Virus Bulletin - November 2010

Editor: Helen Martin

Technical Consultant: John Hawes

Technical Editor: Morton Swimmer

Consulting Editors: Ian Whalley, Nick FitzGerald, Richard Ford, Edward Wilding

2010-11-01

Abstract

Worldwide anti-botnet initiatives (comment); Vancouver expedition (conference report); Deelaed learning (malware analysis); Exploit identification (tutorial); Anti-unpacker tricks - part fourteen (technical feature); Letters to the editor (letters);


Comment

Worldwide anti-botnet initiatives

‘Germany was the first country to launch a large-scale malware-cleaning project backed by the government.’ Sorin Mustaca, Avira

Sorin Mustaca - Avira, Germany


News

Wot no comparative?

VBSpam comparative results postponed.

Helen Martin - Virus Bulletin, UK


Anti-botnet operations

Partial success in the takedown of Bredolab; m00p gang member enters guilty plea.

Helen Martin - Virus Bulletin, UK


Malware prevalence report

September 2010

The Virus Bulletin prevalence table is compiled monthly from virus reports received by Virus Bulletin; both directly, and from other companies who pass on their statistics.



Conference report

Vancouver expedition

The 20th VB conference drew to a close last month in the beautiful city of Vancouver. Helen Martin reports on the presentations, games, awards, birthday cakes, and the buzzword of the event: Stuxnet.

Helen Martin - Virus Bulletin, UK


Malware analysis

Deelaed learning

Over a period of around three months, new virus writer hh86 produced a handful of viruses using some new techniques - then disappeared without a word. Peter Ferrie details her creations.

Peter Ferrie - Microsoft, USA


Tutorial

Exploit identification

In previous articles Mark Davis introduced exploit frameworks such as Fragus, Tornado, and others, and described how to analyse them using LAMP/WAMP servers. Here, he walks through a Tornado kit, start to finish, showing the process required to identify exploits in the kit.

Mark Davis -


Technical feature

Anti-unpacker tricks – part fourteen

Last year, a series of articles described some tricks that might become common in the future, along with some countermeasures. In this final article of the series we look at anti-unpacking by anti-emulating.

Peter Ferrie - Microsoft, USA


Letters

Letters

Letters to the editor on the relevance of spam feeds and the earning potential of cybercrime.



Calendar

Anti-malware industry events

Must-attend events in the anti-malware industry - dates, locations and further details.



Quick Links

Poll
Does your company allow you to use a personal laptop/mobile device to access company resources?
Yes, it's allowed
Yes, it's actively encouraged
No
I don't know
Leave a comment
View 2 comments

Ciso-Intelligence

VB100 certification
VB100 As expected, the annual VB100 test on Windows XP was an epic. A higher than usual pass rate was tempered by numerous stability issues with the products under test, prompting the unveiling of a new stability rating system. John Hawes has all the details.
See full results.

Virus Bulletin currently has 225,307 registered users.