Computer Security Articles

A new method of producing malicious PDF files has been discovered by the avast! Virus Lab team. The new method is more than a specific, patchable vulnerability; it is a trick that enables the makers of malicious PDF files to slide them past almost all AV scanners.

Overall, PDF specifications allow many different filters (such as ASCII85Decode, RunLengthDecode, ASCIIHexDecode, FlateDecode, .) to be used on raw data. In addition, there is no limit on the number of the filters used for a single data entry. Anyone can create valid PDF files where the data uses, for example, five different filters or five layers of the same filter. All of these features are based on extremely liberal specifications, a fact which allows bad guys to utilize malicious files in a way that does not allow antivirus scanners access to the real payload.

The new trick is based just on one filter, so it doesn’t sound exciting, does it? So what’s the reason for posting this blog post?

The filter used to encrypt text data is meant to be used only for black and white images. And apart from avast!, probably no other AV scanner is currently able to decode the payload because no other AV can detect those PDF files.

This story began when we found a new, previously unseen, PDF file a month ago. It wasn’t detected by us or by any other AV company. But its originating URL address was quite suspicious and soon we confirmed the exploitation and system infection caused by just opening this document. But our parser was unable to get any suitable content that we could define as malicious. There wasn’t any javascript stream, just the single XFA array shown in the next image.

XFA form definition

XFA forms usually contain a malicious TIFF image that exploits the well-known CVE-2010-0188 vulnerability. We were interested in the objects referenced by the XFA array. As you can see, there were just two references:

• template – object 201
• dataset – object 301

The dataset object was easy to decode by our scanner as it uses one extremely common filter – FlateDecode. The data decoded from the stream wasn’t suspicious anyway – just some data encoded with the base64 algorithm (as shown in next image). The main payload had to be covered by the first – template object.

dataset – decoded data

Unfortunately, our scanner wasn’t able to decode this content. So what was wrong? Why were other AV engines also unable to detect such an exploit? The answer to those questions is shown in the next image.

template object definition

The image above is the object stream definition. It says that the object is 3125 bytes long and that we must use 2 filters to decode the original data – FlateDecode as first layer and JBIG2Decode as a second layer. But why JBIG2Decode? That’s a pure image encoding algorithm isn’t it? Correct, and following text is what Adobe says about it in the PDF documentation (Part 3.3.6, page 80):

The JBIG2Decode filter (PDF 1.4) decodes monochrome (1 bit per pixel) image data that has been encoded using JBIG2 encoding. JBIG stands for the Joint Bi-Level Image Experts Group, a group within the International Organization for Standardization (ISO) that developed the format. JBIG2 is the second version of a standard originally released as JBIG1.
JBIG2 encoding, which provides for both lossy and lossless compression, is useful only for monochrome images, not for color images, grayscale images, or general data. The algorithms used by the encoder, and the details of the format, are not described here. A working draft of the JBIG2 specification can be found through the Web site for the JBIG and JPEG (Joint Photographic Experts Group) committees at < http://www.jpeg.org >.

And following text that is taken from the same specification (Part 4.8.6, page 353):

Also note that JBIG2Decode and JPXDecode are not listed in Table 4.44 because those filters can be applied only to image XObjects.

That’s another surprise from PDF, another surprise from Adobe, of course. Who would have thought that a pure image algorithm might be used as a standard filter on any object stream you want? And that’s the reason why our scanner wasn’t successful in decoding the original content – we hadn’t expected such behavior. To be fair, any data (text or binary) can be declared as an monochrome two-dimensional image – that’s the reason why JBIG2 algorithm works here.

We guessed that the image would probably has its first dimension set to 1 pixel and the second would be set to a much higher number of pixels. That’s the easiest way how to declare non-image data as a monochrome picture. The following picture shows the data processed by the FlateDecode filter, so it’s actually a JBIG2 stream (PDF version of JBIG2, as the file header is missing here).

Data representing JBIG2 stream (after initial FlateDecode filter)

Two colored 32bit numbers on the picture above represents the image dimensions. You can see that our guesses were right. Image is 25056 (red: 0x000061E0) pixels wide and just 1 pixel (yellow: 0×00000001) high. Remember that the image is monochrome so 1 pixel = 1 bit. To get the size of the decoded data in bytes, we need to divide the width by 8 and get 3132 bytes. The following image shows real content after two decoding procedures.

Decoded content of the template object

The content is the well-known as CVE-2010-0188 exploit. The bad guys are building a specially-crafted TIFF (see underlined text in the image, that’s a TIFF header encoded by base64 algorithm) file which exploits Adobe Reader. The vulnerability is patched in current versions, only old versions are affected.

We released PDF:ContEx [Susp] detection immediately after this discovery. We have been monitoring this new trick now for over a month and now added this decoding algorithm to our PDF engine. Based on the information from the avast! Virus Lab logs, this new trick is currently used in only a very small number of attacks (in comparison to other attacks) and that is probably the reason why no one else is able to detect it. However, we have seen this nasty trick also being used in a targeted attacks.

Here are the links to VirusTotal showing the detection score:

• 18D1BA224B4FAA2296362F93231B6C4E7E488D8FEFC5A5408FE078AD20A55C08
• b1543cd42d03a93b143737d91540b08efffe027219136a59463f80e83222e743

In addition, we have found another 10 malicious PDF files based on the JBIG2Decode trick. All of them were actually detected using our heuristic detection JS:Pdfka-gen even if we did not actually decode the JBIG2 streams. In these cases, different objects (objects without a JBIG2Decode filter) have been marked as malicious parts. In summary, we can say that bad guys are using this trick to hide any possible object they want to be hidden (XFA forms, JS, TTF).

The following image shows an object which is encoded using the JBIG2Decode filter, but this time the object contains specially crafted font (TTF) file which exploits CVE-2010-2883 vulnerability.

TTF font hidden under JBIG2 stream

The image above contains only two (the source PDF contains many more) objects. Object 12 (line 91 in the image) contains encoded data. After we decoded the content using all three filters (JBIG2Decode, ASCIIHexDecode, and FlateDecode) we got the malicious font file. But this object defined only the raw data, there had to be another object that defined the font itself and that’s the second object shown in the image – object 20 (line 162). This is the FontDescriptor which is used to specify the metrics and other parameters of custom embedded fonts. In this case, last parameter is the key to malicious font file – /FontFile2 12 0 R, a reference to the previously defined object.

Here is the link to VirusTotal showing the detection score:

• 05f64217ebc380a9c398d72ec7743beda29bffed5694671aebca78aa6c3b5822

I’m not happy to see another trick based on a glitch in the PDF specification. What should we expect to happen next?

For more goodies, come attend our talk in Prague at the CARO 2011 Workshop. (link)

Virus:W32/Ramnit is no stranger to many malware analysts/researchers, as it was in the wild back in 2010.

Other malware researchers have blogged about the technical details of this interesting virus (here and here, for example); however there are still some noteworthy techniques — and an “easter egg” — waiting to be discovered.

One of the interesting techniques is the injection method that Ramnit uses. This differs from the traditional method, in which a virus would create a suspended thread and inject code using a memory writing Windows API function, then resume the suspended thread after the injection is done.

In this case, what makes Ramnit different is that it calls a Windows API function to spawn a new process, either the default web browser process or the Generic Host Process for Win32 Services, also known as svchost.exe. By injecting into this newly spawned process, the code is not visible to users and able to bypass the firewall.

Before this happens though, Ramnit installs an inline hook in an undocumented Windows native system service called Ntdll!ZwWriteVirtualMemory. The picture below depicts how this injection works:

The hooked Windows native system service redirects the code execution flow to the module defined in the caller process to perform the code injection routine. The injected code in the new process includes the capability for file infection (Windows executable and HTML files), as well as backdoor and downloader functionalities.

Another noteworthy detail in Ramnit is its “easter egg”, found in the DLL that it injects to the processes mentioned above. The code snapshot below should explain everything:

Basically, this easter egg navigates to the registry key and looks for “WASAntidot”:

When we try to create “WASAntidot” registry key on a test machine, we see this:

Voila! The machine is safe from Ramnit infection now!

Threat Solutions post by — Wayne

On 08/04/11 At 08:42 AM

March 2, 2011

The main malicious trends of the previous months persisted in February. Windows blockers and banking password stealers, where the latter ones worked together with fake anti-viruses, constituted a large portion of malicious traffic.

Windows blockers

The idea of extortionist Trojan horses blocking access to Windows has turned out to be a long-lasting one. During its evolution virus makers tried several money transfer options and technological solutions, some rather unexpected, including blocking the loading of Windows from the Master Boot Record.

Several Trojan.Winlockprograms featuring different block screen designs were discovered in February 2011. Apart from their new appearance, the blockers employed new tricks, making their analysis more difficult, and used more complex encryptors to disguise their executables. One such encryptor, popular with Trojan.Winlock writers, adds a specific icon into the executable making it easier to distinguish visually:

Since the scheme’s implementation is so simple and efficient, blockers are unlikely to dwindle away. On the contrary, more sophisticated variations of this ransomware are likely to be discovered in the nearest future.

Encoders

Encoders were another type of ransomware that came into the spotlight in February. The author of Trojan.Encoder changed the encryption algorithm several times, but the number of corresponding Trojan horse modifications found in the wild didn’t change. Doctor Web develops and maintains decoding utilities, enabling users to regain access to files compromised by Trojan.Encoder.

Bank account theft

A handful of account money stealers similar to the notorious Trojan.PWS.Panda, a.k.a. Zeus, entered February 2011’s malicious “top 10”. All these programs are modifications of the same viral prototype. The Trojan horse uses a comprehensive list of addresses of online banking systems. They include Russian, Italian, American, and German systems:

• libertyreserve.com
• perfectmoney.com
• laiki.com
• bankofcyprus.com
• commbank.com.au
• suncorpbank.com.au
• stgeorge.com.au
• online.westpac.com.au
• anz.com
• sparkasse.de
• commerzbanking.de
• finanzportal.fiducia.de
• deutsche-bank.de
• targobank.de
• postbank.de
• csebo.it
• poste.it
• gruppocarige.it
• cedacri.it
• payment.ru
• ibank.alfabank.ru
• chase.com
• capitalone.com

Some Trojan horses of this family are detected by Dr.Web as Trojan.DownLoader2. Their additional payload includes downloading fake anti-viruses (Trojan.FakeAlert) and backdoors.

Mobile platforms

February saw a significant increase from January in the number of Trojan horses for Android. Android.SmsSend are written in Java, and their only feature is sending paid short messages at short codes such as 6008.

Only one sample of the Trojan horse was detected in January, but in February this figure increased to six which would suggest that it is only a matter of time before more dangerous and complex Trojan horses for this platform emerge.

Other threats

Other notable threats include new modifications of Win32.Virut and variations of mail worms Win32.HLLM.NetSky and Win32.HLLM.MyDoom, traditionally found in large numbers in mail traffic.

Developers of the Trojan.WinSpy botnet updated components of their bot software twice in February. Changes delivered with the updates mainly concerned encryption routines for the sfcfiles.dll file.

The virus analysts also noted reduced activity of worms spread over removable data storage devices (Win32.HLLW.Autorunner).

Viruses detected in February in mail traffic

31.01.2011 00:00 – 28.02.2011 17:00
1	Trojan.DownLoad2.20306	1059280 (9.63%)
2	Trojan.DownLoader2.265	1016989 (9.24%)
3	Win32.HLLM.MyDoom.33808	953395 (8.66%)
4	Win32.HLLM.Netsky.18401	678289 (6.16%)
5	Trojan.DownLoader2.1901	644263 (5.85%)
6	Trojan.DownLoader2.2035	573250 (5.21%)
7	Trojan.DownLoad1.58681	525054 (4.77%)
8	Trojan.DownLoader2.2977	494250 (4.49%)
9	Trojan.Packed.20878	378395 (3.44%)
10	Win32.HLLW.Texmer.51	362861 (3.30%)
11	Trojan.MulDrop.64589	339687 (3.09%)
12	Trojan.DownLoad.41551	314629 (2.86%)
13	Win32.HLLM.Netsky.35328	298101 (2.71%)
14	Trojan.Oficla.zip	278088 (2.53%)
15	Trojan.DownLoader2.10188	232049 (2.11%)
16	Trojan.Packed.20312	231918 (2.11%)
17	Trojan.DownLoader2.4077	159628 (1.45%)
18	Trojan.PWS.Siggen.12160	146696 (1.33%)
19	Trojan.Oficla.38	131266 (1.19%)
20	Win32.HLLM.Beagle	127493 (1.16%)

Total scanned:	59,150,116,249
Infected:	11,084,834 (0.02%)

Viruses detected in February on users’ computers

31.01.2011 00:00 – 28.02.2011 17:00
1	Win32.HLLP.Whboy.45	12975162 (27.37%)
2	Win32.HLLP.Neshta	10063066 (21.23%)
3	Win32.HLLP.Novosel	6035651 (12.73%)
4	Trojan.Click.64310	5389563 (11.37%)
5	Win32.Siggen.8	1751123 (3.69%)
6	HTTP.Content.Malformed	1123179 (2.37%)
7	Win32.HLLP.Rox	1084446 (2.29%)
8	Win32.HLLP.Liagand.1	722176 (1.52%)
9	Win32.HLLP.Whboy	608324 (1.28%)
10	Win32.Sector.22	584357 (1.23%)
11	Win32.Virut	574516 (1.21%)
12	Trojan.MulDrop1.48542	533769 (1.13%)
13	Win32.Sector.20480	380038 (0.80%)
14	Win32.HLLW.Shadow.based	261680 (0.55%)
15	Win32.Antidot.1	246844 (0.52%)
16	Exploit.Cpllnk	233278 (0.49%)
17	Win32.Virut.56	214383 (0.45%)
18	Win32.HLLW.Autoruner.18959	151085 (0.32%)
19	Trojan.DownLoad.32973	144293 (0.30%)
20	Win32.HLLW.Autoruner.11962	132218 (0.28%)

Total scanned:	128,616,744,271
Infected:	47,509,667 (0.04%)

Usually, if we talk about virus and antivirus, it is more or less connected with detections. So if I say a malware uses antivirus to do bad things, will that be interesting?

Recently, AVG caught a kind of StartPage malware which uses Kingsoft WebShield as part of itself to achieve its aim.

Kingsoft is one of the most popular antivirus companies in China. Its web shield is desgined to protect users from phishing and injected websites to surf on line safely. It has two well known functions, locking IE’s homepage and page redirection, which are just what the malware take advantage of.

This malware combines modules from Kingsoft:

It would be clearer if we have a look at the digital signatures:

And modified configuration files:

Where kws.ini contains homepage settings, of course filled with faked URLs as you can see in this detail:

And Spitesp.dat which contains the list of URLs that is used for homepage redirection. That means, if you try to access these URLs, you will be redirected to the homepage or a certain URL prior configured:

Just take a look at these URLs. We can see that some of the popular internet websites are also included.

So how does this malware uses Kingsoft WebShield to do bad things?

Actually, this malware is packed in NSIS package (Nullsoft Install System). Below is script decompiled from the package by AVG engine.

First of all, we can see that this malware will search the process named ‘KSWebShield.exe’ which means the Kingsoft WebShield is already running. If it finds out, it will stop and remove the Kingsoft WebShield service.

Second, the malware will drop the needed Kingsoft WebShield modules into directory below:

Third, it will drop the configuration files, mentioned previously, into folder from which Kingsoft WedShield will read the settings by default:

At last, this malware will run a batch file to install and run the Kingsoft Web Shield service:

So far, the Kingsoft WebShield which has been configured malicious took effect. That means, your browsers’ homepages are faked and you will be redirected to the faked homepage if you try to access the URLs listed in the configuration file.

Kingsoft WebShield is a powerful browser protector. Maybe because of its power, it attracts malwares’ interest. Unluckily, malwares can just change the configuration files to take advantage of this power to do bad things. Is this a warning to others?

Jason Zhou & Hynek Blinka

 

Search engine redirection is usually one of the side effects of malicious software. This problem remains even after Trojans or fake antivirus are removed from the infected system.  No matter what site they search for, users experience a redirection of search results and web pages to affiliated websites.

In the infected system shown below, all the results from Google searches redirect to one of these domains:

• “00ee.r.google.com”
• “cbdd.r.google.com”
• “cab7.r.google.com”
• “99db.r.google.com”

Note that the redirection also affects other search engines such as Yahoo, Bing and others.

Users who notice the Google link will probably assume that this is some form of legitimate Google redirect.  In addition most URL filtering solutions will allow access to any URL that is part of the Google domain.  The links lead to sites hosting malware or spam.

How does this work?

The remnants of the Trojan infections found in the computer are the following registry entries:

• HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\ <CLSID of the network card>
• NameServer = 93.188.163.130,93.188.160.80
• DhcpNameServer = 93.188.163.130,93.188.160.80

Effectively all domains are resolved into IP addresses by the rogue DNS server defined in the registry entries above.  The DNS server IP address above belongs to Promnet Ltd. in the Ukraine.  We recommend blocking DNS traffic to: 93.188.163.0 – 93.188.164.255 and 93.188.160.0 – 93.188.160.255.

The search redirection process happens like this:

1. User does a search at Google.com
2. The “rogue DNS” causes the search request to go to “bad server”
3. “Bad server” does a real Google search on behalf of the original requesting PC
4. “Bad server” sends back the real Google results page but switches the real URLs with fake destination URLs like 00ee.r.google.com
5. User clicks on link and goes to 00ee.r.google.com (resolved by “rogue DNS”).  On this page there is malware or spam

The URLs listed above such as 00ee.r.google.com do not really exist and will not be resolved by genuine DNSs.

Querying the Google public DNS shows no result:

• ;; QUESTION SECTION:
• ;00ee.r.google.com.             IN      A
• ;; Got answer:
• ;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 16615
• ;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0

But, querying the rogue DNS (93.188.163.130) does provide a result:

• ;; QUESTION SECTION:
• ;00ee.r.google.com.             IN      A
• ;; Got answer:
• ;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 58738
• ;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 0
• ;; ANSWER SECTION:
• 00ee.r.google.com.      600     IN      A       67.210.15.54

In other words the rogue DNS entry results in:

• “Damaged” search results with fake URLs
• Resolution of those fake URLs to send users to sites with malware or spam

Restoring the DNS setting is the solution to the problem:

1.  Go to the “Network Connections” window

For Windows 7

• Go to Start > Control Panel > Network and Internet > Network and Sharing Center.
• In the left-hand column, click Change adapter settings.
• A new screen will open with a list of network connections.

For Windows Vista

• Go to Start > Control Panel > Network and Internet > Network and Sharing Center.
• In the left-hand column, click Manage network connections.
• A new screen will open with a list of network connections.

For Windows XP

• Go to Start > Control Panel > Network Connections.

2.  Right-click Local Area Connection or Wireless Network Connection and select “Properties”.

3.  Select Internet Protocol (TCP/IP), and then click Properties.

4.  If you want to obtain DNS server addresses from a DHCP server, click “Obtain DNS server address

automatically”.

5. If you want to manually configure DNS server addresses, click “Use the following DNS server

addresses”, and then type the preferred DNS server and alternate DNS server IP addresses in the

“Preferred DNS server” and “Alternate DNS server” boxes.

February 1, 2010

In January 2010 a large number of user requests regarding neutralization of active infections related to Trojan.Winlock programs while the vast majority of fraud schemes employed by cyber-criminals in January were based on paid short messages. The last month also saw introduction of new malware spreading techniques and more sophisticated monetizing methods employed by cyber-criminals for money-laundering.

Windows blockers

The wide spreading of a variety of Trojan.Winlock programs became the most noticeable event of January. In a compromised system this malicious program displays its own window on top of all other windows and won’t close it unless an unlock code is entered. It also disrupts operation of some programs installed on the machine. Criminals offer a victim to retrieve an unlock code by means of a paid SMS. In January the SMS charge varied between EURO 7-14 per each computer.

The statistics server of Doctor Web registered over 850 000 instances of detection of Trojan.Winlock in systems protected by Dr.Web software (Dr.Web Enterprise Suite and Dr.Web anti-virus service included). This figure is 2.15 times larger than the number registered in December 2009 and 23.4 higher than in November 2009 thus indicating the ongoing epidemics in Russia and Ukraine. In the last month several millions of users got infected by this malicious program.

The epidemic caused a stir in the Russian-speaking internet community with providers of short numbers offering unlocking codes free of charge and anti-virus vendors supplying users with free tools to counter Trojan.Winlock programs.

On January 22 Doctor Web set up a special web-page for generation of unlocking codes (over one million visits to the page were registered in a week). Doctor Web also released several versions of Dr.Web CureIt! designed specifically to neutralize such Trojans.

SMS-fraud

Easy monetizing of profits generated by paid SMS served as a good incentive for many cyber criminals. Along with blockers of Windows numerous web-sites were created to promote non-existing services and software with incredible features.

Users were offered online fake anti-viruses that found the same viruses in the same files on all machines, ICQ and SMS sniffers, remote mobile phone control, see-through scanners allowing to see people nude and other similar programs.

Typically users paid for such services and software with short messages. However, as telecom operators and police started to monitor SMS payment systems closely in the face of the winlock epidemic, using such systems has become troublesome for criminals. That’s why they reintroduced means of payments they used before (e.g. WebMoney) and invented new fraud schemes.

New ways for monetizing illegal money

Another scheme that has been gaining popularity among fraudsters in January allows criminals to withdraw funds from accounts of users of mobile phones. Users enter their phone numbers on a web-site that promoted a service and receive short messages with a link for activation of their subscriptions. Once activated, the service charge is withdrawn from an account automatically.

The malicious design allows a person to submit someone else’s number on the web-site while messages with an activation link don’t explain to a user what the service is about, instead, they provide misleading information to encourage the user to click on the link even if he doesn’t mean to subscribe for a service. For example, a message can say that the link will lead the user to an image or a video clip.

In recent weeks criminals have also offered users to pay for services with a paid call that has a minimum duration limit.

New ways to spread malware and spam

In January virus makers used new means to deliver malicious programs to user machines. In particular, Doctor Web virus analysts registered a spam mailing with messages containing attached torrent-files for downloading supposed e-cards that in truth were malicious programs. Mail servers do not block such messages since attached torrent-files do not contain malicious code.

Spammers also adopted new ways to transfer large amounts of data. Spam mailings were registered where e-mails contained attached mp3 files providing around 60 minutes of playback. Users also received messages with links to video clips located on web-sites of cyber-criminals and available on YouTube.

Below you can find a few tips that may help you prevent infection of your system by Trojan.Winlock programs or by other similar pieces of malware

1. Install a licenses anti-virus application and updated as recommended by the vendor.
2. Use alternative web-browsers (Mozilla Firefox, Opera or Google Chrome) and install corresponding security updates as they released by developers.
3. Install latest security updates for your operating system as soon as they are released.
4. Do not use services promoted by web-sites displayed as ad pop-ups – such pop-ups are at risk.
5. If you are offered to download a codec or any other software to view content of the web-site, decline the offer and search for the official web-site of the codec’s developer, download it and install on your computer. In many cases Trojan.Winlock programs are downloaded as software required for viewing content of web-sites.

Trojan.Winlock curing recommendations

If a window with a message demanding to send an SMS at a short number is displayed on top of other windows, won’t close and appears even when the system is started in the safe mode, your system has been infected by one of the modifications of Trojan.Winlock.

1. Under no circumstances should you send messages as demanded by criminals. Every sent message provides criminals with financial support to develop new modifications of the malware.
2. Go to the unlocking page.
3. Download the special version of Dr.Web CureIt! and use the utility to cure your system of Trojan.Winlock.
4. Go to http://www.freedrweb.com/ и скачайте Dr.Web LiveCD and download Dr.Web LiveCD. Once the system is cured with Dr.Web LiveCD it is recommended to scan it again using Dr.Web CureIt!
5. Ask for assistance on the official forum of Doctor Web.
6. Contact the provider of the specified short number and ask for the unlocking code to be given to you free of charge since you have become a victim of cyber crime.

The number of malicious programs in e-mail traffic in January decreased by 30% compared with December 2009. The share of malicious files in the total number of files scanned on user machines dropped by 35%. Most probably this decline is a correction following two times increase of malicious traffic among scanned objects.

Viruses detected in e-mail traffic in January

01.01.2010 00:00 – 01.02.2010 00:00
1	Trojan.DownLoad.37236	13268129 (12.99%)
2	Trojan.DownLoad.47256	10044467 (9.84%)
3	Trojan.MulDrop.40896	7096903 (6.95%)
4	Trojan.Fakealert.5115	7023800 (6.88%)
5	Win32.HLLM.MyDoom.44	6490377 (6.36%)
6	Trojan.Packed.683	5749108 (5.63%)
7	Trojan.Fakealert.5238	5261760 (5.15%)
8	Win32.HLLM.Netsky.35328	4772813 (4.67%)
9	Trojan.DownLoad.50246	4051880 (3.97%)
10	Trojan.Botnetlog.zip	3758307 (3.68%)
11	Trojan.Fakealert.5825	3442880 (3.37%)
12	Trojan.Fakealert.5437	2517200 (2.47%)
13	Win32.HLLM.MyDoom.33808	2392000 (2.34%)
14	Trojan.Fakealert.5356	2281720 (2.23%)
15	Trojan.Fakealert.5784	1973160 (1.93%)
16	Trojan.PWS.Panda.122	1851377 (1.81%)
17	Trojan.Fakealert.5229	1835120 (1.80%)
18	Trojan.Fakealert.5457	1607760 (1.57%)
19	Trojan.Siggen.18256	1526581 (1.49%)
20	Win32.HLLM.Beagle	1505664 (1.47%)

Scanned:	139,350,636,730
Infected:	102,115,886 (0.07%)

Viruses detected on user machines in January

01.01.2010 00:00 – 01.02.2010 00:00
1	Win32.HLLM.MyDoom.49	4020788 (16.80%)
2	Win32.HLLM.Netsky.35328	1637229 (6.84%)
3	Win32.HLLW.Gavir.ini	1081250 (4.52%)
4	Trojan.WinSpy.440	1053086 (4.40%)
5	Trojan.AppActXComp	907785 (3.79%)
6	Trojan.AuxSpy.137	734318 (3.07%)
7	Win32.HLLM.Beagle	656944 (2.74%)
8	Win32.HLLM.MyDoom.33808	646730 (2.70%)
9	Trojan.PWS.Gamania.23481	623699 (2.61%)
10	Trojan.MulDrop.16727	584477 (2.44%)
11	Win32.HLLW.Shadow	513252 (2.14%)
12	Win32.Virut.5	493248 (2.06%)
13	Win32.HLLW.Shadow.based	380166 (1.59%)
14	Trojan.MulDrop.13408	325488 (1.36%)
15	JS.Popup.1	316857 (1.32%)
16	Win32.Virut.14	295463 (1.23%)
17	Win32.HLLW.Kazaa.17	263143 (1.10%)
18	Win32.Alman.1	261298 (1.09%)
19	Exploit.MySql.11	260470 (1.09%)
20	Trojan.Winlock.715	256356 (1.07%)

Scanned:	169,874,198,147
Infected:	23,938,315 (0.01%)

September 3, 2010

The last month of summer abounded with virus news. It saw the forecast for a 64-bit Windows rootkit come true, the emergence of new modifications of malware for Android, and a surge of criminal activity involving the use of social engineering techniques designed to lure users into malicious schemes on web sites and via instant messengers. Countermeasures taken against Windows blockers yielded long-awaited results, as a first criminal investigation regarding the use of blockers was officially launched in Russia.

Rootkit for 64-bit systems

As our 2009 virus activity review predicted, the first rootkit for 64-bit systems made its debut. The new version of BackDoor.Tdss brought new challenges to security software developers.

Windows operating systems for the 64-bit platform feature defence mechanisms that prevent the installation of malicious drivers — the system checks whether the driver has a digital signature while the PatchGuard technology doesn’t allow malware to modify the OS kernel. However, the new BackDoor.Tdss successfully bypasses the obstacles by means of a bootkit, which, once installed, allows the backdoor to modify the MBR and take control of the operating system loading process. It allows the rootkit driver to be installed in the system before the defence mechanisms are activated.

Currently the Dr.Web virus database contains entries that allow the anti-virus to detect various modifications of the new BackDoor.Tdss. On September 1, 2010, Doctor Web released its updated GUI Scanner for 32-bit systems. Development of a 64-bit version of the Dr.Web Shield anti-rootkit is underway; it will be made available to all Dr.Web users shortly.

Malicious programs for Android

On August 26, Doctor Web released a new product — Dr.Web for Android. It came out at just the right moment, with entries for several modifications of Android.MobileSpy programs and Android.SMSSend.2 added into the Dr.Web virus database. Android.SMSSend.2 is a malicious program that sends paid short messages from a compromised device without its owner’s consent.

None of the known malicious programs for Android is capable of self-replication. This means that users must be lured into installing such programs into their systems. Yet all of them pose a threat to personal information stored on devices as well as to users’ cell phone accounts.

Despite the fact that prior to installation a user is informed about which Android features the application is going to use, criminals resort to various social engineering techniques to make a victim disregard such messages. Malicious programs are offered to users as games, screen savers, and applications that disguise their malicious intentions behind harmless features. Spyware can also be installed if an intruder gets access to a device belonging to a careless user.

Pay to extract

In August, a large number of malicious sites with the same look and feel as popular web sites specializing in film, song and e-book archives were discovered.

These malicious sites allow a user to download an 8-16 megabyte executable file, the likes of which are detected as Trojan.SMSSend modifications by Dr.Web. The files look like self-extracting archives, and launching such files brings up a window supposedly displaying how the extraction is progressing. However, at a certain moment, the progress bar stops and the user is prompted to send a paid short message from his mobile phone in order to complete the process. Ultimately the user is deceived twice –several hundred roubles are debited from the mobile account and no useful information is found in the archive.

Criminals resorting to such fraud create sites featuring design elements resembling known Internet services (Google, Yandex) or popular software products (WinRAR) which violates the copyright of the owners of these brands.

Trust, but verify!

In August, two intrusion schemes showed how easily a user can be tricked into launching a malicious program. In both cases victims received messages supposedly from their trusted contacts, who in turn were also victims of the malicious schemes.

On August 16, Win32.HLLW.Natchswas spread over ICQ. The program ends operation of popular ICQ clients, retrieves an ICQ account password, connects to a server using the account information and sends itself to contacts on the list of the compromised account. Win32.HLLW.Natchs can also maintain a simple conversation with a potential victim and transfer its files via the ICQ protocol instead of offering a download link. These abilities added credibility to malicious messages.

On August 30, spam messages were reportedly being distributed among Facebook users. Messages contained a link to a specifically designed application available on the social networking web site. The application exploited a Facebook vulnerability that allows messages to be sent to everyone on the “friends list” of the user who clicks on the link. With this act, criminals demonstrated the great malicious potential of applications uploaded onto social networking sites.

Doctor Web recommends that you exercise caution whenever you get a message with an attached executable file or containing a link to an unfamiliar web site even if such a message is from a trusted contact. If you’ve received such a message, you should contact the supposed sender by another means to make sure that he indeed sent the message.

Crime and punishment

In August, Moscow law enforcement agencies–for the first time in history–launched an official criminal investigation against extortionists who used Windows blockers (Trojan.Winlock programs as classified by Dr.Web). The criminals had been in operation for the previous 12 months. Law enforcement agencies hope that the investigation will be supported by the entire telecom community. For its part, Doctor Web thanks all users who provided information about the latest modifications of blocker programs.

Also last month, the number of detections of Trojan.Winlock dropped by 50 percent and reached 140,000 instances of detections per month. However, roughly 100 people a day are applying to Doctor Web for support in cases related to Internet fraud.

The top spots on this month’s rankings list of the most prolific blockers went to two modifications of Windows blockers, neither of which involved demanding payment via short messages. Instead users were offered to either have their money credited to a mobile phone account or transferred by means of electronic payment systems.

Other news

Exploit.Cpllnk–the program that exploits a Windows vulnerability to launch malware from removable data-storage devices–was the most frequently detected malicious program on user machines in August. However, incidences of its detection dropped in the last days of the month.

Users in Europe remained the targets of banking Trojans that resulted in tougher security measures being introduced. This involved entering a large number of single-use codes on Internet banking web sites to safeguard transactions. The number of such codes has increased from 20 to 40.

Fake anti-viruses (Trojan.Fakealert) spread in Europe as well as in Russia. European users were prompted to pay for a bogus anti-virus with their credit cards, while Russians were typically pushed into sending paid short messages. To compel Russian users into paying for the fake, images from adult-content web sites would be displayed, leading them to believe that malicious programs had entered their systems. It was claimed that the bogus anti-virus would help users eliminate such “infections”.

Client software for the Oficla botent (Trojan.Oficla) and Trojan.PWS.Panda password stealers were spread via e-mail.

September will most likely see more revelations regarding the 64-bit rootkit. Some anti-virus vendors will probably enhance their products with features that will allow them to cure systems of the rootkit. The number of ransomware species appears to be on the decline, while e-mail will most likely remain one of the basic means of spreading malware in the months to come.

Malicious files detected in mail traffic in August

01.07.2010 00:00 — 01.08.2010 00:00
1	Trojan.DownLoad.41551	245764 (13,62%)
2	Trojan.Packed.20312	212565 (11,78%)
3	Trojan.DownLoad1.58681	207763 (11,51%)
4	Trojan.Oficla.zip	198346 (10,99%)
5	Win32.Virut	126509 (7,01%)
6	Trojan.Packed.20878	81090 (4,49%)
7	Trojan.PWS.Panda.114	72949 (4,04%)
8	Win32.HLLM.Netsky.18401	58206 (3,22%)
9	Trojan.Oficla.38	51422 (2,85%)
10	Trojan.DownLoader1.17157	46564 (2,58%)
11	Win32.HLLW.Shadow.based	45415 (2,52%)
12	JS.Redirector.77	38610 (2,14%)
13	Win32.HLLM.MyDoom.33808	35934 (1,99%)
14	Trojan.MulDrop1.39520	33936 (1,88%)
15	Trojan.DownLoad2.14991	27392 (1,52%)
16	Trojan.Botnetlog.zip	25509 (1,41%)
17	BackDoor.Qbot.20	25469 (1,41%)
18	Trojan.PWS.Panda.387	23430 (1,30%)
19	Win32.HLLM.Beagle	21457 (1,19%)
20	W97M.Killer	21093 (1,17%)

Total scanned:	12,924,385,092
Infected:	1,804,893 (0,01%)

Malicious files detected on user machines in August

01.07.2010 00:00 — 01.08.2010 00:00
1	Exploit.Cpllnk	2323984 (18,74%)
2	Trojan.WinSpy.921	1371549 (11,06%)
3	ACAD.Pasdoc	992910 (8,01%)
4	Win32.HLLM.Dref	630531 (5,09%)
5	Trojan.Packed.19647	521687 (4,21%)
6	Win32.HLLP.Neshta	376117 (3,03%)
7	Trojan.WinSpy.922	348662 (2,81%)
8	Win32.Antidot.1	282339 (2,28%)
9	Win32.HLLP.PissOff.36864	258509 (2,09%)
10	Win32.HLLW.Gavir.ini	248243 (2,00%)
11	Win32.HLLW.Shadow.based	218202 (1,76%)
12	Trojan.Upload.40	215135 (1,74%)
13	Trojan.Siggen1.51459	212685 (1,72%)
14	BackDoor.IRC.Sdbot.4590	188934 (1,52%)
15	Trojan.AuxSpy.229	181195 (1,46%)
16	Win32.HLLW.Autoruner.5555	149215 (1,20%)
17	Win32.HLLW.Autoruner.11962	146271 (1,18%)
18	Trojan.Packed.20819	121070 (0,98%)
19	Win32.HLLP.Whboy.45	118002 (0,95%)
20	Win32.Sector.21	105532 (0,85%)

Total scanned:	65,191,497,071
Infected:	12,398,403 (0,02%)

October 4, 2010

September saw an overwhelming number of news posts proclaiming the start to a cyber war sparked by Trojan.Stuxnet and providing suggestions as to what the virus maker’s goals might be. Meanwhile, cyber fraudsters were busy testing atypical extortion techniques, botnet owners took advantage of network system administrator carelessness, and makers of malware for Android carried out “surgical strikes.”

Trojan.Stuxnet and politics

In September, news headlines screamed about Trojan.Stuxnet whose appearance attracted tremendous publicity due to the geographical extent of its impact. Many news posts related to the Trojan dealt mainly with politics and proposed that the makers of Trojan.Stuxnet aimed to disrupt the launch of a nuclear power plant in Iran. In the last days of September, media reports claimed that the Trojan had spread widely in China and was targeting Chinese companies. Amid such speculations little attention was paid to ethnological innovations employed by the virus makers. Yet some experts resorted to a linguistic analysis of the comments found in the Trojan’s code to discern what the goals of its makers really were

Trojan.Stuxnet is indeed a technologically advanced piece of malware that exploits several previously unknown Windows vulnerabilities. Politics aside, Doctor Web’s analysts consider the Trojan to be merely another piece of malware from which Dr.Web users must be protected. Currently there are a number of no less technologically advanced viruses in the wild, for example, the 64-bit version of Trojan.Tdss (a.k.a. TDL) for which curing routines are also diligently being developed.

Internet fraud

In September Doctor Web’s support service registered 124 requests concerning the inability to access Windows UI, web sites, or popular software. This was up from 107 such requests in the previous month of August.

At the same time, Windows blockers were being superseded by other fraudware. In particular, several Trojans discovered in September used new redirection techniques for browsers. Some Trojans made it impossible to use instant messaging applications.

As for converting their illegal income into actual money, in September cyber fraudsters preferred to receive money via cell phone account refills (around 25%) and paid short messages (around 70%).

As before Doctor Web offers free technical support to users who have fallen victim to cyber fraud.

Redirection

In the last month criminals adopted two new techniques for directing users to fake web pages. As always the techniques involved modifying the hosts file, but new technologies were also applied.

Trojan.Hosts.1581 made the browser display fake pages of a Russian bank’s web site, allowing criminals to receive remote account access parameters submitted by duped victims. It has also been discovered that this modification of Trojan.Hosts features a rootkit component that allows it to filter file operations and operations performed with the Windows Registry.

Trojan.HttpBlock programs used another tactic: they launched their own web server in an infected system and used it to display pages that mimicked popular web sites–particularly search engine pages. Here criminals demanded a ransom from users in exchange for allowing them to regain access to the sites.

IM blocker

Trojan.IMLock, which blocks the launch of popular instant messaging clients such as ICQ and Skype, was discovered at the end of September. Instead of launching a program, the Trojan displayed a message, mimicking the design of the blocked messenger and informing the user that he had to send a paid short message in order to regain access to his IM account. To neutralize the Trojan, simply check your system with the Dr.Web scanner.

Malicious web site for Android only

A new malicious program for Android (Android.SmsSend.2) was discovered in September. Its functionality differed little from that of its predecessors (e.g. it sent paid short messages from infected mobile devices), with the exception of one significant difference: The downloading of the Trojan was initiated only if a potential victim loaded a bogus web page onto a device that was running Android. Perhaps, criminals believed that such a selective approach would make it more difficult to discover the malicious site.

New botnet trends

At the end of September, Doctor Web’s analysts discovered a botnet comprised of computers on which the server side of Radmin software was installed and running. This software is the most widely used for remote administration. The malicious program that infects computers and connects them to the botnet was classified by Dr.Web as Win32.HLLW.RAhack.

However, a system would only get infected if an administrator password used to access Radmin was found on the worm’s list. It turned out that many administrators were using weak passwords.

As for trends that could develop in October 2010, they will most likely be related to fraudware and new malicious programs that substitute fake web pages for real ones when certain sites are accessed. This is because criminals have found such programs to be the most profitable. Owners of botnets, which are often used to spread malware, will keep trying to create such networks using non-standard software and hardware solutions since such approaches ensure that infection remains undetected.

Viruses detected in e-mail traffic in September

01.09.2010 00:00 – 01.10.2010 00:00
1	Trojan.DownLoad1.58681	337845 (11.46%)
2	Trojan.Oficla.zip	308357 (10.46%)
3	Trojan.Packed.20878	252490 (8.57%)
4	Trojan.Packed.20312	246976 (8.38%)
5	Trojan.DownLoad.41551	230637 (7.82%)
6	Win32.HLLM.Beagle	118139 (4.01%)
7	Win32.HLLM.MyDoom.33808	102740 (3.49%)
8	Trojan.PWS.Panda.114	90503 (3.07%)
9	Trojan.DownLoader1.17157	65819 (2.23%)
10	W97M.Killer	57658 (1.96%)
11	Win32.HLLM.Netsky.35328	52397 (1.78%)
12	Trojan.Oficla.38	49619 (1.68%)
13	Trojan.PWS.Panda.387	49478 (1.68%)
14	Trojan.Botnetlog.zip	43600 (1.48%)
15	Trojan.MulDrop1.39520	32908 (1.12%)
16	Trojan.DownLoader1.20708	26135 (0.89%)
17	BackDoor.Qbot.20	24706 (0.84%)
18	Trojan.DownLoad2.14991	24681 (0.84%)
19	Trojan.DownLoader1.23313	22101 (0.75%)
20	Exploit.Cpllnk	19668 (0.67%)

Total scanned:	22,631,101,955
Infected:	2,947,658 (0.01%)

Viruses detected on user machines in September

01.09.2010 00:00 – 01.10.2010 00:00
1	Trojan.Click.64310	8273098 (23.82%)
2	Win32.HLLP.Neshta	5135896 (14.79%)
3	Win32.HLLP.Whboy.45	3690668 (10.63%)
4	ACAD.Pasdoc	1977696 (5.70%)
5	Trojan.DownLoader.42350	1927627 (5.55%)
6	JS.Nimda	1370895 (3.95%)
7	Trojan.WinSpy.925	1300940 (3.75%)
8	Exploit.Cpllnk	1091703 (3.14%)
9	Win32.HLLP.Whboy.101	1042949 (3.00%)
10	Win32.HLLP.Rox	823512 (2.37%)
11	Win32.HLLW.Whboy	795502 (2.29%)
12	Win32.HLLM.Dref	620668 (1.79%)
13	Win32.Virut.56	561893 (1.62%)
14	Win32.Antidot.1	298586 (0.86%)
15	Win32.HLLW.Shadow.based	248724 (0.72%)
16	Trojan.Click1.6029	228104 (0.66%)
17	Trojan.AuxSpy.111	213306 (0.61%)
18	Trojan.Smorchok.334	151676 (0.44%)
19	Win32.Sector.12	145085 (0.42%)
20	Trojan.AuxSpy.13	136102 (0.39%)

Total scanned:	12,949,782,895,195,462
Infected:	34,724,949 (0.00%)

February 8, 2011

The year 2011 started with relative calm, and few traditional “holiday” surprises were observed. January, like earlier months, was dominated by malicious programs designed to generate profits through extortion and the theft of passwords to the accounts of e-banking systems and electronic cash systems.

Trojan encoders

The beginning of the year saw the emergence of new versions of Trojans that encrypted documents in infected systems and then offered users a special tool with which to decrypt them – for a price.

In particular, modifications of Trojan.Encoder.94 and Trojan.Encoder.96 were added to the Dr.Web virus database in January.

Please remember that unskilled users’ actions with encrypted files may cause irreparable harm to the data. Restoring systems, deleting temporary system files, and clearing the browser cache, etc., are not recommended; such actions can make it impossible to recover your data.

Also, do not pick out the first available tool for decryption; in such cases, the risk of corrupting files permanently is high. Instead, request assistance from the Doctor Web virus laboratory: select “cure request” as a request category, and attach a few pairs of encrypted and unencrypted documents to your request.

Windows blockers

In January, Windows blockers continued spreading to users systems, and these malicious programs have become more diverse. Programs discovered earlier were found along with new types of blockers.

In contrast with the demands displayed by earlier versions of the malware, the new blockers increased the ransom amount demanded to unlock systems.

In late January, Windows blockers were also spread through the LiveJournal site. By clicking on a link in a comment left by intruders, users were taken to a photo hosting site from which they were directed to an adult content website. There victims were invited to download an EXE-file that concealed Trojan.Winlock.

The gallery below shows screenshots of the most common Windows blockers in January.

General statistics of Internet fraud in January

In cases of Internet fraud, over the past month the average number of users requesting assistance from Doctor Web’s free technical support team reached 178, 8% more than in December 2010.

The number of support requests related to malicious programs that required the transfer of money to a mobile phone account increased to 80% (in November 2010, the number of such complaints was 60%, and in December – 70% of the total).

The number of appeals for assistance concerning Trojans that required users to recharge criminals’ mobile phone accounts using appropriate SMS-services rendered by mobile operators, rather than payment terminals, increased from 23% in December to 43% in January.

The number of support requests related to malware demanding that paid text messages be sent continued to fall, and in January 2011, it amounted to only 15% of all appeals.

Banking botnets

Intruders kept spreading botnet client software among Russian users of e-banking systems and electronic cash systems. Typically, each client modification was directed simultaneously at multiple targets, apparently in the hope that one of them might end up on an infected compute.

Doctor Web virus analysts registered the activity of several of these botnets, in particular WinSpy and IBank. Following criminals’ commands, infected computers regularly update their components that make up the “payload” of the botnet. Upgrading is necessary since fraudsters are forced to deal with the anti-virus products installed on users’ computers and because the specific objectives of criminals also tend to change through time.

Fake anti-viruses targeting Western Europeans were among January’s other significant threats. System Tool 2011 and Antivirus Scan topped the list of fakes. English-speaking Facebook users also came under attack. Trojan.MulDrop1.62295 was spread as a gift from user to user through spam messages sent over the social network.

Viruses detected in January in mail traffic

01.01.2011 00:00 – 01.02.2011 00:00
1	Trojan.DownLoad1.58681	592254 (9.31%)
2	Trojan.Packed.20878	426750 (6.71%)
3	Trojan.Oficla.zip	313652 (4.93%)
4	Trojan.MulDrop.64589	311774 (4.90%)
5	Trojan.DownLoad.41551	271184 (4.26%)
6	Trojan.Packed.20312	261419 (4.11%)
7	Trojan.Oficla.38	148062 (2.33%)
8	Win32.HLLM.Beagle	117539 (1.85%)
9	Trojan.AVKill.2788	113477 (1.78%)
10	Trojan.PWS.Panda.114	95805 (1.51%)
11	Trojan.PWS.SpySweep.17	92209 (1.45%)
12	W97M.Killer	87092 (1.37%)
13	Trojan.MulDrop1.54160	73523 (1.16%)
14	Trojan.DownLoader1.17157	69678 (1.10%)
15	Win32.HLLW.Autoruner.35407	60963 (0.96%)
16	Trojan.PWS.Panda.387	52532 (0.83%)
17	Trojan.Oficla.48	52257 (0.82%)
18	Trojan.Oficla.73	52254 (0.82%)
19	Trojan.AVKill.3097	46052 (0.72%)
20	Win32.HLLM.MyDoom.54464	45653 (0.72%)

Total scanned:	56,551,758,514
Infected:	6,363,080

Viruses detected in January on users’ computers

01.01.2011 00:00 – 01.02.2011 00:00
1	Win32.HLLP.Whboy.45	27057874 (43.80%)
2	Win32.HLLP.Neshta	13487529 (21.83%)
3	Win32.HLLP.Whboy.105	4525965 (7.33%)
4	Win32.HLLP.Rox	2224917 (3.60%)
5	Win32.Siggen.8	1583325 (2.56%)
6	Win32.HLLP.Novosel	1582034 (2.56%)
7	Win32.Antidot.1	1003419 (1.62%)
8	Trojan.Packed.21230	558842 (0.90%)
9	Win32.HLLP.Whboy	396674 (0.64%)
10	Win32.Sector.22	338383 (0.55%)
11	Trojan.MulDrop.54146	285091 (0.46%)
12	JS.Nimda	279705 (0.45%)
13	Win32.Virut.56	274936 (0.45%)
14	Win32.Virut.5	271705 (0.44%)
15	ACAD.Pasdoc	260004 (0.42%)
16	Win32.HLLW.Shadow.based	259855 (0.42%)
17	Trojan.DownLoad.32973	246686 (0.40%)
18	Trojan.MulDrop1.48542	243739 (0.39%)
19	Win32.Sector.21	208654 (0.34%)
20	Win32.Gael.3666	178199 (0.29%)

Total scanned:	127,566,192,623
Infected:	61,779,350

December 3, 2010

In November cyber-criminals demonstrated even greater creativity than before. As a result, anti-virus vendors and users were confronted with new fraud techniques involving bootkit technologies. New modifications of encoder Trojans targeted European users. Criminals seeking the biggest gains attacked online banking systems.

Windows boot blocker

As soon as Trojan.MBRlock.1 appeared in the wild in November, it was employed by cyber-fraudsters. This malicious program is unlike any other malware used to implement fraud schemes.

It bypasses the UAC protection mechanism, so its installation goes unnoticed by users. Once installed, the Trojan writes its code into the MBR and into other nearby disk sectors.

The code, written to the MBR, loads information from the neighbouring disk sectors. The result is a message to users demanding that they pay $ 100 to unlock their systems.

The message also informs a user that all of the files located on all of the computer’s disks are encrypted. This is not true.

In any event curing the Trojan-compromised system can’t be done from inside the system since it wouldn’t boot.

Entering a correct password restores the MBR after which the installed operating system boots normally.

Currently several modifications of Trojan.MBRlock.1 are known, but Dr.Web detects them as the same piece of malware.

To cure the system, enter an ekol or jail unlock code. If neither works, contact the free Doctor Web technical support service for victims of cyber-fraud.

Certain modifications of Trojan.MBRlock.1 had been detected by the Dr.Web heuristic analyzer as MULDROP.Trojan before a corresponding entry was added to the Dr.Web virus database. Dr.Web users were protected from the Trojan even when no virus definitions for this malicious program were available.

New Trojan encoder

Encoder Trojans drew the public’s attention once again in November. This time criminals targeted European users.

Trojan.Encoder.88 uses the AES-256 encryption algorithm to encrypt documents in many popular formats which complicates decryption. To search all possible decryption keys for one that would help restore files on a single computer, 2^256 operations are required. The resulting number exceeds the number that ends in 77 zeros.

A unique encryption key is generated for each compromised machine. It is encrypted using the RSA algorithm and saved to a disk as a text file.

Origins Tracing technology enabled Dr.Web to detect Trojan.Encoder.88 as Trojan.Encoder.origin even before an entry for this program was added to the database.

Fraud in November: winlocks returned

In November the free technical support service received around 4,700 requests from cyber-fraud victims which constituted 42% of all requests. The daily average of requests amounted to 146 which exceeded the October figure by one third.

Trojan.Winlock became the most widely spread malicious program used for fraud (73% of all requests). A significant number of fraud incidents were related to Trojan.Hosts that blocked access to popular web resources.

Criminals also changed routines for converting their profit into actual money. Malicious programs demanding that users send paid short messages were less popular in November, and the number of requests related to such programs reached only 31% of the total. Meanwhile the option that involves paying criminals via terminals became more appealing to fraudsters (60% of all requests).

Banking Trojans on the offensive

November saw the emergence of new Trojans targeting users of online banking systems, both individuals and businesses.

In particular, several modifications of Trojan.PWS.Ibank.213 were added to the Dr.Web virus database.

Variations of the Trojan serve as containers of malicious payloads. Their most harmful feature is their ability to disable security software components. The Trojan can detect whether it is being launched in a virtual environment where it can be safely analyzed. Disabling the system restore service is also among its malicious capabilities.

To collect the information required to access bank accounts online, the Trojan intercepts certain system routines as well as functions of online banking systems, and stores information entered by a user with a keyboard. The fact that Trojan.PWS.Ibank.213 can communicate with a remote server, and download and launch executable files, shows that systems compromised by this program become nodes of a botnet.

November 2010 showed that criminals can make use of various malicious programs to accomplish a wide variety of tasks. When it comes to neutralizing them, anti-viruses capable of protecting a system from all kinds of malware and of curing it proved to be the most efficient. Yet, it is users who still remain the weakest element of the computer defense system. Doctor Web would like to emphasize once again that following basic information security rules dramatically reduces the probability of system infection.

Viruses detected in e-mail traffic in November

01.11.2010 00:00 – 01.12.2010 00:00
1	Trojan.DownLoader.62844	887472 (16.61%)
2	Trojan.DownLoad1.58681	560304 (10.49%)
3	Trojan.Packed.20878	409498 (7.67%)
4	Win32.HLLW.Texmer.51	386408 (7.23%)
5	Win32.HLLM.Netsky.18401	317070 (5.93%)
6	Trojan.Oficla.zip	296642 (5.55%)
7	Win32.HLLM.MyDoom.33808	270438 (5.06%)
8	Trojan.Packed.20312	246743 (4.62%)
9	Trojan.DownLoad.41551	231569 (4.33%)
10	Trojan.Oficla.38	139866 (2.62%)
11	Win32.HLLM.Netsky.35328	121814 (2.28%)
12	Trojan.AVKill.2788	103700 (1.94%)
13	Win32.HLLM.Beagle	98470 (1.84%)
14	Trojan.PWS.Panda.114	90471 (1.69%)
15	W97M.Killer	74444 (1.39%)
16	Trojan.DownLoader1.17157	65832 (1.23%)
17	Trojan.PWS.Panda.387	49461 (0.93%)
18	Trojan.Oficla.73	49351 (0.92%)
19	Trojan.Oficla.48	49342 (0.92%)
20	Trojan.Botnetlog.zip	41304 (0.77%)

Total scanned:	40,984,945,769
Infected:	5,342,395

Viruses detected on user machines in November

<

01.11.2010 00:00 – 01.12.2010 00:00
1	Win32.HLLP.Neshta	7665428 (24.91%)
2	Win32.HLLP.Whboy.45	6184396 (20.09%)
3	Trojan.DownLoader.42350	2364188 (7.68%)
4	Win32.HLLP.Novosel	1644766 (5.34%)
5	Win32.HLLP.Rox	1177270 (3.82%)
6	Trojan.Click.64310	727694 (2.36%)
7	ACAD.Pasdoc	610404 (1.98%)
8	Win32.HLLM.Dref	520690 (1.69%)
9	Exploit.Cpllnk	413622 (1.34%)
10	VBS.Redlof	320729 (1.04%)
11	Trojan.WinSpy.925	284258 (0.92%)
12	Win32.HLLW.Shadow.based	278980 (0.91%)
13	Trojan.PWS.Ibank.238	252705 (0.82%)
14	HTTP.Content.Malformed	244692 (0.80%)
15	Trojan.MulDrop1.48542	183156 (0.60%)
16	Trojan.Click1.6029	180330 (0.59%)
17	Win32.Sector.22	142436 (0.46%)
18	Win32.HLLW.Kati	121106 (0.39%)
19	Trojan.DownLoad.32973	114280 (0.37%)
20	Win32.HLLW.Autoruner.5555	100817 (0.33%)

Total scanned:	92,810,136,138
Infected:	30,778,334

Is this for real?

An Australian newspaper reports that a 93-year-old woman has been scammed by criminals who rang her up, pretending to be Microsoft, and told her that she had a virus infection on her computer.

These scams, of course, are nothing new and we’ve warned users about them before.

The reason why this one caught my eye is the tall story that the criminals used to fleece Ailsa Hamblin, of Mornington Peninsula near Melbourne.

According to the media reports:

Mrs Hamblin was told recent heavy rain and storms had caused more computer viruses to circulate.

Yes, you read that right.

They said that bad weather could help computer viruses to spread. (Is this some kind of cloud-based security issue? Maybe they meant the Storm virus?)

And what’s more (and seemingly without any pun intended), the report continues:

"It's high-pressure salesmanship," Mrs Hamblin said.

Meteorological jokes aside, we have to recognise that these fake tech support calls claiming that PCs beloning to computer users have fallen foul of malware are a significant problem.

As Sophos explained in a recent podcast, it can be hard for vulnerable people to tell the difference between a legitimate phone call and someone trying to scam you:

(Duration 6:15 minutes, size 4.5MBytes)

Make sure that your family and friends are on their guard against suspicious tech support calls telling them about infections on their computer – even if the callers do claim to be from Microsoft. It only takes a lapse of common sense for you to hand your credit card details straight down the line to a criminal.

Oh, and read the full story over on the Herald Sun website of how scammers are using the weather as an excuse for malware infections.

Full story: Naked Security – Sophos

This test result arrived just now from the Virus Bulletin.   For easier presentation I have extracted the results, plot it in graph and listed based on the On-Demand score.     A picture is worth a thousands words so have a look to save me the writing.   Note: none of the top 5 brands had any FPs.

Full story: avast! blog

It’s now January 2011. Which means the Brain virus is now 25 years old

Brain, spreading on 5.25″ floppy disks was the first PC virus.

Which means that the PC virus is now 25 years old.

So, what did brain do? Let’s look at our virus description database, which – of course – has a description of the virus.

As you can see, the Brain virus contains contact information for “Basit and Amjad” in Lahore, Pakistan.

Due to this 25 year milestone, I’ve decided to go to Lahore, Pakistan. I’ll go there to find Basit and Amjad, and I’ll speak with them about how they feel about the phenomenon they started.

Of course, writing a boot sector virus in 1986 was a completely different thing than writing, say, a banking trojan in 2011. For one, writing viruses was not illegal in 1986. People did not know at the time if writing viruses was a bad idea. We learned that later.

But it just boggles to mind to think about how much has happened in these 25 years.

So, what would you like to ask from the writers of the very first PC virus?

Post your suggestions to our blog comments. I’ll take the best ones with me to Lahore.

Yours,
Mikko

On 24/01/11 At 01:52 PM

Full story: F-Secure Antivirus Research Weblog

CSA DISCLAIMER: This video taken from YouTube. As well as any other video found on this site is not hosted here, it just embedded, and it taken randomly by our system from video hosting services like YouTube, Metacafe, and others. Therefore, we are not responsible for any copyright violations, video materials, hacking or cracking activities, or any other. If you have any legal issues, please contact the appropriate host site.

DrWeb – In November cyber-criminals demonstrated even greater creativity than before. As a result, anti-virus vendors and users were confronted with new fraud techniques involving bootkit technologies. New modifications of encoder Trojans targeted European users. Criminals seeking the biggest gains attacked online banking systems.

Windows boot blocker

As soon as Trojan.MBRlock.1 appeared in the wild in November, it was employed by cyber-fraudsters. This malicious program is unlike any other malware used to implement fraud schemes.

It bypasses the UAC protection mechanism, so its installation goes unnoticed by users. Once installed, the Trojan writes its code into the MBR and into other nearby disk sectors.

The code, written to the MBR, loads information from the neighbouring disk sectors. The result is a message to users demanding that they pay $100 to unlock their systems.

The message also informs a user that all of the files located on all of the computer’s disks are encrypted. This is not true.

In any event curing the Trojan-compromised system can’t be done from inside the system since it wouldn’t boot.

Entering a correct password restores the MBR after which the installed operating system boots normally.

Currently several modifications of Trojan.MBRlock.1 are known, but Dr.Web detects them as the same piece of malware.

To cure the system, enter an ekol or jail unlock code. If neither works, contact the free Doctor Web technical support service for victims of cyber-fraud.

Certain modifications of Trojan.MBRlock.1 had been detected by the Dr.Web heuristic analyzer as MULDROP.Trojan before a corresponding entry was added to the Dr.Web virus database. Dr.Web users were protected from the Trojan even when no virus definitions for this malicious program were available.

New Trojan encoder

Encoder Trojans drew the public’s attention once again in November. This time criminals targeted European users.

Trojan.Encoder.88 uses the AES-256 encryption algorithm to encrypt documents in many popular formats which complicates decryption. To search all possible decryption keys for one that would help restore files on a single computer, 2^256 operations are required. The resulting number exceeds the number that ends in 77 zeros.

A unique encryption key is generated for each compromised machine. It is encrypted using the RSA algorithm and saved to a disk as a text file.

Origins Tracing technology enabled Dr.Web to detect Trojan.Encoder.88 as Trojan.Encoder.origin even before an entry for this program was added to the database.

Fraud in November: winlocks returned

In November the free technical support service received around 4,700 requests from cyber-fraud victims which constituted 42% of all requests. The daily average of requests amounted to 146 which exceeded the October figure by one third.

Trojan.Winlock became the most widely spread malicious program used for fraud (73% of all requests). A significant number of fraud incidents were related to Trojan.Hosts that blocked access to popular web resources.

Criminals also changed routines for converting their profit into actual money. Malicious programs demanding that users send paid short messages were less popular in November, and the number of requests related to such programs reached only 31% of the total. Meanwhile the option that involves paying criminals via terminals became more appealing to fraudsters (60% of all requests).

Banking Trojans on the offensive

November saw the emergence of new Trojans targeting users of online banking systems, both individuals and businesses.

In particular, several modifications of Trojan.PWS.Ibank.213 were added to the Dr.Web virus database.

Variations of the Trojan serve as containers of malicious payloads. Their most harmful feature is their ability to disable security software components. The Trojan can detect whether it is being launched in a virtual environment where it can be safely analyzed. Disabling the system restore service is also among its malicious capabilities.

To collect the information required to access bank accounts online, the Trojan intercepts certain system routines as well as functions of online banking systems, and stores information entered by a user with a keyboard. The fact that Trojan.PWS.Ibank.213 can communicate with a remote server, and download and launch executable files, shows that systems compromised by this program become nodes of a botnet.

November 2010 showed that criminals can make use of various malicious programs to accomplish a wide variety of tasks. When it comes to neutralizing them, anti-viruses capable of protecting a system from all kinds of malware and of curing it proved to be the most efficient. Yet, it is users who still remain the weakest element of the computer defense system. Doctor Web would like to emphasize once again that following basic information security rules dramatically reduces the probability of system infection.

Viruses detected in e-mail traffic in November 01.11.2010 00:00 – 01.12.2010 00:00 1Trojan.DownLoader.62844887472 (16.61%)2Trojan.DownLoad1.58681560304 (10.49%)3Trojan.Packed.20878409498 (7.67%)4Win32.HLLW.Texmer.51386408 (7.23%)5Win32.HLLM.Netsky.18401317070 (5.93%)6Trojan.Oficla.zip296642 (5.55%)7Win32.HLLM.MyDoom.33808270438 (5.06%)8Trojan.Packed.20312246743 (4.62%)9Trojan.DownLoad.41551231569 (4.33%)10Trojan.Oficla.38139866 (2.62%)11Win32.HLLM.Netsky.35328121814 (2.28%)12Trojan.AVKill.2788103700 (1.94%)13Win32.HLLM.Beagle98470 (1.84%)14Trojan.PWS.Panda.11490471 (1.69%)15W97M.Killer74444 (1.39%)16Trojan.DownLoader1.1715765832 (1.23%)17Trojan.PWS.Panda.38749461 (0.93%)18Trojan.Oficla.7349351 (0.92%)19Trojan.Oficla.4849342 (0.92%)20Trojan.Botnetlog.zip41304 (0.77%)
Total scanned:40,984,945,769Infected:5,342,395Viruses detected on user machines in November01.11.2010 00:00 – 01.12.2010 00:00  1Win32.HLLP.Neshta7665428 (24.91%)2Win32.HLLP.Whboy.456184396 (20.09%)3Trojan.DownLoader.423502364188 (7.68%)4Win32.HLLP.Novosel1644766 (5.34%)5Win32.HLLP.Rox1177270 (3.82%)6Trojan.Click.64310727694 (2.36%)7ACAD.Pasdoc610404 (1.98%)8Win32.HLLM.Dref520690 (1.69%)9Exploit.Cpllnk413622 (1.34%)10VBS.Redlof320729 (1.04%)11Trojan.WinSpy.925284258 (0.92%)12Win32.HLLW.Shadow.based278980 (0.91%)13Trojan.PWS.Ibank.238252705 (0.82%)14HTTP.Content.Malformed244692 (0.80%)15Trojan.MulDrop1.48542183156 (0.60%)16Trojan.Click1.6029180330 (0.59%)17Win32.Sector.22142436 (0.46%) 18Win32.HLLW.Kati121106 (0.39%) 19Trojan.DownLoad.32973114280 (0.37%) 20Win32.HLLW.Autoruner.5555100817 (0.33%)Total scanned:92,810,136,138Infected:30,778,334

View the original article at DrWeb Blog

Macworld – Is it really true that it’s only a matter of time before Macintosh users are under siege by a flood of viruses and malware? McAfee announced recently that 2011 would be a bad year for people using Apple computers, as hackers will be increasingly attracted by growing Mac market share. It’s not at all hard to find experts who agree.

Full story: Yahoo! News: Security News

Macworld – Is it really true that it’s only a matter of time before Macintosh users are under siege by a flood of viruses and malware? McAfee announced recently that 2011 would be a bad year for people using Apple computers, as hackers will be increasingly attracted by growing Mac market share. It’s not at all hard to find experts who agree.

Full story: Yahoo! News: Security News

CSA DISCLAIMER: This video taken from YouTube. As well as any other video found on this site is not hosted here, it just embedded, and it taken randomly by our system from video hosting services like YouTube, Metacafe, and others. Therefore, we are not responsible for any copyright violations, video materials, hacking or cracking activities, or any other. If you have any legal issues, please contact the appropriate host site.

Reuters – A powerful virus targeting smart phones in China running Google Inc’s Android operating system may represent the most sophisticated bug to target mobile devices to date, security researchers said on Thursday.

Full story: Yahoo! News: Security News

AFP – A virus infecting mobile phones using Google’s Android operating system has emerged in China that can allow a hacker to gain access to personal data, US security experts said.

Full story: Yahoo! News: Security News

A couple of years ago, I underwent radical surgery. (Bear with me, even if you've heard the story before: there's a lot more to this issue than the rearrangement of some of my internal organs…)
Outside the operating theatre, as I was awaiting the tender ministrations of the anaesthetist, the surgeon came by for a word … Read More. – on ESET ThreatBlog

Stuxnet is keeping the people busy. Even after we know so much of it already, gets a new angle: it has been sold on the black market in the UK, according to the Sky News. Of course people buying malware is hardly news, but a piece of malware with the capabilities of Stuxnet and so many SCADA environments that are not protected… Ouch…
According to Sky News, a senior IT security source said: "We have hard evidence that the virus is in the hands of bad guys – we can’t say any more than that but these people are highly motivated and highly skilled with a lot of money behind them”. Of course Stuxnet being in the wrong hands that have the financial resources available to get the programming skills, they could do much damage to national infrastructures such as water and electricity services, public transport, gas and oil-lines, etc. As the code was sold in the UK, it may even target or jeopardize the 2012 Olympics in London. You can imagine what can happen yourself.
But even if we do not consider the national infrastructure, a reprogrammed Stuxnet may be used to target SCADA environments in small(er) production factories. A blackmail scheme “pay us or we will sabotage your machines” comes to mind!
An older publication (17 April 2009) from IndustryWeek called “Hacking the Industrial Network” describing malware hacking into industry networks or causing damage to it, has an intensive list of these hacks. It may need to be updated if the bad guys really start to deploy new different versions of Stuxnet and target the industry.
Regardless if this threat is imminent or not, and some in the UK do think it is imminent, we should not start to live in big fear and keep focusing on catching these malware writers to stop their cybercrime activities. – on Norman’s security blog

Webroot’s Endpoint Security Software provides users with award-winning spyware and virus protection. Find out how Webroot’s Antispyware or Antispyware with Antivirus software can help your company can quickly remove infections and block new malware.