Apple Releases Flashback Malware Removal Tool

Apple has released a security update for Mac OS X that removes the Flashback Trojan, a persistent piece of malware that used a known flaw to infect an estimated 600,000 Macs in the past month.

In a security bulletin posted this afternoon (April 12) on the Apple Support website, Apple said the update “removes the most common variants of the Flashback malware” and “also configures the Java web plug-in to disable the automatic execution of Java applets.”

Apple has been criticized in the security community for failing to stop Flashback from infecting so many machines using a known vulnerability in Oracle’s Java software. The malware has existed in various forms since last fall.

The Java flaw was discovered in late January, and Oracle patched it on Windows and Linux machines Feb. 17. But Apple, which does its own Java updates, did not come out with a patch until April 3, after more than half a million Macs worldwide had been infected.

[FAQ: The New Mac Virus and Apple Anti-Virus Options]

Java, in effect, creates an operating system inside an operating system in order to run Web-based apps and other functions across different platforms. It has a history of serious vulnerabilities. Many security experts recommend that it be disabled on both Macs and PCs unless absolutely necessary.

Apple seems to have heeded that advice. The security bulletin released today said: “Users may re-enable automatic execution of Java applets using the Java Preferences application. If the Java web plug-in detects that no applets have been run for an extended period of time it will again disable Java applets.”

The security update will be pushed out automatically today to all Macs running Mac OS X 10.6 Snow Leopard and OS X 10.7 Lion.

Apple no longer supports Macs running OS X 10.5 Leopard, which includes all Macs based on the PowerPC architecture.

Late yesterday (April 11), and without any announcement, Apple began boosting security in the iTunes Store and the App Store to combat a persistent problem of hijacked Apple customer accounts.

Article provided by SecurityNewsDaily, a sister site to Laptopmag.com.

From Laptopmagazine. Visit Amazon Computer and Notebook Center Here

Avira Internet Security Suite 2012 Review: An Adequate Safeguard Against Malware

We couldn't find anything truly wrong with Avira Internet Security Suite 2012 ($60 for one year, one PC as of January 29, 2012), which ranked 11th in our 2012 roundup of Internet security suites. After all, the package protects against malware adequately, and although the interface isn't perfect, it's certainly usable. But in a year when so many suites are excellent performers, being adequate isn't enough to keep pace.

In our tests, the Avira software put up decent overall scores in malware detection and blocking. It fully blocked 92.3 percent of brand-new malware in our real-world detection tests--a good result, though slightly below average for the products we tested. With known malware, it was able to detect 99.68 percent of samples; despite that better-than-average outcome, Avira's suite wasn't quite on a par with the top performers in this test, which detected over 99.99 percent of samples.

False positives are a nonissue: The Avira suite mistakenly flagged only a single known safe file out of a pool of over 250,000 as being potentially malicious.

It proved capable at dealing with malware infections, too, as it detected and disabled all active malware infections on our test system. That said, it did leave behind malware remnants 50 percent of the time--slightly worse than average next to its rivals.

Avira's package had a moderate impact on overall PC performance as compared with the other suites we looked at. Its performance was average or slightly better than average in most tests we performed, though it seemed to struggle in two particular cases. Our test PC with the Avira suite installed completed our download test in 3 minutes, 12 seconds, which was by far our worst performance in that regard. In contrast, the average completion time for other suites was around 53 seconds; and without any antivirus installed, our test PC finished this test in 37 seconds. In addition, the Avira product slowed file-copying operations on our test PC significantly, wrapping up that test in 2 minutes, 56 seconds. Our test PC with other security software installed finished this test in 2 minutes, 2 seconds on average; without antivirus software, the PC sped through in 1 minute, 28 seconds.

Scan speeds were about average next to the other suites we evaluated. Avira's on-demand scanner--which runs when you manually start a scan--checked 4.5GB of files in 1 minute, 29 seconds, good enough for sixth place and 30 seconds faster than the mean. Meanwhile, the on-access scanner--which runs when you open or save files--finished in 4 minutes, 40 seconds (a slightly better-than-average result).

Avira's interface is usable for the most part, but it's nothing to write home about. The installation process steps you through a fairly standard wizard, though it will check for incompatible software before you install it. Avira's suite underwent a mini-makeover for 2012, with a redesigned main status screen. This new panel is a definite improvement over last year's interface: It's nicely laid out, and it gives you a clear status indicator as to whether you're protected. A 'Fix Now' button makes it easy to correct issues, and you can easily toggle suite components off and on from this main screen. Once you delve beyond the main screen, though, Avira's interface feels designed with experts in mind. I wasn't a big fan of the Avira firewall's insistence on asking me whether programs had permission to connect to the Internet when they attempted to do so the first time--especially since I had no idea what some of the programs it referred to were.

All in all, Avira Internet Security Suite 2012 is a lot like the company's 2011 offering: It isn't flashy, but it will do the job. Even so, Avira must do better if it wants to hang with the top performers in the increasingly competitive race for security supremacy.

From PCWorld. Visit Amazon Computer and Notebook Center here

F-Secure Internet Security 2012 Review: A Slow but Decent Malware Fighter

If you can tolerate some sluggishness, F-Secure Internet Security 2012 ($60 for one year and three PCs as of January 25, 2012), which placed eighth in our 2012 roundup of security suites, will protect your PC pretty well.

F-Secure's suite put up decent all-around scores for malware detection, though it fell somewhat short of the top contenders. With a 96.2 percent blocking rate in our real-world tests (which indicate how well a suite can stop brand-new, as-yet-unknown malware), it’s generally on a par with its competition. Its 99.91 percent detection rate for known malware is also very good. The F-Secure package found and removed all test infections on our system, and it cleaned all malware traces 60 percent of the time (which is just about average compared with the other products we tested).

It did report four false positives; that’s a tiny percentage given our sample size, but several of its rivals had one or zero false positives.

The F-Secure software’s impact on PC performance was fairly low for the most part, though it wasn't the fastest suite we've seen. The 15 seconds it added to PC shutdown times (as compared to our test PC with no antivirus software installed) was among the worst results we saw on that test; it also faired poorly in our app-installation test, completing the task in 3 minutes, 12 seconds. That outcome was a good 22 seconds slower than the average time for the suites we evaluated, and only 3 of the 14 suites we looked at had a larger impact on performance in this test.

Scan speeds were pedestrian: In our on-demand scan test (which indicates how quickly a suite will run a manually initiated scan of 4.5GB of data), the F-Secure software took 2 minutes, 43 seconds, the second-worst result on this measure. In our testing of the on-access scanner--which runs when you open or save a file to disk--it required 4 minutes, 21 seconds to plow through the same 4.5GB of files, landing at the middle of the pack.

Overall I appreciated F-Secure’s basically easy-to-use interface. The installer was fairly straightforward, though it did require me to click through more screens than I would have liked. F-Secure's main interface is based on the Launch Pad, a small window that you use to access the Internet-security and PC-security settings windows--the two feature sets are organized separately from each other. I wasn't crazy about this arrangement, since it merely added another screen that I had to pass through to get where I was going; I don't see why F-Secure can't combine the two categories into a single control panel.

Although the panels for the Internet-security and PC-security sections are laid out nicely, they're almost identical, so it's easy to get them crossed up. When you delve into the settings, you'll find that the interface is clean, but some features could use better descriptions. For example, you must go into the help system to learn what DeepGuard is (it monitors how programs behave, as well as the contents of files, to identify malware).

All things considered, F-Secure Internet Security 2012 is a good product. It'll do an effective job. This year's competition is stiff, however, and F-Secure doesn't quite keep up with the leaders of the pack.

From PCWorld. Visit Amazon Computer and Notebook Center here

Avast Internet Security 6 Review: Good, Basic Malware Detection

A solid choice for keeping you safe, Avast Internet Security 6 ($50 for one year and one PC as of January 25, 2012) finished sixth in our 2012 roundup of security suites. Although it ranked in the bottom half of our Top 10, the Avast package is easy to use, and in general it will protect your PC quite capably.

Avast's suite blocked 96.2 percent of malware in our real-world tests, which help determine how well security products can stop brand-new malware. With that result, it placed near the top of the pack; even so, the very best performers in our test group were able to stop all attacks. The Avast suite also managed to stop 99.75 percent of known malware samples, which is an excellent showing, but again, not the absolute best we've seen (our top performer detected over 99.99 percent of samples in this test). It achieved a perfect score in our false-positives test, flagging not a single safe file as being potentially malicious.

Regrettably, although the Avast software proved adept at identifying and neutralizing all infections on our test PC, it left more malware remnants behind than many of its competitors did.

System slowdowns shouldn’t be a serious issue with the Avast suite, though overall it wound up near the middle of the pack in that respect. It added barely any time to file downloads as compared to our test system without antivirus software installed. Its scan speeds were faster than the average of the products we tested: It completed our on-demand scan test (in which we scan 4.5GB of data using the manual scanner) in 1 minute, 21 seconds--one of the fastest performances we saw this year--and its on-access scanner (which runs when the user opens or saves a file) completed its check of 4.5GB in 4 minutes, 1 second, a slightly better time than average.

In my hands-on testing of Avast Internet Security, I found it generally easy to use and navigate. Its installation process was fairly straightforward, asking me to click though only three screens before it was complete, though it did require me to restart my PC. Once installed, the Avast software does an initial scan of your system. The main interface is little changed from last year's suite, which isn't necessarily a bad thing--it's clean, attractive, and easy to navigate. Along the left side are tabs that let you access settings for the suite's main features. The settings are fractured to some extent, since the software doesn't have a unified 'Settings' panel; instead, it breaks up settings by function. If you want to change the firewall settings, for instance, you have to look under the Firewall tab. Admittedly, this arrangement does make settings less intimidating to beginners.

The interface is visually appealing, with lots of graphs and charts. The look makes the suite friendlier for less advanced users, but it might be a little distracting for some people. I also found that the Avast software popped up notifications in the lower-right corner a little more often than I would have liked.

Avast Internet Security 6 isn’t the most feature-rich suite we tested this year--it lacks some common functions found elsewhere, such as parental controls--but what it does provide, along with its strong protection against malware, should suffice for most users.

From PCWorld. Visit Amazon Computer and Notebook Center here

Massive Android Malware Op May Have Infected 5 Million Users

The largest-ever Android malware campaign may have duped as many as 5 million users into downloading infected apps from Google's Android Market, Symantec said today.

Dubbed "Android.Counterclank" by Symantec, the malware was packaged in 13 different apps from three different publishers, with titles ranging from "Sexy Girls Puzzle" to "Counter Strike Ground Force." Many of the infected apps were still available on the Android Market as of 3 p.m. ET Friday.

"They don't appear to be real publishers," Kevin Haley, a director with Symantec's security response team, said in an interview today. "These aren't rebundled apps, as we've seen so many times before."

Haley was referring to a common tactic by Android malware makers to repackage a legitimate app with attack code, then re-release it to the marketplace in the hope that users will confuse the fake with the real deal.

Symantec estimated the impact by combining the download totals -- which the Android Market shows as ranges -- of the 13 apps, arriving at a figure between 1 million on the low end and 5 million on the high. "Yes, this is the largest malware [outbreak] on the Android Market," said Haley.

Android.Counterclank is a Trojan horse that when installed on an Android smartphone collects a wide range of information, including copies of the bookmarks and the handset maker. It also modifies the browser's home page.

The hackers have monetized the malware by pushing unwanted advertisements to compromised Android phones.

Although the infected apps request an uncommonly large number of privileges -- something that the user must approve -- Haley argued that few people bother reading them before giving their okay.

"If you were the suspicious type, you might wonder why they're asking for permission to modify the browser or transmit GPS coordinates," said Haley. "But most people don't bother."

Android.Counterclank is a minor variation on an older Android Trojan horse called Android.Tonclank that was discovered in June 2011.

Some of the 13 apps that Symantec identified as infected have been on the Android Market for at least a month, according to the revision dates posted on the e-store. Symantec, however, discovered them only yesterday.

Users had noticed something fishy before then.

"The game is decent ... but every time you run this game, a 'search icon gets added randomly to one of your screens," said one user on Jan. 16 after downloading "Deal & Be Millionaire," one of the 13. "I keep deleting the icon, but it always reappears. If you tap the icon you get a page that looks suspiciously like the Google search page."

Android users have hammered one of the infected apps with low review scores, calling it 'crap.'

All 13 suspected apps are free for the downloading.

Symantec's researchers have told Google of their discovery, said Haley. Google, however, did not immediately reply to questions and a request for confirmation on the security firm's claims.

Haley said Symantec's researchers are still "peeling back the layers of the onion," and added that the company would publish more information on the threat as it unearthed details. "What's interesting here is that instead of taking legitimate apps, [malware authors] have created apps similar to legitimate ones," said Haley. "That, and the big numbers of downloads, of course."

Symantec has published a list of the 13 infected apps on its website.

Gregg Keizer covers Microsoft, security issues, Apple, Web browsers and general technology breaking news for Computerworld. Follow Gregg on Twitter at @gkeizer , on Google+ or subscribe to Gregg's RSS feed . His e-mail address is gkeizer@computerworld.com.

See more articles by Gregg Keizer .

Read more about malware and vulnerabilities in Computerworld's Malware and Vulnerabilities Topic Center.

For more enterprise computing news, visit Computerworld. Story copyright © 2011 Computerworld Inc. All rights reserved.

From PCWorld. Visit Amazon Computer and Notebook Center here