Mobile adware on the rise

    As many of you may know, there are many apps that are not entirely beneficial, most being for andriod phones. Now that so many people have a smart phone, malware creators are starting to focus more and more on making malicious apps. These can not only steal your personall data, or harass you and your friends with spam and ads, it also drains your battery. A recent survey has shown that about 12% of phones run out of battery completely each day. This can be very annoying, and with 60% of people saying that battery life is the main selling point, very costly.

A trend micro study on battery usage

    Adware is now incorporated into many apps, and while most ads are displayed legitimatly, they can now create illigitimate "notifications" or icons, that, when clicked, lead to the advertisers website. Many of these ads also steal your personall info, most of them without any sort of notification that they are doing this. They collect and send data in the background, and burn through your battery life and data usage.

    There are many free antivirus apps that can protect agains most common threats, and also many paid apps. I personally recommend either Sophos mobile security, or ESET's mobile app. They can be found here and here, respectively (Sophos being free, ESET a paid app).

Credits:
Trend Micro

PlugX or Korplug

     Some of you may have heard about a campaign using Poison Ivy to target users in Japan, China, and Taiwan. The same group is now developing a new RAT (Remote Administration Tool) called PlugX or Korplug. They seem to be distributing both side by side and are using some of the same servers to control both. This Trojan is detected as "Backdoor.Win32.Plugx". The Trojan is being deployed in attachments to spam mail (examples provided here). Some variants of this virus may be signed with stolen certificates.

    How to remove:
    Most Antivirus programs (such as Norton and Nod32) detect and remove this Trojan, so running a scan with any of these should get rid of the problem. However, it is possible to manually remove this trojan by following these steps (provided by 2-spyware)

1. Delete registry values: 
1. HKEY_LOCAL_MACHINE\SOFTWARE\Classes\FAST
2. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\LEGACY_SXS
3. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SxS
2. Delete files: 
1. %UserProfile%\SxS\bug.log 
2. %UserProfile%\SxS\rc.exe 
3. %UserProfile%\SxS\rc.hlp 
4. %UserProfile%\SxS\rcdll.dll

Sorry for this short post, more information on this threat will be posted later. Be sure to check the sources for more information and continued reading.

Remember to comment with a topic for my next post.



Sources:
TrendMicro
Symantec