SECURITY WARNINGS & Notices - Please post them here

[mkis]

Hackers spam out malware disguised as "account notification" warning

http://www.sophos.com/blogs/gc/g/2010/04/06/account-notification-email

Emails claiming that recipient's accounts have been temporarily suspended are being seen around the world today, attempting to trick users into believing that their email account has been accessed by somebody else. Ensure that your computer systems are protected and find out more now.

[DavidR]

No change here other than perhaps Sophos trying to gain some kudos for something that has been going on for ages, not just happened/happening today.

[mkis]

They do say that it is a 'tried and trusted social engineering trick', and I think the point of the article is that the ruse targets those returning from the Easter break. Perhaps the same scam went down in previous Easter breaks. I cannot recall. I guess they have to report it anyway.

[bob3160]

Mozilla warns of unknown root certificate authority in Firefox

“…I have not been able to find the current owner of this root. Both RSA and VeriSign have stated in email that they do not own this root.

Therefore, to my knowledge this root has no current owner and no current audit, and should be removed from NSS.”

[Hermite15]

Mozilla warns of unknown root certificate authority in Firefox

“…I have not been able to find the current owner of this root. Both RSA and VeriSign have stated in email that they do not own this root.

Therefore, to my knowledge this root has no current owner and no current audit, and should be removed from NSS.”

thanks for this warning; that's been updated, RSA is the owner but acknowledges that the certificate isn't in use anymore >>> so, it should be removed. It's this one: RSA Security 1024 V3. http://blog.mozilla.com/security/2010/04/06/removing-the-rsa-security-1024-v3-root/

[Pondus]

Adobe suggests workaround for PDF embedded executable hack
http://blogs.zdnet.com/security/?p=6028&utm_source=feedburner&utm_medium=feed&utm_campaign=Feed:+zdnet/security+(ZDNet+Zero+Day)

[Pondus]

Report: Windows 7 holes eased by axing admin rights
http://news.cnet.com/8301-27080_3-20001359-245.html?tag=content;col1

[Pondus]

Subscription to malware testing

The title may imply that this article is about subscription services for email checking ?

Rather not! This time we shall examine yet another way that criminal activity imitates legitimate business.

http://www.norman.com/security_center/security_center_archive/2010/79170/en-uk

[Marc57]

MS Patch Tuesday heads-up: 25 holes in Windows, Office

Microsoft plans to release 11 security bulletins on Tuesday April 13, 2010 to fix 25 documented vulnerabilities that expose Windows users to remote code execution attacks.

http://blogs.zdnet.com/security/?p=6070&tag=nl.e540

[Pondus]

1-in-10 Windows PCs still vulnerable to Conficker worm
http://www.computerworld.com/s/article/9174998/1_in_10_Windows_PCs_still_vulnerable_to_Conficker_worm?source=rss_news


Romanian police, FBI break up 70-strong eBay fraud ring
http://www.scmagazineus.com/romanian-police-fbi-break-up-70-strong-ebay-fraud-ring/article/167554/
http://garwarner.blogspot.com/2010/04/70-romanian-phishers-fraudsters.html

[wisteria]

Hello everyone!

I'm new to this forum and to Avast.  I'm not sure if I'm posting my query in the right thread, but here goes.  I'd be grateful if someone could advise me on how to report a possible 'false positive' to Avast?   I've been trying to enter a furniture website here in the UK, but I keep receiving a message from Avast telling me there is a Trojan horse file attached to the shopping cart, thus I always have to abort the connection.

I've telephoned and emailed the furniture company and they admit there was a problem, but they say they've now fixed it.  Yet Avast continues to warn me not to enter the site.

Should I put the website url here for someone to check?  I won't do this if it's against protocol on this forum.  In short, I just need to know how to request a human being at Avast to check whether I'm receiving a false positive?

Thanks in advance for your advice         

[DavidR]

Reports related to detections, etc. should go in a new topic in the viruses and worms forum, http://forum.avast.com/index.php?board=4.0. There you can post this information and the URL, change the URL from http to hXXp or www to wXw, to break the link and avoid accidental exposure to suspect sites, thanks.

[wisteria]

Thanks, will do that. I've now reported the Trojan horse problem to Avast Technical support and  hope they won't take too long to reply.   

[DavidR]

I would still go ahead with the new topic as the forums are very active.

[polonus]

Hi malware fighters,

More and more malware with destructive payload leave users with a non-functioning PC:
http://blog.webroot.com/2010/04/08/this-pc-will-self-destruct-in-ten-seconds/

polonus