Doctor Web, Ltd. Virus Review — July, 2006
August 1, 2006
July of 2006 turned out to be rather calm for viruses, not counting several latent epidemics of Win32.HLLM.Netsky and Win32.HLLM.MyDoom mail worms.
Still, it is worth to mention here the propagation of a "new" modification of Win32.HLLM.Beagle started late in June. We call it "new", as the propagation technique of the worms from this family remains unchanged since 2004 — they are spread in attachments to mail messages in a password protected ZIP-archives and the password is displayed in the body of the infected message as a graphic image. Such propagation technique was designed to make it as difficult as possible their detection by av-filters. The "new" modification of Win32.HLLM.Beagle has an important peculiarity — rootkit-components. Utilization of rootkits has become the dominating tendency in creation of ill-intention codes and numerous variants of BackDoor.Haxdoor and BackDoor.HackDef are the proofs of it.
The malicious goals of cyber criminals remain the same — spam distribution via users’ computers, stealing of confidential user data. And the main "assistants" of malefactors are vulnerabilities in software and careless users. Another example of users’ carelessness – contamination of more than a million computers via the banner at MySpace.com. The banner exploited the flaw in Windows Metafile (WMF) disclosed in January, 2006. The vulnerable systems downloaded malicious programs classified by Doctor Web, Ltd. as Trojan.PurityAd and Adware.ClickSpring. (read news about this incident here).
"Trojanized downloaders" (classified by Doctor Web, Ltd. as Trojan.DownLoader) remain the most popular way of distribution of virus codes. They download additional malicious codes from the Internet imperceptibly for users.
Another event of this month — detection of malicious codes exploiting newly discovered vulnerability in MS Power Point. The vulnerability allows to secretly launch arbitrary codes in a victim system.
It is also worth to mention the short-term increase of activity (approximately by 12%) in mid of July of the so-called fishers. Fishing techniques include sending counterfeit messages to potential victims, pretending to written by some bank. A user is asked to visit a forged web-site and confirm its banking details — PIN codes and other sensitive information used by criminals for stealing money from a victim’s account. Analysts of Virus monitoring service of Doctor Web, Ltd. have added a special entry to the virus base allowing to detect a wide spectrum of modifications of such malicious codes – Trojan.Bankfraud.272
In July, 2006 the world saw the birth of another kind of a fraud — vishing — an Internet fraud technique, a kind of a fishing technique. It uses for malicious purposes "war diallers" and VoIP technology to steal personal sensitive data, such as passwords, banking details, identification cards details, etc. Potential victims receive telephone calls, as if made by legitimate companies and institutions. They are asked to confirm PIN-codes or passwords from keyboards of their smart phones or PDAs which are used in future by criminals to steal money from bank accounts and in other crimes.
The end of month saw new variant of a Trojan program labeled by Doctor Web, Ltd. as Trojan.PWS.LDPinch.1061, which propagates via instant messaging networks (ICQ). This Troj was designed to intercept and then to send to a remote server all passwords collected in the compromised systems: icq, ftp, mail services, dialup, trilian, miranda, etc. Read more about this Troj here.
Below goes virus statistics for July, 2006 by Doctor Web, Ltd. presenting 20 most spread viruses:
| Virus name |
% of total quantity |
| Win32.HLLM.Beagle |
25.08 |
| Win32.HLLM.Netsky.35328 |
12.00 |
| Win32.HLLM.MyDoom.based |
9.94 |
| Win32.HLLM.Beagle.pswzip |
7.49 |
| Win32.HLLM.Netsky.based |
7.46 |
| Trojan.Bankfraud.272 |
7.25 |
| Win32.HLLM.MyDoom |
3.92 |
| Win32.HLLM.Graz |
3.80 |
| Win32.HLLM.Perf |
2.69 |
| Win32.HLLM.MyDoom.33808 |
2.23 |
| Win32.HLLM.MyDoom.49 |
2.14 |
| Win32.HLLM.Beagle.19802 |
1.42 |
| Win32.HLLM.Lovgate.9 |
1.11 |
| Win32.HLLM.Perf.based |
1.08 |
| Exploit.IframeBO |
1.01 |
| Win32.HLLM.Beagle.27136 |
0.85 |
| Win32.HLLM.Netsky |
0.81 |
| Program.RemoteAdmin |
0.75 |
| Win32.HLLM.Bagz |
0.73 |
| Win32.HLLM.Generic.391 |
0.66 |
Other news
|
 |
My five cents
|
 |
| |
What is the screen size of your monitor?
|
 |
|
 |
|
 |
|
