March 1, 2010

Though short, February saw quite a number of viral threats. Along with traditional and online fake anti-viruses in the spotlight, new extortion schemes involving mobile devices appeared, while the proportions of the Windows blockers epidemic declined.

Windows blockers

Joint efforts of Doctor Web, law enforcement organizations, telecom operators, short number aggregators and wide public awareness of the Trojan.Winlock problem allowed reducing the number of infected machines to figures comparable to the number registered when the epidemics began in November 2009. While in January the number of detections of Trojan.Winlock registeredper day could exceed 100 000, in February the figure dropped to several thousands per twenty-four hours.

In spite of the sharp decline, dozens of thousands of users in Russia and Ukraine fall victims of the Trojan on a daily basis.

In the last two weeks of February a new browser blocking extortion scheme became widely popular. Going to a malicious web-page brought up a pop-up window that wouldn’t close unless an “activation code” was entered. The code is provided for a paid SMS. Even though this problem can be solved quite easily (stop the browser process using the task manager or force a system reboot), the number of people fallen victims of this scheme still increases among users of Windows as well as among people that use Mac OS.

Fake anti-viruses

In February cyber-criminals more often resorted to fraud schemes involving sites promoting fake anti-viruses to Internet users from Russian and other CIS countries. Links to such sites are spread over e-mail, compromised ICQ accounts and using contextual advertising on web search results pages and in social networks. Access to such web-sites is blocked by the Dr.Web Parental control.

Along with online fake anti-viruses Russian users were sometimes offered a customary Trojan.Fakealert. In such cases they were persuaded to download and install a fake anti-virus that imitated a scanning procedure and after that offered a user to send a paid short message.

Even though Trojan.Fakealert target group included Russian-speaking users, the highest number of victims of the fraud was found among speakers of English. Trojan.Fakealert offers a victim to pay 50 U.S. dollars for the fake anti-virus with a credit card. The offer to purchase a full version of the supposed anti-virus can be displayed in a browser window as well as using the fake anti-virus’s interface. Statistics regarding Trojan.Fakealert for the last six months shows a rapid growth in number of samples of the malware found in the wild started in October 2009. Doctor Web’s statistics server registers a huge number of detections of fake anti-viruses by Dr.Web solutions every 24 hours. And the top 20 of most widely spread malicious programs in February included 8 modifications of Trojan.Fakealert.

New Internet fraud scheme

A new fraud scheme used for money laundering lures users into giving away their mobile phone numbers in order to subscribe to a certain service. An SMS reply provides a would-be subscriber with an activation code where the contents usually have nothing to do with the topic to which the web-site is related. By entering the code a user signs up for a service. The service fee is debited from the user’s account on a daily basis without any warning. The withdrawn amount is small, so a user may fail to notice that something is wrong right away. Besides, terminating such a subscription may be difficult and require a paid SMS to be sent.

The number of malicious programs in e-mail traffic increased four times in February compared to the previous month. This dramatic surge was mainly caused by a growing number of fake anti-viruses and their downloaders in e-mail attachments. The number of malicious files among all files scanned on user machines increased by 24% in February thus reaching the figure registered in December 2009.

Malicious programs detected in mail traffic in February

Malicious programs detected on user machines in February

• Fake AV for mobile platform
  We have seen countless number of rogue security products for Windows platform however this one is targeted to trick mobile users.The sample masquerades itself as a certain AV for mobile and ...
• Account drainers and other virus threats of February 2011
  March 2, 2011 The main malicious trends of the previous months persisted in February. Windows blockers and banking password stealers, where the latter ones worked together with fake anti-viruses, cons...
• Viral threats in March 2010
  April 1, 2010 March 2010 saw a smaller number of Windows blockers and banners in Internet browsers. Fake anti-viruses with constantly changing look and feel mainly targeted English-speaking users. ...
• Fake torrent-trackers and other tricks of virus-makers in April 2010
  May 1, 2010 In April 2010 cyber-criminals focused on new SMS fraud schemes. This time they targeted users of torrent trackers and file sharing resources whom they tried to lure to fake web-sites su...
• Russian Windows blockers, European “bankers”, and other threats of June 2010
  July 2, 2010 Windows blockers remain a major virus threat in Russia. In June, malicious programs demanding that users refill cell phone account balances belonging to criminals constituted 30 percen...
• Fake anti-viruses always ring twice
  Although they’re just mayhem in disguise... Full story: MalwareCity Blog...
• AVAR 2010: Trend Micro Presents Papers on Emerging Security Threats, New Cleanup Approaches
  The annual conference of the Association of Anti Virus Asia Researchers, “AVAR 2010,” was held last November 17–19, 2010 in Bali, Indonesia. More than 30 papers were presented covering the latest t...
• World of Warcraft Scams: Free Gifts and Fake Account Suspension Threats
  Blizzard’s World of Warcraft (more popularly known as WoW) is one of the most popular massively multiplayer online role-playing games (MMORPGs) in the world. With more than 11.5 million subscribers as...
• Fake antivirus software using ransom threats
  Fake antivirus programs appear to be adopting some of the money-raising tactics of more threatening ransom malware, security company Fortinet’s latest threat report has found. View full post on Net...
• Analysis: Information Security Threats in the Second Quarter of 2010
  The majority of the biggest malware incidents that took place in the second quarter of 2010 were linked in some way to botnets. New bots were created and existing bots further developed, such as TDSS,...