HTML/Malicious.PDF.Gen - Malicious PDF documents

Currently malicious PDF documents find their way into the mailboxes of internet users. They abuse a new security hole in Adobe Reader and Acrobat to infect the computer with malware.

Adobe is investigating the yet unknown security vulnerability. Avira users are already protected though: The antimalware solutions from the german IT security company detect the malicious PDF files generically without updates as HTML/Malicious.PDF.Gen.

When opened with the vulnerable Adobe programs, the PDF file injects code which downloads further malware. The embedded JavaScript in the document checks if the version of Adobe Reader is 8 or higher.

Autorun-Based Malware Tops BitDefender’s November Top Ten Threat Report

BUCHAREST, Romania – December 1, 2009 – BitDefender’s Top Ten Threat Report for November is topped by Trojan.AutorunInf.Gen. Trojan.AutorunInf.Gen, which came in second place on October’s list, is a generic family of malware abusing the Autorun feature in Microsoft Windows operating systems. By default, every removable storage device features an autorun.ini script that instructs the computer which file to execute when the medium is plugged in. Malware authors frequently tamper with the file to make it launch miscellaneous malicious applications.

Trojan.Clicker.CM moves down a spot, ranking second with nearly eight percent of total infections. Trojan.Clicker.CM is found on websites hosting illegal applications such as cracks, keygens and serial numbers for popular commercial software applications. Clicker.CM is used to force advertisements inside a user’s browser in order to boost advertisement revenue.

HTTP Exploits - Malicious Programme

HTTP exploits involve using the Web server application to perform malicious activities. These attacks are very common and are growing in popularity because firewalls typically block most traffi c from the Internet to keep it away from corporate servers. However, HTTP traffic, used for Web browsing, is almost always allowed to pass through fi rewalls unhindered.

Thus, attackers have a direct line to the Web server. If they can coerce the Web server into performing malicious activities, they can access resources that would otherwise be unavailable.

Exploit.PDF-JS.Gen - Malware

There are no obvious symptoms until the malware manages to infiltrate the system. This can happen when opening a crafted PDF file and the javascript code inside the file is executed.

Exploit:Win32/Pidief.D; Exploit:W32/AdobeReader.QQ

This is a generic detection for specially crafted PDF files which exploit different vulnerabilities found in Adobe PDF Reader's Javascript engine in order to execute malicious code on user's computer. The exploitation mainly involves the following two functions: