February virus activity review by Doctor Web, Ltd.

March 4, 2008

February didn’t see any new malware in the wild. Starting at the end of January and up to mid-February Trojan.Packed.357 was being sent out as St. Valentine greetings. Unlike other malicious programs the Trojan executable packer is constantly being changed, the authors of the malicious program also resort to various social engineering techniques to lure users into launching the executable. Launching it places a driver in the Windows installation directory and installs it. The driver has a random name. Dr.Web virus database lists it as Trojan.Spambot.2569. A corresponding entry is also added to the Windows registry. Besides, the malware creates a P2P network configuration file on a hard drive and writes its code to %systemroot%\system32\services.exe. After that it opens random UDP ports and sends out requests to remote hosts, upon receiving a reply it starts sending out spam.

We’d also like to mention spam messages that contained the following words as subject^NEW Full mpeg4 Veronika Zemanova", "NEW Stunning video with a naked celebrity Beyonce", "NEW New sexy songs Salma Hayek", "Stunning video Carmen Electra", "Shocking porno dvd Meg Ryan", "Interesting porno Jennifer Lopez

Such messages provided a link to download an executable detected by Dr.Web anti-virus as Trojan DownLoader 49038.

One more spam mailing contained [postcdard.ru] in its subject and targeted mainly Russian speaking users. A message offered a link to a greeting card. Following it triggered downloading of Trojan.DownLoader.35394. Launching the Trojan downloaded another bunch of malware used to send out spam.

February spam activity summary

Apart from unsolicited mail mentioned above a few words should also be said about an emerged mailing of spam with messages offering downloading commercial software. A share of business related messages and offers of spam mailing based on mailing databases of the CIS has increased.

Statistics

15700 entries have been added to the Dr.Web virus database in February 2008.

Table 1: February 2008. Top viruses detected on mail servers
1	Win32.HLLM.Netsky.35328	78566 (30.60%)
2	Win32.HLLM.Beagle	24743 (9.64%)
3	Win32.HLLM.Netsky	24111 (9.39%)
4	Win32.HLLM.Netsky.based	18699 (7.28%)
5	Win32.HLLM.MyDoom.based	18031 (7.02%)
6	Exploit.MS05-053	9163 (3.57%)
7	Win32.HLLM.Perf	8470 (3.30%)
8	Win32.HLLM.MyDoom.33808	8073 (3.14%)
9	Win32.HLLM.Oder	7634 (2.97%)
10	Win32.HLLM.Limar.2246	5745 (2.24%)
11	Win32.HLLP.Sector	4762 (1.85%)
12	BackDoor.Bulknet.145	3968 (1.55%)
13	Win32.HLLM.Netsky.24064	3606 (1.40%)
14	BackDoor.Bulknet.160	3144 (1.22%)
15	Win32.HLLM.Netsky.28008	2912 (1.13%)
16	Win32.Virut	2911 (1.13%)
17	BAT.310	2509 (0.98%)
18	Win32.HLLM.MyDoom.33	2077 (0.81%)
19	Win32.Alman	1633 (0.64%)
20	Win32.HLLM.Netsky.28672	1412 (0.55%)
Table 2. February 2008. Top viruses detected on workstations
1	DDoS.Kardraw	929600 (8.95%)
2	Win32.HLLM.Generic.440	225226 (2.17%)
3	Win32.HLLM.Lovgate.2	208820 (2.01%)
4	Win32.HLLW.Krepper	142608 (1.37%)
5	VBS.Igidak	129691 (1.25%)
6	Win32.HLLW.Autoruner.437	109673 (1.06%)
7	Win32.HLLP.Sector	93245 (0.90%)
8	Win32.HLLP.Jeefo.36352	88048 (0.85%)
9	Win32.HLLW.Autoruner.274	85987 (0.83%)
10	Trojan.Inject.544	78436 (0.76%)
11	Trojan.Recycle	74398 (0.72%)
12	Win32.Sector.4	73113 (0.70%)
13	Trojan.Click.17013	72738 (0.70%)
14	Trojan.AppActXComp	69827 (0.67%)
15	Win32.HLLW.Autoruner.1053	68579 (0.66%)
16	Win32.HLLM.RoRo	64822 (0.62%)
17	Win32.HLLW.Autoruner.1408	62208 (0.60%)
18	Trojan.Landa	62196 (0.60%)
19	Win32.Alman	61227 (0.59%)
20	Win32.HLLW.Autoruner.1268	58046 (0.56%)

2008-05-13	April 2008 virus activity review from Doctor Web, Ltd.
2008-05-07	Dr.Web AV-Desk shields four hundred educational institutions of the Russian university network RUNNet
2008-05-06	New version of Dr.Web anti-virus scanner for Windows released
2008-05-06	Win32.Ntldrbot (aka Rustock.C) no longer a myth, no longer a threat. New Dr.Web scanner detects and cures it for real
2008-05-05	Another 17 Russian cities get anti-virus as a service with Dr.Web AV-Desk
2008-05-04	Protection against viruses and spam from Doctor Web, Ltd. and Sun Microsystems thoroughly tested
2008-05-04	Another Russian ISP launches Dr.Web AV-Desk
2008-05-02	Doctor Web – Central Asia Kazakhstan market summary 2007
2008-05-02	Doctor Web came to China at the eve of Olympics
2008-04-08	PC Magazine Russia: Dr.Web AV-Desk – the best product-as-a-service of 2007
2008-04-07	Dr.Web for IBM Lotus Domino – a new product by Doctor Web, Ltd. protecting application servers of enterprises and corporations
2008-04-03	Updated Dr.Web Shell Extension library released
2008-04-03	Dr.Web for Unix Mail servers and Dr.Web Mail Gateway have been updated to version 4.44.1
2008-04-02	March 2008 virus activity review from Doctor Web, Ltd.
2008-04-01	Updated version of Dr.Web Enterprise Suite 4.44.2 released
2008-04-01	Dr.Web scanner vanquishes BackDoor.MaosBoot once again
2008-04-01	Updated modules of Dr.Web anti-virus for Windows workstations released