Anti-Malware Engineering Team

VirusTotal Participation

Hi, this is Ziv Mador again from the Microsoft Anti-Malware team. This week, the folks over at VirusTotal added the Microsoft anti-malware engine to their service. VirusTotal is a free service that enables users to submit suspicious files to be scanned by several anti-malware engines. If you choose, files that are not identified as malicious are sent to the vendors who supply the anti-malware engines to this service to be analyzed. As of April 27, the Microsoft anti-malware scanner is included in the set of scanning engines used by VirusTotal. This scanner is based on the same technology found in Windows Live OneCare, the Windows Malicious Software Removal Tool, and Microsoft Antigen, and includes our full antivirus set of signatures. We are glad to be participating in this community opportunity.

On the Road at Infosecurity Europe and EICAR

Windows Defender Beta 2 Refresh

Today, we released a refresh of Windows Defender (Beta 2) which includes updates based on the customer feedback that we have received through this blog and the newsgroups. This update also addresses some issues that have been brought to our attention around signature updating, improves upon the usability of Windows Defender and also improves our SpyNet reporting capabilities.

First off, we have added a checkbox option to continually display the system tray icon. We heard your feedback loud and clear on this one, so those who want to see our icon with the little green check in their system tray as a sign of system health can now do so. We have also improved Windows Defender's ability to report more accurate data about potentially unwanted software through SpyNet so that we can help create better definition updates.

With these upcoming changes to our reporting network and our core technology, we will improve our detection and removal capabilities even more in the upcoming months.

News on Alcan, Mywife.E

In Bill Gates' keynote at RSA in February, one of the subjects he spoke on was the ability for Microsoft to have a comprehensive view of the evolving threat landscape using the information and feedback from such tools as Hotmail, Watson, the Windows Malicious Software Removal Tool, and Windows Defender.

Each month, the Malicious Software Removal Tool runs on approximately 250 million computers, mainly via Windows Update and Automatic Updates. In February's release of the tool, we added the ability to detect and remove a worm called Win32/Alcan. We believed that Alcan would be moderately prevalent based on data from Windows Live Safety Center and Windows Live OneCare but we were genuinely surprised once we sifted through the data from the February release. During the course of that month, the tool detected Alcan (and, specifically, Alcan.B) on just over 250 thousand unique machines, easily the top detection for the month. Compare this to the Win32/Mywife.E worm (aka CME-24), which we removed from approximately 40 thousand computers in February.

Alcan.B does not exploit any software vulnerabilities. Instead, it spreads through popular peer to peer applications and its prevalence is likely due to effective social engineering. Specifically, when sharing copies of itself over a P2P network, to name the copies, it contacts several websites to look for the names of recent, popular program cracks. Thus, the worm's name is always relatively up-to-date and attractive to those surfing these networks for cracks. Also, when the worm is run, instead of displaying nothing or popping up 50 browser windows, it displays what appears to be a setup wizard window, as displayed in our write-up. When the user clicks next, an error message is displayed. Thus, the user is fooled into thinking that what he or she just ran was a buggy or incomplete program, not a worm.

Threats like this reinforce the idea that malware that exploits user weakness can be as dangerous as those threats which exploit software vulnerabilities and reinforces the value of up-to-date antivirus products as well as general user vigilance.

Matt

Windows Defender Beta 2: Updated Version Available

An updated version of Windows Defender Beta 2 is now available from the Microsoft Download Center. This update resolves the two issues described in the below blog post relating to non-English versions of Windows and referenced in KB915087.  If you are running on a non-English version of Windows, then we advise that you uninstall the previous installation and install the updated version.  If you are running on an English version of Windows, then no action is required.

Also, a new definition update package is now available from Microsoft Update which should resolve the problem described in KB915105.  Users with Automatic Updates enabled will be notified of the availability of the release in a manner consistent with their Automatic Updates settings.

Windows Defender Beta 2: Update

Hi all,

We’ve gotten some great feedback from places like this blog and our support newsgroups about the recently released Windows Defender Beta 2. We really appreciate the enthusiastic participation!

Some of this feedback has allowed us to identify a couple of problems with our setup on non-English versions of Windows: 

• We have a problem installing on systems which don’t have a group named “Users”. On these systems, the group typically exists but it is in another language.
• Sometimes the link to Windows Defender creates a new group called “Programs” at the top of the start menu.

Our international users are very important to us and so we are currently testing an updated version that fixes these issues.  That update will be available soon through the same links where you installed the original version. Until we make this version available, users may follow the steps in KB915087 to workaround these issues and successfully install Windows Defender Beta 2.

Another problem that was appearing in the newsgroups:

• Uninstalling and reinstalling can temporarily cause problems updating signatures.

This will automatically get fixed in the next update of our signatures, which is scheduled for Tuesday. Please see KB915105 for more information.

Finally, we have also received a few questions about the tray icon. A consistent point of feedback from Windows users is that there are just too many icons that appear in the system tray.  With this in mind, we decided not to display a system tray icon for Windows Defender if no action is needed.  This way, we can help the industry move towards a model where the items in the system tray are programs that need a user's attention instead of items that are simply running.  As always, your comments on this are welcome.

Thanks again for all the support and please keep the feedback coming !

Adam

Announcing Windows Defender Beta 2

Hi, I'm Adam Overton, the group program manager for the anti-malware technology team. I'm very excited to be blogging today about the availability of Windows Defender Beta 2 which was announced by Bill Gates at his RSA conference keynote earlier this morning. You can download the new beta version from the Microsoft Download Center. Users who have Microsoft AntiSpyware Beta 1 already installed do not need to first uninstall this program; the installer will automatically upgrade you to Windows Defender Beta 2. There are a lot of exciting and fundamental changes which we have made with this release and I highly recommend that you check out the press release and fact sheet for more details. As previously announced, updates to Windows Defender will be available at no additional charge to Windows customers.

This is the culmination of many months of hard work by our team to provide the best antispyware solution to our customers. We recently topped 25 million active customers in December with Windows Antispyware Beta 1 and hope to grow our customer base even more with this release of Windows Defender Beta 2. If you have any comments on this release, please feel free to respond to this blog entry or post a message to our newsgroups. We look forward to your feedback as we work towards our final release.

Thanks,

Adam

Notes from the Anti-Spyware Coalition (ASC) Public Workshop, etc.

The Mywife.E Worm: Update # 2

As we pass noon on Monday, here in Redmond, we are happy to see that the Mywife.E worm (aka CME 24) turned out to be more hype than reality. Our product support departments (including calls to our free virus support line: 1-866-PCSafety) around the world are currently reporting low call volumes with respect to this issue and the few calls they did receive tended to be inquiries based on word-of-mouth vs. infected users.  This is consistent with what most of our anti-malware partners are reporting.
 
It is my hope that incidents like this don’t get too over-hyped in the future. As members of the security community, I believe we have the responsibility to provide our audience with accurate data that properly reflects the threat. What's interesting is that in this case, data from an unreliable source (a web counter essentially controlled by a malware author) was the primary data source to determine the level of threat to the world. I fear that too much hype in situations that end in false alarms ends up diluting the meaning of warnings for true worldwide threats. That's not to say that customers should not have been warned for this threat, but these notices should be based on fact and broadcast with the best interest of the audience in mind.

Thanks,
-Matt

------------------------------------------------------------
Matt Braverman
Program Manager
Anti-Malware Technology Team
Microsoft Corporation

Team Blog: http://blogs.technet.com/antimalware

The Mywife.E Worm: Update

Microsoft has posted an advisory for the Mywife.E worm that provides information on the threat and suggests possible mitigations. To help detect and remove the infection from a computer, we recommend using the Windows Live Safety Center Beta at http://safety.live.com.

The Mywife.E Worm

Here is an update from the Microsoft anti-malware team regarding the recent variant of the Mywife mass mailing worm. The mails' subject and body may vary. However they include an attachment that looks like a ZIP file while it is actually a malicious executable file. The naming for this worm is really all over the place (such as Nyxem, Blackmal, Grew, Kasper, and Tearec) but most vendors have been referring to it in their write-ups using its CME ID of 24. Our analysis of the worm can be found here. As described in the write-up, the worm will corrupt common document format files, first on February 3rd 2006 and on the third day of every month moving forward. As always, we strongly recommend running an up-to-date antivirus program on your computers and being wary of opening suspicious e-mail attachments even if they were sent from a familiar mail address.

Microsoft releases a new version of the Windows Malicious Software Removal Tool every month on the second Tuesday of the month together with the other security updates. The next version, targeted for release on February 14th will detect and remove this worm. Also, the beta version of Windows OneCare Live protects against this threat. It can be obtained here:  http://www.windowsonecare.com.

Finally, there has been significant discussion regarding the web-based counter that the worm uses and attempts to map the values of the counter to infection statistics. Our investigation has revealed that the web counter that is incremented by the malicious software is being artificially manipulated by outside parties.  It is therefore not a trustworthy indication of the infection rate or of the total of infected computers.  Instead, we utilize our industry partnerships as well as our own internal data to help gauge the impact to customers.  This information has revealed that the attack is limited at this time.

December Update for Windows Malicious Software Removal Tool Released

Windows OneCare Live Beta Available!

On Tuesday, the Windows OneCare team announced the availability of the beta of Windows OneCare Live – a comprehensive PC health service for consumers, which offers an integrated approach to help consumers more easily protect and care for their computers. The Windows OneCare team is a very important partner team of ours, and we are extremely excited about this release because it marks yet another technology debut for our team: our full antivirus engine and signature set! We have been working hard over the two years to provide the antivirus technology for this product, and seeing it in beta now is really cool. Windows OneCare Live will offer regular virus scanning as well as continuous protection against the latest virus threats. Windows OneCare Live also includes a two way firewall, a performance tune up wizard, automated backup and more. We hope you'll give this beta a try, and submit feedback to their team blog, which also has some more information on the beta.

Right now we're in an exciting time for our team, we have been heads-down for a long time working on some great technologies and we are finally getting to sharing it all with you. In just the past month we have been able to share with you a number of milestones:

• Delivering for the first time, our full antivirus engine and signatures in the Windows OneCare Live beta
• Debut an online, on-demand virus scanner as part of Windows Live Safety Center beta, including an interface into our searchable malware encyclopedia
• Announce more details of our plans around Windows Defender, and its availability in the December Community Technology Preview (CTP) for Windows Vista
• Shipping an update to the current Windows AntiSpyware beta to extend the expiration date to July 31, 2006
• Share our plans to detect and remove the rootkit that has been shipped as part of Sony’s XCP software with our upcoming December release of the Malicious Software Removal Tool, as well as with the Windows Live Safety Center, and the current beta of Windows AntiSpyware

We will keep trying to provide you with the latest information about what's going on here at Microsoft in the anti-malware space. Stay tuned!

Thanks for your interest,
-JasonG

------------------------------------------------------------
Jason Garms
Architect & Group PM
Anti-Malware Technology Team
Microsoft Corporation

Team Blog: http://blogs.technet.com/antimalware

Anti-Malware White Papers Posted

Hi, Matthew Braverman here again.

In early October, members of Microsoft's anti-malware team attended the 2005 Virus Bulletin Conference in Dublin, Ireland. This is one of the top three annual antivirus industry conferences, and was an excellent opportunity to mix and mingle with some of the leading members of the anti-malware industry and community. While members of our team have attended the annual Virus Bulletin conferences for the past few years, this year was especially exciting for us because we were presenting papers for the first time. We presented two papers: "Defeating Polymorphism: Beyond Emulation", presented by Adrian Stepan, a software developer on our team, and "Win32/Blaster: A Case Study From Microsoft's Perspective", presented by myself.

Both white papers can now be downloaded from the Microsoft Download Center, by clicking on their titles above. We hope that you find these papers interesting. If you have any thoughts or feedback, feel free to send them along or post comments to this blog.

Thanks,
Matt

Extending the expiration date for Windows AntiSpyware Beta 1