ONLINE GAMERS ARE TOP PASSWORD-STEALING MALWARE TARGETS

What's the most common type of malware on the Internet? Viruses? Botnet code? How about password-stealing worms, designed to victimize online gamers?
Microsoft said Thursday it had removed nearly 1 million samples of a particularly virulent password-stealing worm in the first half of February. The company's Malicious Software Removal Tool (MSRT) rooted out more than 981,000 copies of a family of programs called Win32/Taterf, best known for stealing usernames and passwords for games such as World of Warcraft, Legend of Mir and Gamania.
Taterf has been especially widespread for months now. Microsoft removed more than 700,000 copies of it in one day alone last year. The worm is a mutated version of another password stealer, known as Win32/Frethog -- Microsoft has zapped nearly 317,000 copies of Frethog this month.
Online passwords are a popular target because they can be turned to cash, often in untraceable ways. The criminals use the hacked accounts to steal characters and virtual gold or other treasures, which are then sold to fans who pay real-world cash.
Although China has traditionally been the top spot for password-stealing infections, that seems to be changing, Microsoft said in a blog posting. In the first week of February, the top three countries, ranked by number of Taterf infections, were the U.S., Taiwan and Korea, respectively.
The MSRT is available free of charge to Windows users, and it gets monthly updates from Microsoft. Because it is so widely used, it can have a major effect on any piece of malware. MSRT is credited with crushing the notorious Storm worm in 2007.
This month Microsoft added MSRT detection for another notorious botnet, called Srizbi. Total number of Srizbi infections removed since the update: 38,697.

RUSSIAN HACKER SENDS MESSAGE TO MICROSOFT THROUGH WIN32/ZLOB

Here's a new way to get Microsoft to pay attention to you: Slip a brief message into the malicious Trojan horse program you just wrote.
That's what an unnamed Russian hacker did recently with a variation of Win32/Zlob, a Trojan program victims are being tricked into installing on their computers.
The message is surprisingly cordial, given that Microsoft's security researchers spend their days trying to put people like Zlob's author out of business. "Just want to say 'Hello' from Russia. You are really good guys. It was a surprise for me that Microsoft can respond on threats so fast," the hacker wrote, adding, "Happy New Year, guys, and good luck!"
Zlob is one of the most common types of Trojan programs used to attack Windows these days. In a typical Zlob scam, the victim is sent a link to what looks like an interesting video. When the link is clicked, the user is told to install a multimedia codec file in order to watch the video. That file is actually malicious software.
It's not clear whether the author of this message is the creator of Zlob, according to Joe Stewart, a researcher with SecureWorks. That's because "Zlob is one of those things that gets mislabeled by AV companies a lot," he said via e-mail. "Basically any time they see malware being spread by 'you need this video codec...' messages in multimedia files, it gets the Zlob label."
This isn't the first time this particular hacker has sent a note to Microsoft's security group. Last October he wrote a slightly creepy message, saying, "I want to see your eyes the man from Windows Defender's team."
Unlike the October message, this latest note wasn't caught by Microsoft. It was found Friday by a French security researcher using the hacker handle S!Ri.
According to this latest message, it may be the Zlob hacker's last note to Microsoft. "We are closing soon," he wrote. "So, you will not see some of my great ;) ideas in that family of software."
"It warms my heart that they're 'closing soon,'" wrote Microsoft spokesman Tareq Saade in a blog post.
All things considered, hiding messages in source code may not be the most effective way of reaching the Windows Defender team. "Considering the enormous amount of malware we go through every day, it can be difficult to track follow up samples like this," Saade wrote.
The hacker also claimed that Microsoft had once offered him a job to help improve Windows Vista's security. Microsoft hired a large number of outside security consultants to test Vista's code before it was released in late 2006. "It's not interesting for me," the hacker concluded. "Just a life's irony."