All the news
December 11, 2019
11.12 Doctor Web’s overview of mobile malware detected in November 2019
December 11, 2019
This November, Doctor Web virus analysts detected a number of new threats on Google Play. The list included new modifications to trojans of the
PRINCIPAL TREND IN NOVEMBER
- Malicious software appearing on Google Play
Mobile threat of the month
In November, Doctor Web experts detected a new modification to the
According to statistics collected by Dr.Web for Android
Android.Backdoor .682.origin- A trojan that executes cybercriminals’ commands and helps them control infected mobile devices.
Android.DownLoader .677.origin- A downloader of other malicious software.
Android.Triada .481.origin- A multi-functional trojan that performs various malicious actions.
Android.MobiDash.4006 - Trojan code that displays obnoxious advertising.
Android.RemoteCode .197.origin- A malicious application that downloads and executes arbitrary code.
- Program.FakeAntiVirus.2.origin
Detects adware that imitates anti-virus software. - Program.RiskMarket.1.origin
An app store that contains trojan software and recommends that users install it. - Program.HighScore.3.origin
An app store that invites users to install free Google Play apps by paying for them via expensive text messages. Program.MonitorMinor .1.originProgram.MobileTool .2.origin
Spyware that monitors activities of Android users and may serve as a tool for cyber espionage.
Tool.SilentInstaller .6.originTool.SilentInstaller .7.originTool.SilentInstaller .11.originTool.VirtualApk .1.origin
A riskware platform that allows applications to launch APK files without installing them.- Tool.Rooter.3
A utility designed to obtain root privileges on Android devices. It may be used by cybercriminals and malware.
Program modules that incorporate themselves into Android applications and display obnoxious ads on mobile devices:
- Adware.Dowgin.5.origin
- Adware.Toofan.1.origin
- Adware.BrowserAd.1
- Adware.Myteam.2.origin
- Adware.Altamob.1.origin
Trojans on Google Play
Last month, Doctor Web virus analysts detected a number of new modifications to trojans from the
We also detected the new trojan adware,
To protect your Android device from malware and unwanted programs, we recommend you install Dr.Web for Android.
Your Android needs protection.
Use Dr.Web
- The first Russian anti-virus for Android
- Over 140 million downloads—just from Google Play
- Available free of charge for users of Dr.Web home products
09.12 Components updated in Dr.Web 11.1 products for Unix-like systems
December 9, 2019
Specifically, it speeds up the database loading process for faster scan query processing.
The update is performed via the Dr.Web repository. If you encounter any problems when updating, please use the instructions from our previous news post to specify the additional repository for the Dr.Web software you use.
03.12 Components updated in Dr.Web 12.0 products for Windows
December 3, 2019
Changes made to the Dr.Web SpIDer Agent for Windows:
- The firewall rule list now loads faster. A notification icon is displayed while the table content loads.
Changes made to the Dr.Web Control Service:
- Issues preventing sysinfo reports from being generated when no Temp directory is found in the Windows folder have been resolved.
Changes made to Dr.Web Updater:
- The module's routines for interacting with updating severs have been optimised.
Changes made to Dr.Web Security Space, Anti-virus for Windows, Anti-virus for Windows servers setup:
- Some UI texts in certain languages have been updated.
Changes made to Lua-script main 12.5.2.10140, Lua-script for spider-agent:
- The SpIDer Agent item in the Start menu has been changed to Security Center.
The update will be performed automatically; however, a system reboot will be required.
02.12 Dr.Web Security Space for Android updated to version 12.5.0
December 2, 2019
New:
- The Anti-theft component can now use push notifications;
- In the Google Play version of the application, the Call and SMS filter component has been changed to Call Filter;
- The new version changes the way the application handles root permissions;
- The ability to disable program scan notifications in the application settings added;
- The ability to connect to servers using self-signed certificates;
- The Administration component now supports all Android versions in a centralised protection mode;
- Application version 15.5.0 operates differently regarding administrator permissions;
- Support for 64-bit architecture added;
- Ping queries now pass through the firewall;
- A new notification channel added Notifications from Friends ; and
- The updated version also incorporates UI tweaks and fixes for known defects.
If you downloaded the Dr. Web application from Google Play, the updates will be downloaded and installed automatically. If you ve disabled automatic updates, go to Google Play, select the Dr.Web Security Space or Dr.Web Security Space Life icon in the application list, and tap "Update.
To update via the Doctor Web site, you need to download a new distribution file. If you ve enabled the New app version option in the settings, a notification will be displayed whenever the virus databases are updated. You can begin the download directly from this dialogue box.
A note for Dr. Web Anti-virus service subscribers who use Dr. Web Security Space for Android: installing the updated version will not overwrite your previous installation. You will need to remove the earlier version manually after the update has been installed.
28.11 Dr.Web Enterprise Security Suite 12.0 Server Update
November 28, 2019
Change log:
- An issue preventing devices from being blocked if multiple device classes or buses were indicated simultaneously has been resolved;
- A defect preventing version 11 of Dr. Web server software from being upgraded to version 12 if MySQL or MariaDB was also being used as a database server has been corrected;
- A server error that occurred while hosts or host groups were being compared in the Control Center has been fixed;
- An issue that stopped the server software from being updated if var-root and home-root directories were located on different partitions has been eliminated;
- A problem preventing items on the Office Control class block list from being removed properly has been eliminated;
- An error that, under certain circumstances, interfered with Dr. Web software updates on protected hosts has been fixed.
The server software can be updated via the Dr. Web Global Update System.
25.11 Dr.Web Office Shield beta testing is underway
November 25, 2019
The Dr.Web Office Shield operates as a gateway between local mail servers and untrusted networks. The distribution is based on Ubutnu 18.04 (Bionic) and uses Linux kernel 4.15, while the Dr.Web Mail Security Suite 11.1 facilitates anti-spam and malware filtering.
With the Dr.Web Office Shield you can:
- Scan inbound SMTP traffic for malware and neutralise it;
- Filter spam and dubious content;
- Block attachments by file type;
- Receive up-to-date information from logs and the monitoring panel; and
- View statistics.
An OVA image is used to deploy the Dr.Web Office Shield in a virtual environment, while a web interface is used to configure and control the solution.
Doctor Web invites all Dr.Web community members to participate in the Dr.Web Office Shield beta-testing. Testers whose advice and comments prove to be most helpful in improving the product will receive gifts from Doctor Web. Please note that registration is required to access the beta-testing section.
Important! This beta version is not the final version of the new Dr. Web Office Shield. The product is being tested prior to its release and the final version may differ from the beta release.
22.11 Components updated in Dr.Web 11.1 products for Unix-like systems
November 22, 2019
Changes affecting Dr.Web Anti-virus 11.1 for Unix Mail Servers, Dr.Web Anti-virus 11.1 for Linux, Dr.Web Anti-virus 11.1 for Unix Server and Dr.Web Anti-virus 11.1 for Internet gateways Unix.
drweb-statd:
- The update eliminates a database rotation problem that occurred while messages with multiple attachments were being scanned.
Changes affecting Dr.Web Anti-virus 11.1 for Unix Mail Servers and Dr.Web Anti-virus 11.1 for Linux
drweb-maild:
- An issue preventing temporary files from being deleted has been eliminated.
The update is performed via the Dr.Web repository. If you encounter any problems when updating, please use the instructions from our previous news post to specify the additional repository for the Dr.Web software you use.
20.11 Agent software updated in Dr.Web Enterprise Security Suite 11.0
November 20, 2019
Changes made to the Dr.Web Net filtering Service:
- Problems occurring when the Mikrotik routers' web interface was being accessed have been fixed.
- An issue preventing the Your Phone application on Windows 10 PCs from establishing a connection to Android devices has been resolved;
- An issue preventing the service from being started on computers running Windows Vista x64 has been resolved.
Changes made to Lua-script for antispam:
- An issue causing the anti-virus setup to freeze while the anti-spam was being installed has been eliminated.
Changes made to Dr.Web Updater:
- Updating routines have been optimised.
Changes made to DwService::
- Also eliminated was a problem that prevented REBOOTSYSTEM messages in Cyrillic font from being displayed correctly.
The update will be performed automatically; however, a system reboot will be required.
19.11 Dr.Web Anti-rootkit API updated in Dr.Web 12.0 products for Windows
November 19, 2019
Specifically, it improves anti-rootkit detection and neutralisation routines.
The update will be downloaded and installed automatically.
19.11 Dr.Web CureIt! updated
November 19, 2019
Specifically, threat detection and neutralisation routines have been enhanced.
18.11 Dr.Web Virus-Finding Engine updated
November 18, 2019
The update fixes signature-extraction errors and resolves data-processing issues affecting the following executable file formats: CRX, AHK, SQUASHFS, ULTRAPROTECT, PE-files with double headers (UPX for ARMADILLO), ASPROTECT and FLY-CODE.
Dr.Web Virus-Finding Engine has been updated in the following products:
- Dr.Web 9/10/11.0/11.1 for macOS
- Dr.Web 6/11.0/11.1 for Unix Server
- Dr.Web 6/11.0/11.1 for Unix Mail Servers
- Dr.Web Anti-virus 6/11.0/11.1 for Internet gateways Unix
- Dr.Web Anti-virus 6/11.0/11.1 for Linux
- Dr.Web Security Space 7/8/9/10/11.0/11.5/12
- Dr.Web Anti-virus 7/8/9/10/11.0/11.5/12 for Windows
- Dr.Web 7/8/10/11.0/11.5/12 for Windows Servers
- Dr.Web 10/11/11.5/12 for MS Exchange
- Dr.Web 10/11.0/11.5/12 for M Lotus Domino (version for Windows)
- Dr.Web 6.0 for IBM Lotus Domino (Linux-version)
- Dr.Web AV-Desk 10.00.1/10.01.0
- Dr.Web ATM Shield 6
- Dr.Web Enterprise Security Suite 10.00.0/10.00.1/10.01.0/11.00/12.0 (Windows)
- Dr.Web 6 for MIMEsweeper
- Dr.Web LiveCD 9
- Dr.Web for Novell NetWare 7
- Dr.Web 6.0 for Qbik WinGate
- Dr.Web 6.0 for for Trafficinspector
- Dr.Web CureNet! 10/11
- Dr.Web 11.0 for Microsoft ISA Server and Forefront TMG
- Dr.Web 6.0 for Kerio mail servers (Windows)
- Dr.Web 11.1 for Kerio mail servers (Linux)
- Dr.Web 6.0 for Internet gateways Kerio (Windows)
- Dr.Web 11.0/11.1 for Internet gateways Kerio (Linux)
The update will be downloaded and installed automatically.
14.11 Dr.Web vxCube updated to version 1.4.10
November 14, 2019
Changes made to the analysis service:
- The causes behind possible analysis and detection errors have been eliminated.
- Analysis report formatting errors have been fixed.
- Issues that could occur while a Dr.Web CureIt! build was being generated have been resolved.
To purchase a license, please contact our sales support service.
With a Dr.Web vxCube trial license, available here, you can examine 10 objects in 10 days.
14.11 New anti-spam library in Dr.Web 11.1 for Unix-like systems
November 14, 2019
In addition to the libvaderetro library, the aforementionedDr.Web 11.1 products will now use *.kwo update files to maintain their anti-spam functionality.
To make full use of LivePatch, install the latest versions of the software with up-to-date components from the official Dr.Web repository or download the corresponding run-packages from Doctor Web's site.
14.11 Components updated in Dr.Web KATANA 1.0
November 14, 2019
Changes made to Dr.Web Protection for Windows:
- Adjustments have been made to ensure compatibility with Windows 10 Redstone 6.
Changes made to the Dr.Web Shellguard anti-exploit module:
- An issue causing anti-exploit module false positives to occur while MS Office 2019 and the Office Tab 13.0 plugin or Habel software were in use has been fixed.
Changes made to Dr.Web Anti-rootkit API:
- Enhanced threat detection and neutralisation routines.
The update will be performed automatically; however, a system reboot will be required.
14.11 Dr.Web Agent for Active Directory in Dr.Web Enterprise Security Suite 12.0 updated
November 14, 2019
Specifically, it eliminates an issue that caused an Active Directory policy to repeatedly attempt to install the Agent software on computers where the agent had already been installed
The update will be downloaded and installed automatically.
14.11 Dr.Web Mobile Control Center for iOS updated to version 12.0.1
November 14, 2019
Changes made to the Mobile Control Center:
- Now more information about server connection errors is displayed;
- IPv6 addresses can now be entered manually.
- A server HTTPS connection error has been fixed.
The updated Mobile Control Center is available free of charge via the App Store.
13.11 Doctor Web’s overview of malware detected on mobile devices in October 2019
November 13, 2019
The second autumn month turned out to be rough for Android users. Doctor Web virus analysts detected numerous malicious applications on Google Play, such as
PRINCIPAL TRENDS IN OCTOBER
- A growing number of threats on Google Play
Mobile threat of the month
In early October, Doctor Web reported a few clicker trojans that were added to the Dr.Web virus database as
- they are embedded into harmless applications;
- they are protected by a program packer;
- they are disguised as well-known SDKs;
- they attack users from specific countries.
Our virus analysts continued detecting additional modifications to these clickers throughout the entire month, having found
According to statistics collected by Dr.Web for Android
Android.HiddenAds .472.origin- A trojan that delivers annoying advertisements.
Android.RemoteCode .5564- A malicious application that downloads and executes arbitrary code.
Android.Backdoor .682.origin- A trojan that executes cybercriminals’ commands and helps them control infected mobile devices.
Android.DownLoader .677.origin- A downloader of other malicious software.
Android.Triada .465.origin- A multi-functional trojan that performs various malicious actions.
Program.FakeAntiVirus .2.origin
Detection of adware that imitates anti-virus software.Program.MonitorMinor .1.originProgram.MobileTool .2.originProgram.FreeAndroidSpy .1.originProgram.SpyPhone .4.origin
Spyware that monitors activities of Android users and may serve as a tool for cyber espionage.
Tool.SilentInstaller .6.originTool.SilentInstaller .7.originTool.SilentInstaller .11.originTool.VirtualApk .1.origin
A riskware platform that allows applications to launch APK files without installing them.- Tool.Rooter.3
A utility designed to obtain root privileges on Android devices. It may be used by cybercriminals and malware.
Program modules that incorporate themselves into Android applications and display obnoxious ads on mobile devices:
Adware.Patacore .253- Adware.Myteam.2.origin
- Adware.Toofan.1.origin
- Adware.Adpush.6547
- Adware.Altamob.1.origin
Trojans on Google Play
Apart from clicker trojans, Doctor Web virus analysts revealed several versions, as well as modifications to already known malware from the
Apart from that, our experts detected another trojan adware from the
Additionally, the Dr.Web virus database was updated to detect the trojans
To protect your Android device from malware and unwanted programs, we recommend you install Dr.Web for Android.
Your Android needs protection.
Use Dr.Web
- The first Russian Anti-virus for Android
- More than 140 million downloads on Google Play alone
- Free for users of Dr.Web home products
13.11 Doctor Web’s October 2019 virus activity review
November 13, 2019
In October, Dr.Web server statistics showed an increase in the total number of threats compared to September. The number of unique threats dropped by 6.86%. The most common threat in email traffic was malware that exploits vulnerabilities in Microsoft Office documents, as well as phishing newsletters. A password stealing trojan topped the list of detected malware and unwanted software, but adware still makes up the majority of all threats.
Principal trends in October
- A drop in spreading activity of unique malware
- An upturn in encoder activity
According to Doctor Web’s statistics servers
Threats of this month:
- Trojan.PWS.Siggen2.34629
- A trojan designed to steal passwords.
- Adware.Elemental.14
- Detects adware downloaded from file sharing services because of link spoofing. Instead of normal files, victims get applications that display advertising as well as install unwanted software.
- Adware.SweetLabs.2
- Alternative app store and add-on for Windows GUI from the creators of Adware.Opencandy.
- Adware.Softobase.15
- An installer that distributes outdated software. It changes browser settings.
- Adware.Ubar.13
- A torrent client that installs unwanted software on devices.
- Trojan.InstallCore.3553
- Another notorious adware installer. It displays ad banners and installs software without users’ permission.
Statistics for malware discovered in email traffic
- Exploit.Rtf.CVE2012-0158
- A modified Microsoft Office Word document that exploits the CVE2012-0158 vulnerability to execute malicious code.
- W97M.DownLoader.2938
- A modified Microsoft Office Word document that exploits the CVE2012-0158 vulnerability to execute malicious code.
- PDF.Phisher.115
- A PDF document used in phishing newsletters.
- Exploit.ShellCode.69
- A malicious Microsoft Office Word document that exploits the CVE-2017-11882 vulnerability.
- Trojan.PWS.Siggen2.34629
- A trojan designed to steal passwords.
- Trojan.PWS.Stealer.19347
- A family of trojans designed to steal passwords and other confidential information stored on an infected computer.
Encoders
In October, cases involving the following trojan encoders were most commonly registered by Doctor Web’s technical support service:
Trojan.Encoder.858 — 16.34%- Trojan.Encoder.10700 — 6.27%
- Trojan.Encoder.29750 — 2.81%
Trojan.Encoder.11539 — 2.64%Trojan.Encoder.25574 — 2.64%ACCDFISA v2 — 2.48%- Trojan.Encoder.11464 — 2.15%
Dr.Web Security Space for Windows protects against encryption ransomware
Dangerous websites
In October 2019, the database of non-recommended and malicious websites was updated with 254,849 webpages.
| September 2019 | October 2019 | Dynamics |
|---|---|---|
| + 238 637 | + 254 849 | + 6.79% |
Malicious and unwanted programs for mobile devices
Last month, Doctor Web virus analysts revealed a number of threats on Google Play. They included clicker trojans from the
The most noticeable October event related to mobile malware:
- rapid distribution of malware on Google Play.
Find out more about malicious and unwanted programs for mobile devices in our special overview.
Find out more with Dr.Web
13.11 Clickers, trojan adware, and other threats in the October 2019 mobile malware activity review
November 13, 2019
November 13, 2019
11.11 Dr.Web account unlock service on Doctor Web site updated
November 11, 2019
Changes made to the service:
- Support is now provided for the new Dr.Web Anti-theft features;
- The following interface languages are currently unavailable: Greek, Estonian, Latvian, Czech, Slovak, Korean, Indonesian and Hindi;
- The same links are now used in emails and on the service webpage.
- The text notifying users that they do not have an account has been changed.
11.11 Dr.Web Mobile Control Center for iOS updated to version 12.0.0
November 11, 2019
Changes made to the Control Center:
- Dr.Web Enterprise Security Suite 12.0 is now supported;
- The ability to use a custom port for server connections;
- The option to change the status of the installed components is no longer available;
- Entries showing zero values no longer appear in statistics;
- Minor UI tweaks have been introduced.
The updated is available free of charge via the App Store.
07.11 Application Control and other new features in Dr.Web Enterprise Security Suite 12.0
November 7, 2019
New Dr.Web Agent 12 for Windows
Changes made to the Agent:
- A significantly expanded range of Agent features;
- An expanded range of entities can now be protected by the anti-virus (processes, system services, drivers, the registry, Windows management instrumentation (WMI), system scheduler tasks, process network connections, and file system events);
- New, advanced scanning techniques, including new non-signature methods for detecting threats and new behavioural algorithms;
- Heuristic algorithms with expanded detection capabilities;
- Enhanced behavioural detection routines—an even broader spectrum of threats can now be detected;
- Dr.Web Agent for Windows’ design has been significantly revamped;
- A new device class—Multimedia devices—is now available in the Office Control settings for Windows OS workstations, offering more reliable access control.
Application Control — a new Agent component
The Application Control module within Dr.Web Enterprise Security Suite's Control Center controls the launch of programs on anti-virus network stations: unwanted applications, known malware, and outdated operating system versions. Application Control lets system administrators allow or block the launch of applications on anti-virus network stations running Dr.Web Agent for Windows, including for selected users. The administrator can decide what needs to be monitored on protected PCs and specify the specific signs of a threat the protection module should react to.
Using the statistics of the Application Control module, the network administrator can, on the fly, create allow and deny rules, which makes it possible to deflect even targeted attacks.
The updated Dr.Web Enterprise Security Suite has even more features for working with security centers (SOC) and incident analysis systems in computer networks (SIEM). Some of these new features are implemented with the Application Control module. Thus, FinCERT mailing data can be integrated into a Dr.Web Enterprise Security Suite security system with minimal effort.
Systems in which an anti-virus cannot be installed for one reason or another can be protected by an array of measures, including the Application Control, Office Control, and Preventive Protection modules.
You must install the Control Center to use the Application Control module. The component is included in the Comprehensive Protection license.
Find out more about Dr.Web Application Control
Major changes made to the Server:
- The installation process has been simplified; the number of distributions to install has been reduced—the network administrator can now download only the products that will be deployed in their company's network;
- The network administrator can automatically receive the latest versions of Dr.Web utilities;
- A new Server parameter has been added; it can be used to create missing accounts for hosts automatically when the agent software is being installed from a group installer;
- The installation process for Dr.Web Enterprise Security Suite on PCs running UNIX-like systems, including Russian ones, has been simplified.
The Dr.Web Enterprise Security Suite server software can now be updated directly from Dr.Web Control Center — after the administrator issues the command to launch the updating process.
Major changes made to the Control Center:
- Protection components can now be started and stopped remotely for stations running Unix-like operating systems; additional parameters are now available for the Dr.Web ICAPD and SpIDer Gate components;
- MAC addresses can now be used to look for hosts in the anti-virus network layout window;
- Statistics are now available about devices that are being blocked by Dr.Web on protected hosts;
- The audit log now contains information about the following events: Purge database, Analyse database, and Purge Active Directory database;
- New Dr.Web Server notification sorting options have been added for events involving the Dr.Web Preventative Protection and Application Control components, malware outbreak control, and abnormally terminated client connections;
- Less traffic and the ability to exchange data over low bandwidth: the detailed repository configuration now has a new setting for disabling the exchange of updates for neighbouring Servers, which can be used to prevent updates from being forwarded using inter-server connections.
More information about the innovations and tweaks in Dr.Web Enterprise Security Suite can be found in the Release Notes.
Read our detailed instructions to learn how to start using Dr.Web Enterprise Security Suite 12.0.
Corporate customers increasingly trust Dr.Web anti-virus protection technologies. From year to year, the share of Doctor Web revenue generated through the sales of Dr.Web licenses for business users is constantly growing, and to date, it exceeds 71%.
#Dr.Web #update
07.11 New security features powered by Application Control now available to Dr.Web administrators
November 7, 2019
The new Dr.Web Enterprise Security Suite 12.0 component— Application Control—enables system administrators to use flexible allow and block lists to assert control over the applications in their corporate networks.
The series of supplementary documents highlights how administrators can configure the component to address various security situations. They can: block legitimate software whose use for some reason is not allowed under company policies; Block applications by their file checksums, which can be provided by SOC/SIEM solutions, or prevent legacy application versions from being started on all the hosts in their network or limit the restriction to specific groups of nodes and users.
With Dr.Web Enterprise Security Suite 12.0, you can opt to install only the Application Control component on a computer and thus protect a system where no other anti-virus software can be installed.
To give the Application Control feature a try, upgrade Dr.Web Enterprise Security Suite to version 12.0 (here you can find the upgrade instructions) or request a trial version.
Please note that Application Control is only available under the comprehensive protection license and the Control Center is required to change its settings.
Doctor Web invites all system administrators and corporate information security specialists to study the Application Control guides and make full use of the new protection features so that they can achieve even more robust security for their corporate infrastructures.
#Application_Control #new_version #components
