February 8, 2011

The year 2011 started with relative calm, and few traditional “holiday” surprises were observed. January, like earlier months, was dominated by malicious programs designed to generate profits through extortion and the theft of passwords to the accounts of e-banking systems and electronic cash systems.

Trojan encoders

The beginning of the year saw the emergence of new versions of Trojans that encrypted documents in infected systems and then offered users a special tool with which to decrypt them – for a price.

In particular, modifications of Trojan.Encoder.94 and Trojan.Encoder.96 were added to the Dr.Web virus database in January.

Please remember that unskilled users’ actions with encrypted files may cause irreparable harm to the data. Restoring systems, deleting temporary system files, and clearing the browser cache, etc., are not recommended; such actions can make it impossible to recover your data.

Also, do not pick out the first available tool for decryption; in such cases, the risk of corrupting files permanently is high. Instead, request assistance from the Doctor Web virus laboratory: select “cure request” as a request category, and attach a few pairs of encrypted and unencrypted documents to your request.

Windows blockers

In January, Windows blockers continued spreading to users systems, and these malicious programs have become more diverse. Programs discovered earlier were found along with new types of blockers.

In contrast with the demands displayed by earlier versions of the malware, the new blockers increased the ransom amount demanded to unlock systems.

In late January, Windows blockers were also spread through the LiveJournal site. By clicking on a link in a comment left by intruders, users were taken to a photo hosting site from which they were directed to an adult content website. There victims were invited to download an EXE-file that concealed Trojan.Winlock.

The gallery below shows screenshots of the most common Windows blockers in January.

General statistics of Internet fraud in January

In cases of Internet fraud, over the past month the average number of users requesting assistance from Doctor Web’s free technical support team reached 178, 8% more than in December 2010.

The number of support requests related to malicious programs that required the transfer of money to a mobile phone account increased to 80% (in November 2010, the number of such complaints was 60%, and in December – 70% of the total).

The number of appeals for assistance concerning Trojans that required users to recharge criminals’ mobile phone accounts using appropriate SMS-services rendered by mobile operators, rather than payment terminals, increased from 23% in December to 43% in January.

The number of support requests related to malware demanding that paid text messages be sent continued to fall, and in January 2011, it amounted to only 15% of all appeals.

Banking botnets

Intruders kept spreading botnet client software among Russian users of e-banking systems and electronic cash systems. Typically, each client modification was directed simultaneously at multiple targets, apparently in the hope that one of them might end up on an infected compute.

Doctor Web virus analysts registered the activity of several of these botnets, in particular WinSpy and IBank. Following criminals’ commands, infected computers regularly update their components that make up the “payload” of the botnet. Upgrading is necessary since fraudsters are forced to deal with the anti-virus products installed on users’ computers and because the specific objectives of criminals also tend to change through time.

Fake anti-viruses targeting Western Europeans were among January’s other significant threats. System Tool 2011 and Antivirus Scan topped the list of fakes. English-speaking Facebook users also came under attack. Trojan.MulDrop1.62295 was spread as a gift from user to user through spam messages sent over the social network.

Viruses detected in January in mail traffic

Viruses detected in January on users’ computers

• Account drainers and other virus threats of February 2011
  March 2, 2011 The main malicious trends of the previous months persisted in February. Windows blockers and banking password stealers, where the latter ones worked together with fake anti-viruses, cons...
• Phishing, Spam and Malware Statistics for January 2011
  A little late this time, but here are our statistics about the phishing, spam and malware situation in January 2011! Most abused TLDs While the numbers for Phishing in December were almost all red, sh...
• First epidemic in 2010 and other virus events of January
  February 1, 2010 In January 2010 a large number of user requests regarding neutralization of active infections related to Trojan.Winlock programs while the vast majority of fraud schemes employed by ...
• Featured Security Posts from January 2011
  Now that a new month is upon us, I wanted to highlight several posts I wrote on this security blog in January 2011: Resisting the Gentle Pull of Mediocrity - A Reminder When Bots Chat With Social Net...
• Virus Bulletin: Feb 2011 for Linux
  This test result arrived just now from the Virus Bulletin.   For easier presentation I have extracted the results, plot it in graph and listed based on the On-Demand score.     A picture is worth a th...
• Analysis: Monthly Malware Statistics, January 2011
  The majority of malware will attempt to conceal its presence on users’ computers and function without the users’ knowledge, especially the more sophisticated types. Full story: Securel...
• Microsoft Patch Tuesday – January 2011
  Hello and welcome to this month’s blog on the Microsoft patch release. This is quiet month —the vendor is releasing two bulletins covering a total of three vulnerabilities. One of the iss...
• Mac virus onslaught in 2011? Not so fast (Macworld)
  Macworld - Is it really true that it's only a matter of time before Macintosh users are under siege by a flood of viruses and malware? McAfee announced recently that 2011 would be a bad year for peop...
• Will 2011 signal a Mac virus onslaught? Not so fast (Macworld)
  Macworld - Is it really true that it's only a matter of time before Macintosh users are under siege by a flood of viruses and malware? McAfee announced recently that 2011 would be a bad year for peop...
• Blog: Malware Calendar Wallpaper for January 2011
  We'd like to wish all our readers a very happy New Year and offer you a small gift - a selection of wallpaper calendars with the dates of the most significant events in the history of the IT security...