tag:blogger.com,1999:blog-54138827806541141502026-03-07T07:58:00.143+08:00independent.open.verifiable                      <a href="http://malware-test-lab-tw.blogspot.com/"> <img border="0" src="http://malware-test-lab.googlegroups.com/web/cht.gif?gda=yHqZ-zkAAABl-1h6XNARU1FowdyBoh41qVAm8oqpX0eZ9iPUogcWEKfsEAATYR7yhtkODHOd9LuECKgQbmraGdxlZulaYnsh" width="51" height="15"></a>Roger Chiuhttp://www.blogger.com/profile/14616629338243439273noreply@blogger.comBlogger39125tag:blogger.com,1999:blog-5413882780654114150.post-65201568593760387702008-09-11T22:40:00.012+08:002008-09-11T23:01:02.128+08:00

MEDTECS Taiwan Web Site is inserted malicious links, the malware name is Trojan.Asprox.The home page of MEDTECS Taiwan Web Site as below:The above home page contains malicious link as below:The malicious scripts as below:==The following focus on Web Reputation Service Testing==Google Search CAN detect it as below:Armorize HackAlert CAN detect it as below:McAfee SiteAdvisor CANNOT detect it as

Roger Chiuhttp://www.blogger.com/profile/14616629338243439273noreply@blogger.com3tag:blogger.com,1999:blog-5413882780654114150.post-3409942198265204622008-09-04T07:54:00.011+08:002008-09-04T08:14:43.181+08:00

The analysis of the following is related to a malicious link in some Taiwan web site.(Above picture is a malicious web site)(Above picture is the web page's source code of the malicious link)==The following focus on Web Reputation Service Testing==Armorize HackAlert CAN find it as below:McAfee SiteAdvisor CANNOT find it as below:Trend Micro WRS CANNOT find it as below:finjan URL analysis CAN find

Roger Chiuhttp://www.blogger.com/profile/14616629338243439273noreply@blogger.com0tag:blogger.com,1999:blog-5413882780654114150.post-59547293519054262562008-08-28T14:52:00.012+08:002008-08-28T15:43:20.304+08:00

We received many spams related to "Official Update 2008!", the content describes free update Windows XP and Vista.The following screens will be displayed when clicked the link inside email:==The following focus on Web Reputation Service Testing==Google Search CANNOT find it as below:McAfee SiteAdvisor CANNOT find it as below:Trend Micro WRS CAN find it as below:finjan URL analysis CANNOT find it

Roger Chiuhttp://www.blogger.com/profile/14616629338243439273noreply@blogger.com3tag:blogger.com,1999:blog-5413882780654114150.post-12969260907505472812008-08-28T11:21:00.004+08:002008-08-28T11:40:18.520+08:00

We received many spams related to "You've received a greeting ecard", some are pharmaceutical ads, some contains malicious links.The following screens will be displayed when clicked the link inside email:

Roger Chiuhttp://www.blogger.com/profile/14616629338243439273noreply@blogger.com0tag:blogger.com,1999:blog-5413882780654114150.post-31959319485419157282008-08-22T12:03:00.016+08:002008-08-22T12:32:52.432+08:00

Recently we received many spams related to "Weekly Top News", they contain many different malicious links, but almost do the same things.The following screens will be displayed when clicked the link inside email:Wireshark captures files downloaded as below:==The following focus on Web Reputation Service Testing==Google Search CANNOT find it as below:McAfee SiteAdvisor CANNOT find it as

Roger Chiuhttp://www.blogger.com/profile/14616629338243439273noreply@blogger.com2tag:blogger.com,1999:blog-5413882780654114150.post-87354107715767020272008-08-21T00:27:00.015+08:002008-08-21T07:47:40.010+08:00

Recently we received many spams related to "Paris Hilton Nuke Video". Of course, the content contains a malicious link, when clicked, it will download "video-paris-hilton.avi.exe", some antivirus scanner detects it as "Trojan-Downloader.Win32.Renos.AQ".The following screens will be displayed when clicked the link in this email:Wireshark captures files downloaded as below:==The following focus on

Roger Chiuhttp://www.blogger.com/profile/14616629338243439273noreply@blogger.com0tag:blogger.com,1999:blog-5413882780654114150.post-19732581005838688992008-08-18T11:05:00.015+08:002008-08-18T11:33:41.238+08:00

Recently, The Register reported "Mystery web attack hijacks your clipboard", what happened? The conclusion is attacker tries to lure users to install a fake antivirus software and most people guess attacker uses Adobe Flash's vulnerability.When clicked link (first picture), it will display the following screens:When clicked, wireshark captures files downloaded as below:==The following focus on

Roger Chiuhttp://www.blogger.com/profile/14616629338243439273noreply@blogger.com27tag:blogger.com,1999:blog-5413882780654114150.post-3328243090631450372008-08-13T19:33:00.004+08:002008-08-13T19:50:55.684+08:00

Today I receive an email, the subject is "msnbc.com - BREAKING NEWS: Too much freedom will destroy America", the content contains a malicious link, after clicked, it appears the same screen as "Fake CNN Alerts: Breaking news", please be careful.After clicked the links, it will display as below:

Roger Chiuhttp://www.blogger.com/profile/14616629338243439273noreply@blogger.com0tag:blogger.com,1999:blog-5413882780654114150.post-71326032812696812862008-08-13T11:03:00.012+08:002008-08-13T19:52:04.805+08:00

Today I receive another fake CNN Alerts News, subject is "CNN Alerts: Breaking news", when clicked the link, it will download "adobe_flash.exe". In the following, I will test web reputation service (most are not live analysis) and AV scanners separately.Fake "CNN Alerts: Breaking news" email and email source code as below:After clicked the links, it will display as below:==The following focus on

Roger Chiuhttp://www.blogger.com/profile/14616629338243439273noreply@blogger.com1tag:blogger.com,1999:blog-5413882780654114150.post-86191580500309899192008-08-10T01:05:00.014+08:002008-08-13T19:52:22.715+08:00

After fake "CNN.com Daily Top 10" Video, another fake "CNN Alerts: My Custom Alert" appears recently. When clicked the link, it will download "adobe_flash.exe" and it identifies as TR/Crypt.XPACK.Gen.Fake "CNN Alerts: My Custom Alert" email as below:Fake "CNN Alerts: My Custom Alert" email header as below:After clicked the links in email, it will display as below:The above link contains a

Roger Chiuhttp://www.blogger.com/profile/14616629338243439273noreply@blogger.com4tag:blogger.com,1999:blog-5413882780654114150.post-25641023611565482272008-08-09T10:23:00.005+08:002008-08-09T10:43:58.305+08:00

4th Hacks in Taiwan Conference has held on July 19,2008, now the slides (some contain traditional chinese) have published on http://hitcon.org/hit2008/.Vista system restore rootkit - Principle and protection by CardMagicWeb Threat Detection and Prevention by Roger ChiuFirefox Extension Spyware by ANTYou can't see me!! by UnohopeYou can't see me!! by Trueman0Day Demo (unavailable)Worm ,Botnet and

Roger Chiuhttp://www.blogger.com/profile/14616629338243439273noreply@blogger.com1tag:blogger.com,1999:blog-5413882780654114150.post-59946252800842571152008-08-09T09:56:00.009+08:002008-08-13T19:52:46.209+08:00

Recently I received several emails with subject "Internet Explorer 7", this is a fake IE7 update. When you clicked the link in this mail, it will download "update.exe" to local system, please be careful.An email of fake IE7 update as below:Fake IE7 update email header as below:After clicked the links in mail, it will display as below:After executed in VMWare, it displays an error as below:Google

Roger Chiuhttp://www.blogger.com/profile/14616629338243439273noreply@blogger.com2tag:blogger.com,1999:blog-5413882780654114150.post-27791000869677498742008-08-08T14:15:00.005+08:002008-08-08T14:35:28.718+08:00

Trend Micro Web Protection Add-On identifies the following PDF files as spyware, this is a false-positive detection.http://www.hitcon.org/hit2008/download/HIT2008-Vista_system_restore_rootkit-CardMagic.pdfhttp://www.hitcon.org/hit2008/download/HIT2008-%20You_Cannot_See_Me-Unohope.pdfhttp://www.hitcon.org/hit2008/download/HIT2008-%20You_Cannot_See_Me-Tureman.pdfhttp://www.hitcon.org/hit2008/

Roger Chiuhttp://www.blogger.com/profile/14616629338243439273noreply@blogger.com1tag:blogger.com,1999:blog-5413882780654114150.post-52136995358015383512008-08-08T11:05:00.020+08:002008-08-13T19:53:14.907+08:00

Recently many news about CNN.com Daily Top 10, this is a fake CNN videos, it contains a malware, please be careful.The following is fake CNN.com Daily Top 10's email:After clicked the links in mail, it will display as below:Google Search finds nothing as below:McAfee SiteAdvisor finds nothing as below:Trend Micro WRS can find it as below:finjan URL analysis finds nothing as below:Dr.Web URL

Roger Chiuhttp://www.blogger.com/profile/14616629338243439273noreply@blogger.com2tag:blogger.com,1999:blog-5413882780654114150.post-11582495258881537222008-08-08T08:06:00.003+08:002008-08-08T08:14:23.827+08:00

We have stopped to test antivirus softwares about a year, now we are back, we will start to perform antivirus comparison from September, 2008.

Roger Chiuhttp://www.blogger.com/profile/14616629338243439273noreply@blogger.com1tag:blogger.com,1999:blog-5413882780654114150.post-90502014154075273232007-06-29T10:47:00.000+08:002007-07-06T01:56:16.305+08:00

Updated: July 5, 2007In this report, the terminology, malware, includes virus, trojan, worm, backdoor, spyware, adware, dialer, keylogger, hack tool and so on. The samples we use are collected daily from Honeypot, the total malware count is 267,287, total file size is about 34,156 MB.The following table shows detection rate and scan performance for antivirus software:For detailed information,

Roger Chiuhttp://www.blogger.com/profile/14616629338243439273noreply@blogger.com7tag:blogger.com,1999:blog-5413882780654114150.post-54846278735151693062007-05-05T18:52:00.000+08:002007-05-05T18:55:53.782+08:00

Update: "New" to be added on March 2, 2007Antivirus Detection Rate:AVIRA Premium Security Suite 7.0: 95.09% NewFortinet FortiClient Host Security 3.0: 94.70%BitDefender Internet Security v10: 92.36%AOL Active Virus Shield (Free): 89.02%AVIRA AntiVir PersonalEdition Classic 7.0 (Free): 88.44%GRISOFT AVG Internet Security 7.5: 88.37%Norman Virus Control Plus 5.82: 86.64% NewBitDefender 8 Free

Roger Chiuhttp://www.blogger.com/profile/14616629338243439273noreply@blogger.com1tag:blogger.com,1999:blog-5413882780654114150.post-31149908804520376762007-05-05T18:49:00.000+08:002007-05-05T18:56:31.832+08:00

Antivirus Detection Rate:Fortinet FortiClient Host Security 3.0: 94.33%GRISOFT AVG Internet Security 7.5: 92.75%Dr.Web Antivirus 4.33: 87.44%AVIRA AntiVir ProfessionalEdition 7.0: 87.01%Kaspersky Internet Security 6.0: 83.45%Rising Antivirus 2006: 82.40%ALWIL avast Professional 4.7: 79.16%MicroWorld eScan Internet Security 8.0: 76.31%Panda Internet Security 2007: 72.45%McAfee Internet Security

Roger Chiuhttp://www.blogger.com/profile/14616629338243439273noreply@blogger.com0tag:blogger.com,1999:blog-5413882780654114150.post-75116881874400463842007-05-05T18:46:00.000+08:002007-05-05T18:56:58.795+08:00

Antispyware Detection Rate:BitDefender Internet Security v10: 94.85%ESET NOD32 2.7: 89.12%Kaspersky Internet Security 6.0: 88.86%Grisoft AVG Anti-Spyware 7.5 (ewido anti-spyware 4.0): 88.50%Alwil avast! 4.7 Home Edition (free): 84.47%Norman Virus Control 5.82: 79.41%Rising Antivirus 2006: 69.11%F-Secure Internet Security 2007: 68.20%Sunbelt CounterSpy 1.5: 67.51%Panda Internet Security 2007:

Roger Chiuhttp://www.blogger.com/profile/14616629338243439273noreply@blogger.com4tag:blogger.com,1999:blog-5413882780654114150.post-11078666716954728802007-05-05T18:43:00.000+08:002007-05-05T18:45:48.510+08:00

Cleanup Success Rate for Entry-based Viewpoint:PC Tools Spyware Doctor: 49.64%F-Secure Internet Security: 44.53%Norton Internet Security: 40.88%Ahnlab SpyZero: 40.88%SUPERAntispyware: 40.15%Microsoft Windows Defender: 39.42%Trend Micro Anti-Spyware: 37.96%Agnitum Outpost Firewall Pro: 33.58%ZoneAlarm Anti-spyware: 31.39%Computer Associate Anti-Spyware: 30.66%McAfee antispyware: 29.20%Webroot Spy

Roger Chiuhttp://www.blogger.com/profile/14616629338243439273noreply@blogger.com0tag:blogger.com,1999:blog-5413882780654114150.post-43908923450913497872007-05-05T18:41:00.000+08:002007-05-05T18:43:34.580+08:00

Cleanup Success Rate for Entry-based Viewpoint:Sunbelt CounterSpy: 35.71%Norton Internet Security: 33.33%PC Tools Spyware Doctor: 31.75%ZeroSpyware: 30.16%McAfee antispyware: 28.57%Computer Associate Anti-Spyware: 28.57%Webroot Spy Sweeper: 27.78%ewido anti-spyware: 27.78%Ahnlab SpyZero: 26.98%Spybot S&amp;D: 25.40%Kaspersky Internet Security: 24.60%SUPERAntispyware: 24.60%F-Secure Internet

Roger Chiuhttp://www.blogger.com/profile/14616629338243439273noreply@blogger.com0tag:blogger.com,1999:blog-5413882780654114150.post-78300913932721296692007-05-05T18:39:00.000+08:002007-05-05T18:41:13.533+08:00

Cleanup Success Rate for Entry-based Viewpoint:Trend Micro Anti-Spyware: 71.17%Sunbelt CounterSpy: 68.47%Webroot Spy Sweeper: 65.77%ewido anti-spyware: 62.16%McAfee antispyware: 62.16%PC Tools Spyware Doctor: 59.46%Norton Internet Security: 54.05%Computer Associate Anti-Spyware: 49.55%BitDefender Internet Security: 48.65%Microsoft Windows Defender: 44.14%F-Secure Internet Security: 44.14%

Roger Chiuhttp://www.blogger.com/profile/14616629338243439273noreply@blogger.com0tag:blogger.com,1999:blog-5413882780654114150.post-35330825653910478592007-05-05T18:37:00.000+08:002007-05-05T18:38:50.728+08:00

Cleanup Success Rate for Entry-based Viewpoint:Trend Micro Anti-Spyware: 74.02%Webroot Spy Sweeper: 58.27%McAfee antispyware: 56.69%Sunbelt CounterSpy: 53.54%PC Tools Spyware Doctor: 50.39%Lavasoft Ad-Aware: 48.82%F-Secure Internet Security: 46.47%ZoneAlarm Anti-spyware: 43.31%Panda Platinum Internet Security: 40.16%Norton Internet Security: 38.58%Microsoft Windows Defender: 38.58%ewido

Roger Chiuhttp://www.blogger.com/profile/14616629338243439273noreply@blogger.com0tag:blogger.com,1999:blog-5413882780654114150.post-1289222459242600862007-05-05T18:34:00.000+08:002007-05-05T18:36:48.604+08:00

Cleanup Success Rate for Entry-based Viewpoint:Trend Micro Anti-Spyware: 79.62%Webroot Spy Sweeper: 61.15%PC Tools Spyware Doctor: 57.96%Sunbelt CounterSpy: 55.41%Norton Internet Security: 52.23%McAfee antispyware: 45.86%Computer Associate Anti-Spyware: 41.40%Panda Platinum Internet Security: 28.66%ewido anti-malware: 28.66%Microsoft Windows Defender: 24.84%Lavasoft Ad-Aware: 14.65%Spybot S&amp;D

Roger Chiuhttp://www.blogger.com/profile/14616629338243439273noreply@blogger.com0tag:blogger.com,1999:blog-5413882780654114150.post-82440910204924481522007-05-05T18:32:00.000+08:002007-05-05T18:34:35.377+08:00

Cleanup Success Rate for Entry-based Viewpoint:Trend Micro Anti-Spyware: 78.15%Sunbelt CounterSpy: 55.19%Webroot Spy Sweeper: 54.07%Norton Internet Security: 53.70%McAfee antispyware: 50.00%PC Tools Spyware Doctor: 43.33%Computer Associate Anti-Spyware: 37.41%ewido anti-malware: 34.81%Lavasoft Ad-Aware: 32.96%Spybot S&amp;D: 28.52%Microsoft Windows Defender: 22.59%Panda Platinum Internet Security

Roger Chiuhttp://www.blogger.com/profile/14616629338243439273noreply@blogger.com1