch of the registry, conducting startup programs. Then, the virus triggers an infinite loop start and stop several applications, including the researchers note the Task Manager, Notepad, Registry Editor, Command Prompt, system settings, browsers, Microsoft Internet Explorer, Google Chrome, Firefox, Opera, application ProcessHacker, Process Monitor, and others. After that, the Trojan disables the firewall and makes invisible to the victim's window, which is functioning as a backdoor downloadable from hackers web-page with the requirement to pay to unlock the operating system. For "unlocking" attackers require at $ 200.