New backdoor intercepts input data from the keyboard

The company "Dr. Web" warned of spreading malware BackDoor.Saker.1, which bypassing mechanism to control user accounts. The main function of BackDoor.Saker.1 - execution command coming from intruders, and most importantly, to intercept the keys pressed by the user ( keylogging ) .

Infiltrating for becoming infected computer , the Trojan executes the file temp.exe, designed to circumvent the system UAC (User Accounts Control). This file extracts the resources of the library for bypass UAC and incorporated into the process explorer.exe. Thereafter the library is stored in a system folder. Then when you start the system utility Sysprep, the library is launching a malicious application ps.exe, detected by Dr.Web anti-virus software as Trojan.MulDrop4.61259. In turn, this saves the file to another folder, another library which registers in the Windows registry as a service with the name "Net Security Service" and the following description : "keep watch on system security and configuration.if this services is stopped, protoected content might not be down loaded to the device". It was in the library and the main focus malicious backdoor functionality.

In Facebook detected a Trojan that steals financial data users

This malicious program is installed on the device, and then runs in the background.

According to the Daily Mail, the experts on information security failed to detect a new malicious program that spreads through the social network Facebook. This Trojan steals financial data of users.

According to experts, the malicious program is installed on the device after the user is on a malicious link. Next, the Trojan runs in the background. To date, the IS experts argue that all references have been removed.

After installation, the virus begins to track user activity and intercept any data entered into online banking, online stores, etc. The information collected is redirected to malicious users, who are able to illegally withdraw funds from the accounts of their victims.

Backdoor Bulknet actively creates botnet

The company Dr. Web today announced that it is gaining control over the botnet, which was formed on the basis of distributed malicious malware BackDoor.Bulknet.739, infecting an average of 100 PCs hourly. Getting on a victim's computer, the Trojan helps hackers to send him hundreds of spam emails.

Among the victims BackDoor.Bulknet.739 mostly users in Italy, France, Turkey, USA, Mexico and Thailand, but the Russians could also fall under its scope.

First BackDoor.Bulknet.739 interested analysts in October 2012. Trojan was able to connect computers in a botnet and allows attackers to carry out mass spam mailings.

The new trojan aimed at computers of the Middle East

BaneChant contains malicious code without the files and uses short URL or dynamic DNS-servers to redirect users to viral resources.

FireEye researchers found a backdoor trojan that seems designed to attack computer systems of government in the Middle East and Central Asia. Malware is giving new abilities that allow him to evade detection by the fact that it is run after a lot of clicks.

Experts have found that the code contains a trojan tag relating to the soundtrack of Batman - "The Dark Knight: The Legend Continues."

Elusive Trojan demonstrates advertising messages in the form of pop-up browser windows

Symantec Corp. has detected a Trojan program that prompts the user to potentially dangerous content, and demonstrates their advertising messages in the form of pop-up browser windows.

In doing so, open the site are not infected and not in any way connected with the contents of the popup window. The program uses the Sender Policy Framework (SPF) to ensure reliable communication between infected computers and servers attacks and bypass standard security features.

For virus it is important to have a reliable connection between their malware, operating on infected computers, and own server, so that a malicious program could receive instructions and updates at any time. However, in the way of interaction between malware and server management can be a gateway or firewall software, or connection may be blocked intrusion prevention system (intrusion prevention system, IPS). So malware authors try to get around these protections. Recently, experts Symantec found a Trojan that uses the technology for this purpose SPF (Sender Policy Framework - Wednesday sender policy framework), originally created to confirm the legitimacy of mail servers to filter spam.

The Japanese space agency is a victim of the Trojan

Japanese Space Agency Jaxa today announced that with the help of Trojan software unknown attackers stole private data on the latest Japanese space rocket. As reported in Jaxa, computer virus has been detected on the network at Tsukuba Space Center in the northeast of Tokyo. Said malicious code secretly collect and transmit data about the missile beyond Jaxa.

The agency said today that the malicious code was detected by anti-virus software is November 21, the same space agency employees took 'all necessary measures'. Also in Jaxa say spy code was detected in only one space center, the other systems have not been exposed to infection.

An official statement said that while it was unclear whether the virus is available on computers Jaxa employees or hit by cyberattacks. Previously, a number of Japanese military-industrial company claims that have been targets of cyber attacks, the traces of which were in China.

As for the information stolen by malicious code, it is associated with a new missile Epsilon, solid fuel and is a further development of modern Japanese rockets. Independent experts say that Epsilon was originally created as a solution for launching satellites and interplanetary spacecraft, but in principle it could have a dual purpose and be used as an intercontinental ballistic missile.

Epsilon first start is expected in autumn 2013.

Dr. Web: New Windows Trojan-blocker

Experts have found a new sample of the Trojan family - Trojan.Winlock, which found signs of a backdoor

Researchers antivirus company "Dr. Web" reported the discovery of new malware samples per family Trojan.Winlock, specializing in locking the operating system Windows. The virus, called Trojan.Winlock.7372, differs from its predecessors because it does not contain any images or texts, and be uploaded from the Internet, serving as a backdoor.

According to experts, the new malware is an atypical representative Trojan.Winlock, because it contains the usual components of such viruses. When you lock the operating system loads the virus all the necessary elements of the Internet, and when locking the screen displayed by normal web-page.

After activation of the infected computer Trojan.Winlock.7372 puts itself into a branch of the registry, conducting startup programs. Then, the virus triggers an infinite loop start and stop several applications, including the researchers note the Task Manager, Notepad, Registry Editor, Command Prompt, system settings, browsers, Microsoft Internet Explorer, Google Chrome, Firefox, Opera, application ProcessHacker, Process Monitor, and others. After that, the Trojan disables the firewall and makes invisible to the victim's window, which is functioning as a backdoor downloadable from hackers web-page with the requirement to pay to unlock the operating system. For "unlocking" attackers require at $ 200.

Trojan for Linux and Mac OS X

Trojan for Linux and Mac OS X steals passwords

Trojan keylogger has the functions and steals passwords typed by the user in almost all popular browsers.

Experts of "Doctor Web" found Trojan-oriented operating systems Linux and Mac OS X. The activities of malware is to steal passwords from some of the most popular Internet applications. Experts note that BackDoor.Wirenet.1 is the first of its kind with a similar Trojan functionality, which also works in the listed operating systems.