MSRT June 2017: Removing sneaky Xiazai

In the June release of the Microsoft Malicious Software Removal Tool MSRT, we’re adding Xiazai, a widespread family of browser modifiers that we have blocked and removed from millions of computers since 2015. Xiazai is a software bundler that can sneak in additional changes. Xiazai does not insta...

MSRT February 2017: Chuckenit detection completes MSRT solution for one malware suite

In September 2016, we started adding to Microsoft Malicious Software Removal Tool MSRT a malware suite of browser modifiers and other Trojans installed by software bundlers. We documented how the malware in this group install other malware or applications silently, without your consent. This...

MSRT December 2016 addresses Clodaconas, which serves unsolicited ads through DNS hijacking

In this month’s Microsoft Malicious Software Removal Tool MSRT release, we continue taking down unwanted software, the pesky threats that force onto our computers things that we neither want nor need. BrowserModifier:Win32/Clodaconas, for instance, displays ads when you’re browsing the internet. ...

MSRT November 2016: Unwanted software has nowhere to hide in this month’s release

We came across a browser modifier that sports rootkit capabilities. Not only does the threat, detected as BrowserModifier:Win32/Soctuseer, cross the line that separates legitimate software from unwanted, it also takes staying under the radar to the next level. Rootkit capabilities, which make it...

MSRT July 2016 – Cerber ransomware

As part of our ongoing effort to provide better malware protection, the July 2016 release of the Microsoft Malicious Software Removal Tool MSRT includes detection for Win32/Cerber, a prevalent ransomware family. The inclusion in MSRT complements our Cerber-specific family detections in Windows...

Microsoft Malicious Software Removal Tool Privilege Escalation Security Advisory (3057154)

This host is missing an important security update according to Microsoft advisory 3057154. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

CVE-2015-2418

CVE-2015-2418 concerns a race condition in Microsoft Malicious Software Removal Tool (MSRT) prior to 5.26 that lets an authenticated local user escalate privileges by placing a crafted DLL in a local directory. The vulnerability stems from how MSRT loads DLLs, enabling privilege elevation when th...

Microsoft Targets SpyEye Trojan in Latest MSRT Update

The company takes aim at the ubiquitous SpyEye banking trojan with its free Malicious Software Removal Tool MSRT, saying that the malware is more common than ever, and is being used to grab data from sensitive online sessions. In a blog post on Wednesday on the company’s Malware Protection Center...

Microsoft teams with Facebook to halt Koobface worm

From Facebook, by Jeff Williams, Microsoft When the Koobface worm hit Facebook users last year, the company’s security team scrambled to help affected users reset their accounts and avoid new infections. But the worm has continued to crop up periodically since then, and so the anti-malware team a...