Microsoft released Security Patch for CVE-2013-5065 TIFF Zero-Day vulnerability

Microsoft has released 11 Security Patch this Tuesday, including one for CVE-2013-5065 zero-day vulnerability, recently discovered Local privilege escalation vulnerability that could allow a hacker to launch an attack using corrupted TIFF images to take over victims' computers. FireEye researcher...

Microsoft Malicious Software Removal Tool Installed

The Microsoft Malicious Software Removal Tool is installed on the remote host. This tool is an application that attempts to detect and remove known malware from Windows systems. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid66424; scriptversion"1.60";...

MS Security Advisory 2846338: Vulnerability in Microsoft Malware Protection Engine Could Allow Remote Code Execution

A vulnerable version of Microsoft Malware Protection Engine MMPE is installed on the remote host. Scanning a maliciously crafted file can result in arbitrary code execution. This plugin checks if a vulnerable version of MMPE is being used by any of the following applications : - Microsoft Forefro...

Bafruz trojan vs Microsoft : Malicious Software Removal Tool Updated

There's a new family of malware that's using a complex set of capabilities to disable antimalware and listen in on sessions between users and some social networks. Bafruz is essentially a backdoor trojan that also is creating a peer-to-peer network of infected computers. Microsoft has announced...

Zeus Now Using Autorun As Infection Numbers Rise

After tapering off, the Zeus Trojan has been staging a comeback over the last few months, possibly using a new infection routine that leverages Windows’ autorun feature even after a company update to limit infections that use it, according to research by Microsoft. Microsoft’s Malicious Software...

AutoRun Infections Plummet Following Upgrade

A mid-February AutoRun update has had a dramatic effect on malware infection rates on the XP and Vista platforms, reducing infection rates using the AutoRun feature by as much as 68% across Windows platforms, according to Microsoft. Infections via the AutoRun feature in systems running Windows XP...

U.S. Reigns As Most Bot-Infected Country

The U.S. has by far the highest number of bot-infected computers of any country in the world, with nearly four times as many infected PCs as the country in second place, Brazil, according to a new report by Microsoft. The quarterly report on malicious software and Internet attacks shows that whil...

Linux Software Detection Application Removal (via Splunk): non-yum

Binary data 710018.prm...

Windows Software Detection Application Removal (via Splunk): code 1034

Binary data 710046.prm...

Linux Software Detection Application Removal (via Splunk): yum

Binary data 710035.prm...

Windows Software Detection Application Removal (via Splunk): code 1001

Binary data 710007.prm...

WEBHANCER Detection

The remote host is using the WEBHANCER program. You should ensure that : - the user intended to install WEBHANCER it is sometimes silently installed - the use of WEBHANCER matches your corporate mandates and security policies. To remove this sort of software, you may wish to check out ad-aware or...

LOP.COM Detection

The remote host is using the LOP.COM program. You should ensure that: - the user intended to install LOP.COM it is sometimes silently installed - the use of LOP.COM matches your corporate mandates and security policies. To remove this sort of software, install software such as Ad-Aware or Spybot....

DSSAGENT Software Detection

The remote host is using the DSSAGENT program. You should ensure that: - the user intended to install DSSAGENT it is sometimes silently installed - the use of DSSAGENT matches your corporate mandates and security policies. To remove this sort of software, you may wish to check out ad-aware or...

RADIATE Detection

The remote host is using the RADIATE program. You should ensure that : - the user intended to install RADIATE it is sometimes silently installed - the use of RADIATE matches your corporate mandates and security policies. To remove this sort of software, you may wish to check out ad-aware or spybo...

CYDOOR Software Detection

Cydoor Desktop Media, an adware program, is installed on the remote host. This program displays pop-up/pop-under advertisements and changes web browser settings e.g., homepage without the user's permission. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid12012;...

l2tpd Malformed Data Remote DoS

The remote host is running l2tpd, a network tunneling application. The installed version is vulnerable to a denial of service attack. An attacker may use this flaw to disable the VPN and prevent partners / employees from connecting to it. C Tenable Network Security, Inc. Ref:...

Trillian Detection

Trillian is installed on the remote Windows host. Trillian is an instant messaging client for Windows. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid11428; scriptversion"1.20"; scriptsetattributeattribute:"pluginmodificationdate", value:"2023/02/06";...

ICQ Detection

ICQ is installed on the remote host. ICQ is an instant messaging client for Windows that also includes some peer-to-peer file sharing features. As such, it may not be suitable for use in a business environment. C Tenable Network Security, Inc. include"compat.inc"; if description scriptid11425;...

Gnutella Servent Detection

The remote host is running a Gnutella 'servent', a P2P file sharing application. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include"compat.inc"; ifdescription scriptid10946; scriptversion"1.34"; scriptsetattributeattribute:"pluginmodificationdate",...