<?xml version="1.0" encoding="UTF-8"?>
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	xmlns:atom="http://www.w3.org/2005/Atom"
	xmlns:sy="http://purl.org/rss/1.0/modules/syndication/"
	xmlns:slash="http://purl.org/rss/1.0/modules/slash/"
	>

<channel>
	<title>damnedspyware.com</title>
	<atom:link href="http://www.damnedspyware.com/feed" rel="self" type="application/rss+xml" />
	<link>http://www.damnedspyware.com</link>
	<description>Spyware News. Spyware removal resources.</description>
	<lastBuildDate>Fri, 12 Mar 2010 01:14:17 +0000</lastBuildDate>
	<generator>http://wordpress.org/?v=2.9.2</generator>
	<language>en</language>
	<sy:updatePeriod>hourly</sy:updatePeriod>
	<sy:updateFrequency>1</sy:updateFrequency>
			<item>
		<title>Invitation card means trouble</title>
		<link>http://www.damnedspyware.com/invitation-card-means-trouble.html</link>
		<comments>http://www.damnedspyware.com/invitation-card-means-trouble.html#comments</comments>
		<pubDate>Fri, 12 Mar 2010 01:14:17 +0000</pubDate>
		<dc:creator></dc:creator>
				<category><![CDATA[Uncategorized]]></category>

		<guid isPermaLink="false">http://blogs.paretologic.com/malwarediaries/?p=2505</guid>
		<description><![CDATA[Our Director of Marketing got this nice piece of spam today:
Subject: Jessica would like to be your friend on hi5!
I set up a hi5 profile and I want to add you as a friend so we can share pictures and start building our network. First see your invitation card I attached! Once you join, you [...]]]></description>
		<wfw:commentRss>http://www.damnedspyware.com/invitation-card-means-trouble.html/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Demonstrating the Latest IE 0-day Vulnerability</title>
		<link>http://www.damnedspyware.com/demonstrating-the-latest-ie-0-day-vulnerability.html</link>
		<comments>http://www.damnedspyware.com/demonstrating-the-latest-ie-0-day-vulnerability.html#comments</comments>
		<pubDate>Thu, 11 Mar 2010 19:00:12 +0000</pubDate>
		<dc:creator></dc:creator>
				<category><![CDATA[Uncategorized]]></category>

		<guid isPermaLink="false">tag:pandalabs.pandasecurity.com://639096e2667103121cf833cfc5671d77</guid>
		<description><![CDATA[Yesterday, Microsoft issued a security advisory for an unpatched and actively exploited invalid reference pointer vulnerability in the Internet Explorer 6 and 7 web browsers.  In the attack we observed, the exploit code will load the TDSS.CQ trojan, which is designed to steal personal and sensitive data.  Panda customers are ...]]></description>
		<wfw:commentRss>http://www.damnedspyware.com/demonstrating-the-latest-ie-0-day-vulnerability.html/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>YES the partner friendly exploit system.</title>
		<link>http://www.damnedspyware.com/yes-the-partner-friendly-exploit-system.html</link>
		<comments>http://www.damnedspyware.com/yes-the-partner-friendly-exploit-system.html#comments</comments>
		<pubDate>Thu, 11 Mar 2010 16:01:31 +0000</pubDate>
		<dc:creator></dc:creator>
				<category><![CDATA[Uncategorized]]></category>

		<guid isPermaLink="false">http://countermeasures.trendmicro.eu/?p=1884</guid>
		<description><![CDATA[The Russian crimeware &#8220;YES Exploit System&#8221; is a fully manageable system that generates malicious code for injecting into compromised pages or malicious web sites. This code is designed to redirect victims to files on your own hosted exploit server allowing you to push out malicious files invisibly and instantly, and it just got a major [...]]]></description>
		<wfw:commentRss>http://www.damnedspyware.com/yes-the-partner-friendly-exploit-system.html/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Browsersecurecheck.com</title>
		<link>http://www.damnedspyware.com/browsersecurecheck-com.html</link>
		<comments>http://www.damnedspyware.com/browsersecurecheck-com.html#comments</comments>
		<pubDate>Thu, 11 Mar 2010 14:56:27 +0000</pubDate>
		<dc:creator></dc:creator>
				<category><![CDATA[Uncategorized]]></category>

		<guid isPermaLink="false">http://www.2-viruses.com/remove-browsersecurecheck-com</guid>
		<description><![CDATA[Browsersecurecheck.com is a malicious website which is closely connected to Antivirus 7 rogue anti-spyware and its propagation. People usually get familiar with Browsersecurecheck.com without any intention to do this because of the browser hijacking techniques used to redirect users to that domain. Hijacker disables certain functions of the infected web browser and makes it operate [...]]]></description>
		<wfw:commentRss>http://www.damnedspyware.com/browsersecurecheck-com.html/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Av.exe Removal Instructions</title>
		<link>http://www.damnedspyware.com/av-exe-removal-instructions.html</link>
		<comments>http://www.damnedspyware.com/av-exe-removal-instructions.html#comments</comments>
		<pubDate>Thu, 11 Mar 2010 11:25:17 +0000</pubDate>
		<dc:creator></dc:creator>
				<category><![CDATA[Uncategorized]]></category>

		<guid isPermaLink="false">http://hands-oncorp.com/?p=1554</guid>
		<description><![CDATA[   Av.exe is executable that constitutes essential part of numerous rogue antispyware applications. Av.exe removal may be problematic if executed in manual mode. However, you cannot remove Av.exe based rogue antispyware or another counterfeit unless you get rid of Av.exe. To be precise, removing all spyware files and registry entries but Av.exe is [...]]]></description>
		<wfw:commentRss>http://www.damnedspyware.com/av-exe-removal-instructions.html/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Remove Smart Security (Smart Security Removal)</title>
		<link>http://www.damnedspyware.com/remove-smart-security-smart-security-removal.html</link>
		<comments>http://www.damnedspyware.com/remove-smart-security-smart-security-removal.html#comments</comments>
		<pubDate>Thu, 11 Mar 2010 10:55:27 +0000</pubDate>
		<dc:creator></dc:creator>
				<category><![CDATA[Uncategorized]]></category>

		<guid isPermaLink="false">http://www.xp-vista.com/?p=4721</guid>
		<description><![CDATA[Smart Security Descriptions:
Smart Security is a rogue anti-spyware application, a clone of Security Tool. The fake software can get into your PC in several different ways: it can either steal into your machine with the video codec or it can be a part of any flash update. In both cases, you don&#8217;t notice when it [...]]]></description>
		<wfw:commentRss>http://www.damnedspyware.com/remove-smart-security-smart-security-removal.html/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Remove CleanUp Antivirus (CleanUp Antivirus Removal)</title>
		<link>http://www.damnedspyware.com/remove-cleanup-antivirus-cleanup-antivirus-removal.html</link>
		<comments>http://www.damnedspyware.com/remove-cleanup-antivirus-cleanup-antivirus-removal.html#comments</comments>
		<pubDate>Thu, 11 Mar 2010 10:49:03 +0000</pubDate>
		<dc:creator></dc:creator>
				<category><![CDATA[Uncategorized]]></category>

		<guid isPermaLink="false">http://www.xp-vista.com/?p=4668</guid>
		<description><![CDATA[CleanUp Antivirus Descriptions:
CleanUp Antivirus has descended from the same family as Security Antivirus. Similarly to most of the roguewares, CleanUp Antivirus gets to your PC as you don&#8217;t expect that. It can be that the infection is installed after you click to download an update for your PC, or just try some online scanner. In [...]]]></description>
		<wfw:commentRss>http://www.damnedspyware.com/remove-cleanup-antivirus-cleanup-antivirus-removal.html/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Allaple Virus Author Sentenced</title>
		<link>http://www.damnedspyware.com/allaple-virus-author-sentenced.html</link>
		<comments>http://www.damnedspyware.com/allaple-virus-author-sentenced.html#comments</comments>
		<pubDate>Thu, 11 Mar 2010 09:30:12 +0000</pubDate>
		<dc:creator></dc:creator>
				<category><![CDATA[Uncategorized]]></category>

		<guid isPermaLink="false">http://www.f-secure.com/weblog/archives/00001907.html</guid>
		<description><![CDATA[ 			 			An Estonian virus writer has been sentenced to jail in Harju, Estonia.The author of the Allaple virus family, 44-year old Mr. Artur Boiko pleaded not guilty.Nevertheless, he was found guilty and sentenced to 2 years and 7 months in prison.Allaple is a complex worm using polymorphic encryption. It spreads over network shares and by modifying local HTML files. When such HTML files are uploaded to public websites, they spread the infection further.Apparently Mr. Boiko had been in a car accident and had ended up in dispute over his insurance claim with If Insurance. As a result, his worm launches DDoS attacks against these sites:&#160;&#160;&#160; www.if.ee &#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;(website of the insurance company)&#160;&#160;&#160; www.online.if.ee &#160;&#160;&#160;(customer online interface of the insurance company)&#160;&#160;&#160; www.starman.ee &#160;&#160;&#160;(website of a local ISP)The DDoS attacks were quite serious &#8212; see this post from ISC Diary in 2007.We detected several variants of Allaple during 2006-2007. The problem is that this is not a botnet &#8212; these worms have no command and control channel. The infected machines will attack their targets until they are cleaned. There are still thousands of active, infected computers today around the world, and they are still attacking. And the worm is still spreading further.Snapshot from F-Secure interface showing new samples on 11th of March 2010Boiko was sentenced to prison, where he has already been awaiting his trial for 19 months. He was also sentenced to pay the following sums to cover losses:To If Insurance: 5.1 Million Estonian Kroons (about 330000 Euros or 450000 USD)To Starman ISP: 1.4 Million Estonian Kroons (about 91000 Euros or 130000 USD)More info (in Estonian) from ERR Uudised 			 On 11/03/10 At 11:20 AM]]></description>
		<wfw:commentRss>http://www.damnedspyware.com/allaple-virus-author-sentenced.html/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Select Your Web Browser(s)</title>
		<link>http://www.damnedspyware.com/select-your-web-browsers.html</link>
		<comments>http://www.damnedspyware.com/select-your-web-browsers.html#comments</comments>
		<pubDate>Thu, 11 Mar 2010 09:30:12 +0000</pubDate>
		<dc:creator></dc:creator>
				<category><![CDATA[Uncategorized]]></category>

		<guid isPermaLink="false">http://www.f-secure.com/weblog/archives/00001905.html</guid>
		<description><![CDATA[ 			 			I wasn't sure I'd see this Browser Choice update:I set my computer's Regional Options for the United States even though it's physically located in Finland (I'm an American after all).Regional settings might trump my IP address, I thought&#8230; but it seems not. I manually ran Microsoft Update and was provided access to KB976002. Cool.If you're located outside of Europe and are wondering what's this is all about, read this from the BBC.Microsoft is offering alternative browser options to European Windows users to settle an anti-trust lawsuit. The update component points users to browserchoice.eu &#8212; from where they can select from 12 different web browsers.On a somewhat not completely unrelated note: Microsoft Security Advisory (981374) was published yesterday."Microsoft is investigating new, public reports of a vulnerability in Internet Explorer 6 and Internet Explorer 7."The vulnerability could allow for remote code execution.Once again, that browser choice link is browserchoice.eu. Share it with your family and friends.Signing off,Sean 			 On 10/03/10 At 05:00 PM]]></description>
		<wfw:commentRss>http://www.damnedspyware.com/select-your-web-browsers.html/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Be Savvy, Get Six Months of Internet Security</title>
		<link>http://www.damnedspyware.com/be-savvy-get-six-months-of-internet-security.html</link>
		<comments>http://www.damnedspyware.com/be-savvy-get-six-months-of-internet-security.html#comments</comments>
		<pubDate>Thu, 11 Mar 2010 09:30:12 +0000</pubDate>
		<dc:creator></dc:creator>
				<category><![CDATA[Uncategorized]]></category>

		<guid isPermaLink="false">http://www.f-secure.com/weblog/archives/00001906.html</guid>
		<description><![CDATA[ 			 			F-Secure has an additional blog that launched today. It's called Safe and Savvy.You'll notice that the name is pink. That's part of our new brand but it also reflects the authorship. Safe and Savvy's contributors are the female employees of F-Secure (mostly).Hetta, Marja, Annika, Alia, Melody-Jane, (and Jason) have already gotten started.Read more of Hetta's latest post to learn about six free months of our Internet Security 2010. 			 On 10/03/10 At 05:29 PM]]></description>
		<wfw:commentRss>http://www.damnedspyware.com/be-savvy-get-six-months-of-internet-security.html/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>How are ATM skimmers installed?</title>
		<link>http://www.damnedspyware.com/how-are-atm-skimmers-installed.html</link>
		<comments>http://www.damnedspyware.com/how-are-atm-skimmers-installed.html#comments</comments>
		<pubDate>Thu, 11 Mar 2010 09:30:12 +0000</pubDate>
		<dc:creator></dc:creator>
				<category><![CDATA[Uncategorized]]></category>

		<guid isPermaLink="false">http://www.f-secure.com/weblog/archives/00001904.html</guid>
		<description><![CDATA[ 			 			ATM skimmers are installed like this:Video source: Spiegel.de &#38; German Federal Criminal Office (Bundeskriminalamt) 			 On 10/03/10 At 12:06 PM]]></description>
		<wfw:commentRss>http://www.damnedspyware.com/how-are-atm-skimmers-installed.html/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>PDF Based Targeted Attacks are Increasing</title>
		<link>http://www.damnedspyware.com/pdf-based-targeted-attacks-are-increasing.html</link>
		<comments>http://www.damnedspyware.com/pdf-based-targeted-attacks-are-increasing.html#comments</comments>
		<pubDate>Thu, 11 Mar 2010 09:30:12 +0000</pubDate>
		<dc:creator></dc:creator>
				<category><![CDATA[Uncategorized]]></category>

		<guid isPermaLink="false">http://www.f-secure.com/weblog/archives/00001903.html</guid>
		<description><![CDATA[ 			 			Microsoft schedules its security updates on the second Tuesday of the month. Adobe recently began following this schedule as well, and while there are no Adobe updates today, there was an out-of-cycle security update two weeks ago.That update should now be applied if you haven't already done so.Why?Because we're now seeing the vulnerability (CVE-2010-0188) being exploited in targeted attacks (Microsoft also).Our sample was submitted by a European financial organization and the file name includes a reference to the G20. The exploit drops a downloader and attempts to make a connection to tiantian.ninth.biz. We detect this attack as Exploit:W32/PDFExploit.G.It doesn't surprise us to see this Adobe Reader vulnerability utilized so quickly.Looking through our sample management system, we see a growing number of targeted attack files.There were 1968 files in 2008. The number was 2195 during the year 2009. That isn't a very large increase in the overall total from 2008 to 2009 but we did see a greater percentage targeting Adobe.And how about the first two months of 2010?Well, so far the number is 895, which will more than double last year's number if the current pace continues.The percentage targeting Adobe Reader continues to rise.Here's a graph with a breakdown of the most common attack vectors used in targeted (espionage) attacks:Updated to add: A couple of readers noticed that our graph's 2009 percentages where slightly off &#8212; it's been corrected. 			 On 09/03/10 At 03:30 PM]]></description>
		<wfw:commentRss>http://www.damnedspyware.com/pdf-based-targeted-attacks-are-increasing.html/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Darkmarket Avatars</title>
		<link>http://www.damnedspyware.com/darkmarket-avatars.html</link>
		<comments>http://www.damnedspyware.com/darkmarket-avatars.html#comments</comments>
		<pubDate>Thu, 11 Mar 2010 09:30:12 +0000</pubDate>
		<dc:creator></dc:creator>
				<category><![CDATA[Uncategorized]]></category>

		<guid isPermaLink="false">http://www.f-secure.com/weblog/archives/00001902.html</guid>
		<description><![CDATA[ 			 			As "JiLsi" &#8212; one of the online criminals from Darkmarket &#8212; was sentenced last week to almost five years in prison, we have received some media queries on the case.In particular, one journalist wanted to know what JiLsi (aka Renu Subramaniam), Matrix001 (aka Markus Kellerer) and Cha0 (aka Ça&#287;atay Evyapan) looked like when they were posting to the Darkmarket forum.So I went back to my notes and dug up example posts from the guys, complete with their avatar icons. Perhaps these are interesting for our blog readers too.Cheers,Mikko 			 On 08/03/10 At 11:19 AM]]></description>
		<wfw:commentRss>http://www.damnedspyware.com/darkmarket-avatars.html/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>Desperate Phishing Attempt</title>
		<link>http://www.damnedspyware.com/desperate-phishing-attempt.html</link>
		<comments>http://www.damnedspyware.com/desperate-phishing-attempt.html#comments</comments>
		<pubDate>Thu, 11 Mar 2010 09:30:12 +0000</pubDate>
		<dc:creator></dc:creator>
				<category><![CDATA[Uncategorized]]></category>

		<guid isPermaLink="false">http://www.f-secure.com/weblog/archives/00001901.html</guid>
		<description><![CDATA[ 			 			Somebody is trying to pose as us. If you see an email like the one below, please ignore it:&#160;&#160;&#160;&#160;&#160;From: security@f-secure.com&#160;&#160;&#160;&#160;&#160;Reply-To: securitysupport@hotxf.com&#160;&#160;&#160;&#160;&#160;Subject: Security Maintenance.F-Secure HTK4S&#160;&#160;&#160;&#160;&#160;Date: Fri, 5 Mar 2010 18:11:05 -0000&#160;&#160;&#160;&#160;&#160;To: undisclosed-recipients:;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;Dear Email Subscriber, &#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;Your e-mail account needs to be improved with our new &#160;&#160;&#160;&#160;&#160;F-Secure HTK4S anti-virus/anti-spam 2010-version. &#160;&#160;&#160;&#160;&#160;Fill in the columns below or your account will be &#160;&#160;&#160;&#160;&#160;temporarily excluded from our services. &#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;E-mail Address:&#160;&#160;&#160;&#160;&#160;Password:&#160;&#160;&#160;&#160;&#160;Phone  Number:&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;Please note that your password is encrypted &#160;&#160;&#160;&#160;&#160;with 1024-bit RSA keys for increased security. &#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;Management. &#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;&#160;Copyright 2009. All Rights Reserved.Before you ask: No, we've never heard of "F-Secure HTK4S anti-virus" either. 			 On 05/03/10 At 10:26 PM]]></description>
		<wfw:commentRss>http://www.damnedspyware.com/desperate-phishing-attempt.html/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
		<item>
		<title>The Morphing PDF</title>
		<link>http://www.damnedspyware.com/the-morphing-pdf.html</link>
		<comments>http://www.damnedspyware.com/the-morphing-pdf.html#comments</comments>
		<pubDate>Thu, 11 Mar 2010 09:30:12 +0000</pubDate>
		<dc:creator></dc:creator>
				<category><![CDATA[Uncategorized]]></category>

		<guid isPermaLink="false">http://www.f-secure.com/weblog/archives/00001900.html</guid>
		<description><![CDATA[ 			 			Just when we thought SEO using Flash was as interesting as SEO poisoning can get, it seems it's getting even sneakier&#8230;Imagine a PDF file posted by someone evil online. Of course, Google being Google, the file is recognized as a PDF.And when we open it, it really is a PDF. No evil codes inside, just a good old vanilla PDF file.Three hours later&#8230; Google still says the file is a PDF. Brod (one of our geeky guys here) is attributing this to Google's cache.But is it really a PDF this time around?It morphed! And it even has different topics this time. Topics which, when you follow them, will lead you to another PDF:At least for a few hours before it becomes&#8230;It's a vicious cycle, but a pretty neat trick. Who would suspect a non-malicious PDF file right? At least before it becomes an HTML file. And the end result is a rogue antivirus scam.Response post by &#8212; Christine and Mina 			 On 05/03/10 At 07:00 AM]]></description>
		<wfw:commentRss>http://www.damnedspyware.com/the-morphing-pdf.html/feed</wfw:commentRss>
		<slash:comments>0</slash:comments>
		</item>
	</channel>
</rss>
