Fake Facebook Password Reset Confirmation

Hi,

Has loads of these hit the inbox this morning....
















Virus Total:

Antivirus	Version	Last Update	Result
a-squared	4.5.0.41	2009.10.27	-
AhnLab-V3	5.0.0.2	2009.10.26	-
AntiVir	7.9.1.44	2009.10.26	-
Antiy-AVL	2.0.3.7	2009.10.26	-
Authentium	5.1.2.4	2009.10.27	W32/Bredolab!Generic
Avast	4.8.1351.0	2009.10.26	-
AVG	8.5.0.423	2009.10.26	Win32/Heur
BitDefender	7.2	2009.10.27	Trojan.Downloader.Bredolab.AZ
CAT-QuickHeal	10.00	2009.10.27	-
ClamAV	0.94.1	2009.10.27	-
Comodo	2744	2009.10.27	Heur.Packed.Unknown
DrWeb	5.0.0.12182	2009.10.27	-
eSafe	7.0.17.0	2009.10.25	Suspicious File
eTrust-Vet	35.1.7084	2009.10.26	-
F-Prot	4.5.1.85	2009.10.26	-
F-Secure	9.0.15370.0	2009.10.22	Trojan.Downloader.Bredolab.AZ
Fortinet	3.120.0.0	2009.10.26	-
GData	19	2009.10.27	Trojan.Downloader.Bredolab.AZ
Ikarus	T3.1.1.72.0	2009.10.27	-
Jiangmin	11.0.800	2009.10.26	-
K7AntiVirus	7.10.879	2009.10.24	-
Kaspersky	7.0.0.125	2009.10.27	Packed.Win32.Krap.w
McAfee	5783	2009.10.26	Bredolab.gen.a
McAfee+Artemis	5783	2009.10.26	Bredolab.gen.a
McAfee-GW-Edition	6.8.5	2009.10.27	-
Microsoft	1.5202	2009.10.27	TrojanDownloader:Win32/Bredolab.X
NOD32	4545	2009.10.26	-
Norman	6.03.02	2009.10.26	W32/Obfuscated.D2!genr
nProtect	2009.1.8.0	2009.10.26	-
Panda	10.0.2.2	2009.10.26	-
PCTools	4.4.2.0	2009.10.19	-
Prevx	3.0	2009.10.27	-
Rising	21.53.10.00	2009.10.27	-
Sophos	4.46.0	2009.10.27	Mal/Bredo-A
Sunbelt	3.2.1858.2	2009.10.26	Trojan.Win32.Bredolab.Gen.1 (v)
Symantec	1.4.4.12	2009.10.27	-
TheHacker	6.5.0.2.054	2009.10.26	-
TrendMicro	8.950.0.1094	2009.10.27	TROJ_BREDLAB.SMF
VBA32	3.12.10.11	2009.10.26	-
ViRobot	2009.10.27.2006	2009.10.27	-
VirusBuster	4.6.5.0	2009.10.26	-

Detected as:

Sanesecurity.Malware.12841
Sanesecurity.Malware.12842

Spammer Fail

A nice big...





















to the spammer that sent this...





Firefox says....






I think they meant http:// not htt://

:)

michael jackson virus already :(

Well, it didn't take long for the "them" to abuse the situation did it? :(

News item, with a picture and "video" to download:





















Here's the Anubis report on the "video"

Being detected as : Sanesecurity.Malware.11747.UNOFFICIAL

Update: Other article with translation here

Cheers,

Steve
Sanesecurity

Fake News/Flash Player

Interesting email came in just:

I worry about you httx: // ho.bestbreakingfree.com/news.php

Here's the "news page" that you are taken too....

















Downloading the fake Player and running it through VirusTotal gives you this:
















VirusTotal

As you can see the 0-hour detection rates aren't that good (3/39 scanners) :(

I'm sure we'll see more of this.

A good way to cut down on costs.. or not

I received an email today, looks quite safe and perhaps needed in the current climate... cutting costs:






Clicking on the link, you are taken to a nice friendly looking coupon page to save money...















Ah... it's asking to download an exe file... best submit to virus total first....















VirusTotal Results shows it's not exactly going to save us money... but does give us something nasty... for free :(

13.01.09: News

Lots of changes have been made recently to the download scripts, so if you haven't
checked out the new versions recently, it might be worth taking a look in the usage page.

In other news, there is now a support forum available here and there is now a searchable mailing list available here

20.01.09: News

31.01.09: Update... aka Oops... forgot to update the main blog

20.01.09: News

It's been a while... but the Sanesecurity signatures have returned!

We disappeared for a while due a DDos, a small number of users who overloaded the shared hosting servers by downloading the signatures every second and in reality, an unscalable download system.

The old download system doesn't work any more and won't be coming back, so if you haven't done already, please disable your cron jobs and wget/curls downloads, as a new round-robin rsync based download url is available.

All the changes are detailed here.

There's also a Sanesecurity list, which is recommended that signature users subscribe to, so that any future problems can be reported directly to you:

Subscribe to Sanesecurity list, by sending an email to the address in the below graphic, with a subject of: subscribe

There is an archive, so you can read previous messages here

Finally, thank you for all the support and feedback.

Steve
Sanesecurity

Update 18/01/09

Subscribe to Sanesecurity list, by sending an email to the address in the below graphic,
with a subject of: subscribe

Currently there is a great deal of work going on behind the scenes in getting the signatures back. This is the status so far:

* wget/curl etc. will no longer be used to download the signatures, we're moving to rsync. So please disable all downloads for the signatures, as they won't be coming back using the old urls.

* Signatures will now be signed using GnuPG, ensuring integrity of the signatures. The public key for these signature will be available from here.

For example, here's a good verify:

gpg --verify junk.ndb.sig
gpg: Signature made 01/09/09 09:55:48 using DSA key ID 31EA4D9E
gpg: Good signature from "Sanesecurity (Sanesecurity Signatures)"

Here's a bad verify:

gpg --verify junk.ndb.sig
gpg: Signature made 01/09/09 09:55:48 using DSA key ID 31EA4D9E
gpg: BAD signature from "Sanesecurity (Sanesecurity Signatures)"

* will be using round-robin dns system, to help spread the load over rsync servers.

* three new databases added: spear.ndb, spamimg.hdb and spam.ldb

* donation page, using PayPal will now also accept credit cards and hopefully will be able to provide and invoice for people who want one.

Hopefully, there will be more updates soon... so signup to the Sanesecurity list for more news.

Finally a Huuuuuuge thank you to everyone who has helped and offered help.