June 28, 2012
Which is the most popular antivirus software?
In an over-crowded antivirus software market, end and corporate users are often finding it difficult to differentiate between a value-added market proposition, next to the “me too” vendors of solutions. As in every other market segment, any scientific insight into the market share of various vendors offers an invaluable perspective into the market dynamics, what are customers purchasing, and most importantly, are they living in a world of ‘false feeling of security’.
Using a data set consisting of 120,000 data points, researchers from OPSWAT recently released an informative overview of the antivirus market, answering an important question - which is the most popular antivirus vendor?
According to their findings, that’s avast! Free Antivirus, followed by Microsoft Security Essentials and ESET NOD32 Antivirus.
Detailed market share statistics:
Avast - 17.4% worldwide market share
Microsoft - 13.2% worldwide market share
ESET - 11.1% worldwide market share
Symantec - 10.3% worldwide market share
AVG - 10.1% worldwide market share
Avira - 9.6% worldwide market share
Kaspersky - 6.7% worldwide market share
McAfee - 4.9% worldwide market share
Panda - 2.9% worldwide market share
Trend Micro - 2.8% worldwide market share
Other - 11.1% worldwide market share
Microsoft is the market leader in North America, followed by Symantec and AVG. Not surprisingly, the market leading avast! Free Antivirus is relying on the so called “freemium” business model, where the company grows and gains market share by offering a free alternative of their software, and earns revenue thanks to the successful conversion of free users to paid ones. Earlier this year, the company announced that it has 150 million active users worldwide, a clear indication of a working “freemium” business model.
What do you think? Is antivirus software still relevant in the age of Stuxnet, Duqu and Flame, the so called poster kids of the DIY targeted attack toolkits and weaponized malware releases? Do think free antivirus is offering a ‘false feeling of security’ compared to subscription based license models?
August 17, 2011
Android Malware Posing as Google+ app
Uncovered by the team at Trend Micro, the new malware known as ANDROIDOS_NICKISPY.C can also automatically answer and record phone calls. To capture data, the app loads at boot-up and runs certain services that can monitor messages, phone calls, and the user's location, thereby stealing e-mail and other content.
Detailing its findings in a blog Friday, Trend Micro said it discovered that the malicious app tries to trick people by installing itself under the name Google++.
But instead of providing access to Google's new social network, the app sends its stolen user data to a remote site where presumably cybercriminals can grab it. Unlike some malware in the past that masqueraded as legitimate apps through Google's Android Market, this particular one must be downloaded by an unsuspecting user from a malicious Web site and then manually installed.
And even if installed, the app can be uninstalled from an Android device by selecting Settings > Application > Manage applications, choosing Google++ and then clicking Uninstall, according to Trend Micro.
Trend Micro gives the app a low-risk rating, but it's still something that Android owners should be sure to avoid.
Android users concerned about security can learn how to better protect themselves through Trend Micro's online guide "5 Simple Steps to Secure Your Android-Based Smartphones."
Categories:
Android,
Android Malware,
Malware,
Virus
August 3, 2011
Hackers compromised 72 organizations since 2006
McAfee said the attackers are likely a single group acting on behalf of a government, differing from the recent wave of less sophisticated attacks from cyber activist groups such as Anonymous and LulzSec, according to the report.
McAfee did not say what country might have been working with the hackers, in contrast to companies such as Google, which as recently as last month blamed China for hacking into the Gmail accounts of several high-profile U.S. officials.
The intrusions, which McAfee called Operation Shady RAT, was discovered after the security vendor gained access to a command-and-control server that collected data from the hacked computers and logged the intrusions.
"After painstaking analysis of the logs, even we were surprised by the enormous diversity of the victim organizations and were taken aback by the audacity of the perpetrators," wrote Dmitri Alperovitch, vice president of threat research at McAfee, and author of the report.Alperovitch wrote that over the past five to six years there has been nothing short of a "historically unprecedented transfer of wealth" due to the hacking operation.
The data stolen consists of everything from classified information on government networks, source code, e-mail archives, exploration details for new oil and gas field auctions, legal contracts, SCADA (supervisory control and data acquisition) configurations, design schematics and more, Alperovitch said.
McAfee declined to name most of the organizations attacked, referring to businesses such as "South Korean Steel Company," "U.S. Defense Contractor #1" and "Taiwanese Electronics Company," among others.
Those that were named include the International Olympic Committee (IOC), the World Anti-Doping Agency, the United Nations and the ASEAN (Association of Southeast Asian Nations) Secretariat. Those organizations, however, were not of economic interest to hackers, and "potentially pointed a finger at a state actor behind the intrusions," Alperovitch wrote.
The hacking group gained access to computers by first sending targeted e-mails to individuals within the companies or organizations. The e-mails contained an exploit that, if executed, would cause the download of a piece of malicious software that communicates with the command-and-control server.
In 2006, eight organizations were attacked, but by 2007 the number jumped to 29 organizations, according to the report. The number of victimized organizations increased to 36 in 2008 and peaked at 38 in 2009 before starting to fall, "likely due to the widespread availability of the countermeasures for the specific intrusion indicators used by this specific actor," Alperovitch wrote.
The duration of the compromises ranged from less than a month to up to more than two years in the case of an attack on the Olympic committee of a unnamed nation in Asia.
October 11, 2010
What is svchost.exe? Is svchost.exe spyware or a virus?
"Svchost.exe" (Generic Host Process for Win32 Services) is an integral part of Windows OS. It cannot be stopped or restarted manually. This process manages system services that run from dynamic link libraries (files with extension .dll). Examples for such system services are: "Automatic Updates", "Windows Firewall", "Plug and Play", "Fax Service", "Windows Themes" and many more.
At startup, Svchost.exe checks the services portion of the registry and constructs a list of services that it needs to load. Under normal conditions, multiple instances of Svchost.exe will be running simultaneously. Each Svchost.exe session can contain a grouping of services, so that many services can be run depending on how and where Svchost.exe is started. This allows for better control and debugging.
If the process svchost.exe uses high cpu resources, it is mostly due because the service "Automatic Updates" is downloading some new Windows update. But having a 99% or 100% cpu usage could be caused by downloads due of some hidden malware on your computer. Some malware like the Conficker worm changes the Windows Registry so that svchost loads the malware .dll file. In this case you only see the authentic svchost.exe process in the task manager!
The biggest problem now is identifying what services are being run on a particular svchost.exe instance… we’ll cover that below.
If you are curious what we’re talking about, just open up Task Manager and check the “Show processes from all users” box:
Checking From the Command Line (Vista or XP Pro)
If you want to see what services are being hosted by a particular svchost.exe instance, you can use the tasklist command from the command prompt in order to see the list of services.
tasklist /SVC
The problem with using the command line method is that you don’t necessarily know what these cryptic names refer to.
Checking in Task Manager in Vista
You can right-click on a particular svchost.exe process, and then choose the “Go to Service” option.
This will flip over to the Services tab, where the services running under that svchost.exe process will be selected:
The great thing about doing it this way is that you can see the real name under the Description column, so you can choose to disable the service if you don’t want it running.
Using Process Explorer in Vista or XP
You can use the excellent Process Explorer utility from Microsoft/Sysinternals to see what services are running as a part of a svchost.exe process.
Hovering your mouse over one of the processes will show you a popup list of all the services:
Or you can double-click on a svchost.exe instance and select the Services tab, where you can choose to stop one of the services if you choose.
Disabling Services
Open up Services from the administrative tools section of Control Panel, or type services.msc into the start menu search or run box.
Find the service in the list that you’d like to disable, and either double-click on it or right-click and choose Properties.
Change the Startup Type to Disabled, and then click the Stop button to immediately stop it.
You could also use the command prompt to disable the service if you choose. In this command “trkwks” is the Service name from the above dialog, but if you go back to the tasklist command at the beginning of this article you’ll notice you can find it there as well.
sc config trkwks start= disabled
Categories:
spywae,
svchost.exe,
Virus
Subscribe to:
Posts (Atom)